OCI Cloud Security Associate - quick reference guide

We use Patch management software to centrally distribute and monitor the patch level of systems throughout the enterprise
Zero Trust architecture is based on the principle of “never trust, always verify”
When we go with PaaS service, then Data is Customer's responsibility under Shared Responsibility Model.
Security Information and Event Management (SIEM) can automatically collect and aggregate log data generated throughout your organization's infrastructure, analyze it, and send alerts if it detects a deviation from the norm.
Web Application Firewall (WAF) are designed to protect against web application attacks, such as SQL injection and cross-site scripting

If You want to make API calls against other OCI services from your instance without configuring user credentials. then it can be achieved by "creating a dynamic group and add a policy".
If You create a new compartment, "apps," to host some production apps and you create an apps_group and added users to it. To ensure that the users have access to the apps compartment, then you need to "Add an IAM policy for apps_group granting access to the apps compartment"
Compartments options helps us to set Oracle Cloud Infrastructure Budget.
Policies helps us to make Oracle Cloud Infrastructure Identity and Access Management govern resources in a tenancy.
Policies is a part of the OCI Identity and Access Management service.

Inherent policies applies immediately if we move a resource from one compartment to another.
With the use of Update Shape workflows, we can convert a fixed load balancer to a flexible load balancer.
Bastion service provides restricted access to target resources in Oracle Cloud.
By using the Network Visualizer tool we can get the information of Interconnectivity of VCNs.
We need to configure Listner, for a load balancer to accept incoming traffic.

"Windows Servers that does not have the minimum agent version requires an agent update or installation" statement is true about using custom BYOI instances in Windows Servers that are managed by OS Management Service.
OS Management Service Increases security and reliability by regular bug fixes.
"Add applications to network security groups for fine-grained ingress/egress rules" is the security recommendations and best practices for Oracle Functions.
Manual scaling can be performed on a dedicated virtual machine host.

Boot volume contains the image used to boot a compute instance.
Standard Storage is most effective when you want to move some unstructured data, consisting of images and videos, to cloud storage.
"All the traffic to and from object storage is encrypted by using Transport Layer Security" statement is true about Oracle Cloud Infrastructure (OCI) Object Storage server-side encryption.
file storage uses NFSv3 file system.
Vault service lets us centrally manage the encryption keys that protect your data and the secret credentials that we use to securely access resources in OCI cloud.

Web Application Firewall policy encompasses the overall configuration of your WAF service on OCI.
Protection rules must be configured in WAF service to allow, block, or log network requests when they meet specified criteria.
JavaScript challenge is generally the first level of bot mitigation, but not sufficient with more advanced bot tools.
In WAF, Multiple origins can be defined but only a single origin can be active.

Tenant can disable rules and customize them in User-managed detector recipe.
Service Owner (Root) role can manage cloud-guard-family in a tenancy.
In Cloud Security Posture, Problems are created when Cloud Guard discovers a deviation from a responder rule.
In Cloud Guard, Detectors identify issues with resources or user actions and alerts you when an issue is found.
Cloud Guard re-open an issue and update the history If it detects an issue for a previously resolved configuration problem.

Header is included in audit log event.
Logs are stored in OCI Object Storage.
30 days is the minimum active storage duration for logs used by Logging Analytics to be archived.
Event Services, Logging and Logging Analytics are part of Observability and Management Services.
Service Connector Hub helps to move logging data to other services, such as archiving log data in object storage.

Attestation, Bridge letter and Certificate are considered as compliance document in OCI cloud.
API calls audited and available for 90 days.
Standards are a result of a regulation or contractual requirement or an industry requirement.
Data encryption protects customer data at rest and in transit in a way that allows customers to meet their security and compliance requirements for cryptographic algorithms and key management.
Organizations that provide global cloud services must comply with the legal requirements that operate in countries where they do business.

TECHNOLOGY-TO-THE-POINT (T3P)