1Z0-1104-25 Question 160
Select 2You have integrated Oracle Threat Intelligence with your OCI environment. Your security dashboard shows repeated login attempts from an IP address flagged as a known malicious source. You suspect a legitimate IAM user� credentials may have been compromised and are being used by a rogue actor. Which two initial actions should you take to further investigate and confirm suspicious activity?
- A
Cross-reference the flagged IP address with external threat feeds to verify if it is consistently marked malicious.
- B
Immediately revoke the suspect user� credentials to block any further logins without performing further investigation.
- C
Review the user's recent activity using Oracle Cloud Audit and IAM logs to identify unusual resource access or patterns.
- D
Use the OS Management service to initiate a system-wide patch update on all compute instances.
Show answer and explanation
Correct answers: A, C
Explanation
When an IP address is flagged by Oracle Threat Intelligence as malicious, the immediate focus should be on verifying the threat and determining whether the account is compromised. Cross-referencing the IP with additional threat feeds helps confirm the threat intelligence, while reviewing Oracle Cloud Audit and IAM logs uncovers evidence of misuse. Once suspicious activity is confirmed, further actions, such as credential revocation and security incident handling, can be taken. For more information, refer to Oracle Cloud Security documentation on Threat Intelligence and best practices for investigating suspicious IAM events.
- A. Correct.
Cross-referencing the suspicious IP with external threat feeds helps confirm if multiple sources label it as malicious. This step validates the credibility of the threat intelligence data and hones in on potential rogue activity from that IP.
- B. Incorrect.
Immediately revoking all credentials without additional investigation might disrupt legitimate users and operational workflows if the alert is a false positive. A more thorough investigation is recommended before taking that action.
- C. Correct.
Reviewing Oracle Cloud Audit logs and IAM logs can reveal anomalies such as abnormal console logins, unusual resource provisioning, or unauthorized compartment access, which are critical indicators of rogue user behavior.
- D. Incorrect.
Applying OS or system patches addresses vulnerabilities on compute instances, but it does not directly help confirm or investigate an account-level compromise. It is not the correct initial step to validate suspicious login patterns or IP addresses.