Oracle Cloud AR flashcards
Oracle Cloud AR · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Security Zone
- A compartment-level policy that denies creation of resources violating a security recipe, such as public buckets or unencrypted boot volumes, and can block public IPs in Maximum Security Zone.
- Vault master encryption key
- An HSM-backed key that wraps data encryption keys; deleting or disabling it makes every resource encrypted with its wrapped keys unrecoverable, so deletion requires careful planning.
- Network Firewall
- A managed stateful firewall appliance placed in a subnet with an attached firewall policy; it inspects north-south and east-west traffic and supports TLS inspection.
- Fault domain
- Independent hardware grouping within an availability domain; spreading instances across fault domains provides high availability inside a single AD without crossing AD boundaries.
- Cloud Guard responder
- An action attached to a detector recipe that reacts to a problem, such as sending a notification, invoking a function, or remediating a misconfiguration like a public bucket.
- Flexible compute shape
- A shape allowing fractional OCPUs and adjustable memory within limits, so you can right-size instances instead of choosing a fixed shape and overpaying for capacity.
- Block Volume VPUs
- Volume performance units attached per volume; the tier sets VPUs per GB, but the instance shape caps total VPUs and per-volume VPUs, limiting achievable throughput.
- Object Storage Archive tier
- A cold storage tier with a minimum storage duration and retrieval latency measured in hours; it is unsuitable when data must be available instantly.
- Network security group
- A stateful, VNIC-level firewall rule set used to isolate tiers such as web, app, and database; unlike security lists, return traffic is automatically allowed.
- Service gateway
- A VCN gateway that provides private access to OCI services such as Object Storage without traversing the internet; it does not reach third-party APIs.
- Network Load Balancer
- A layer 4 load balancer that preserves source IP and supports UDP and TCP; choose it for non-HTTP traffic and when WAF integration is not required.
- FastConnect
- Private dedicated connectivity between on-premises networks and OCI; pair it with an IPSec VPN over the internet as a backup path for redundancy.
- IAM policy verb order
- Verbs ascend as inspect, read, use, and manage; manage on a compartment grants all lower verbs on all resources within that compartment and its children.
- Dynamic group
- A group whose membership is computed from matching rules on resource attributes, such as compartment OCID, enabling instances and functions to call APIs without stored credentials.
- Instance principal
- A short-lived certificate-based identity issued to a compute instance, letting it call OCI APIs without user API keys when it belongs to a matching dynamic group.
- Defined tag
- A tag created in a namespace with a schema; unlike free-form tags, defined tags enable tag-based policy conditions and cost-tracking reports.
- Budget-scoped policy
- A policy that blocks resource creation when a budget threshold is reached; a budget alert alone only notifies and does not stop spending.
- Compartment nesting
- Compartments can be nested up to six levels deep; policies attached to a parent apply to children unless the policy names a specific compartment path.
- Autonomous Database serverless
- A fully managed database that scales OCPUs automatically and bills per second of use; it requires no Exadata infrastructure in the tenancy and suits variable workloads.
- Autonomous Data Guard
- A standby database kept in sync across availability domains or regions; switchover is planned role reversal, while failover is unplanned and follows a primary outage.
- Service Connector Hub
- A service that moves data between services, for example Logging to Object Storage or Streaming, and can invoke Functions to automate responses to log events.
- Monitoring alarm
- A rule that evaluates a metric against a threshold and publishes to a Notifications topic, whose subscriptions can be email, HTTPS, PagerDuty, or a function.
- Audit retention
- OCI Audit records every API call and retains events for 90 days by default; export to Object Storage for longer retention when compliance requires it.
- Reserved capacity
- A prepaid annual commitment to compute capacity that lowers the effective hourly rate compared with on-demand pricing, useful for steady predictable workloads.
- VCN CIDR range
- A VCN CIDR block must fall between /16 and /30; subnets can be AD-specific or regional, and a regional subnet spans all availability domains in the region.
- NAT gateway
- A VCN gateway that lets instances in private subnets make outbound internet connections while preventing inbound connections from the internet.
- Security list statefulness
- Security lists apply at the subnet level and require explicit rules for both request and response traffic, unlike stateful network security groups that allow return traffic automatically.
- Object Storage object limit
- A single object can be up to 10 TiB; multipart upload is required above 100 MiB by default and is recommended for large objects to improve throughput and resilience.
- Block Volume maximum size
- A block volume can be up to 32 TiB, and the number of volumes attachable to an instance depends on the instance shape rather than the tenancy.
- Compartment deletion rule
- A compartment must be empty before it can be deleted; resources inside it, including nested compartments, must be removed or moved first.
- Autonomous Database Dedicated
- A deployment on dedicated Exadata infrastructure in the tenancy, chosen for isolation and predictable performance rather than lower cost compared with serverless.
- Observability combination
- A complete design uses Monitoring for metrics, Logging for logs, APM for traces, and Events for state changes, rather than relying on any single service.