1Z0-1104-25 Question 158
Select 2Your organization suspects that a privileged user is connecting from an IP address flagged as malicious by Oracle Threat Intelligence. You need to identify the user's recent activities and mitigate potential threats. Which two actions should you take in Oracle Cloud Infrastructure to investigate and respond effectively?
- A
Implement a custom Cloud Guard detector recipe that triggers alerts for sign-ins from IP addresses flagged by Oracle Threat Intelligence.
- B
Configure Oracle Logging Analytics to ingest user activity logs and correlate them with Threat Intelligence data to highlight suspicious sessions.
- C
Disable relevant threat feed alerts to avoid unnecessary notifications, focusing exclusively on Oracle Audit logs for user activities.
- D
Ignore the IP-based threat alert and rely on monthly manual security reviews to identify any anomalies in user access.
Show answer and explanation
Correct answers: A, B
Explanation
By integrating Oracle Threat Intelligence with services like Cloud Guard detector recipes and Oracle Logging Analytics, you can comprehensively detect and investigate rogue users. Aligning known malicious IP addresses from the threat feed with detailed audit data provides real-time, actionable insights. Refer to 'Using Cloud Guard with Threat Intelligence' and 'Logging Analytics Best Practices' in the OCI documentation for guided configurations and recommended workflows.
- A. Correct.
Option 1 is correct. Creating a custom Cloud Guard detector recipe enables automatic detection of suspicious sign-in activities. By incorporating the Threat Intelligence feed, you can immediately flag logins from IP addresses known to be malicious, ensuring prompt visibility into potentially rogue user actions.
- B. Correct.
Option 2 is correct. Oracle Logging Analytics can correlate user activity logs with data from Oracle Threat Intelligence to pinpoint unusual login patterns or suspicious sessions. This combination provides clear insights into when and how frequently a flagged IP is used, helping to confirm if the user is indeed rogue.
- C. Incorrect.
Option 3 is incorrect. Disabling threat feed alerts removes an essential layer of automated defense. Engaging threat intelligence and audit logs together is more effective than relying solely on Oracle Audit logs, which might not provide real-time correlation with known malicious IP addresses.
- D. Incorrect.
Option 4 is incorrect. Relying on manual monthly reviews can fail to catch time-sensitive attacks. Threat Intelligence feeds and automated alerts are critical for proactively identifying and containing malicious behavior before major damage occurs.