1Z0-1104-25 exam dumps: questions 101 to 174 of 174

Correct answer: A

• A. Correct.

  Option 1 is correct. OCI Bastion supports creating Managed SSH sessions with time-bound settings, typically up to a few hours. Once the configured session lifetime (TTL) ends, the session is automatically terminated, fulfilling the requirement for time-limited access.

• B. Incorrect.

  Option 2 is incorrect because granting direct SSH key access bypasses OCI Bastion� time-based restrictions. This approach cannot enforce short-lived sessions and introduces persistent access, which violates the security requirement.

• C. Incorrect.

  Option 3 is incorrect because it relies on manual enforcement. If users forget to terminate a session, it remains open indefinitely, negating the objective of enforcing time-limited access via Bastion� built-in TTL controls.

• D. Incorrect.

  Option 4 is incorrect because deploying a dedicated Bastion compute instance and relying on external scripts is more complicated, error-prone, and does not leverage the built-in time-limited session mechanism provided by OCI Bastion� Managed SSH sessions.

Correct answers: A, D

• A. Correct.

  Option 1: Correct. Specifying a maximum session TTL (like two hours) when creating a bastion session and using ephemeral SSH credentials is a best practice for time-limited access. Bastion automatically handles the session lifecycle and terminates the session once the TTL is reached.

• B. Incorrect.

  Option 2: Incorrect. While attaching a policy that allows 'bastion usage' is necessary, relying on the contractor's personal SSH key for unlimited ongoing connections does not enforce time-limited access by itself. You must configure the session through Bastion to ensure automatic expiration.

• C. Incorrect.

  Option 3: Incorrect. Installing a dynamic key on the compute instance itself and retaining it for auditing does not use OCI Bastion� built-in session termination. The contractor could potentially continue using the key beyond the intended timeframe if not manually revoked.

• D. Correct.

  Option 4: Correct. Using the Oracle-managed ephemeral key feature (provided as part of Bastion) allows you to specify a predetermined session duration (two hours) and limit access by source IP. This enforces both the time limit and tightens network restrictions.

Correct answer: B

• A. Incorrect.

  Incorrect. Oracle Cloud Guard focuses on security posture management and detection of suspicious activities. It does not automatically perform comprehensive vulnerability scans on container images or compute instances without additional services.

• B. Correct.

  Correct. OCI Vulnerability Scanning service supports both host scanning and container image scanning. It can be configured to run scheduled scans and to identify newly discovered vulnerabilities, making it an appropriate solution to meet the requirement.

• C. Incorrect.

  Incorrect. While Oracle Linux updates can help with package-level updates, they do not provide a full solution for scanning container images or proactively identifying new vulnerabilities as they appear for all system components.

• D. Incorrect.

  Incorrect. While custom scripts might help manage some vulnerabilities, this approach is labor-intensive, error-prone, and does not provide a single dashboard to track container image vulnerabilities. It also lacks direct integration with OCI services for automated scanning.

Correct answers: A, B

• A. Correct.

  Option 1 is correct. Configuring a Vulnerability Scanning target for your compartment ensures OCI will regularly scan the associated Compute instances for known security vulnerabilities. You can define the scope for scanning by compartment or subnet, and schedule scans as needed.

• B. Correct.

  Option 2 is correct. To scan newly pushed container images, you must create a separate target for container images in the OCI Container Registry. This allows OCI Vulnerability Scanning to identify CVEs in images before they are deployed to production.

• C. Incorrect.

  Option 3 is incorrect. Disabling OS Management is not required�nor recommended�for Vulnerability Scanning. The service can function regardless of the OS Management service status, and disabling OS Management can remove useful patching and update features.

• D. Incorrect.

  Option 4 is incorrect. While you can create alarms or automated responses, it is not sufficient by itself to set up a custom metric alarm for vulnerability remediation. A separate scanning target is still required for the scanning process itself.

• E. Incorrect.

  Option 5 is incorrect. A Block Volume backup policy ensures data durability but does not enable or configure vulnerability scanning for hosts or container images. Vulnerability Scanning is managed through the Vulnerability Scanning service targets.

Correct answer: B

• A. Incorrect.

  Option 1 is incorrect. Manually analyzing logs is time-consuming and prone to oversights, and it does not leverage OCI� built-in vulnerability scanning. While monitoring logs is important, it does not replace automated vulnerability scanning for hosts or container images.

• B. Correct.

  Option 2 is correct. OCI Vulnerability Scanning Service can be configured to run scheduled scans for both Compute instances (host scanning) and container images in the Oracle Container Registry. This provides comprehensive visibility of vulnerabilities before they become critical issues.

• C. Incorrect.

  Option 3 is incorrect. Deploying WAF is primarily for protecting web applications from malicious traffic; it does not offer container image scanning or deep host-level scanning for vulnerabilities. WAF and vulnerability scanning are complementary but serve different security needs.

• D. Incorrect.

  Option 4 is incorrect. Enabling block volume encryption ensures data at rest is protected but does not perform vulnerability scans on hosts or container images. Encryption addresses data confidentiality rather than vulnerability detection.