Security and Compliance
What to know
Security and compliance spans preventive and detective controls. Preventive: IAM least privilege, security zones (compartment-level deny policies that block risky actions such as making buckets public), security lists and NSGs, WAF, network firewall, and encryption with Vault - customer-managed keys in a vault, plus secrets. Detective: Cloud Guard (detector recipes find problems, responder recipes act on them), Vulnerability Scanning Service, Audit (all API activity), Logging, and Security Advisor.
Data protection topics include the Vault key lifecycle (key versions, rotation, scheduled deletion with a waiting period), Data Safe for database security assessment and masking, and certificates. Compliance questions usually ask about separation of duties, audit trails, and encryption at rest and in transit.
Traps
- Confusing Cloud Guard detectors (find) with responders (fix or notify).
- Assuming a security zone can be bypassed by an administrator - it blocks actions even for admins until removed.
- Believing deleting a vault key is instant; scheduled deletion has a waiting period for recovery.
- Forgetting that Audit records control-plane API calls, not data-plane object reads.
Worked example
A team must prove data is encrypted with keys they control and that no public buckets exist. Create a Vault and key, set the bucket to use the customer-managed key, then enable a security zone on the compartment with the public-bucket policy so any attempt to make a bucket public is denied. Cloud Guard monitors for drift.