1Z0-1104-25 Question 101
Single answerYour organization needs to provide a remote maintenance team with intermittent SSH access to a private Linux host. The security requirement is that each SSH session remains active only for a limited time and does not allow ongoing or persistent connections. How should you implement this using OCI Bastion to ensure time-limited access?
- A
Use OCI Bastion to create a Managed SSH session with a specified session lifetime, allowing the session to expire automatically.
- B
Configure an IAM policy for the maintenance team granting direct SSH key access to the private host indefinitely to reduce overhead.
- C
Create a Bastion session set to �unlimited duration� but require the team to manually terminate the session after use.
- D
Deploy a separate dedicated Bastion compute instance and configure manual cron jobs to kill idle sessions every 24 hours.
Show answer and explanation
Correct answer: A
Explanation
OCI Bastion offers managed and short-lived SSH sessions that automatically terminate after a configured duration (TTL). This meets the requirement for ephemeral access without leaving long-lived tunnels open. Refer to Oracle� documentation on OCI Bastion and Managed SSH connections for details on setting session lifetimes.
- A. Correct.
Option 1 is correct. OCI Bastion supports creating Managed SSH sessions with time-bound settings, typically up to a few hours. Once the configured session lifetime (TTL) ends, the session is automatically terminated, fulfilling the requirement for time-limited access.
- B. Incorrect.
Option 2 is incorrect because granting direct SSH key access bypasses OCI Bastion� time-based restrictions. This approach cannot enforce short-lived sessions and introduces persistent access, which violates the security requirement.
- C. Incorrect.
Option 3 is incorrect because it relies on manual enforcement. If users forget to terminate a session, it remains open indefinitely, negating the objective of enforcing time-limited access via Bastion� built-in TTL controls.
- D. Incorrect.
Option 4 is incorrect because deploying a dedicated Bastion compute instance and relying on external scripts is more complicated, error-prone, and does not leverage the built-in time-limited session mechanism provided by OCI Bastion� Managed SSH sessions.