OCI Architect Associate study plan

Design a three-tier VCN on paper: non-overlapping CIDR blocks, public and private subnets across two availability domains, internet gateway, NAT gateway, and service gateway.

Differentiate route tables, security lists, and network security groups by writing five traffic scenarios and predicting the allow/deny outcome before testing each one.

Build the designed VCN manually in the console without the wizard, then verify that the public subnet reaches the internet while the private subnet reaches Object Storage only through the service gateway.

Explain why a subnet is regional while a security list applies to all VNICs in it, and where NSGs give finer control.

Compare load balancer shapes and policies (weighted round robin, IP hash, least connections) and select the correct one for three stated application profiles.

Distinguish FastConnect, site-to-site VPN, and dynamic routing gateway usage, and justify a hybrid connectivity choice for two given bandwidth and latency requirements.

Compare local peering, remote peering, and transit routing through a DRG, then sketch a hub-and-spoke topology that avoids overlapping CIDRs.

Configure a private DNS zone and resolver rules to support name resolution between a VCN and an on-premises domain, and verify resolution behavior.

Select an appropriate compute shape for four workloads, converting between OCPU and vCPU counts and justifying flexible versus fixed shapes.

Deploy an instance configuration and an instance pool, then attach a CPU-based autoscaling policy and describe the scaling thresholds and cooldown behavior.

Launch an instance from a custom image with a cloud-init script that pulls configuration from instance metadata, and attach a separately priced boot volume.

Rank virtual machines, bare metal, OKE, container instances, and functions against five workload descriptions and defend each ranking.

Trace the network path from a client to an instance in a private subnet through a load balancer and state which component enforces each filter.

Model a compartment hierarchy for an organization with development, staging, and production environments, including where shared networking and security resources live.

Write at least ten least-privilege policy statements using verb, resource-type, and condition syntax, and revise any statement broader than required.

Create a dynamic group with matching rules and grant an instance principal access to a bucket, then confirm the policy fails when the matching rule is removed.

Explain identity domains, federation with an external identity provider, and MFA enforcement, and choose the right option for two stated compliance requirements.

Assign Standard, Infrequent Access, and Archive tiers to four datasets and write lifecycle rules that transition and eventually delete the objects.

Configure block volume performance settings, attach a volume to an instance, and explain when multipath or higher performance units are warranted.

Create a file system with a mount target, set export options, take a snapshot, and clone the file system from the snapshot.

Compare object, block, and file storage on durability, access pattern, and cost, and select the correct service for five scenarios.

Perform a restore of an archived object and record the retrieval time and any tier-related constraints encountered.

Provision an autonomous database, connect with a wallet, and compare serverless and dedicated deployment options for two workloads.

Configure automatic backups and retention, then perform a point-in-time restore and state the achieved recovery point.

Explain Data Guard and Active Data Guard roles and design a standby configuration for a base database service instance.

Select between autonomous database, base database, MySQL HeatWave, and NoSQL for five workload descriptions and justify each choice.

Identify which database service requires you to patch and manage the host and which one does not.

Define a tagging strategy with defined tags and cost-tracking tags, create a budget with alert thresholds, and analyze spend by tag in cost analysis.

Create a monitoring alarm on a metric threshold that publishes to a notifications topic, and route audit logs through a service connector to a destination.

Enable Cloud Guard and a security zone, store a secret and a key in the vault, and attach a WAF policy to a load balancer.

Script an audit with the CLI that lists buckets with public access and security rules allowing traffic from the internet.

Explain how security zones prevent or detect noncompliant resource creation and what happens to an existing noncompliant resource.

Map database migration, zero-downtime migration, and offline transfer approaches to five migration scenarios and state the required downtime for each.

Design a multi-region architecture with defined RTO and RPO tiers, choosing between backup and restore, standby, and active-active patterns.

Describe the components of a landing zone, including compartments, identity, networking, and guardrails, and explain what it accelerates.

Complete two full-length practice exams and convert every missed question into a one-line remediation note tied to its domain.

Re-derive from memory the VCN, IAM, and compute models that carried the most weight in earlier weeks.