OCI Security Professional flashcards
OCI Security Professional · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- IAM policy verb: inspect
- Grants permission to list resources and read their metadata but not their contents. It is the weakest verb and is often combined with read for visibility without data access.
- Dynamic group matching rule
- An expression such as instance.compartment.id = 'ocid1.compartment...' that automatically includes compute instances in a group, enabling instance principals to call OCI APIs without stored credentials.
- Instance principal
- An IAM principal that represents a compute instance. It authenticates using the instance metadata service, so applications on the instance do not need user API keys or config files.
- Federation with SAML 2.0
- An identity provider authenticates users and asserts their identity to OCI. Groups from the IdP are mapped to OCI groups, and users receive a session token instead of local passwords.
- Tenancy administrator group
- The built-in group whose members have unrestricted access to all resources in the tenancy. Policies cannot restrict it, so membership should be minimal and protected with MFA.
- Policy inheritance by compartment
- A policy written at a compartment applies to that compartment and all its child compartments. Placing a policy higher in the hierarchy broadens its scope, so least privilege favors lower compartments.
- Service-to-service authorization
- Policies can allow one OCI service, acting as a resource principal, to access another service's resources. This avoids embedding user credentials in serverless or managed services.
- MFA and API keys
- API key authentication does not support multi-factor authentication. Workloads that require MFA should use instance principals, resource principals, or auth tokens instead of user API keys.
- Security list scope
- A security list is a set of stateful allow rules applied to all VNICs in a subnet. It is the coarse-grained control, while NSGs provide per-VNIC granularity.
- Network security group scope
- An NSG is a stateful allow-rule set applied to specific VNICs. A VNIC can belong to multiple NSGs, and the union of their rules is evaluated for traffic.
- Internet gateway
- A gateway that provides bidirectional internet connectivity for resources in a public subnet. The subnet route table must point 0.0.0.0/0 to the internet gateway.
- NAT gateway
- A gateway that allows instances in a private subnet to initiate outbound internet connections without exposing them to inbound internet traffic. It is not used for inbound connections.
- Service gateway
- A gateway that lets a private subnet reach supported OCI services (such as Object Storage) over the Oracle network without traversing the internet or a NAT gateway.
- Local peering gateway
- A gateway that connects two VCNs in the same region. The VCNs must have non-overlapping CIDR blocks, and route tables and security rules must allow the traffic.
- Dynamic routing gateway
- A virtual router attached to a VCN that provides connectivity to on-premises networks via IPSec VPN or FastConnect, and transit between peered VCNs across regions.
- Route table versus security rule
- A route table determines the path traffic takes, while security lists and NSGs determine whether traffic is allowed. Both must permit a flow for it to succeed.
- VCN flow logs
- Logs that capture accepted and rejected traffic for a subnet or VNIC. They are enabled through the Logging service and are useful for troubleshooting and security monitoring.
- Five NSG membership limit
- A single VNIC can be a member of at most five network security groups. Rules from all memberships are combined, so overlapping rules should be reviewed for unintended exposure.
- Master encryption key
- A key stored in OCI Vault that wraps data encryption keys. It is created in a vault, can be rotated, and its versions are used to protect data across OCI services.
- Envelope encryption in Vault
- A pattern where a master encryption key encrypts data encryption keys, and those DEKs encrypt the actual data. This limits how often the master key is used directly.
- Key rotation behavior
- Rotating a master encryption key creates a new key version. Previous versions remain available for decryption, so existing ciphertext stays readable after rotation.
- Key deletion irreversibility
- Scheduling a key version for deletion starts a waiting period. After deletion, data encrypted with that key version cannot be decrypted, so deletion should follow a data-retention review.
- Vault secrets
- Versioned secrets such as passwords and tokens stored in OCI Vault. Applications retrieve them at runtime using instance principals, avoiding hard-coded credentials in code or config.
- Customer-managed keys
- Encryption keys created and controlled by the customer in OCI Vault, used by services such as Block Volume, Object Storage, and File Storage instead of Oracle-managed keys.
- Client-side encryption
- Encryption performed by the customer before data is sent to OCI. The customer holds the key material, so OCI cannot decrypt the data even if it controls the storage layer.
- Key administrator versus key user
- Separate IAM policies can grant key lifecycle management to administrators and crypto operations to users. This separation of duties reduces the risk of unauthorized key use.
- OCI Audit retention
- Audit records control-plane API activity and is enabled by default. Records are retained for 365 days and cannot be disabled, making it a baseline for compliance evidence.
- Service logs opt-in
- Logs such as VCN flow logs and Object Storage access logs are not enabled by default. They must be configured in the Logging service and stored in a log group.
- Service connector
- A Logging feature that routes log data to Object Storage, Streaming, or Monitoring. It supports long-term retention and ingestion into a SIEM or analytics pipeline.
- Cloud Guard detector and responder
- Cloud Guard uses detectors to identify misconfigurations and risky activity, and responders to remediate them. Responder recipes can automate actions such as stopping a public bucket.
- Security Zones
- A set of enforced policies that block creation of resources that violate security requirements, such as public buckets or unencrypted volumes. Violations are prevented at creation time.
- Monitoring alarm actions
- An alarm evaluates a metric against a threshold and triggers a notification or invokes a Function. This enables automated response to security events such as a spike in audit failures.
- Vulnerability Scanning Service
- A service that scans compute instances for open ports and missing patches. Scans can be scheduled per compartment, and results help prioritize remediation.