OracleProfessional level1Z0-1104-25

1Z0-1104-25 exam dumps: 174 free OCI 2025 Security Professional practice questions

Free 1Z0-1104-25 practice questions for the Oracle Cloud Infrastructure 2025 Security Professional exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 174 by number, or take a timed practice exam.

Question bank last updated May 2025

Start timed practice exam Browse all 174 questions

Free 1Z0-1104-25 practice questions

Questions 1 to 10 of 174

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

1Z0-1104-25 Question 1

Select 3

Your organization is migrating its financial application to Oracle Cloud Infrastructure (OCI) and has created separate compartments for development, testing, and production. As the security engineer, you want to ensure compliance with OCI� shared responsibility model. Which of the following tasks do you need to handle as the customer to maintain a secure environment?

A
Managing security lists and network security group rules for compute subnets
B
Applying operating system patches and updates on your compute instances
C
Overseeing physical security controls at OCI� data centers
D
Enforcing compartment-based IAM policies to restrict user access
E
Relying on automatic block volume encryption at rest provided by OCI, requiring no further action

Show answer and explanation

Correct answers: A, B, D

Explanation

In OCI� shared responsibility model, Oracle secures the underlying cloud infrastructure (e.g., physical servers, facilities, and hypervisors), while customers remain responsible for tasks such as configuring access controls, applying patches, and managing IAM policies in their tenancies. For more details, refer to the OCI documentation on 'Security in OCI' and the 'Shared Security Model' guidelines.

A. Correct.
Managing security lists and network security group rules is the customer� responsibility, as you must configure network-based access controls to prevent unauthorized traffic to your instances. This is part of the �security in the cloud� under OCI� shared responsibility model.
B. Correct.
Applying operating system patches and updates on your compute instances is a key customer responsibility, since Oracle manages the underlying infrastructure but not the guest OS. You control how frequently and when your servers are patched.
C. Incorrect.
Overseeing physical security controls at OCI� data centers is Oracle� responsibility. Oracle manages data center physical security such as surveillance, access control, and facility hardening under the �security of the cloud� portion.
D. Correct.
Enforcing compartment-based IAM policies is the customer� responsibility. Configuring appropriate IAM policies ensures the right users or groups have sufficient, but not excessive, privileges in each compartment.
E. Incorrect.
While OCI automatically encrypts block volumes at rest, as a customer you do not need to take extra steps to enable this feature by default. However, creation and rotation of your own customer-managed keys (if you choose to go beyond default encryption) is an additional optional responsibility.

1Z0-1104-25 Question 2

Select 2

Your organization has discovered that certain Object Storage buckets in OCI are publicly accessible and some network security rules are overly permissive. The security team wants a solution that continuously detects misconfigurations and can automatically remediate them. Which TWO OCI services can you combine to achieve both real-time visibility and automated corrective actions for these security issues?

A
Cloud Guard
B
Data Safe
C
Security Zones
D
Vault
E
Vulnerability Scanning Service

Show answer and explanation

Correct answers: A, C

Explanation

Cloud Guard provides continuous security monitoring and automated remediation via responder rules, making it an excellent choice for detecting and resolving issues like publicly exposed buckets or permissive network rules. Security Zones enforce secure configurations from the start, blocking high-risk actions in designated compartments. Together, these two services address real-time detection, enforcement, and auto-remediation of misconfigurations. Refer to Oracle� Cloud Guard and Security Zones documentation for best practices and configuration details.

A. Correct.
Cloud Guard is correct because it monitors resources continuously for security risks and can automate remediation through responder rules, making it ideal for detecting and fixing exposed buckets or permissive security rules.
B. Incorrect.
Data Safe is incorrect because it primarily focuses on database security features like user assessment, data discovery, and activity auditing. It does not provide the continuous infrastructure misconfiguration detection and automated remediation you need for Object Storage buckets or network security configurations.
C. Correct.
Security Zones is correct because it enforces security best practices from the outset. If a compartment is designated as a Security Zone, OCI prevents many misconfigurations (such as creating a public bucket) from ever happening. Used together with Cloud Guard, you get both enforcement and real-time detection/remediation.
D. Incorrect.
Vault is incorrect because it provides centralized key management and supports data encryption, but it does not continuously monitor or remediate misconfigurations in OCI resources.
E. Incorrect.
Vulnerability Scanning Service is incorrect because it focuses on scanning compute instances and load balancers for known vulnerabilities and open ports, rather than misconfigured Object Storage buckets or overly permissive network rules.

