1Z0-1104-25 Question 141
Select 2Your organization has discovered that some Object Storage buckets in OCI are inadvertently set to public, posing a security risk. You decide to use Oracle Cloud Guard to detect and automatically remediate these misconfigurations across multiple compartments. Which two steps must you take to ensure all compartments are scanned and any non-compliant buckets are returned to private status with minimal manual intervention? (Select two)
- A
- Create a Cloud Guard target that includes the root compartment and all subcompartments.
- B
- Enable the Oracle-provided responder rule that automatically sets public buckets to private.
- C
- Manually tag each non-compliant bucket before Cloud Guard can detect and remediate it.
- D
- Disable Cloud Guard� built-in responder rules to avoid unexpected changes to existing buckets.
Show answer and explanation
Correct answers: A, B
Explanation
To detect, remediate, and continually monitor public buckets across all OCI compartments, you must create a Cloud Guard target that includes the root compartment and enable the responder rules for misconfigured Object Storage buckets. This ensures that Cloud Guard scans every compartment and takes prompt automated action. Refer to OCI documentation on 'Using Oracle Cloud Guard' for best practices on configuring targets, security recipes, and responder actions.
- A. Correct.
- Correct. Creating a Cloud Guard target that references the root compartment (and includes its subcompartments) ensures that Cloud Guard checks all compartments under the root for misconfigurations. This is the recommended approach for broad coverage.
- B. Correct.
- Correct. Enabling the relevant responder rule for public Object Storage buckets allows Cloud Guard to automatically remediate by reverting non-compliant buckets to private status. Without enabling the responder rule, Cloud Guard would only detect (not fix) the issue.
- C. Incorrect.
- Incorrect. You do not need to tag each non-compliant bucket; Cloud Guard detects and identifies non-compliant resources automatically based on its recipes. Manually tagging buckets would be cumbersome and unnecessary for automated detection and remediation.
- D. Incorrect.
- Incorrect. Disabling Cloud Guard� responder rules prevents the automatic remediation process. Instead, for minimal manual effort, you want to keep the responder rules enabled so that Cloud Guard can fix issues as soon as they are detected.