Foundation Flashcards
What is the bandwidth between servers in each AD (and cross regions)?
- Oracle claims the network bandwidth between servers in each AD is 10 Gbps with a latency of less than 100 microseconds
- The bandwidth between ADs in each region is 1 Tbps with a latency of less than 5,000 microseconds.
- Finally, the bandwidth between regions, which are geographically vast distances apart, is 100 Gbps with a latency of less than 100 milliseconds.
- This network is a flat high-speed non-oversubscribed Clos network that provides around one million network ports per AD
Definition of Fault Domains ?
- Logical Data Center
- Infrastructure grouping allowing instances to be distributed so they do not reside on the same physical hardware within an AD
- Protection at a physical server level against unexpected hardware failures and improves availability during planned outages.
What is created with a VCN ?
- 3 subnets were automatically created, one for each availability domain
- A default route table is created along with an Internet Gateway, allowing your compute instances to connect to the Internet if desired
- A default security list is also created with several default ingress rules, one of which permits SSH access on port 22 to provide remote login and access to your compute instances.
- An ingress rule permits incoming traffic, while an egress rule permits outgoing traffic
Load Balancers description ?
- LB is a network device you may provision that receives incoming traffic on an IP address and routes the traffic to one or more underlying instances
- The OCI LB service is a regional service that distributes traffic to instances either within the same availability domain or across multiple availability domains
- The protocol and ports being serviced by an LB are specified in an entity called the Listener (up to 16 listeners can be defined)
- When creating an LB, you specify the VCN in which incoming traffic is accepted as well as whether it will be a private or public LB
- You also choose the shape of the LB, which limits the speed at which network traffic is routed
- LBs are commonly used to support high availability and scaling out of web servers.
- LBs distribute traffic to backend servers based on a set of policies known as a backend set. Routing algorithms, including Weighted Round-Robin (a weight is given such as 1, 2…), IP Hash, and Least Connections, are specified when creating the backend set
What are the 3 protocols that OCI load balancers supports ?
- TCP (level 4)
- HTTP (level 7) - HTTP/1.0, HTTP/1.1, HTTP/2
- WebSockets
Meaning of shape names ?
- The shape names contain several useful identifiers
- Standard means that only block storage is available while DenseIO refers to local NVMe drivers being present
- The last digits in the shape name refer to the number of OCPUs, or Oracle Compute Units. The digit before last corresponds to the hardware generation (for instance on first- and second-generation hardware (in this case, X5 and X7).
- An OCPU provides CPU capacity equivalent to one physical core of an Intel Xeon processor with hyperthreading enabled.
- Each OCPU corresponds to two hardware execution threads, known as vCPUs
- VM.Standard.E2.8 shapes are almost identically named, except for the additional “.E” in the latter shape. This identifies the underlying CPU as an AMD E-series microprocessor (EPYC CPU) as opposed to the standard Intel Xeon–based microchips found in other shapes.
What are the 4 storages types ?
- Block volumes (iSCSI interface = TCP/IP network connection)
- Block volumes may be dismounted from one instance and mounted to another instance in the same AD without data loss
- May be grouped with other block volumes to form a logical entity known as a volume group. Volume groups may be backed up together to form a consistent point-in-time, crash-consistent backup that is also useful for cloning
- A boot volume is a special type of block volume because it contains a boot image (when an instance is created, a new boot volume can be created, or an unused boot volume can be chosen)
- Object storage (HTTP, immediately available)
- Not suitable for high speed, Object storage is not bound to an instance or an AD but is a region-level construct that resides in a compartment
- The object storage service uses the 134.70.0.0/17 CIDR block IP range for all regions
- OCI object storage integrates with OCI’s Identity and Access Management (IAM) to control permissions on object storage.
- Archive storage (HTTP, needs a restore for data to be available)
- Object and archive are based on the same storage solution, but archive is slower
- File storage (NFS)
What are the global resources ?
Tenancy, compartments, users, groups (cannot be nested), and policies are global resources and span regions.
- When you create these IAM entities, they exist in all regions to which your tenancy or cloud account has subscribed
- IAM changes do not occur immediately across all regions. A user impacted by a policy change in the home region will experience a propagation delay before the changes are effected in all regions (there is a replication mechanism from the master region = tenancy home region)
What are the different types of users ?
