1Z0-1104-25 Question 154
Select 2Your organization is setting up a new critical application on Oracle Cloud Infrastructure (OCI). The security team wants to ensure that the application is deployed in a securely governed environment using Security Zones and that any configuration drift or policy violations are promptly identified by the Security Advisor. Which two actions should you implement to adhere to OCI security best practices?
- A
Create a new compartment for the application and enable a Security Zone with a suitable security zone recipe for that compartment.
- B
Migrate existing resources from a standard compartment to a security zone compartment simply by updating the compartment assignment.
- C
Use the Security Advisor� recommendations to remediate any configuration drift or violations that occur within the security zone.
- D
Disable security zone constraints when you need to allow temporary policy overrides for urgent updates.
Show answer and explanation
Correct answers: A, C
Explanation
In OCI, creating a security zone for your critical application� compartment applies strict security policies from the chosen security zone recipe, ensuring that any resource deployed therein meets predefined best-practice constraints. The Security Advisor provides continuous monitoring and recommendations for drift or potential misconfigurations, so you can remediate issues promptly. Refer to the Oracle Cloud Infrastructure Security Zones documentation for details on constraints and best practices, and to the Security Advisor documentation for information on automated compliance checks and remediation.
- A. Correct.
Correct. Creating a dedicated compartment and enabling a Security Zone ensures that all resources in that compartment adhere to strict security controls defined by the recipe. This is in alignment with OCI best practices.
- B. Incorrect.
Incorrect. You cannot just update an existing resource� compartment assignment to move it into a security zone if it violates security zone constraints. The constraints must be met first, or the move is not allowed.
- C. Correct.
Correct. The Security Advisor can detect misconfigurations or policy violations and provide recommended actions. Leveraging these automated alerts and remediation steps helps maintain continuous compliance.
- D. Incorrect.
Incorrect. Security zone constraints are enforced to prevent risky configurations. They cannot be disabled on a whim. Allowing overrides would break the purpose of the security zone� strict policies.