Operations, Security, and Governance in Multicloud
Operations, Security, and Governance in Multicloud
This domain tests how you run a multicloud estate: shared responsibility, monitoring, logging, key management, guardrails, cost control, and incident response. The exam expects centralized visibility without pretending one cloud's native tool manages the other.
Core rules and concepts
- Shared responsibility is service-specific. For Oracle Database@Azure, provider-managed infrastructure does not remove customer duties for database users, data classification, network rules, or application security. Document the split per service.
- OCI native controls include Cloud Guard for posture and threat detectors, Security Zones for immutable guardrails, Vault for customer-managed keys and secrets, Audit for control-plane events, Logging and Monitoring for telemetry, and compartments, policies, quotas, and budgets for governance.
- Centralize telemetry. Use OCI Service Connector Hub or Logging to export OCI audit and logs to a SIEM; export Azure Activity Log and Google Cloud Audit Logs to the same SIEM. Native Cloud Guard does not assess Azure or Google Cloud resources.
- Govern with tags, compartments, and budgets, and enforce tag defaults. Cost allocation across clouds needs a consistent tagging schema and regular reconciliation.
- Security architecture: private connectivity, least-privilege IAM, MFA at the IdP, encryption at rest and in transit, key rotation, vulnerability management, and tested break-glass and incident-response runbooks.
Worked example
A security team needs one view of administrative activity across OCI and Azure. They enable OCI Audit and a Service Connector Hub stream to the SIEM, and Azure Activity Log diagnostic settings to the same SIEM. They tag all resources with cost center and owner, create OCI budgets and Azure budgets, and run Cloud Guard in OCI while using a CSPM tool for Azure. They document that Cloud Guard findings do not cover Azure; the SIEM correlation covers both.
Traps
Assuming Cloud Guard secures the whole multicloud estate; leaving audit logs only in each native console; inconsistent tags that break chargeback; unrotated customer-managed keys; no break-glass path; and treating provider patching as complete security for the database.