1Z0-1072-25 Question 269
Single answerYou are configuring Oracle Cloud Infrastructure (OCI) File Storage for a new analytics platform handling highly sensitive data. You want to ensure data is encrypted at rest and that only analytics compute instances in your private subnet can access the file system. Which approach follows OCI best practices to secure the File Storage resource?
- A
Rely on default encryption and configure export rules to allow traffic only from your analytics subnet.
- B
Disable encryption for performance gain and place the file system behind a public load balancer.
- C
Create an IAM policy to grant access to 'Any user in the tenancy' and open port 2048 in the VCN security list.
- D
Use a public IP for the export endpoint and rely on default compartment-level isolation for access control.
Show answer and explanation
Correct answer: A
Explanation
Oracle Cloud Infrastructure File Storage encrypts data at rest by default, and it� a best practice to further control access by limiting NFS mounts to specific private subnets or IP addresses using export rules. The combination of encryption at rest and restricting network access to trusted sources ensures robust security for sensitive workloads. Refer to OCI File Storage documentation for details on configuring export options, network security, and optional integration with OCI Vault if you need to use customer-managed encryption keys.
- A. Correct.
Correct. OCI File Storage encrypts data at rest by default, and limiting NFS access to specific private subnets through export rules ensures that only authorized compute instances in your analytics subnet can mount and access the file system.
- B. Incorrect.
Incorrect. Disabling encryption is not recommended for sensitive data. Additionally, placing the file system behind a public load balancer would expose it unnecessarily and increase the risk of unauthorized access.
- C. Incorrect.
Incorrect. Granting overly broad access through IAM policies and opening ports widely in the security list can compromise security. You must restrict both network traffic and IAM permissions more narrowly.
- D. Incorrect.
Incorrect. Using a public IP for the mount endpoint exposes the file system to external traffic. Relying solely on compartment-level isolation is insufficient to protect sensitive data from potential unauthorized access.