1z0-1085-23 Questions and Answers

Oracle Cloud Infrastructure Web Application Firewall (WAF) is a cloud-based, Payment Card Industry (PCI) compliant, global security service that protects applications from malicious and unwanted internet traffic. WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications.

WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable bots to enter. Access rules can limit based on geography or the signature of the request.

Nano instance is not a type of instance offered by the Oracle Cloud Infrastructure Compute service. The types of instances offered by the Compute service are bare metal, virtual machine, dedicated virtual machine host, and flexible virtual machine host. A nano instance is a type of instance offered by AWS EC2 service that provides a small amount of consistent CPU resources and allows users to increase CPU capacity in short bursts when additional cycles are available.

In Oracle Cloud Infrastructure, you can set up email alerts to receive notifications when budget thresholds are reached. Email alerts are sent to users who are subscribed to a budget alert rule, which specifies the percentage or amount of budget consumption that triggers the alert. Email alerts help users monitor and control their cloud spending.

Oracle Cloud Infrastructure Key Management is a managed service that enables you to encrypt your data using keys that you control.

To design a high availability architecture, three key elements should be considered— redundancy, monitoring, and failover:

1) Redundancy means that multiple components can perform the same task. The problem of a single point of failure is eliminated because redundant components can take over a task performed by a component that has failed.

2) Monitoring means checking whether or not a component is working properly.

3) Failover is the process by which a secondary component becomes primary when the primary component fails.

The best practices introduced here focus on these three key elements. Although high availability can be achieved at many different levels, including the application level and the cloud infrastructure level, here we will focus on the cloud infrastructure level.

An Oracle Cloud Infrastructure region is a localized geographic area composed of one or more availability domains, each composed of three fault domains. High availability is ensured by a redundancy of fault domains within the availability domains.

An availability domain is one or more data centers located within a region. Availability domains are isolated from each other, fault tolerant, and unlikely to fail simultaneously. Because availability domains do not share physical infrastructure, such as power or cooling, or the internal availability domain network, a failure that impacts one availability domain is unlikely to impact the availability of others.

A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain contains three fault domains. Fault domains let you distribute your instances so that they are not on the same physical hardware within a single availability domain. As a result, an unexpected hardware failure or a Compute hardware maintenance that affects one fault domain does not affect instances in other fault domains. You can optionally specify the fault domain for a new instance at launch time, or you can let the system select one for you.

All the availability domains in a region are connected to each other by a low-latency, high bandwidth network. This predictable, encrypted interconnection between availability domains provides the building blocks for both high availability and disaster recovery.

Fault domains are the feature that the Oracle Cloud Infrastructure Compute service leverages for ensuring high availability of applications. A fault domain is a grouping of hardware and infrastructure within an availability domain that is isolated from other fault domains. Fault domains provide protection from unexpected hardware failures or power interruptions within an availability domain.

Oracle Cloud Infrastructure is hosted in regions and availability domains. A region is a localized geographic area, and an availability domain is one or more data centers located within a region. A region is composed of one or more availability domains.

Regions are independent of other regions and can be separated by vast distances—across countries or even continents.

Availability domains are isolated from each other, fault tolerant, and very unlikely to fail simultaneously. Because availability domains do not share infrastructure such as power or cooling, or the internal availability domain network, a failure at one availability domain within a region is unlikely to impact the availability of the others within the same region.

Fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain contains three fault domains. Fault domains provide anti-affinity: they let you distribute your instances so that the instances are not on the same physical hardware within a single availability domain. A hardware failure or Compute hardware maintenance event that affects one fault domain does not affect instances in other fault domains. In addition, the physical hardware in a fault domain has independent and redundant power supplies, which prevents a failure in the power supply hardware within one fault domain from affecting other fault domains.

Infrastructure as a service (IaaS) is a type of cloud service model in which computing resources are hosted in the cloud. Businesses can use the IaaS model to shift some or all of their use of on-premises or colocated data center infrastructure to the cloud, where it is owned and managed by a cloud provider. These infrastructure elements can include compute, network, and storage hardware as well as other components and software.

How Does IaaS Work?

In a typical IaaS model, a business—which can be of any size—consumes services like compute, storage, and databases from a cloud provider. The cloud provider offers those services by hosting hardware and software in the cloud. The business will no longer need to purchase and manage its own equipment, or space to host the equipment, and the cost will shift to a pay-as-you-go model. When the business needs less, it pays for less. And when it grows, it can provision additional computing resources and other technologies in minutes.