1Z0-1104-25 Question 3

Select 2

Your organization is migrating critical workloads to Oracle Cloud Infrastructure (OCI). You have been tasked with setting up the initial security configuration to align with the principle of least privilege. Which two actions should you prioritize to ensure that users only have access to the resources they need and to reduce the overall attack surface?

A
Create a single compartment for all resources and assign broad administrative privileges to administrators for easier maintenance
B
Organize resources into multiple compartments based on different functional or environment-specific requirements
C
Define and apply IAM policies that grant each user group only the permissions necessary to perform their tasks
D
Enable all advanced security features like Web Application Firewall (WAF) and Bastion by default, regardless of the environment� actual requirements

Show answer and explanation

Correct answers: B, C

Explanation

Implementing compartments and defining targeted IAM policies from the outset aligns with OCI best practices for least privilege. By segmenting resources and granting minimal but sufficient permissions, you reduce the potential blast radius of any security breach. Oracle� documentation emphasizes compartmentalization and precise policy management to maintain strong oversight of resource access while avoiding unnecessary privileges.

A. Incorrect.
Incorrect. Consolidating all resources into a single compartment and assigning broad privileges contradicts the principle of least privilege. This approach increases the risk of unauthorized access if an administrator account is compromised, as it potentially grants them control over all resources.
B. Correct.
Correct. Configuring separate compartments for different functional or environment-specific groups (e.g., Production, Development, Finance) is a best practice. Compartments help segment resources, allowing security boundaries to be properly enforced through policies.
C. Correct.
Correct. IAM policies control who can access which resources and how. By granting only the necessary privileges to each group, you reduce the risk of accidental or malicious activity on resources outside a team� scope.
D. Incorrect.
Incorrect. While enabling security features like WAF or Bastion when appropriate is important, turning them on indiscriminately without evaluating specific requirements can lead to unnecessary costs and complexity. Not all environments require every advanced security feature by default.

1Z0-1104-25 Question 4

Select 2

An organization discovers that a developer inadvertently has broad access to resources across multiple OCI compartments. To adhere to the principle of least privilege and properly isolate sensitive workloads, which two actions should the security administrator take going forward?

A
Create and maintain separate compartments for each environment or team to isolate resources
B
Grant tenancy-wide policy permissions to all resources for faster development
C
Restrict IAM policies to ensure only the required groups or roles can access each compartment
D
Use Oracle Cloud Infrastructure Logging to track and block all access attempts

Show answer and explanation

Correct answers: A, C

Explanation

In OCI, maintaining separate compartments and using narrowly scoped IAM policies are fundamental steps in implementing least privilege. Compartments logically group resources, while policies specify precisely who can access them. Refer to Oracle documentation on 'OCI Compartments and IAM Policies Best Practices' for more guidance on defining appropriate access boundaries.

A. Correct.
Correct. Compartmentalizing resources according to environment or team helps maintain strict boundaries and enforces the principle of least privilege by minimizing unnecessary access.
B. Incorrect.
Incorrect. Tenancy-wide policy permissions are too broad and contradict least-privilege principles. It allows access beyond what is required for specific tasks.
C. Correct.
Correct. Granular IAM policies that grant privileges only to the necessary compartments and resources ensure that users cannot access data or services beyond their role requirements.
D. Incorrect.
Incorrect. Logging provides detailed records of system events and user actions, but it does not inherently block or limit access. It is primarily used for auditing and troubleshooting, not for controlling resource isolation.

1Z0-1104-25 Question 5

Single answer

You have created multiple compartments to isolate resources for different teams in your OCI tenancy. You want to grant a new developer permission to create and manage Compute resources only in the 'Development' compartment while restricting them to read-only access to logs in a separate 'Logging' compartment. Which solution best enforces the principle of least privilege in this scenario?

