OCI Security Lab: Compartments, IAM and Cloud Guard

It teaches how to put structure and guardrails into an Oracle Cloud Infrastructure tenancy: compartments that follow the business, a small Administrators group, federated sign-in with MFA, policies scoped to compartments and resource types, dynamic groups instead of stored keys, Cloud Guard for detection, Security Zones as a hard boundary, network security groups, private subnets with Bastion, Vault keys, private buckets and Audit review.

Oracle describes IAM policies as granting permission to manage resources, while security zone policies deny non-compliant actions regardless of which user performs them and do not grant anything. You need both: IAM decides who may act, and a zone decides what configurations are allowed in a compartment.

Oracle recommends network security groups, because they separate the subnet architecture from application security requirements, and says it prioritizes them for future enhancements. If you use both, the rules that apply to a VNIC are the union of the two. The lab scores NSGs with an NSG as the rule source above opening address ranges.

Oracle states that anonymous access lets any user obtain object metadata and download objects, and recommends pre-authenticated requests instead because they support expiry and scoping. Buckets in a security zone cannot be public. The lab scores a scoped, expiring request above a public bucket.

No. It is a decision lab based on Oracle documentation. For a self-assessment across domains use the OCI Security Checklist, and for the authoritative control list use the CIS Oracle Cloud Infrastructure Foundations Benchmark itself.