Alarms are the Oracle Cloud Infrastructure (OCI) monitoring service feature that uses metrics for monitoring and consists of a trigger action and notification method. Alarms allow you to set rules for metric data and receive notifications when the rules are met or breached. For example, you can create an alarm that triggers when the CPU utilization of a compute instance exceeds 80% for more than 5 minutes, and sends an email notification to a specified topic in Notifications service6

Users are not a component of the OCI Identity domains, but rather a resource within an identity domain. An identity domain is a container for managing users and roles, federating and provisioning of users, secure application integration through Oracle Single Sign-On (SSO) configuration, and SAML/OAuth based Identity Provider administration1.

Oracle Autonomous Data Warehouse is a cloud data warehouse service that eliminates virtually all the complexities of operating a data warehouse and securing data. It automates provisioning, configuring, securing, tuning, scaling, patching, backing up, and repairing of the data warehouse. Unlike other “fully managed” cloud data warehouse solutions that only patch and update the service, it also features elastic, automated scaling, performance tuning, security, and a broad set of built-in capabilities that enable machine learning analysis, simple data loading, and data visualizations.

Data Warehouse uses continuous query optimization, table indexing, data summaries, and auto-tuning to ensure consistent high performance even as data volume and number of users grows. Autonomous scaling can temporarily increase compute and I/O by a factor of three to maintain performance. Unlike other cloud services which require downtime to scale, Autonomous Data Warehouse scales while the service continues to run.

Oracle Cloud Infrastructure is hosted in regions and availability domains. A region is a localized geographic area, and an availability domain is one or more data centers located within a region. A region is composed of one or more availability domains. Most Oracle Cloud Infrastructure resources are either region-specific, such as a virtual cloud network, or availability domain-specific, such as a compute instance. Traffic between availability domains and between regions is encrypted.

Availability domains are isolated from each other, fault tolerant, and very unlikely to fail simultaneously. Because availability domains do not share infrastructure such as power or cooling, or the internal availability domain network, a failure at one availability domain within a region is unlikely to impact the availability of the others within the same region.

The availability domains within the same region are connected to each other by a low latency, high bandwidth network, which makes it possible for you to provide high-availability connectivity to the internet and on-premises, and to build replicated systems in multiple availability domains for both high-availability and disaster recovery.

A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain contains three fault domains. Fault domains provide anti-affinity: they let you distribute your instances so that the instances are not on the same physical hardware within a single availability domain. A hardware failure or Compute hardware maintenance event that affects one fault domain does not affect instances in other fault domains. In addition, the physical hardware in a fault domain has independent and redundant power supplies, which prevents a failure in the power supply hardware within one fault domain from affecting other fault domains.

Low performance is not a performance level available in the Oracle Cloud Infrastructure Block Volume service. The Block Volume service offers four performance levels for block volumes: higher performance, balanced, lower cost, and ultra high performance. Each performance level has different characteristics in terms of throughput, IOPS, latency, and cost.

The Oracle Cloud Infrastructure Notifications service broadcasts messages to distributed components through a publish-subscribe pattern, delivering secure, highly reliable, low latency and durable messages for applications hosted on Oracle Cloud Infrastructure and externally. Use Notifications to get notified when event rules are triggered or alarms are breached, or to directly publish a message.

Messages sent out as email by the Oracle Cloud Infrastructure Notifications service are processed and delivered through Oracle resources

Exadata DB Systems are not available as part of Oracle Cloud Free Tier. Exadata DB Systems are a premium service that provides the highest levels of performance and availability for Oracle Database workloads. Oracle Cloud Free Tier includes a set of Always Free services that never expire, and a 30-day trial with US$300 of free credit to use on all eligible OCI services1. The Always Free services include two Oracle Autonomous Databases, two AMD Compute VMs, up to four instances of ARM Ampere A1 Compute, and other services1.

https://www.oracle.com/cloud/what-is-iaas/

What Is IaaS?

Infrastructure as a service (IaaS) is a type of cloud service model in which computing resources are hosted in the cloud. Businesses can use the IaaS model to shift some or all of their use of on-premises or colocated data center infrastructure to the cloud, where it is owned and managed by a cloud provider. These infrastructure elements can include compute, network, and storage hardware as well as other components and software.