A
Create a single group for all developers and grant it full administrative access to every compartment.
B
Place the developer in a dedicated group and write an IAM policy that allows 'manage' on Compute in the Development compartment and 'read' on logs in the Logging compartment.
C
Add the developer directly to the Administrators group, granting them global administrative privileges across all resources.
D
Create a dynamic group based on the developer's user credentials and grant that group full permissions on the Development and Logging compartments.

Show answer and explanation

Correct answer: B

Explanation

In OCI, best practices recommend using the principle of least privilege by assigning narrowly scoped policies to groups. By creating a group specifically for the developer and writing an IAM policy with compartment-scoped permissions, you ensure they can only perform the required actions (manage Compute in Development, read logs in Logging). Reference: Oracle Cloud Infrastructure Documentation � Identity and Access Management Best Practices.

A. Incorrect.
Incorrect. Granting full administrative access to every compartment violates least privilege and unnecessarily broadens access.
B. Correct.
Correct. Creating a dedicated group and applying an IAM policy that grants only the necessary permissions to specific compartments aligns with the principle of least privilege.
C. Incorrect.
Incorrect. Adding a user to the Administrators group gives universal permissions, which exceeds minimal required privileges and poses security risks.
D. Incorrect.
Incorrect. While dynamic groups can be used to grant access based on conditions, giving full permissions to both compartments also violates the principle of least privilege.

1Z0-1104-25 Question 6

Single answer

Your organization recently migrated its on-premises finance, HR, and marketing systems to Oracle Cloud Infrastructure (OCI). Each department wants to maintain control over its own resources without interfering with one another. As a Security Professional, you need to design the best logical isolation strategy from the start. Which approach should you recommend first to achieve this requirement?

A
Assign each department to an entirely separate Identity Domain and rely on cross-domain trust for collaboration.
B
Create separate compartments for each department and apply relevant IAM policies to those compartments.
C
Use a single compartment but rely on detailed Object Storage bucket policies to limit inter-departmental access.
D
Grant each department member the Administrator role so they can manage only their own resources.

Show answer and explanation

Correct answer: B

Explanation

OCI recommends using compartments as the primary mechanism to separate and manage resources logically. By placing each department� resources in its own compartment and applying least-privilege IAM policies, you align with Oracle� best practices for secure deployment. Refer to the Oracle Cloud Infrastructure documentation on 'Managing Compartments' and 'Identity and Access Management' for more details on creating a scalable and secure multi-compartment design.

A. Incorrect.
Option 1: Assigning each department to its own Identity Domain can work in certain scenarios, but it is typically more complex to manage and not necessary for simple departmental isolation. Compartments are the recommended first layer of resource isolation in OCI.
B. Correct.
Option 2: Creating separate compartments for each department and applying IAM policies to those compartments is the fundamental best practice for logical isolation in OCI. This ensures each department controls access to its resources without cross-department conflicts. (Correct)
C. Incorrect.
Option 3: Using a single compartment and relying on Object Storage bucket policies alone does not provide broad resource isolation. While bucket policies can limit storage access, they don�t address overall compartment-level security and governance needs.
D. Incorrect.
Option 4: Granting everyone Administrator privileges for self-management contradicts the least-privilege principle and could easily lead to misconfigurations or security breaches. Roles should be scoped to specific resources and tasks instead.

1Z0-1104-25 Question 7

Single answer

Your financial services company is migrating a critical HR application to an Oracle Cloud Infrastructure (OCI) Compute instance. You need to ensure the environment meets strict regulatory requirements for data security, patches, and access controls. According to the OCI Shared Security Responsibility model, which statement best reflects your responsibilities versus Oracle� responsibilities?

A
A) Oracle handles all aspects of data security, including operating system patching and encryption within the guest operating system.
B
B) Your team is responsible for configuring and maintaining the guest operating system, applying application-level patches, and managing data encryption, while Oracle secures the underlying physical and virtual infrastructure.
C
C) Oracle covers application-level security controls and user access management, and your team only needs to manage network firewall and traffic filtering rules.
D
D) You are only required to manage authentication for users logging into OCI. Oracle implements all other security controls, including encryption and compliance.

