1Z0-1104-25 Question 140
Select 3You are the security lead for a large e-commerce platform hosted on Oracle Cloud Infrastructure (OCI). Your team wants to ensure that both newly created and existing compute instances are continuously monitored for potential misconfigurations, and any discovered issues are automatically remediated. You decide to use OCI Cloud Guard to achieve this goal. Which three actions are required to accomplish automatic detection and remediation of compute instance misconfigurations with Cloud Guard?
- A
Create a separate Security Zone for each new compute instance so that Cloud Guard can automatically block misconfigurations.
- B
Configure a Cloud Guard Target to include the compartment(s) hosting your compute resources.
- C
Enable or customize Cloud Guard's default detection recipe for misconfigured compute resources.
- D
Enable OCI Bastion sessions from the public internet to allow Cloud Guard to perform regular remote scans.
- E
Create or enable a Responder recipe for compute instance misconfigurations and set it to 'Auto' remediation mode.
Show answer and explanation
Correct answers: B, C, E
Explanation
To automatically detect and remediate misconfigurations in OCI compute instances using Cloud Guard, you must designate a target (the compartments to monitor), enable relevant detection rules (either by using the default or a custom detection recipe), and configure an automated responder recipe to remediate discovered issues. Refer to Oracle documentation on 'Using Cloud Guard' for detailed steps on setting up targets, detection recipes, and responder recipes.
- A. Incorrect.
Incorrect. Security Zones enforce specific security policies, but merely placing a compute instance in a separate Security Zone does not automatically facilitate Cloud Guard detection or remediation. Security Zones are a complementary feature rather than a substitute for Cloud Guard detection and responder recipes.
- B. Correct.
Correct. You must configure a Cloud Guard Target to specify the tenancy or compartments you want monitored. Without a properly configured target, Cloud Guard cannot detect or remediate any resource misconfigurations in those compartments.
- C. Correct.
Correct. Detection recipes define which problems Cloud Guard looks for. If you want Cloud Guard to identify misconfigured compute instances, you must enable and possibly customize the relevant detection recipe rules for compute resources (either using the default recipe or a custom recipe).
- D. Incorrect.
Incorrect. OCI Bastion is used for secure access to private resources, not for Cloud Guard scanning. Enabling bastion sessions from the public internet would not help detect or remediate misconfigurations automatically, and it could introduce additional security risk if misused.
- E. Correct.
Correct. A Responder recipe with 'Auto' mode enabled is required for Cloud Guard to automatically remediate discovered issues. Detection alone only flags problems; the Responder recipe defines the actions to fix those problems without manual intervention.