In the IaaS model, the cloud provider owns and operates the hardware and software and also owns or leases the data center. When you have an IaaS solution, you rent the resources like compute or storage, provision them when needed, and pay for the resources your organization consumes. For some resources such as compute, you’ll pay for the resources you use. For others such as storage, you’ll pay for capacity.

How Does IaaS Work?

In a typical IaaS model, a business—which can be of any size—consumes services like compute, storage, and databases from a cloud provider. The cloud provider offers those services by hosting hardware and software in the cloud. The business will no longer need to purchase and manage its own equipment, or space to host the equipment, and the cost will shift to a pay-as-you-go model. When the business needs less, it pays for less. And when it grows, it can provision additional computing resources and other technologies in minutes.

In contrast, in a traditional on-premises scenario, a business manages and maintains its own data center. The business must invest in servers, storage, software, and other technologies, and hire an IT staff or contractors to purchase, manage, and upgrade all the equipment and licenses. The data center has to be built to meet peak demand, even though sometimes workloads decline and those resources stand idle. Conversely, if the business grows quickly, the IT department might struggle to keep up.

Here is the official list of all industry standards that OCI complies with : https://www.oracle.com/in/cloud/cloud-infrastructure-compliance/

APPLIANCE-BASED DATA TRANSFER

You send your data as files on secure, high-capacity, Oracle-supplied storage appliances to an Oracle transfer site. Operators at the Oracle transfer site upload the data into your designated Object Storage bucket in your tenancy.

This solution supports data transfer when you are migrating a large volume of data and when using disks is not a practical alternative. You do not need to write any code or purchase any hardware. Oracle supplies the transfer appliance and software required to manage the transfer.

https://docs.cloud.oracle.com/en-us/iaas/Content/DataTransfer/Concepts/overview.htm

Oracle Cloud Infrastructure Data Transfer Appliance securely moves terabytes or petabytes data between on-premise data centers and the cloud. The service reduces data migration times from weeks or months to just hours and is available for data import to the cloud and data export from the cloud.

CapEx is Capital expenditures comprise major purchases that will be used in the future.

OpEx Operating expenditures (expenses) represent day-to-day costs that are necessary to keep a business running.

Oracle Cloud Infrastructure’s security approach is based on seven core pillars. Each pillar has multiple solutions designed to maximize the security and compliance of the platform and to help customers to improve their security posture.

High Availability: Offer fault-independent data centers that enable high-availability scale-out architectures and are resilient against network attacks, ensuring constant uptime in the face of disaster and security attack.

Customer Isolation: Allow customers to deploy their application and data assets in an environment that commits full isolation from other tenants and Oracle’s staff.

Data Encryption: Protect customer data at-rest and in-transit in a way that allows customers to meet their security and compliance requirements with respect to cryptographic algorithms and key management.

Security Controls: Offer customers effective and easy-to-use application, platform, and network security solutions that allow them to protect their workloads, have a secure application delivery using a global edge network, constrain access to their services, and segregate operational responsibilities to reduce the risk associated with malicious and accidental user actions.

Visibility: Offer customers comprehensive log data and security analytics that they can use to audit and monitor actions on their resources, allowing them to meet their audit requirements and reduce security and operational risk.

Secure Hybrid Cloud: Enable customers to use their existing security assets, such as user accounts and policies, as well as third-party security solutions, when accessing their cloud resources and securing their data and application assets in the cloud.

Verifiably Secure Infrastructure: Follow rigorous processes and use effective security controls in all phases of cloud service development and operation. Demonstrate adherence to Oracle’s strict security standards through third-party audits, certifications, and attestations. Help customers demonstrate compliance readiness to internal security and compliance teams, their customers, auditors, and regulators.

Oracle Compute Shape is coming with predefined or customize the number of OCPUs that are allocated to an instance. The amount of memory, network bandwidth, and number of VNICs scale proportionately with the number of OCPUs.

Dimensions are defined as qualifiers used for filtering group metric data presented in the OCI Monitoring service. Dimensions are key-value pairs that provide additional information about a metric, such as resource ID, region, availability domain, fault domain, shape, image, etc. Dimensions allow you to narrow down the scope of your metric queries and alarms by specifying which resources or attributes you want to monitor. For example, you can use dimensions to filter the CPU utilization metric by instance ID or shape.

