Oracle Cloud AR cheat sheet

Security Zones: a compartment-level recipe that denies creation of resources violating policy (for example public buckets or unencrypted boot volumes); Maximum Security Zone also blocks public IPs on compute and blocks public load balancers.

Vault key hierarchy: Vault → Master Encryption Key (HSM-backed, FIPS 140-2 Level 3) → Data Encryption Key; DEKs are wrapped by the MEK, and deleting or rotating the MEK affects every resource using it.

Customer-managed keys integrate with Block Volume, Object Storage, File Storage, Boot Volume, and Autonomous Database; rotating a key version does not re-encrypt existing data, it only wraps new DEKs.

OCI WAF runs on regional edge nodes and is attached to a load balancer or edge; Web Application Firewall policies support access rules, rate limiting, and protection rules per URI.

Network Firewall is a stateful, managed firewall appliance placed in a subnet with a policy attached to a firewall policy; it inspects east-west and north-south traffic and supports TLS inspection.

Resilience pattern: multi-AD regions give fault-tolerant placement within a region; multi-region designs need a remote region plus replication (Object Storage replication, Cross-Region Autonomous Data Guard, or Block Volume replication).

Fault domain placement spreads instances across independent hardware within an AD; use it for HA inside a single AD, and AD placement for HA across the region.

Cloud Guard detects misconfigurations via detector recipes and responds via responder recipes; a responder can be a notification, a function, or a remediation action such as stopping a public bucket.

Compute shapes: VM (flexible OCPU/memory), Bare Metal (no hypervisor), and dedicated/GPU shapes; flexible shapes allow fractional OCPUs and adjustable memory within shape limits.

Block Volume performance tiers: Lower Cost, Balanced, Higher Performance, and Ultra High Performance; VPUs per GB scale with the tier, and performance is attached per volume, not per instance.

Volume performance is limited by the instance's maximum VPUs per volume and total VPUs per instance; a single volume cannot exceed the instance's per-volume cap.

Object Storage tiers: Standard, Infrequent Access, Archive, and Auto-Tiering; Archive has a minimum storage duration and retrieval latency measured in hours, so it suits cold data only.

VCN components: subnets (regional, AD-specific or regional), route tables, security lists, NSGs, internet gateway, NAT gateway, service gateway, and local peering or DRG for connectivity.

Security lists apply at the subnet level and are evaluated for all VNICs in the subnet; NSGs apply at the VNIC level and are the recommended way to isolate tiers such as web, app, and database.

Load Balancer (flexible shape, bandwidth-based) versus Network Load Balancer (layer 4, preserves source IP, supports UDP); use NLB for non-HTTP traffic and LB for HTTP/HTTPS with WAF integration.

FastConnect provides private dedicated connectivity; a DRG with FastConnect plus a virtual circuit can be used for hybrid designs, and a backup IPSec VPN over the internet provides redundancy.

IAM policy syntax: Allow to in where ; verbs include inspect, read, use, and manage, with manage implying all lower verbs.

Compartments are the primary authorization boundary; policies are attached to a compartment or tenancy and apply to the compartment and its children unless the policy uses a specific compartment path.

Dynamic groups match instances and functions by matching rules (for example instance.compartment.id or resource.type); they let workloads call APIs without storing credentials.

Instance principals and resource principals issue short-lived certificates; use them instead of user API keys for compute and serverless workloads.

Federation: OCI supports SAML 2.0 and SCIM for identity providers; map IdP groups to OCI groups and grant access through policies on groups, never on users directly.

Tagging: free-form tags are unstructured; defined tags use namespaces and are required for tag-based policy conditions and for cost-tracking reports.

Governance controls: budgets with alert rules and budget-scoped policies that can block resource creation, plus quota policies that cap resources per compartment.

Cloud Guard and Audit: Audit records every API call and retains events for 90 days by default; export to Object Storage for longer retention and use Cloud Guard for drift detection.

Autonomous Database serverless scales OCPUs automatically and bills per second of use; Dedicated Exadata infrastructure gives isolation and predictable performance at a fixed cost.

Autonomous Data Guard provides standby databases across ADs or regions; switchover is planned, failover is unplanned, and both change the primary role.

Base Database Service runs on VM or Bare Metal DB systems and supports RAC, Data Guard, and BYOL licensing; use it when full control or specific database versions are required.

Observability: Monitoring collects metrics (1-minute intervals, 90-day retention), Logging aggregates service and custom logs, and Application Performance Monitoring traces distributed applications.

Alarms evaluate metrics against thresholds and publish to a topic in the Notifications service; subscriptions can be email, HTTPS, PagerDuty, or a function.

Service Connector Hub moves data between services (for example Logging to Object Storage or Streaming) and can also trigger Functions, enabling automated responses to log events.

Cost levers: reserved capacity and annual commitments reduce compute cost, Autonomous Database auto-scaling avoids overprovisioning, and Object Storage lifecycle policies move data to cheaper tiers.

Budgets track actual and forecast spend per compartment or tag; combine budgets with alerts and quota policies to prevent cost overruns rather than only reporting them.

When a requirement mentions isolation between teams, the answer is compartments plus policies on groups; when it mentions isolation between workloads, the answer is NSGs plus separate subnets.

