1Z0-1104-25 Question 139
Select 2Your organization recently discovered that some Security Lists in a critical OCI compartment allow inbound SSH from any source. Cloud Guard has flagged these overly permissive rules as a security risk. You want to automatically remove these rules when detected and continually monitor future Security List changes to prevent reoccurrence. Which two approaches would best achieve your goal?
- A
Enable Cloud Guard's 'Security List Misconfiguration' detector and configure a responder recipe to remove the offending rules automatically.
- B
Run a daily Vulnerability Scanning Service check against Compute instances to remove any Security List rules that allow inbound SSH from all sources.
- C
Create an OCI Events rule that triggers an Oracle Functions function to detect and remove newly created insecure Security List rules.
- D
Enable Object Storage event notifications to reconfigure Security Lists when objects are uploaded or removed.
Show answer and explanation
Correct answers: A, C
Explanation
To automatically detect, remediate, and monitor misconfigured Security Lists, you can use Cloud Guard� built-in detectors and responders or leverage OCI Events with Oracle Functions. Cloud Guard identifies insecure configurations and can remove them via responders, while OCI Events enables near real-time remediation workflows. Refer to the Oracle Cloud Guard documentation (https://docs.oracle.com/en-us/iaas/cloud-guard/) and the OCI Events and Functions documentation (https://docs.oracle.com/en-us/iaas/Content/Events/Concepts/eventsoverview.htm, https://docs.oracle.com/en-us/iaas/Content/Functions/Concepts/functionsoverview.htm) for detailed setup steps and best practices.
- A. Correct.
Option 1 is CORRECT. Cloud Guard can detect misconfigured Security Lists, and with a properly configured responder recipe, it can automatically remove or remediate the identified risk. This is a standard best practice for reducing manual overhead and ensuring continuous compliance.
- B. Incorrect.
Option 2 is INCORRECT. While the Vulnerability Scanning Service can detect vulnerabilities on Compute instances, it does not remediate Security Lists. It is designed to scan host OS vulnerabilities and container images, not to modify network security configurations.
- C. Correct.
Option 3 is CORRECT. OCI Events can be configured to listen for Security List creation or update events, and then invoke an Oracle Functions function to remove any newly created rules matching specific criteria (e.g., SSH allowed from 0.0.0.0/0). This automates the remediation at the time of misconfiguration.
- D. Incorrect.
Option 4 is INCORRECT. Object Storage event notifications help you track uploads or deletions of objects within buckets; they are not designed to monitor or remediate network security settings such as Security Lists.