Show answer and explanation

Correct answer: B

Explanation

The OCI Shared Security Responsibility model clearly divides duties: Oracle secures the underlying infrastructure (hardware, network, hypervisor, and physical data centers), while the customer is accountable for the security of their own instances, operating systems, application software, and data. For more details, refer to Oracle� official documentation on Shared Security Responsibility, which outlines the boundaries between Oracle� responsibilities and those of the customer (e.g., OS-level patching, encryption management, and application configuration).

A. Incorrect.
Option A: Incorrect. While Oracle manages security of the underlying physical infrastructure and cloud services, customers must still patch and secure the operating system and configure encryption within their own instances. It is a misconception to assume Oracle covers all aspects of data security.
B. Correct.
Option B: Correct. Under the Shared Security Responsibility model, Oracle is responsible for the physical data centers, network, and hypervisor layers, while customers are responsible for what runs on top of those layers, including guest OS patching, application security, and data protection controls.
C. Incorrect.
Option C: Incorrect. Customers manage not only network firewall rules but also operating system security and application patches. Oracle does not assume responsibility for application-level security in the customer� environment.
D. Incorrect.
Option D: Incorrect. This suggests that the customer has almost no responsibilities beyond authentication, which is not accurate. Customers also handle OS-level patching, data encryption, and compliance tasks within their tenant� scope.

1Z0-1104-25 Question 8

Select 2

Your healthcare organization is migrating a patient management system to Oracle Cloud Infrastructure (OCI). As part of the shared security responsibility model, which responsibilities specifically fall under your organization� role to ensure the environment remains protected?

A
Setting up and maintaining physical security controls at Oracle� data centers
B
Controlling and managing IAM policies for users and groups in your OCI tenancy
C
Deploying security patches to the underlying hypervisor that hosts your instances
D
Implementing and maintaining OS-level patches and configurations within your compute instances

Show answer and explanation

Correct answers: B, D

Explanation

In OCI� shared security responsibility model, Oracle secures the underlying infrastructure�including physical data centers, hardware, and the hypervisor. Customers are responsible for securing their applications, data, OS patches, and IAM policies. For details, refer to Oracle documentation on the Shared Security Responsibility Model and best practices for infrastructure security in OCI.

A. Incorrect.
Option 1: Incorrect. Physical security of OCI data centers is Oracle� responsibility. They manage locks, surveillance, and restricted access at the data center level.
B. Correct.
Option 2: Correct. You are responsible for configuring and enforcing Identity and Access Management (IAM) policies for your resources, ensuring correct privilege assignments and secure authentication methods.
C. Incorrect.
Option 3: Incorrect. Oracle is responsible for applying patches to the underlying hypervisor and virtualization layers. As a customer, you only manage responsibilities starting at the operating system level and above (for IaaS).
D. Correct.
Option 4: Correct. Managing and regularly updating OS patches, antivirus software, and other configurations within your instances is part of the customer� responsibilities in OCI.

1Z0-1104-25 Question 9

Select 2

Your organization is migrating a mission-critical workload to an OCI Compute instance. The leadership team is uncertain about who is responsible for operating system patching, data encryption at rest, security of the physical infrastructure, and user access management. According to the OCI Shared Security Responsibility model, which two tasks are typically the customer� responsibility in this scenario?

A
Patching the operating system on the compute instance
B
Securing the physical hardware in the OCI data center
C
Managing user access and credentials
D
Maintaining the underlying virtualization layer

Show answer and explanation

Correct answers: A, C

Explanation

Under OCI� Shared Security Responsibility model, Oracle secures the underlying infrastructure (data centers, hardware, network, and virtualization). Customers are responsible for securing their workloads, including operating system patches, IAM components, data configurations, and application-level security. Refer to OCI documentation at https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm for more details.

