47 questions · Governance And Administration · All types, answers revealed
Which OCI construct serves as the root container for all your cloud resources and acts as the logical boundary for managing users, groups, and compartments?
The tenancy is your root account provided by Oracle Cloud Infrastructure, containing all your compartments, users, and resources.
Why this answer
The Tenancy is the root compartment and overarching container for all OCI resources.
Which THREE actions can be performed using OCI Audit log data? (Choose three.)
OCI Events can capture audit log events to trigger notifications or serverless functions.
Why this answer
OCI Audit logs can be queried, streamed to streaming services, archived to Object Storage, and used with Events/Notifications.
An enterprise has multiple child compartments under a root tenancy. A security administrator wants to ensure that a specific IAM policy written in the root tenancy cannot be overridden or weakened by child compartment policies. How does OCI handle policy evaluation across hierarchical boundaries?
OCI IAM is purely additive. If access is granted at the tenancy or parent level, child policies cannot strip those permissions away.
Why this answer
OCI IAM policies are additive. Permissions granted at higher levels (like tenancy or parent compartments) flow down and cannot be blocked or denied by child compartment policies since OCI does not have explicit DENY rules.
Which TWO methods can be used to authenticate users accessing OCI services? (Choose two.)
API signing keys are required for programmatic access via the CLI, SDKs, and API requests.
Why this answer
Users can authenticate via passwords/MFA in Identity Domains, API signing keys, auth tokens, or federated identity providers.
An administrator wants to use Tagged-Based Access Control (TBAC) in OCI IAM policies. Which condition syntax is used in an IAM policy to check if a resource has a specific defined tag value during a request?
This condition checks whether the target resource being accessed has the specified defined tag value.
Why this answer
TBAC in OCI uses target.tag.<namespace>.<key>.value in IAM policy conditions to verify resource tags.
You are writing an IAM policy for a group that needs to manage block storage volumes, but you want to ensure they can only perform these actions from a specific corporate IP address range (`192.168.1.0/24`). How should you write the policy condition?
The correct OCI condition syntax for IP range restriction uses the cidr function: 'where request.ip = cidr("192.168.1.0/24")'.
Why this answer
OCI IAM policy conditions support request.ip using the cidr function to restrict access to specific source IP ranges.
Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?
Compartment quotas allow tenancy administrators to restrict resource consumption and hard limits within specific compartments.
Why this answer
Compartment quotas allow administrators to set resource limits (such as max OCPUs or counts) on specific compartments to enforce financial and capacity governance.
Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?
Defined tags enabled for cost-tracking allow you to aggregate and analyze spending by specific tag keys and values in OCI Cost Analysis.
Why this answer
Tags in OCI allow you to attach metadata to resources, which can then be used in Cost Analysis for tracking and allocating spend.
Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?
Since authentication is federated, OCI defers authentication checks to the corporate IdP. A disabled IdP account blocks login.
Why this answer
Federated authentication relies on the corporate IdP; once disabled there, the user cannot successfully authenticate or generate security assertions for OCI.
An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?
OCI Audit logs every API call and user action, making it the definitive tool for tracking who did what and when.
Why this answer
The OCI Audit service automatically records all API calls made to supported OCI services, including identity, user actions, and resource deletions.
An administrator wants to move a Virtual Cloud Network (VCN) from 'CompartmentA' to 'CompartmentB'. What is the primary prerequisite that must be met for this move to succeed?
Moving resources across compartments requires 'manage' access on both the source and destination compartments to ensure authorization.
Why this answer
To move a resource between compartments, all dependent child or associated resources (like subnets, route tables, or security lists) must be supported, and you must have manage permissions on both source and destination compartments.
Which TWO tools can you use to analyze and track Oracle Cloud Infrastructure costs and spending? (Choose two.)
Cost Analysis provides visual dashboards and filters for exploring billing data.
Why this answer
OCI Cost Analysis and OCI Budgets are the primary tools for tracking and analyzing cloud expenditures.
An administrator wants to ensure that all Audit log events in the tenancy are archived to an Object Storage bucket for long-term retention and compliance. How should this be configured?
OCI Audit allows you to configure periodic export and archiving of audit logs into an Object Storage bucket.
Why this answer
OCI Audit provides an archival feature where you can configure a retention period and point Audit logs to an Object Storage bucket for long-term preservation.
An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?
This statement correctly scopes the 'manage' verb to autonomous-databases specifically within DevCompartment for DBA-Group.
Why this answer
To scope access to a specific resource type within a specific compartment, the policy must use the target resource type (autonomous-databases) and be defined at the appropriate compartment level.
What is the name of the file format used by OCI Usage Reports that allows financial teams to ingest cloud spending data into spreadsheet and BI tools?
Usage Reports deliver data in compressed CSV format into an Object Storage bucket.
Why this answer
Usage Reports export data as CSV (Comma-Separated Values) files.