- Local users
- Federated users (Federated users are created and managed in an identity provider outside of OCI’s IAM service such as Microsoft Active Directory or Oracle Identity Cloud Service (IDCS).
- Provisioned (or synchronized) users (Provisioned users are automatically created in OCI’s IAM service based on federated users in an identity provider. A provisioned user does not exist without a corresponding federated user. If your tenancy has been federated to another identity provider and you attempt to access the OCI console using the preceding URLs, you will be prompted to either use a single sign-on (SSO) credential or to specify your local username and password. Provisioned users allow federated users to sign in to the OCI console using a password managed by their identity provider—for example, IDCS.)
What are the policies scope ?
- Policies are inherited by their child compartments.
- If a policy is created in the root compartment, it applies to all compartments.
- A policy created in a child compartment with no subcompartments applies only to the relevant resources within that child compartment
What are the dynamic groups used for ?
Dynamic groups authorize member instances to interact with OCI resources at a tenancy level by using IAM policies.
To support automation, OCI offers dynamic groups.
- Dynamic groups are a tenancy-wide construct and represent a collection of compute instances added to the group by one or more matching rules.
- A typical matching rule is to include all compute instances that belong to a certain compartment.
- The group becomes dynamic as instances in that compartment are launched or terminated.
- A single compute instance may belong to a maximum of ten dynamic groups.
- Matching rules that determine the inclusion or exclusion of instances in dynamic groups are based on one or more of the following:
- Compartment OCID
- Compute instance OCID
- Tag namespace and tag key
- Tag namespace, tag key, and tag value
VCN Definition ?
- A virtual cloud network (VCN) is functionally equivalent to an on-premises network and is a private network running on Oracle networking equipment in several data centers.
- A VCN is a regional resource that spans all ADs in a single region and resides in a compartment (multiple VCNs may be created in a given compartment)
- 3 subnets are automatically created, one for each availability domain
- A default route table is created along with an Internet Gateway, allowing your compute instances to connect to the Internet if desired.
- A default security list is also created with several default ingress rules, one of which permits SSH access on port 22 to provide remote login and access to your compute instances
Which OCI managed database service needs to be selected to use RAC on OCI?
- Bare Metal DB system
- Autonomous OLTP
- Autonomous Data Warehouse
- VM DB Systems
VM DB System
At which level does a policy apply ?
A policy always applies at the group level and not individual user
It can also apply at the instance level
What is the difference between a Security List and a Network Security Group (NSG) ?
- Security List applies to all the VNIC of the subnet
- NSG applies to some VNIC only of the subnet and specific resources
How much storage comes under the free tier subscription of Oracle Cloud ?
5 TB
What are the IAM resources and their related scope ?
- Tenancy
- Compartment
- User
- Group
- Policy
IAM resources have global scope and are available in each Compartment, AD, and Region.
What are the 2 potential constraints of data management ?
- Data residency regulations that restrict the geographical location of data
- Many public sector organizations in Canada have a regulatory restriction on data leaving Canadian soil. Oracle has provisioned a Canadian region with an availability domain in Toronto, which has opened the door for widespread OCI adoption in that region.
- Another design consideration to bear in mind relates to data sovereignty.
- Some organizations have regulatory limitations on the location of the staff who work on their data.
- For example, a large Canadian insurance corporation has a legal obligation to its policy holders guaranteeing that their data is never worked on by non–Canadian-based staff
What are the regional resources ?
- Buckets
- Images
- Internet Gateways (IG)
- Customer Premises Equipment (CPE) - local representation of on-premise modem
- Dynamic Routing Gateways (DRGs)
- NAT Gateways
- Route tables
- Local Peering Gateways (LPGs)
- Repositories
- Security lists
- Volume backups
What are the AD specific resources ?
- Volumes
- Database systems
- Instances
- Ephemeral public IPs
Definition of Realm in the OCID ?
- The realm is always oc1 for now and is meant to represent the set of regions that share OCI entities.
- Region segment (region) is blank for global resources such as tenancy and compartments but contains the region code for regional and AD-specific
- Future use is blank for now
What are the 2 types of tags ?
A tag is simply a key-value pair that you associate with a resource.