A. Correct.
Correct. In an IaaS model on OCI, customers are responsible for maintaining and patching the operating system on their compute instances.
B. Incorrect.
Incorrect. Oracle is responsible for securing the physical hardware, including data centers and network infrastructure.
C. Correct.
Correct. Managing users, permissions, and credentials is the customer� responsibility, including creating and managing IAM policies, groups, and roles.
D. Incorrect.
Incorrect. Oracle manages the underlying virtualization layer that supports compute instances.

1Z0-1104-25 Question 10

Single answer

Your e-commerce company is deploying a customer-facing application on Oracle Cloud Infrastructure (OCI). During a security review, your team is uncertain about which security tasks they must handle versus those that Oracle handles. Under the OCI Shared Security Responsibility model, which of the following tasks is the customer responsible for?

A
Ensuring physical security at the OCI data centers
B
Managing and rotating user credentials within the OCI environment
C
Maintaining and updating OCI� underlying hypervisor layer
D
Providing uninterrupted power and network infrastructure at OCI facilities

Show answer and explanation

Correct answer: B

Explanation

In the OCI Shared Security Responsibility model, Oracle is responsible for the infrastructure, including the physical data center security, underlying network, and hypervisor. Customers, however, are responsible for securing their own workloads, data, and the configurations within their OCI tenancy. This includes managing user credentials, applying OS and application-level patches, and enforcing strong identity and access management policies. Refer to the official Oracle Cloud Infrastructure Security documentation (https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_overview.htm) for detailed guidance on each party� responsibilities.

A. Incorrect.
Incorrect. Oracle manages physical security at its data centers, including entry controls and on-premises security. Customers generally have no control or responsibilities in this area.
B. Correct.
Correct. Under the shared responsibility model, customers must manage credentials, implement strong password policies, and perform periodic key rotations or secret management for their users in the OCI environment.
C. Incorrect.
Incorrect. Oracle manages and patches the underlying hypervisor for its compute infrastructure. Customers do not maintain or update the hypervisor or other infrastructure layers.
D. Incorrect.
Incorrect. Oracle is responsible for the physical infrastructure, power, and network connectivity at its data centers. Customers do not handle these aspects.

Timed practice exam

Take a 1Z0-1104-25 practice test under exam conditions

70 questions in 90 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the 1Z0-1104-25 exam covers

Official Oracle Cloud Infrastructure 2025 Security Professional exam domains and weightings.

Identity and Access Management
25% of exam
Network Security
25% of exam
Data Protection and Encryption
25% of exam
Security Monitoring and Compliance
25% of exam

All 174 1Z0-1104-25 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

1Z0-1104-25 exam dumps FAQ

Are these 1Z0-1104-25 dumps real exam questions?

No. These are original practice questions written to the Oracle Cloud Infrastructure 2025 Security Professional exam objectives, not questions copied from a live exam. Memorising leaked questions violates Oracle's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many 1Z0-1104-25 practice questions are there?

174 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the 1Z0-1104-25 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed 1Z0-1104-25 practice test?

Sign in and start the Oracle Cloud Infrastructure 2025 Security Professional exam on HydraNode. A session gives you 70 questions drawn from this bank in 90 minutes, then a score report with a per-question review.

What topics does the 1Z0-1104-25 exam cover?

The official exam domains are: Identity and Access Management; Network Security; Data Protection and Encryption; Security Monitoring and Compliance.

More Oracle exam dumps

All Oracle exams

1Z0-1123-25150 questions

OCI 2025 Migration Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Migration Architect Professional

1Z0-184-25182 questions

Oracle AI Vector Search Professional exam dumps

Oracle AI Vector Search Professional

1Z0-1072-25318 questions

OCI 2025 Architect Associate exam dumps

Oracle Cloud Infrastructure 2025 Architect Associate

1Z0-997-25175 questions

OCI 2025 Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Architect Professional

1Z0-1067-25138 questions

OCI 2025 Cloud Operations Professional exam dumps

Oracle Cloud Infrastructure 2025 Cloud Ops Professional

1Z0-1151-25133 questions

OCI 2025 Multicloud Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Multicloud Architect Professional