Oracle Cloud Infrastructure Autonomous Database is based on Oracle Database, the world’s leading relational database management system. It leverages the features and capabilities of Oracle Database to provide a fully managed, self-driving, self-securing, and self-repairing database service6

The Universal Credits pricing model allows customers to use prepaid credits for any eligible cloud service. This gives customers the flexibility to switch between services or regions as needed without having to renegotiate contracts2

Oracle Dedicated Region Cloud @Customer is a fully managed cloud region that brings all Oracle Cloud Infrastructure services and Oracle Fusion Cloud Applications, including Oracle Autonomous Database and SaaS applications, to customer datacenters, starting from only $500K a month1

https://education.oracle.com/en/learning-paths/trackp_OCIF2023CA

Oracle Functions is a fully managed, multi-tenant, highly scalable, on-demand, Functions-as-a-Service platform. It is built on enterprise-grade Oracle Cloud Infrastructure and powered by the Fn Project open source engine. Use Oracle Functions (sometimes abbreviated to just Functions) when you want to focus on writing code to meet business needs.

The serverless and elastic architecture of Oracle Functions means there's no infrastructure administration or software administration for you to perform. You don't provision or maintain compute instances, and operating system software patches and upgrades are applied automatically. Oracle Functions simply ensures your app is highly-available, scalable, secure, and monitored. With Oracle Functions, you can write code in Java, Python, Node, Go, and Ruby (and for advanced use cases, bring your own Dockerfile, and Graal VM). You can then deploy your code, call it directly or trigger it in response to events, and get billed only for the resources consumed during the execution.

Oracle Functions is based on Fn Project. Fn Project is an open source, container native, serverless platform that can be run anywhere - any cloud or on-premises. Fn Project is easy to use, extensible, and performant. You can download and install the open source distribution of Fn Project, develop and test a function locally, and then use the same tooling to deploy that function to Oracle Functions.

You can access Oracle Functions using the Console, a CLI, and a REST API. You can invoke the functions you deploy to Oracle Functions using the CLI or by making signed HTTP requests.

Oracle Cloud Infrastructure File Storage service provides a durable, scalable, secure, enterprise-grade network file system. You can connect to a File Storage service file system from any bare metal, virtual machine, or container instance in your Virtual Cloud Network (VCN).

You can control the access of the file system from FSS by applying some security rules and others but the services it self not related to security but it related to shared storage

The following are capabilities of the OCI Data Catalog service:

• It provides a repository of searchable metadata. Data Catalog harvests metadata from data sources across the OCI ecosystem and on-premises to create an inventory of data assets. This helps data consumers easily find the data they need for analytics4.
• It enables enrichment of the metadata. Data Catalog allows users to add business metadata such as business terms, tags, custom properties, and annotations to data assets. This helps provide more insight and context into the data5.
• It can automate harvesting of data. Data Catalog supports on-demand or schedule-based automatic harvesting to ensure the data catalog always has up-to-date information4.

Autoscaling is an Oracle Cloud Infrastructure (OCI) compute feature that automatically adjusts the number of compute instances in an instance pool based on performance metrics such as CPU utilization. Autoscaling can help you match capacity to demand, while keeping the application up and running, and also saving cost. You can configure autoscaling policies to scale up or down the instance pool based on predefined thresholds or schedules

OCI logs are encrypted in three ways: in-flight, disk-level, and archive. OCI logs are encrypted in-flight, that is, while they are in the process of being ingested into OCI Logging; after the logs are in the system, they are encrypted with disk-level encryption for commercial environments; and logs are also encrypted when they are archived, and while in storage

Creating a manual cluster of compute instances, and Writing custom scripts that will monitor your solution are not valid ways to ensure fault tolerance at all. Also, Performing Data Integrity check when using OCI File Storage Service is not valid since OCI takes care of it.

Therefore, we are left with:

1) Using multiple OCI Availibility Domains (AD), where available, to deploy your solution - Which is excellent because we have multiple AD's so that if one fails, we have a backup AD!

2) Ensuring your solution components are distributed across OCI Fault Domains - So that we can protect our deployment against unexpected power failures, AD failure etc.

