1Z0-1104-25 Question 104
Select 2You are managing an e-commerce application on Oracle Cloud Infrastructure (OCI) that uses container images stored in a private OCI Container Registry and multiple Compute instances for backend services. Your Security team requires that all newly launched Compute instances and newly pushed container images be scanned for known vulnerabilities on a recurring schedule. Which two actions must you take to meet this requirement?
- A
Create a Vulnerability Scanning target that includes your compartment with Compute instances.
- B
Define a separate Vulnerability Scanning target referencing the container image repositories in the OCI Container Registry.
- C
Disable OS Management on all your Compute instances to enable scanning with minimal conflicts.
- D
Configure a custom metric alarm to automatically remediate critical findings on Compute instances.
- E
Set up a Block Volume backup policy to capture vulnerability scan results for compliance checks.
Show answer and explanation
Correct answers: A, B
Explanation
To implement regular vulnerability scanning for both new Compute instances and newly pushed container images, you must define scanning targets specifically for those resources. The OCI Vulnerability Scanning service allows you to set up multiple targets�one for hosts and another for container images�and configure the scan frequency. Refer to Oracle� documentation on the Vulnerability Scanning service for detailed steps: https://docs.oracle.com/en-us/iaas/Content/vulnerability-scanning/home.htm.
- A. Correct.
Option 1 is correct. Configuring a Vulnerability Scanning target for your compartment ensures OCI will regularly scan the associated Compute instances for known security vulnerabilities. You can define the scope for scanning by compartment or subnet, and schedule scans as needed.
- B. Correct.
Option 2 is correct. To scan newly pushed container images, you must create a separate target for container images in the OCI Container Registry. This allows OCI Vulnerability Scanning to identify CVEs in images before they are deployed to production.
- C. Incorrect.
Option 3 is incorrect. Disabling OS Management is not required�nor recommended�for Vulnerability Scanning. The service can function regardless of the OS Management service status, and disabling OS Management can remove useful patching and update features.
- D. Incorrect.
Option 4 is incorrect. While you can create alarms or automated responses, it is not sufficient by itself to set up a custom metric alarm for vulnerability remediation. A separate scanning target is still required for the scanning process itself.
- E. Incorrect.
Option 5 is incorrect. A Block Volume backup policy ensures data durability but does not enable or configure vulnerability scanning for hosts or container images. Vulnerability Scanning is managed through the Vulnerability Scanning service targets.