When a requirement mentions regulatory data residency, choose a region and use customer-managed keys in a Vault in that region; cross-region replication must be justified explicitly.

When a requirement mentions no public internet exposure, combine a private subnet, NAT gateway for egress, service gateway for OCI services, and a private load balancer.

When a requirement mentions unpredictable traffic, prefer flexible compute shapes, Autonomous Database auto-scaling, and a flexible load balancer over fixed shapes.

When a requirement mentions lowest cost for cold data, choose Archive tier with a lifecycle policy; when it mentions instant access, Archive is disqualified.

When a requirement mentions auditing who changed a resource, the answer is Audit plus Cloud Guard; when it mentions who can change a resource, the answer is IAM policies.

When a requirement mentions workload identity without secrets, choose instance principals or resource principals with dynamic groups, not user API keys.

When a requirement mentions disaster recovery with a recovery time objective of minutes, choose multi-AD with Data Guard or cross-region replication; a backup-and-restore strategy meets hours, not minutes.

VCN CIDR blocks must be between /16 and /30; subnets can be AD-specific or regional, and a regional subnet spans all ADs in the region.

Object Storage object size limit is 10 TiB per object; multipart upload is required for objects larger than 100 MiB by default and is recommended above that.

Block Volume maximum size is 32 TiB per volume, and an instance can attach a limited number of volumes determined by its shape.

Audit log retention is 90 days by default; Monitoring metric retention is 90 days at 1-minute resolution.

IAM policy verbs in ascending order of privilege: inspect, read, use, manage; manage on a compartment grants all verbs on all resources in that compartment.

A tenancy has a single root compartment; every resource belongs to exactly one compartment, and compartments can be nested up to six levels deep.

Autonomous Database storage auto-scales up to 384 TB depending on the workload type; serverless billing is per second with a minimum charge period.

Budgets can be scoped to a compartment or a cost-tracking tag, and forecast alerts fire before the budget period ends based on projected spend.

Security lists are stateless in the sense that you must allow both request and response traffic rules; NSGs are stateful and return traffic is automatically allowed.

A service gateway allows private access to Object Storage and other OCI services without traversing the internet, but it does not provide access to third-party APIs.

A NAT gateway allows outbound internet access for private subnets but does not allow inbound connections; use a public load balancer or bastion for inbound.

Deleting a compartment requires it to be empty; deleting a Vault or MEK can render encrypted data unrecoverable, so plan key deletion carefully.

A dynamic group matching rule uses the instance's compartment, not the instance's OCID, unless the rule explicitly references the OCID.

Cross-region replication of Object Storage is asynchronous and is configured per bucket, not per object; it does not replicate bucket policies automatically in all cases.

Autonomous Database Dedicated requires an Exadata infrastructure in the tenancy; serverless does not, so Dedicated is chosen for isolation, not for lower cost.

A budget alert does not stop spending by itself; only a budget-scoped policy or quota policy can block resource creation.

Identify the constraint category first: security, resilience, performance, cost, or governance; the correct answer usually optimizes the stated constraint and accepts trade-offs elsewhere.

For HA within a region, place instances across ADs; for HA within an AD, place instances across fault domains; for DR across regions, add replication and a runbook.

For least privilege, grant manage only where needed and prefer use or read; scope policies to the narrowest compartment path.

For encryption, decide between Oracle-managed keys and customer-managed keys in Vault; customer-managed keys are required when the requirement mentions key control or rotation.

For observability, combine metrics (Monitoring), logs (Logging), traces (APM), and events (Events service) rather than relying on a single service.

For cost, compare reserved capacity versus on-demand, check data transfer and storage retrieval charges, and use lifecycle policies and auto-scaling.

For connectivity, choose internet gateway for public, NAT for outbound-only, service gateway for OCI services, DRG for on-premises, and peering for VCN-to-VCN.

Validate the answer against every stated requirement; an option that satisfies performance but violates a security requirement is wrong.

Identity: IAM, Identity Domains, dynamic groups, instance principals, federation with SAML/SCIM.

Network: VCN, subnets, route tables, security lists, NSGs, internet/NAT/service gateways, DRG, FastConnect, VPN, Load Balancer, Network Load Balancer, WAF, Network Firewall.

Compute: VM, Bare Metal, flexible shapes, autoscaling configurations, instance pools, Functions, Container Engine for Kubernetes, OKE.

Storage: Block Volume, Boot Volume, Object Storage, File Storage, Archive, replication, lifecycle policies.

Database: Autonomous Database (serverless and dedicated), Base Database Service, Exadata, Data Guard, GoldenGate.

Observability: Monitoring, Logging, APM, Events, Service Connector Hub, Notifications, Audit.

Governance and cost: compartments, policies, tags, budgets, quotas, Cloud Guard, Security Zones.

Can you state the difference between a security list and an NSG in one sentence, including statefulness and scope?

Can you name the four IAM verbs in order and explain what manage implies?

Can you describe how a dynamic group lets an instance call an API without credentials?

Can you compare Autonomous Database serverless and Dedicated on scaling, isolation, and cost?

Can you list the Object Storage tiers and the retrieval characteristics of Archive?

Can you explain how a budget alert differs from a budget-scoped policy?

Can you describe a multi-AD HA design and a multi-region DR design, including the replication mechanism used in each?