OCI Security Professional study plan
OCI Security Professional · Give each week a clear focus.
8 weeks · About 7 hours per week
Security fundamentals and OCI Identity and Access Management
Map every OCI IAM primitive (users, groups, dynamic groups, policies, compartments, tenancy) to the security question it answers
Write policy statements from scratch for least-privilege access to a compartment, including verb, resource-type, and condition scoping
Explain the difference between identity-based and resource-based policies and when each applies
Set up federation or an identity domain and trace how an authenticated principal becomes an authorized request
Your checkpoint
A one-page policy cheat sheet with 10 original policy statements you wrote and annotated, each labeled with the risk it mitigates
Security fundamentals and OCI Identity and Access Management & Network security (VCN, security lists, NSGs, gateways)
Design a compartment hierarchy that enforces separation of duties across two teams
Configure MFA and password/identity-domain policies and verify enforcement with a test user
Build a VCN with public and private subnets and justify each routing decision
Compare security lists and NSGs and choose the right control for three given traffic scenarios
Your checkpoint
A working tenancy slice (compartments, groups, policies, one VCN with two subnets) plus a diagram showing which control blocks which traffic path
Network security (VCN, security lists, NSGs, gateways)
Configure internet, NAT, service, and customer-premises gateways and state exactly what each permits
Write stateful NSG rules for a three-tier application and verify with connectivity tests
Harden a public subnet by removing unnecessary ingress and restricting management ports
Explain how VCN peering and transit routing change the effective attack surface
Your checkpoint
A connectivity test log showing allowed and denied paths across the three tiers, with the rule responsible for each denial named
Network security (VCN, security lists, NSGs, gateways) & Data protection, encryption, and key management
Implement a private-subnet workload that reaches object storage only through a service gateway
Identify where OCI encrypts data at rest and in transit by default and where it does not
Create a Vault, a master encryption key, and a data encryption key, then encrypt and decrypt sample data
Distinguish OCI-managed keys from customer-managed keys and list the operational duties each adds
Your checkpoint
An encryption inventory table listing every data store in your design, its default encryption state, and whether you would move it to customer-managed keys with a stated reason
Data protection, encryption, and key management
Configure key rotation and describe what happens to existing ciphertext after rotation
Apply the principle of least privilege to key and secret access using vault-level policies
Store and retrieve a credential with the Secrets service instead of embedding it in code or config
Explain how key deletion and key version retirement affect recoverability and plan a guardrail
Your checkpoint
A key lifecycle runbook covering creation, rotation, disable, and scheduled deletion, with the policy statements needed for each role
Security monitoring, logging, and compliance
Enable audit logging and write queries that surface failed authorization and IAM policy changes
Configure a service connector or log group to centralize logs from at least two sources
Design alerts for high-signal events such as root compartment policy edits and key deletion
Map a chosen control objective to the OCI features and evidence that satisfy it
Your checkpoint
A detection pack: five saved audit queries, three alert rules, and the control-to-evidence mapping for one compliance objective
Security monitoring, logging, and compliance & Security fundamentals and OCI Identity and Access Management
Review Cloud Guard, Security Zones, and Vulnerability Scanning and decide which findings you would act on first
Trace one suspicious audit event end to end from log entry to the identity or network control that should have stopped it
Re-verify your week 1 policies for over-permissioning and tighten at least two statements
Document an incident response sequence for a leaked credential, naming the exact containment actions
Your checkpoint
A tightened policy set with a before/after diff and a one-page incident response playbook for credential compromise
Security fundamentals and OCI Identity and Access Management & Network security (VCN, security lists, NSGs, gateways) & Data protection, encryption, and key management & Security monitoring, logging, and compliance
Re-derive each domain's core controls from memory and check against your notes for gaps
Complete timed practice sets weighted toward your two weakest domains
Rebuild the full reference architecture on paper without looking, then correct it
Write the three questions you still cannot answer confidently and resolve each with documentation
Your checkpoint
A final one-page architecture and control summary written from memory, plus a scored gap list showing every remaining weak area and its resolution
Milestones
Week 2: You can write a least-privilege policy for a new team without consulting notes, and your test user is correctly denied access outside its compartment
Week 4: You can explain, unprompted, the path a packet takes from the internet to a private-subnet instance and name every control it crosses
Week 6: Your audit query surfaces a deliberately created policy change within your log pipeline, and the alert fires
Week 8: On a timed mixed-domain set you score above your target in all four domains, with no domain below your weakest-domain threshold