- Free-Form Tags
- Defined Tags based on a tenancy level namespace
- There is a facility for enabling tags as cost-tracking tags that appear on your invoice, which is very useful for implementing a chargeback system (cost tracking checkbox must be selected on the tag)
- As of this writing there is a limit of ten tags that may be identified as cost-tracking tags, so factor this into your tag naming strategy.
- Once you define your tag keys, you can apply these to any resource
What are some significant resource families ?
Storage - volume-family - object-family - file-family Compute - instance-family Network - virtual-network-family Database - database-family
Which is a capability of OCI users but not federated users?
A. Can add API keys
B. Can generate Auth tokens
C. Can use a local password for console access
D. Can generate customer secret keys
C. Can use a local password for console access
Which resource is not an availability domain–level resource? A. Compute instance B. Subnet C. Block volume D. Object storage
D. Object storage
Object storage buckets are an interesting regional resource. An instance in AD: US-ASHBURN-AD-1 may access a bucket in the region: us-ashburn-1. This bucket is equally accessible by another instance in AD: US-ASHBURN-AD-2. Given the correct region-specific object storage URL and permissions, this bucket is accessible from any location.
Security list Stateful and Stateless rules
- Security lists contain firewall rules for all the compute instances using the subnet.
- Rule can be either stateful or stateless.
- Stateful rules allow connection tracking and are the default, but stateless is recommended if you have high traffic volumes. Stateful rules with connection tracking allow response traffic to leave your network without the need to explicitly define an egress rule to match an ingress rule.
- Stateless rules, however, do not permit response traffic to leave your network unless an egress rule is defined.
- One of the ingress rules in the default security list allows traffic from anywhere to instances using the subnet on TCP port 22. This supports incoming SSH traffic and is useful for connecting to Linux compute instances.
What are the types of public IP adresses ?
- Ephemeral addresses are transient and are optionally assigned to an instance at launch or afterwards to a secondary vNIC. These persist reboot cycles of an instance and can be unassigned at any time resulting in the object being deleted. Once the instance is terminated, the address is unassigned and automatically deleted. Ephemeral public IPs cannot be moved to a different private IP. The scope of an ephemeral IP is limited to one AD.
- Reserved addresses are persistent and exist independently of an instance. These may be assigned to an instance, unassigned back to the tenancy’s pool of reserved public IPs at any time, and assigned to a different instance. The scope of the reserved public IP is regional and can be assigned to any private IP in any AD in a region.
A vNIC on a public subnet is automatically assigned a public IP. It is not mandatory and may be removed or de-assigned.
What is another name for a Gateway ?
Virtual Router
How many IP addresses a private load balancer requires ?
- 3 IP addresses from the associated subnet for the primary and standby load balancers as well as the floating private IP.
- A passive (standby) private load balancer is created automatically for failover purposes and also receives a private IP address from the same subnet. A floating private IP address serves as a highly available address of the load balancer.
At what level is a Public load balancer defined ?
Region
- The public load balancer is a regional resource as opposed to a private load balancer, which is an AD-level resource.
- In regions with multiple ADs, it is mandatory to specify public subnets in different ADs for the active and passive load balancers.
When do we need to use a DRG for peering ?
- Local peering gateways link up VCNs in the same region, while remote peering across regions is facilitated by running a remote peering connection through your DRG.
Which of the following statements is true?
A. BGP is supported with IPSec VPN but not FastConnect when connecting external networks to your VCN.
B. BGP is supported with FastConnect but not IPSec VPN when connecting external networks to your VCN.
C. BGP is supported with FastConnect but not IPSec VPN when connecting subnets within your VCN.
D. BGP is supported with IPSec VPN but not FastConnect when connecting subnets within your VCN.
B. BGP is supported with FastConnect but not IPSec VPN when connecting external networks to your VCN.
A VCN is defined with the CIDR 192.168.0.0/30. How many IP addresses from this CIDR block are reserved by OCI?
3
- OCI networking service reserves the first IP known as the network address, the last IP known as the broadcast address, as well as the first host address in the CIDR range known as the subnet default gateway address
A VCN is defined with the CIDR 192.168.0.0/30. How many IP addresses from this CIDR block are available for host addresses?
1 (2 puissance 2 - 3)
This CIDR block specifies four IPs: 192.168.0.0–192.168.0.3. After OCI networking services takes the three it requires, only one remains for host addressing.