SLAs are Oracle’s commitments to specific aspects of OCI services, measured over a calendar month and expressed as monthly uptime percentages or monthly performance rates. Oracle is committed to providing the best-in-class service levels and believes that SLAs are key performance indicators for customers of cloud providers. Each OCI service has its own definition of service level. OCI offers competitive SLAs for more than 50 PaaS and IaaS public cloud services4

SLAs are defined as a number of nines for a month and a percentage credit. For example, Oracle NoSQL Database Cloud Service offers an availability SLA of 99.995%. If the monthly uptime percentage falls below 99.995%, but is equal to or greater than 99%, then the customer is eligible for a 10% credit for their spend for that service; if the monthly uptime percentage falls below 99%, but is equal to or greater than 95%, then the customer is eligible for a 25% credit; if the monthly uptime percentage falls below 95%, then the customer is eligible for a 100% credit4

SLAs are financially backed commitments to provide a minimum level of service to customers. If Oracle does not meet an SLA commitment in any given month during your subscription term (for example if your monthly uptime percentage falls below the specified threshold), then you may be eligible for a credit toward your future consumption of that service (for example 10%, 25%, or 100% depending on the severity of the breach). To receive this credit you must submit a claim within 30 days after the end of that month with supporting evidence as specified in the SLA policy document (for example screenshots or log files)4

• A compartment is a logical container that can hold OCI resources such as compute instances, block volumes, virtual cloud networks, etc. Compartments help you organize and control access to your resources based on business needs or security requirements3
• By default, your tenancy comes with a root compartment that is the parent of all other compartments in your tenancy. You cannot delete the root compartment, but you can create subcompartments within it to further organize your resources3
• Compartments can be used to logically separate OCI resources, not physically separate them. Resources within one compartment can interact with resources in other compartments, as long as the appropriate policies and network configurations are in place. For example, you can attach a compute instance in one compartment to a virtual cloud network in another compartment, or grant access to a user group in one compartment to manage resources in another compartment34

OCI leverages advanced encryption that leads to fast performance, OCI does not over subscribe CPU, but only memory, and OCI hypervisor provides industry leading performance are WRONG.

However, OCI does back claims with SLAs and offers predictable pricing for all services.

Resource Manager is an Oracle Cloud Infrastructure service that allows you to automate the process of provisioning your Oracle Cloud Infrastructure resources. Using Terraform, Resource Manager helps you install, configure, and manage resources through the "infrastructure-as-code" model.

A Terraform configuration codifies your infrastructure in declarative configuration files. Resource Manager allows you to share and manage infrastructure configurations and state files across multiple teams and platforms. This infrastructure management can't be done with local Terraform installations and Oracle Terraform modules alone. For more information about the Oracle Cloud Infrastructure Terraform provider, see Terraform Provider. For a general introduction to Terraform and the "infrastructure-as-code" model, see https://www.terraform.io .

The Oracle Cloud Infrastructure Load Balancing service provides automated traffic distribution from one entry point to multiple servers reachable from your virtual cloud network (VCN). The service offers a load balancer with your choice of a public or private IP address, and provisioned bandwidth.

A load balancer improves resource utilization, facilitates scaling, and helps ensure high availability. You can configure multiple load balancing policies and application-specific health checks

to ensure that the load balancer directs traffic only to healthy instances. The load balancer can reduce your maintenance window by draining traffic from an unhealthy application server before you remove it from service for maintenance.

HOW LOAD BALANCING WORKS:

The Load Balancing service enables you to create a public or private load balancer within your VCN. A public load balancer has a public IP address that is accessible from the internet. A private load balancer has an IP address from the hosting subnet, which is visible only within your VCN. You can configure multiple listeners

for an IP address to load balance transport Layer 4 and Layer 7 (TCP and HTTP) traffic. Both public and private load balancers can route data traffic to any backend server that is reachable from the VCN.

1) Public Load Balancer

To accept traffic from the internet, you create a public load balancer. The service assigns it a public IP address that serves as the entry point for incoming traffic. You can associate the public IP address with a friendly DNS name through any DNS vendor.

A public load balancer is regional in scope. If your region includes multiple availability domains, a public load balancer requires either a regional subnet (recommended) or two availability domain-specific (AD-specific) subnets, each in a separate availability domain. With a regional subnet, the Load Balancing service creates a primary load balancer and a standby load balancer, each in a different availability domain, to ensure accessibility even during an availability domain outage. If you create a load balancer in two AD-specific subnets, one subnet hosts the primary load balancer and the other hosts a standby load balancer. If the primary load balancer fails, the public IP address switches to the secondary load balancer. The service treats the two load balancers as equivalent and you cannot specify which one is "primary".

Whether you use regional or AD-specific subnets, each load balancer requires one private IP address from its host subnet. The Load Balancing service supplies a floating public IP address to the primary load balancer. The floating public IP address does not come from your backend subnets.

