1Z0-1104-25 Question 1
Select 3Your organization is migrating its financial application to Oracle Cloud Infrastructure (OCI) and has created separate compartments for development, testing, and production. As the security engineer, you want to ensure compliance with OCI� shared responsibility model. Which of the following tasks do you need to handle as the customer to maintain a secure environment?
- A
Managing security lists and network security group rules for compute subnets
- B
Applying operating system patches and updates on your compute instances
- C
Overseeing physical security controls at OCI� data centers
- D
Enforcing compartment-based IAM policies to restrict user access
- E
Relying on automatic block volume encryption at rest provided by OCI, requiring no further action
Show answer and explanation
Correct answers: A, B, D
Explanation
In OCI� shared responsibility model, Oracle secures the underlying cloud infrastructure (e.g., physical servers, facilities, and hypervisors), while customers remain responsible for tasks such as configuring access controls, applying patches, and managing IAM policies in their tenancies. For more details, refer to the OCI documentation on 'Security in OCI' and the 'Shared Security Model' guidelines.
- A. Correct.
Managing security lists and network security group rules is the customer� responsibility, as you must configure network-based access controls to prevent unauthorized traffic to your instances. This is part of the �security in the cloud� under OCI� shared responsibility model.
- B. Correct.
Applying operating system patches and updates on your compute instances is a key customer responsibility, since Oracle manages the underlying infrastructure but not the guest OS. You control how frequently and when your servers are patched.
- C. Incorrect.
Overseeing physical security controls at OCI� data centers is Oracle� responsibility. Oracle manages data center physical security such as surveillance, access control, and facility hardening under the �security of the cloud� portion.
- D. Correct.
Enforcing compartment-based IAM policies is the customer� responsibility. Configuring appropriate IAM policies ensures the right users or groups have sufficient, but not excessive, privileges in each compartment.
- E. Incorrect.
While OCI automatically encrypts block volumes at rest, as a customer you do not need to take extra steps to enable this feature by default. However, creation and rotation of your own customer-managed keys (if you choose to go beyond default encryption) is an additional optional responsibility.