1Z0-1072-25 Question 179
Single answerYou manage a web application in Oracle Cloud Infrastructure that is suddenly experiencing suspicious inbound traffic. You decide to deploy a Virtual Test Access Point (vTAP) on the application� instance to mirror only traffic on ports 80 and 443 to a network monitoring tool for analysis. Which configuration must you implement to accomplish this while minimizing extraneous data collection?
- A
A) Create a vTAP associated with the instance� VNIC and apply a capture filter specifying inbound TCP and port numbers 80, 443.
- B
B) Create two separate vTAPs on the subnet and leave the capture filter undefined to collect all inbound traffic across the subnet.
- C
C) Create a vTAP at the regional level and apply an egress capture filter listing all well-known ports, then rely on the network monitoring tool to filter inbound traffic on ports 80 and 443.
- D
D) Create a vTAP associated with the instance� VNIC, but configure the capture filter to match all inbound and outbound UDP traffic on ports 80, 443 for broad coverage.
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure, to narrow traffic collection and reduce unnecessary data, you create a vTAP on the specific instance VNIC you want to monitor. You then apply a capture filter that explicitly defines the protocol(s) and port(s) you intend to analyze. For web traffic, focusing on inbound TCP ports 80 and 443 ensures you capture relevant HTTP/HTTPS data. For more details, refer to the OCI documentation on creating vTAPs (Virtual Test Access Points) and configuring capture filters to refine traffic mirroring in a cost-effective, targeted manner.
- A. Correct.
A) Correct. Associating the vTAP directly with the instance� VNIC targets the exact traffic source. By applying a capture filter for TCP ports 80 and 443, you ensure only inbound HTTP/HTTPS traffic is mirrored, minimizing overhead.
- B. Incorrect.
B) Incorrect. Deploying multiple vTAPs on the entire subnet without a capture filter generates excessive data from all instances and all ports. This approach does not isolate traffic to ports 80 and 443, nor does it minimize overhead.
- C. Incorrect.
C) Incorrect. vTAP cannot be created at a regional level to capture all traffic system-wide. Additionally, specifying capture filters to include all well-known ports defeats the purpose of targeted traffic analysis for ports 80 and 443 and substantially increases overhead.
- D. Incorrect.
D) Incorrect. Configuring the capture filter for UDP on ports 80 and 443 does not help analyze standard HTTP/HTTPS traffic, which primarily uses TCP. This option mistakenly selects the wrong protocol and does not minimize extraneous capture data.