Ephemeral principals in Oracle Cloud Infrastructure (OCI) refer to temporary security credentials granted to resources, such as compute instances, to enable them to interact with OCI services securely. These credentials have a limited lifespan and are typically used in situations where resources need to authenticate temporarily without the need for long-lived credentials.
* Use Case:Ephemeral principals are often used for instance principals, allowing compute instances to make API calls without the need to manage long-term keys or credentials.
References:
* Oracle Cloud Infrastructure Documentation:Using Instance Principals

To securely grant a third-party application access to specific Oracle Cloud Infrastructure (OCI) resources, the recommended approach is to configure the application to useInstance Principal. This method allows the application to authenticate directly with OCI services without needing to manage sensitive credentials like passwords or API keys.
* Instance Principals:Enable compute instances to directly make API calls against OCI services, inheriting permissions through IAM policies. This setup is more secure than sharing user credentials, as it avoids hardcoding credentials within the application and leverages OCI's native security features.
References:
* Oracle Cloud Infrastructure Documentation:Instance Principals

Oracle Cloud Infrastructure (OCI) File Storage Service offers robust encryption capabilities to ensure data security.
* B. Customer-Managed Encryption:Customers can choose to encrypt their data using their own keys stored in the OCI Vault service. This gives customers control over their encryption keys and enhances data security.
* D. Oracle-Managed Encryption:By default, all data stored in OCI File Storage is encrypted using Oracle-managed keys. This ensures that data is encrypted at rest without requiring any action from the customer.
Incorrect Statements:
* A. Communication is not encrypted via HTTPSwhen accessing file systems; instead, encryption in transit is typically managed via NFS over TLS.
* C. Encryption of communication to a mount target is handled via network configurations, not through export options.
References:
* Oracle Cloud Infrastructure Documentation:File Storage Encryption

Even after removing port 22 from the Security Lists, SSH was still possible because the Virtual Network Interface Card (VNIC) of the compute instance is attached to aNetwork Security Group (NSG).
* NSGs:NSGs provide a more flexible and granular way to manage security rules compared to Security Lists. They allow you to apply security rules directly to VNICs associated with resources such as compute instances. If an NSG allows traffic on port 22, SSH will still be possible, regardless of the Security List settings.
References:
* Oracle Cloud Infrastructure Documentation:Security Lists and Network Security Groups