I85PREP
⌘ K
OCI GenAI Pro study materials
OCI GenAI Pro study resources

OCI GenAI Pro: Security, Governance, and Solution Architecture

OCI GenAI Pro · Work through your exam, one topic at a time.

All guide sections

Security, Governance, and Solution Architecture

Domain 4 - Security, Governance, and Solution Architecture

This domain tests whether you can place OCI Generative AI inside a governed, private architecture: IAM least privilege, network isolation, encryption, audit, quotas, and operational controls. Questions often present a regulated workload and ask which control closes a specific gap.

Core rules

  • IAM: policies are written in compartments using verbs. use generative-ai-family permits invoking models and endpoints; manage generative-ai-family covers creating and administering resources such as dedicated clusters and endpoints. Scope to the compartment, not tenancy-wide, and use groups or dynamic groups for workloads.
  • Network: private endpoints keep inference traffic on the customer VCN; pair them with private subnets, NSGs, and a service gateway. Public on-demand access is not a private deployment.
  • Encryption: OCI-managed keys by default; customer-managed keys via OCI Vault for stricter control.
  • Observability and governance: Audit records API calls, Cloud Guard detects misconfiguration, budgets and quotas cap spend, and dedicated clusters isolate capacity from other tenants.
  • Data handling: prompts and completions are not used to train base models; still classify data and redact PII before sending it.

Worked example

A bank needs model calls never to traverse the public internet, keys it controls, and evidence of who invoked which model. Reasoning: deploy the model behind a private endpoint in a private subnet; store the encryption key in OCI Vault and attach it; write an IAM policy granting only the application's dynamic group use generative-ai-family in the workload compartment; enable Audit and export logs to Object Storage for retention. A dedicated cluster adds capacity isolation but does not by itself provide private networking - the endpoint and subnet do.

Traps

Using manage everywhere; assuming a dedicated cluster is automatically private; forgetting quotas on hosting units; treating model-level safety as a substitute for IAM and network controls.