OCI Architect Associate flashcards
OCI Architect Associate · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Policy verb hierarchy
- Inspect is the least privileged IAM verb, followed by read, use, and manage; each higher verb includes the permissions of the lower ones, so manage grants full access.
- Dynamic group
- An IAM resource whose membership is defined by matching rules on instance or resource attributes, such as compartment OCID, letting those resources act as principals without stored credentials.
- Compartment nesting depth
- Compartments can be nested up to six levels below the tenancy root, and policies attached to a parent compartment are inherited by every compartment beneath it.
- Identity federation in OCI
- Federation lets users authenticate against an external SAML 2.0 identity provider and access OCI resources through mapped identity-provider groups, avoiding separate OCI credentials.
- Service gateway
- A VCN gateway that lets private subnets reach supported OCI services such as Object Storage over the Oracle network without internet or NAT gateway traffic.
- NAT gateway
- A VCN gateway that allows instances in a private subnet to initiate outbound internet connections while preventing any inbound internet connections from reaching those instances.
- Network security group
- A virtual firewall applied to individual VNICs rather than subnets; rules are stateful, and a VNIC can belong to up to five NSGs in the same VCN.
- Local peering gateway
- A component connecting two VCNs in the same region and tenancy so their subnets communicate over private IP addresses without internet or a DRG.
- Flexible shape
- A compute shape whose OCPU count and memory are selected independently within allowed ranges, letting you right-size an instance instead of choosing a fixed configuration.
- Instance metadata service
- A link-local endpoint at 169.254.169.254 that an instance queries for its own metadata, including user data, OCIDs, and region, without credentials or internet egress.
- Instance pool
- A group of identical instances created from one instance configuration that scales manually or automatically through an autoscaling policy based on metrics or a schedule.
- Preemptible instance
- A lower-cost compute instance that Oracle may reclaim when capacity is needed; it can be terminated with short notice, so it suits fault-tolerant interruptible workloads.
- Object Storage storage tiers
- Buckets store objects in Standard, Infrequent Access, or Archive tiers; auto-tiering moves objects between Standard and Infrequent Access based on access patterns to cut cost.
- Pre-authenticated request
- A URL containing an embedded, time-limited token that lets anyone holding it read or write a specific Object Storage bucket or object without OCI credentials.
- File Storage mount target
- An NFS endpoint created in a subnet that exports file systems to clients; export options define which source CIDRs may mount and with what permissions.
- Block volume volume group
- A collection of block volumes and boot volumes backed up together, producing a crash-consistent snapshot set for applications that span multiple volumes.
- Autonomous Database backups
- Automated backups of an Autonomous Database are taken by the service and retained for up to 60 days; manual backups can be kept longer.
- Autonomous Database Serverless
- A fully managed deployment where compute and storage scale elastically and independently, and Oracle handles provisioning, patching, tuning, and backups on shared infrastructure.
- Active Data Guard
- An Oracle Data Guard option that keeps a standby database open read-only while applying redo, offloading reporting queries from the primary database.
- MySQL HeatWave
- A managed MySQL database service with an integrated in-memory analytics engine that runs OLAP queries against data replicated from the MySQL database.
- OCI Vault
- A managed key and secret service backed by hardware security modules that stores master encryption keys and secrets used by other OCI services and applications.
- Cloud Guard
- A security posture service that detects misconfigured or risky resources using detectors and can respond automatically through responder recipes defined in the tenancy.
- Security zone
- A special compartment associated with a security-zone recipe whose policies block actions that would create insecure resources, such as making a bucket public.
- Budget
- A governance tool that tracks actual and forecast spending for a compartment or tag and alerts when thresholds are crossed; budget rules can trigger actions.
- Compartment quota
- A policy that caps how much of a specific resource family can be created in a compartment, helping prevent runaway consumption and controlling cost.
- Defined tags
- Tags created in a tag namespace with a defined schema and value type, enabling consistent cost tracking and use in policy conditions across compartments.
- Monitoring alarm
- A Monitoring resource that evaluates a metric against a threshold over an interval and window, transitions to firing, and notifies an ONS topic.
- Notifications topic
- A publish-subscribe channel in the Notifications service that delivers messages to subscriptions such as email addresses, HTTPS endpoints, PagerDuty, or Slack.
- Logging service
- A service that collects audit logs, service logs, and custom logs from OCI resources and lets you search, store, and route them to Object Storage or Streaming.
- FastConnect
- A dedicated private network connection between an on-premises data center and an OCI region, offering higher bandwidth and more consistent latency than an internet VPN.
- Site-to-site VPN
- An IPSec connection between a customer edge device and a dynamic routing gateway, typically provisioned with two tunnels for redundancy across OCI VPN endpoints.
- Fault domain
- A grouping of hardware within an availability domain; spreading instances across three fault domains reduces the chance that one hardware failure affects them all.