1Z0-1104-25 Question 100
Single answerYou are setting up OCI Bastion to grant a contractor short-term SSH access to a private compute instance for troubleshooting. The contractor must have access only for two hours, after which the session should be automatically invalidated. Which action must you perform to ensure this requirement is met?
- A
Create a policy statement in IAM that dynamically revokes the contractor� privileges after two hours
- B
Use OCI Bastion to generate an ephemeral SSH key pair and configure a maximum session TTL of two hours
- C
Configure a separate VCN security list to allow the contractor� IP address and specify a two-hour timeout
- D
Enable Remote Peering with the contractor� on-premises network and rely on the firewall to close the session
Show answer and explanation
Correct answer: B
Explanation
OCI Bastion provides ephemeral sessions that let you define a maximum session time (TTL). When you create a Bastion session, you generate an ephemeral SSH key pair and specify how long the session is valid. After that duration, the session automatically expires, preventing further access. Refer to OCI Documentation on 'Using Bastion to Access Private Resources' for specific steps on setting session TTL and ephemeral key configuration.
- A. Incorrect.
Incorrect: IAM policy statements control access but do not provide the auto-expiration of an in-progress Bastion session. Policies do not shorten an existing session automatically once it is established.
- B. Correct.
Correct: OCI Bastion supports ephemeral SSH key pairs with a configurable session TTL, ensuring the session automatically terminates when the time is up. This is the recommended approach for time-limited access.
- C. Incorrect.
Incorrect: Security lists in the VCN define network-level access rules but cannot force the closure of an active SSH session after a designated duration. They do not provide session-level behavior.
- D. Incorrect.
Incorrect: Remote Peering is used for connecting two VCNs across regions or tenancies. It does not manage or limit the session time for Bastion-based SSH connections.