If your region includes only one availability domain, the service requires just one subnet, either regional or AD-specific, to host both the primary and standby load balancers. The primary and standby load balancers each require a private IP address from the host subnet, in addition to the assigned floating public IP address. If there is an availability domain outage, the load balancer has no failover.

2) Private Load Balancer

To isolate your load balancer from the internet and simplify your security posture, you can create a private load balancer. The Load Balancing service assigns it a private IP address that serves as the entry point for incoming traffic.

When you create a private load balancer, the service requires only one subnet to host both the primary and standby load balancers. The load balancer can be regional or AD-specific, depending on the scope of the host subnet. The load balancer is accessible only from within the VCN that contains the host subnet, or as further restricted by your security rules.

The assigned floating private IP address is local to the host subnet. The primary and standby load balancers each require an extra private IP address from the host subnet.

If there is an availability domain outage, a private load balancer created in a regional subnet within a multi-AD region provides failover capability. A private load balancer created in an AD-specific subnet, or in a regional subnet within a single availability domain region, has no failover capability in response to an availability domain outage.

There are two types of DB systems on virtual machines:

· A 1-node virtual machine DB system consists of one virtual machine.

· A 2-node virtual machine DB system consists of two virtual machines. (RAC)

A virtual machine DB system database uses Oracle Cloud Infrastructure block storage instead of local storage. You specify a storage size when you launch the DB system, and you can scale up the storage as needed at any time.

For 1-node virtual machine DB systems, Oracle Cloud Infrastructure provides have a "fast provisioning" option that allows you to create your DB system using Logical Volume Manager as your storage management software.

Oracle Cloud Infrastructure offers single-node DB systems on either bare metal or virtual machines, and 2-node RAC DB systems on virtual machines. If you need to provision a DB system for development or testing purposes, then a special fast provisioning single-node virtual machine system is available.

You can manage these systems by using the Console, the API, the Oracle Cloud Infrastructure CLI, the Database CLI (DBCLI), Enterprise Manager, Enterprise Manager Express, or SQL Developer.

The cost of running a virtual machine instance in Oracle Cloud Infrastructure depends on several factors, such as the size, shape, region, and operating system of the instance. The number of virtual machines running does not impact the cost of each individual instance1

You can open a support service request with Oracle Support

To create a service request:

Go to My Oracle Support and sign in.

If you are not signed in to Oracle Cloud Support, click Switch to Cloud Support at the top of the page.

Click Create Service Request.

Select the following from the displayed menus:

Service Type: Select Oracle Cloud Infrastructure from the list.

Service Name: Select the appropriate option for your organization.

Problem Type: Select your problem type from the list.

Enter your contact information.

Enter a Description, and then enter the required fields specific to your issue. For most Oracle Cloud Infrastructure issues you need to include the OCID (Oracle Cloud Identifier) for each resource you need help with. See Locating Oracle Cloud Infrastructure IDs for instructions on locating these.

• Master encryption keys are keys that are stored and managed by the Vault service. They are used to encrypt or decrypt data encryption keys or other secrets stored in the Vault service7
• Data encryption keys are keys that are generated by the Vault service and used to encrypt or decrypt data outside of the Vault service, such as data in Object Storage or Block Volume. Data encryption keys are themselves encrypted by master encryption keys and returned to the user as ciphertext

Oracle Data Safe is a unified control center for your Oracle databases which helps you understand the sensitivity of your data, evaluate risks to data, mask sensitive data, implement and monitor security controls, assess user security, monitor user activity, and address data security compliance requirements.

Whether you’re using an Autonomous Database or an Oracle DB system, Oracle Data Safe delivers essential data security capabilities as a service on Oracle Cloud Infrastructure.

Oracle Cloud Infrastructure Container Engine for Kubernetes is a fully-managed, scalable, and highly available service that you can use to deploy your containerized applications to the cloud. Use Container Engine for Kubernetes (sometimes abbreviated to just OKE) when your development team wants to reliably build, deploy, and manage cloud-native applications. You specify the compute resources that your applications require, and Container Engine for Kubernetes provisions them on Oracle Cloud Infrastructure in an existing OCI tenancy.

You can access Container Engine for Kubernetes to define and create Kubernetes clusters using the Console and the REST API. You can access the clusters you create using the Kubernetes command line (kubectl), the Kubernetes Dashboard, and the Kubernetes API.

Container Engine for Kubernetes is integrated with Oracle Cloud Infrastructure Identity and Access Management (IAM), which provides easy authentication with native Oracle Cloud Infrastructure identity functionality.