Oracle Cloud Infrastructure Architect Associate flashcards
OCI Architect Associate · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Policy verb hierarchy
- inspect < read < use < manage. A statement granting manage includes use, read, and inspect. Grant the lowest verb that satisfies the requirement to enforce least privilege.
- Policy inheritance direction
- Policies attached to a compartment apply to that compartment and all descendants, never to parents. Place grants at the highest compartment containing every target resource.
- Dynamic group
- A group whose membership is computed from matching rules on resource attributes such as instance.compartment.id. Used with instance principals so instances call APIs without stored credentials.
- Compartment quota
- A governance control that sets or zeroes limits on resource usage within a compartment. It caps consumption and supports cost control independent of IAM policies.
- Instance principal
- An IAM principal representing a compute instance. The instance must match a dynamic group rule and a policy must grant to that dynamic group for API calls to succeed.
- NAT gateway
- A VCN gateway providing outbound-only internet access for private subnets. Instances can initiate connections but cannot receive inbound internet traffic through it.
- Service gateway
- A VCN gateway that routes traffic privately to supported OCI services such as Object Storage without traversing the internet. Requires a route rule in the subnet route table.
- Security list vs NSG
- Security lists apply at subnet level to all VNIs; network security groups apply to selected VNIs. Both are stateful and allow-only, with no explicit deny rules.
- Route rule matching
- Route tables use longest-prefix match to choose a target. A subnet needs a route to the internet gateway for public access or NAT gateway for private egress.
- VCN peering transitivity
- Local and remote peering are non-transitive. A spoke cannot reach another spoke through the hub unless a transit routing design with DRGs is configured.
- Flexible shape
- A compute shape where OCPU count and memory are selected independently within allowed ranges. One OCPU equals one physical core, or two vCPUs on x86.
- Instance configuration
- A reusable template capturing shape, image, metadata, and networking. Instance pools use it to launch and replace instances consistently at a fixed size.
- Instance pool autoscaling
- Metric-based or schedule-based policies adjust pool size between minimum and maximum bounds. Cooldown periods prevent rapid oscillation, and scale-in respects the minimum.
- Preemptible instance
- A lower-cost instance that OCI may reclaim. Suitable for fault-tolerant batch workloads, not for stateful or latency-critical services.
- Instance metadata service
- An internal endpoint at 169.254.169.254 providing instance metadata and user data. Cloud-init consumes user data at first boot; instance principals obtain tokens here.
- Block volume performance
- Performance is governed by VPUs per GB and can be tuned independently of volume size. Volumes are AD-scoped and attach to one instance at a time.
- Object Storage lifecycle policy
- Rules that transition objects between Standard, Infrequent Access, and Archive tiers or delete them based on age or name prefix. Reduces cost without manual intervention.
- Pre-authenticated request
- A time-limited URL granting access to a bucket or object without OCI credentials. Scope it to a single object or bucket and set an expiry.
- Archive storage retrieval
- Archive tier is lowest cost but objects must be restored before download, adding latency. Choose it only when retrieval-time requirements allow the delay.
- File Storage export options
- NFSv3 file systems mount through a mount target in a subnet. Export options restrict client CIDR ranges and UID/GID mappings for access control.
- Autonomous Database
- A fully managed database that autoscales compute and storage and patches automatically. Workload types include Transaction Processing, Data Warehouse, and JSON.
- Autonomous Data Guard
- A managed standby for Autonomous Database, optionally in another region. It provides disaster recovery with low data loss and controlled failover.
- GoldenGate migration
- Continuous replication between source and target databases, enabling minimal-downtime migration and ongoing synchronization during cutover.
- Refreshable clone
- A read-only Autonomous Database clone periodically refreshed from its source. Useful for reporting offload and for staging migration validation.
- DB system vs ADB
- DB systems give OS and sysdba-level control with manual patching and backups. Autonomous Database is fully managed and preferred when that control is unnecessary.
- RTO and RPO
- RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss. Together they select the DR pattern and drive cost.
- DR pattern ladder
- Backup and Restore, Pilot Light, Warm Standby, and Active-Active, ordered from highest to lowest RTO and from lowest to highest cost.
- Fault domain
- A hardware isolation group within an availability domain. Spreading instances across fault domains improves resilience within a single-AD deployment.
- Backup restore testing
- A backup is unproven until a restore succeeds. Schedule periodic restore drills and verify cross-region copies and retention meet the defined RPO.
- Alarm and notification
- A monitoring alarm fires when a metric crosses a threshold and publishes to a Notifications topic or invokes a function, enabling automated incident response.
- Budget alert
- A cost control that tracks spending against a threshold and sends notifications. Scope budgets by compartment or defined tag for meaningful chargeback.
- Defined tag cost tracking
- A tag namespace with cost-tracking keys applied to resources. Enables cost analysis, showback, and policy conditions that reference tags.
- Audit log
- A tenancy-wide record of API activity used for security investigation and compliance. Retained and searchable through the Logging and Audit services.