Ephemeral principals in Oracle Cloud Infrastructure (OCI) refer to temporary security credentials granted to resources, such as compute instances, to enable them to interact with OCI services securely. These credentials have a limited lifespan and are typically used in situations where resources need to authenticate temporarily without the need for long-lived credentials.

Use Case: Ephemeral principals are often used for instance principals, allowing compute instances to make API calls without the need to manage long-term keys or credentials.

The principle of least privilege is a security best practice that dictates that users should only be granted the minimum set of permissions necessary to perform their tasks. This principle helps to minimize the risk of accidental or malicious actions that could compromise security.

IAM Policies in OCI: When creating IAM policies in OCI, you should carefully evaluate the required permissions and only grant those that are absolutely necessary for the users or groups to perform their specific roles. This helps to reduce the attack surface and prevent unauthorized access to sensitive resources.

File System Replication in Oracle Cloud Infrastructure (OCI) allows you to replicate data from one file system to another either within the same region or across different regions. This capability is particularly useful for disaster recovery, data protection, and global data distribution scenarios.

Cross-Region Replication: The replication feature enables you to create a copy of your file system in a different region, ensuring that your data is available even in the event of a regional failure.

Same-Region Replication: You also have the option to replicate data within the same region, which can be useful for scenarios such as high availability and local backups.

In Oracle Cloud Infrastructure (OCI), to ensure high availability and distribution across Availability Domains (ADs), the recommended approach is as follows:

Capacity Reservations for High Availability : To achieve high availability, especially across all three Availability Domains in a region, you should create three capacity reservations . Each reservation corresponds to one AD, ensuring that your instances or resources are evenly distributed and resilient to AD-level failures.

Why Three : This setup provides redundancy and load distribution across the ADs, meeting the high availability requirements.

Relevant OCI Documentation :

Capacity Reservations

This document outlines how to create and manage capacity reservations to meet high availability and fault tolerance requirements.

=================

In Oracle Cloud Infrastructure (OCI), pre-authenticated requests (PARs) allow users to grant access to specific objects in Object Storage without requiring the recipient to have an OCI account or credentials. This feature is useful for sharing objects securely without exposing broader access.

Cannot Edit a PAR : Once a pre-authenticated request is created, you cannot edit it. If you need to change the settings, such as the expiration date or the object being shared, you must delete the existing PAR and create a new one.

Other Statements :

Deleting a PAR does indeed revoke access immediately, contradicting option B.

Providing OCI credentials (C) is not required for using PARs. The purpose of PARs is to avoid sharing credentials.

Deleting Buckets (D) : PARs are designed for accessing objects, not for administrative actions like deleting buckets.

Relevant OCI Documentation :

Managing Pre-Authenticated Requests

This reference outlines the features and limitations of pre-authenticated requests, including the inability to edit them once created.

=================

Setting up a Site-to-Site VPN on Oracle Cloud Infrastructure offers several key benefits related to connectivity and reliability:

Static or Dynamic Routing (BGP) : OCI allows customers to configure Site-to-Site VPN with either static routing or dynamic routing using Border Gateway Protocol (BGP). This flexibility enables customers to choose the routing method that best suits their network configuration and requirements.

Redundant VPN Tunnels : OCI automatically provisions redundant VPN tunnels when you set up a Site-to-Site VPN. These redundant tunnels ensure high availability and fault tolerance, so if one tunnel fails, traffic can continue to flow through the other tunnel without interruption.

Bandwidth Considerations : While the VPN provides a reliable connection, it typically does not exceed 2 Gbps in bandwidth. Higher bandwidth connections usually require FastConnect.

Private Connection : The VPN does create a secure and private connection between on-premises data centers and OCI, but it does not inherently provide a consistent network experience in the way that a dedicated connection like FastConnect does.

Relevant OCI Documentation :

Site-to-Site VPN Overview

Configuring Routing for VPNs

These references detail the benefits and technical specifications of setting up Site-to-Site VPNs on OCI.

=================

To ensure secure communication between database servers and OCI Object Storage, you should use a Service Gateway . A Service Gateway enables instances in your VCN to privately access OCI services like Object Storage without traversing the public internet.

Security: The traffic between your database servers and Object Storage remains within the Oracle network, providing a secure and high-performance connection.