1Z0-1104-25 Question 102
Select 2Your organization hires a contractor who requires SSH access to a private compute instance for a short maintenance task. You decide to use OCI Bastion to provide time-limited SSH access that automatically expires after two hours. Which two steps must you implement to ensure secure, time-limited access using OCI Bastion?
- A
- Create a bastion session specifying a maximum session TTL (Time To Live) of two hours, and enable ephemeral key-based SSH access.
- B
- Attach an IAM policy that grants the contractor permission to use Bastion and rely on their personal SSH key for ongoing connections.
- C
- Configure a dynamic SSH key directly on the compute instance and retain the key for audit purposes after the session has ended.
- D
- Use Oracle-managed SSH key generation within Bastion, set the session duration to two hours, and restrict access to the contractor� source IP.
Show answer and explanation
Correct answers: A, D
Explanation
OCI Bastion provides the capability to create ephemeral SSH sessions with a configurable TTL, ensuring that temporary access is automatically revoked after a specific time period. By combining time-limited sessions with ephemeral SSH keys and optional IP address restrictions, you can securely grant short-term access to resources in a private subnet. Refer to Oracle� OCI Bastion documentation (e.g., 'Using Oracle Cloud Infrastructure Bastion' in the Oracle Cloud Infrastructure documentation) for guidance on creating bastion sessions, configuring session TTL, and using ephemeral credentials.
- A. Correct.
Option 1: Correct. Specifying a maximum session TTL (like two hours) when creating a bastion session and using ephemeral SSH credentials is a best practice for time-limited access. Bastion automatically handles the session lifecycle and terminates the session once the TTL is reached.
- B. Incorrect.
Option 2: Incorrect. While attaching a policy that allows 'bastion usage' is necessary, relying on the contractor's personal SSH key for unlimited ongoing connections does not enforce time-limited access by itself. You must configure the session through Bastion to ensure automatic expiration.
- C. Incorrect.
Option 3: Incorrect. Installing a dynamic key on the compute instance itself and retaining it for auditing does not use OCI Bastion� built-in session termination. The contractor could potentially continue using the key beyond the intended timeframe if not manually revoked.
- D. Correct.
Option 4: Correct. Using the Oracle-managed ephemeral key feature (provided as part of Bastion) allows you to specify a predetermined session duration (two hours) and limit access by source IP. This enforces both the time limit and tightens network restrictions.