OCI Operations Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Policy verb hierarchy

inspect, read, use, and manage are cumulative: manage includes use, read, and inspect. Choosing the lowest verb that satisfies the task enforces least privilege within a compartment.

Dynamic group

An IAM resource whose matching rules identify compute instances or other resources by attributes. It enables instance principals and services to call OCI APIs without stored credentials.

Compartment inheritance

Policies attached to a parent compartment apply to all child compartments beneath it. Grants never flow upward, so broad access belongs high in the tree and narrow access low.

Availability domain

A physically isolated data center group within a region, with independent power, cooling, and network. Distributing resources across ADs protects workloads from single-facility failures.

Defined tag namespace

A container for defined tags that supports schema validation and tag defaults. Enabling cost-tracking on a defined tag lets Cost Analysis attribute spending to that tag.

Audit event retention

Audit records are searchable in the console for a limited window per tenancy. Export events to Object Storage to retain evidence beyond that window for compliance.

Flexible compute shape

A shape where you choose OCPU count and memory independently within allowed bounds. Fixed shapes have preset ratios, so resizing across them requires a new launch or shape change.

Instance metadata service

An internal endpoint at 169.254.169.254 that serves instance identity certificates and user data. Instance principals use it to obtain short-lived tokens for OCI API calls.

Network security group

A stateful, VNIC-level firewall rule set applied to chosen instances. It gives per-workload granularity, unlike subnet-wide security lists that affect every VNIC in the subnet.

NAT gateway

A VCN gateway that lets private-subnet instances initiate outbound internet connections while blocking inbound connections. It preserves private IPs and requires a matching route rule.

Service gateway

A VCN gateway that routes traffic to supported OCI services such as Object Storage without traversing the internet. It keeps traffic on the Oracle network.

Local versus remote peering

Local peering connects VCNs within one region directly. Remote peering connects VCNs across regions through a dynamic routing gateway. Overlapping CIDRs block either option.

Boot volume preservation

When terminating an instance, you can keep the boot volume for later reuse or recovery. The volume retains data, and a new instance can attach it.

Load balancer backend set

A group of backend servers with a health-check policy and load-balancing policy. Listeners route incoming traffic to a backend set, and unhealthy backends are removed automatically.

Block volume VPUs

Volume performance units per GB determine IOPS and throughput. Tiers run from Lower Cost through Ultra High Performance, and performance scales with volume size.

Object Storage Archive tier

A low-cost tier for rarely accessed data with retrieval latency and a minimum storage duration. Early deletion can incur charges, so lifecycle rules should match access patterns.

Volume group backup

A crash-consistent backup of multiple block volumes taken together. It preserves write-order consistency across volumes attached to the same instance.

File system mount target

An NFS endpoint placed in a subnet that exposes file systems to clients. Export options restrict client CIDR ranges and read/write permissions.

Autonomous Database auto-scaling

Auto-scaling lets an Autonomous Database temporarily use up to three times its base OCPU count during demand spikes, then return to base. Billing follows actual consumption.

Autonomous Data Guard

A standby Autonomous Database kept synchronized with the primary for failover. It can be same-region or cross-region and supports switchover and failover operations.

Vault master encryption key

The top-level key that protects data encryption keys. It can be software- or HSM-protected, and rotation creates a new version while prior versions still decrypt existing data.

Key deletion waiting period

Scheduling a vault key for deletion starts a waiting period during which you can cancel. After deletion completes, data encrypted with that key cannot be recovered.

Alarm states

An alarm is OK when the metric is within threshold, FIRING when it breaches, and RESET when data is insufficient. Muting rules suppress notifications without deleting the alarm.

Events rule

A rule that matches emitted events by type and attributes, then invokes an action such as a Function, Notification topic, or Stream. It enables event-driven automation.

Resource Manager stack

A Terraform configuration plus stored state managed by OCI. Plan shows drift, apply reconciles infrastructure, and state tracking enables repeatable deployments.

Budget alert rule

A threshold on forecast or actual spend for a compartment or tag, triggering notifications at set percentages. Budgets track spend but do not block resource creation.

Cost-tracking tag

A defined tag with cost-tracking enabled. Cost Analysis and usage reports group spend by its values, enabling chargeback and workload-level visibility.

Unified Monitoring Agent

An agent installed on compute instances that collects custom metrics and log data. It forwards them to Monitoring and Logging for alarms and search.

Service limit versus quota

Service limits are Oracle-set maximums per tenancy and region. Quotas are admin-set caps on compartments that restrict consumption below the service limit.

Route table next hop

Each route maps a destination CIDR to a target such as an internet, NAT, or service gateway. The most specific matching route is used for outbound traffic.

Point-in-time recovery

Database backup capability that restores to a chosen moment within the retention window. It relies on full backups plus archived redo, letting you recover from logical errors.

Right-sizing

Matching compute and database resources to measured demand. Flexible shapes, autoscaling, and stopping idle instances reduce spend without degrading performance.