OCI Architect Professional study plan
OCI Architect Professional · Give each week a clear focus.
8 weeks · About 7 hours per week
Identity and Access Management
Map every OCI IAM primitive (users, groups, dynamic groups, policies, compartments) to the exact resource it governs, and write a one-line rule for when each is the correct choice.
Draft a compartment hierarchy for a three-tier app (network, app, data) plus a shared-services compartment, and justify each boundary in writing.
Write and then tighten five IAM policy statements so each grants the minimum verbs on the minimum resource at the minimum compartment level.
Configure an identity domain, a federated IdP trust, and a group-to-policy mapping in a free-tier tenancy, then break the mapping on purpose and observe the denial.
Your checkpoint
A one-page IAM decision matrix (primitive to use case to failure mode) plus a working federated login in your tenancy, both saved to your notes repo.
Identity and Access Management
Distinguish instance principals, resource principals, and dynamic groups by writing one working example of each and noting what each can and cannot authenticate.
Design a cross-tenancy access pattern and list the policy statements required on both the granting and receiving side.
Enumerate the OCI IAM policy verb set and predict allow versus deny outcomes for ten tricky statements before testing them.
Implement MFA, a password policy, and an API key rotation procedure, then document the break-glass admin path.
Your checkpoint
A ten-question self-quiz on policy evaluation with your predicted answers, your actual test results, and a short note on every mismatch.
Networking
Build a VCN with public and private subnets, an internet gateway, a NAT gateway, and a service gateway, and trace the exact egress path for each of the three gateway types.
Compare security lists and NSGs by writing the same three-rule firewall policy in both models and stating which scales better and why.
Configure a route table that forces private-subnet traffic through a firewall appliance and verify the path with flow logs.
Explain the difference between a DRG, a local peering gateway, and a remote peering connection, and pick the right one for three given topologies.
Your checkpoint
A working three-subnet VCN with captured flow-log evidence that each gateway type carried the traffic you intended.
Networking
Design a hub-and-spoke topology using a DRG and write the attachment and route-table entries needed for transitive spoke-to-spoke traffic.
Configure private DNS resolution across a VCN and a peered VCN, and document the resolver and view settings that made it work.
Set up a site-to-site VPN and describe the IPSec parameters and redundancy model OCI expects.
Evaluate OCI WAF and network firewall placement options for a public web tier and defend one placement in writing.
Your checkpoint
A network architecture diagram with every route table, gateway, and security rule annotated, plus a two-minute spoken walkthrough recorded for self-review.
Compute
Compare VM, bare metal, and flexible shapes by selecting a shape for three workloads with stated CPU, memory, and licensing constraints.
Write cloud-init and instance metadata usage that bootstraps an instance without any post-launch manual step.
Configure instance pools with an autoscaling policy tied to a metric, and state why a given metric is a poor scaling signal.
Place workloads across availability and fault domains and justify the blast radius of each placement decision.
Your checkpoint
A reproducible launch script or Terraform module that builds a shape-correct instance with cloud-init bootstrap and an autoscaling pool.
Compute
Deploy a containerized workload on OCI Container Engine for Kubernetes and explain how node pools, shape choice, and IAM interact.
Compare serverless functions and container instances against VMs for three workloads and defend each choice on cost and operational surface.
Implement an OS management and patching routine, and describe how to roll back a bad patch.
Use instance and application performance monitoring to diagnose a deliberately throttled workload.
Your checkpoint
A running Kubernetes workload with a documented scaling and patching runbook, plus a written diagnosis of the throttling experiment.
Storage
Select block volume performance settings for three IOPS and throughput profiles and explain when VPUs or balanced performance is the right lever.
Configure the block volume backup policy, cross-region copy, and a restore drill, and time how long the restore actually takes.
Choose between Object Storage tiers and lifecycle rules for a data set with mixed access frequency, and quantify the cost trade-off.
Configure File Storage and mount it from two instances, then explain the mount target and export path model.
Your checkpoint
A storage decision table covering block, file, object, and archive, backed by a completed restore drill with real timings.
Identity and Access Management & Networking & Compute & Storage
Rebuild the full three-tier reference architecture end to end from a blank tenancy using only your own notes, and log every gap you hit.
Resolve every logged gap by re-reading the relevant domain notes, then rebuild the failing piece once more.
Run two timed mixed-domain practice sets and categorize every miss by domain and by root cause (knowledge, misread, or guess).
Write a one-page cheat sheet per domain limited to the facts you actually got wrong.
Your checkpoint
A from-scratch tenancy rebuild that passes your own acceptance checklist, plus four domain cheat sheets and a miss log with zero unresolved items.
Milestones
Week 2: You can predict the allow or deny outcome of an unfamiliar IAM policy statement before testing it, with at least 8 of 10 predictions correct.
Week 4: A packet from a private subnet reaches the internet only through the intended gateway, proven by flow logs, and spoke-to-spoke traffic works over the DRG.
Week 6: You can provision a compute workload from a script with no manual console steps and explain every shape and placement decision out loud.
Week 8: A blank-tenancy rebuild of the full three-tier architecture succeeds using only your notes, and your practice-set misses are fully resolved.