1Z0-1104-25 Question 15
Select 2Your organization is deploying a new set of microservices in Oracle Cloud Infrastructure (OCI) that handle sensitive personal data. To meet regulatory and compliance requirements, you must ensure robust security at each layer of the architecture. Which two security design principles should be prioritized to best protect this data in this scenario?
- A
Enforce a least-privilege access model using IAM policies for each microservice and compartmentalize resources effectively
- B
Use a single administrative user with broad privileges to manage all microservices across compartments
- C
Implement an end-to-end encryption strategy, leveraging OCI Vault to manage keys
- D
Distribute secrets within the microservice code for faster deployment
- E
Deploy microservices to a public subnet for easier connectivity and rely on default security lists
Show answer and explanation
Correct answers: A, C
Explanation
Prioritizing least privilege and encryption aligns with core OCI security design principles. Least privilege restricts access to only what is necessary, limiting potential damage from compromised credentials. End-to-end encryption, with keys stored and managed in OCI Vault, secures data against unauthorized access. For more details, refer to Oracle� documentation on IAM best practices, network segmentation, and Vault-based key management.
- A. Correct.
Option 1 is correct. Enforcing least privilege ensures each microservice only has the access it needs, reducing the blast radius if a component is compromised and preventing excessive access to resources.
- B. Incorrect.
Option 2 is incorrect. Assigning a single administrative user with wide-ranging privileges undermines the principle of least privilege and creates a single point of failure.
- C. Correct.
Option 3 is correct. Adopting an end-to-end encryption strategy, managed via OCI Vault, helps secure data both at rest and in transit, addressing regulatory compliance and mitigating unauthorized access.
- D. Incorrect.
Option 4 is incorrect. Embedding secrets in microservice code is insecure; it risks accidental disclosure in source control or logs. OCI Vault or a secrets management service is a more secure approach.
- E. Incorrect.
Option 5 is incorrect. Placing microservices in a public subnet by default exposes them to unnecessary risk. Private subnets, with well-defined network security rules, align better with secure design principles.