You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?
The 'request.region' variable checks the region where the API request is being executed.
Why this answer
OCI IAM policy conditions support checking contextual variables such as request.region, enabling regional scoping.
You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?
OCI continuously evaluates dynamic group rules, updating membership shortly after a resource changes its compartment or attributes.
Why this answer
Dynamic group membership evaluations happen dynamically and near-real-time as instances change states or compartments.
Which OCI administrative feature allows you to organize and categorize cloud resources using user-defined key-value pairs for granular tracking and automation?
Tags (Free-form and Defined) let you attach metadata key-value pairs to OCI resources for organization, filtering, and cost tracking.
Why this answer
Tags provide key-value metadata attachment to OCI resources.
Where in the OCI Console can an administrator view current service limits, usage, and request a service limit increase?
This section displays current usage against service limits and provides a direct workflow to request increases.
Why this answer
The 'Limits, Quotas and Usage' section under Governance and Administration in the OCI Console is where service limits are managed.
Which TWO types of tags are supported in Oracle Cloud Infrastructure? (Choose two.)
Defined tags are controlled by administrators using namespaces and tag keys defined in IAM.
Why this answer
OCI supports Free-form tags and Defined tags.
Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?
Cloud Guard detects security misconfigurations and insecure operational states across your OCI tenancy.
Why this answer
OCI Cloud Guard scans OCI resources for security misconfigurations and risky activities, providing actionable remediation steps.
You created a Defined Tag namespace called 'Department' and a key called 'CostCenter'. However, developers are forgetting to add these tags when creating compute instances. How can you ensure that every new compute instance created in a specific compartment automatically receives these tags without relying on manual user input?
Tag defaults automatically inject defined tag keys and values upon resource creation within the target compartment.
Why this answer
Tag defaults allow administrators to specify default values for defined tags that are automatically applied to all resources created within a compartment.
You need to grant an external auditing firm read-only access to view all resources across your entire OCI tenancy without allowing them to make any changes. What is the most efficient way to achieve this?
The 'inspect' verb allows listing and viewing resources across the tenancy without permitting any modifications.
Why this answer
Using the 'inspect' or 'read' verb across 'all-resources' at the tenancy level grants read-only visibility to auditors.
Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)
Defined tags must belong to a pre-created tag namespace managed by administrators.
Why this answer
Defined tags require tag namespaces, support tag defaults, and can be evaluated in IAM policies for TBAC.
You need to export billing and usage data automatically every day into an Object Storage bucket for custom financial analysis and reporting. Which OCI feature facilitates this?
Usage Reports provide granular CSV files of cost and usage data delivered automatically to an Object Storage bucket.
Why this answer
Usage Reports in OCI automatically generate detailed CSV cost and usage reports and deposit them into a designated tenancy-owned Object Storage bucket daily.
Which TWO statements are correct regarding OCI Budgets and spending alerts? (Choose two.)
OCI Budgets integrate with OCI Notifications to dispatch alerts when thresholds are reached.
Why this answer
Budgets can alert on both actual and forecasted spend, and notifications can be sent via OCI Notifications to email or endpoints.
Which OCI service provides native tools to monitor resource metrics (such as CPU utilization) and trigger alarms when thresholds are breached?
OCI Monitoring collects performance metrics and allows you to set up alarms based on metric triggers.
Why this answer
OCI Monitoring collects metrics and enables alarms based on telemetry data.
You want to delegate the ability to create and manage sub-compartments within an existing compartment called 'AppCompartment' to a lead architect, without granting them full tenancy administration rights. How should you write this IAM policy?
This allows the group to create, move, and manage sub-compartments specifically underneath AppCompartment.
Why this answer
To allow managing compartments within a specific parent compartment, the policy must target the 'compartments' resource type at the parent compartment level.
Which THREE features are provided by OCI Cloud Guard to help secure a tenancy? (Choose three.)
Responder recipes contain actions that can automatically respond to and remediate security alerts.
Why this answer
Cloud Guard provides detector recipes, responder recipes, and targeted security problem remediation and monitoring.
You want to organize your OCI resources so that all networking components belong to one administrative boundary, security tools belong to another, and application workloads belong to a third. Which OCI entity is specifically designed to isolate resources for administrative and security delegation?
Compartments are the fundamental logical building blocks used to isolate and govern resources in OCI.
Why this answer
Compartments are logical partitions within a tenancy used to organize and isolate OCI resources.
You are setting up OCI Budgets for multiple departments. You want a budget to evaluate spending based on the actual costs incurred plus estimated charges for resources that have been running during the month. Which budget calculation rule should you select?
Forecasted spend looks at historical consumption patterns to predict total end-of-month spending, allowing alerts before the budget is exceeded.
Why this answer
OCI Budgets support both 'ACTUAL' and 'FORECASTED' spend tracking types. To include both incurred spend and projected end-of-month spend, you use forecasted spend alerts.
An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?
Creating a dynamic group defines who the principal is, but an IAM policy is still required to grant them access.
Why this answer
For a dynamic group to receive permissions, an IAM policy must be written granting access to that specific dynamic group name (e.g., 'Allow dynamic-group <group-name> to...').
You have a parent compartment named 'ParentComp' and a child compartment named 'ChildComp'. If you write an IAM policy at the root tenancy level granting a group access to 'ParentComp', what is the inheritance rule regarding 'ChildComp'?
Compartment hierarchies inherit permissions downward, meaning permissions granted at ParentComp apply to ChildComp as well.
Why this answer
Policies defined at a parent compartment or tenancy level automatically inherit down to all nested child compartments.
Which TWO statements describe OCI Service Limits? (Choose two.)
Service limits act as built-in safeguards and capacity ceilings for cloud resources.
Why this answer
Service limits are thresholds set on resource consumption per tenancy/region, and administrators can request increases via the console.
You want to ensure that any compute instance launched by the data science team is automatically tagged with a specific project code, without requiring manual tagging by the users. Which OCI governance mechanism is best suited for this?
Tag defaults automatically inject defined tags into resources created within the specified compartment.
Why this answer
Tag defaults allow you to set default values for defined tags at the compartment level, automatically applying them upon resource creation.
Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?
Budgets allow you to set financial limits and configure automated alerts when forecasted or actual spend crosses set percentages.
Why this answer
OCI Budgets allow you orange spending limits and trigger alerts at specified percentage thresholds via email or notifications.
A security administrator needs to ensure that users configure Multi-Factor Authentication (MFA) for their OCI accounts to enhance login security. Where is MFA managed in OCI?
Identity Domains manage user security settings, sign-on policies, and MFA configurations.
Why this answer
MFA and user authentication policies are managed within Identity Domains in OCI.
Which THREE components are required when writing an OCI IAM policy statement? (Choose three.)
Policies must specify where the permission is granted (compartment or tenancy).
Why this answer
OCI IAM policy syntax requires a verb, a resource type (or all-resources), and a location (compartment or tenancy).
Which OCI tool can you use to visualize your monthly cloud spend trends, filter costs by compartments, and examine expenses broken down by specific services?
Cost Analysis provides graphical dashboards to analyze spending, filter by tags, compartments, and services.
Why this answer
OCI Cost Analysis is the built-in dashboard for analyzing cloud spending and cost breakdowns.
Which OCI Console menu section should an administrator navigate to in order to create and manage user groups, compartments, and IAM policies?
Identity & Security in the OCI navigation menu houses users, groups, dynamic groups, compartments, and IAM policies.
Why this answer
Identity & Security (or Governance & Administration depending on console navigation structure) contains Identity, Compartments, and Policies.
What is the primary purpose of the OCI Vault service in relation to administrative governance?
Vault allows you to store master encryption keys and application secrets safely, supporting compliance and security governance.
Why this answer
OCI Vault is used to centrally manage encryption keys and secret credentials securely.
Which THREE best practices should be followed when designing an OCI compartment hierarchy and IAM policy structure? (Choose three.)
Managing access via groups simplifies user onboarding and role management.
Why this answer
Best practices include keeping compartment hierarchies shallow, using groups rather than individual users in policies, and following the principle of least privilege.
Your organization wants to ensure that all resources tagged with `Environment: Production` cannot be deleted accidentally by any user, including administrators. Which OCI feature can help achieve protection against accidental deletion?
Resource locks can be applied to OCI resources to prevent them from being modified or deleted (DELETE or FULL lock types).
Why this answer
OCI provides resource locks (full or delete locks) that can be applied to resources to prevent accidental modification or deletion.
Which OCI service allows you to define and run infrastructure as code (IaC) using Terraform configurations natively managed inside your tenancy?
Resource Manager manages Terraform configurations, state files, and execution plans natively in OCI.
Why this answer
OCI Resource Manager is a fully managed service that uses Terraform to provision and govern OCI resources.
Which TWO options are valid methods for organizing and managing infrastructure configuration in OCI? (Choose two.)
Resource Manager automates Terraform-based infrastructure deployment and state management.
Why this answer
Compartments organize resources logically, and Resource Manager organizes infrastructure as code via Terraform.
You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?
OCI architecture best practices recommend a maximum compartment depth of 6 levels to simplify policy administration and tracking.
Why this answer
OCI recommends keeping compartment hierarchies shallow, typically no more than 6 levels deep, to maintain manageable IAM policies and avoid complexity.
Which TWO of the following statements are true regarding OCI Compartments? (Choose two.)
OCI supports moving resources between compartments without needing to recreate them.
Why this answer
Compartments are logical, global entities used to organize resources across regions, and resources within them can generally be moved between compartments.
Ready to test yourself?
Try a timed practice session using only Governance And Administration questions.