1Z0-1104-25 Question 161
Single answerYou are a security administrator for an organization using Oracle Cloud Infrastructure (OCI). You have enabled Threat Intelligence to monitor and block known malicious IP addresses. Over the weekend, you observe multiple failed login attempts from an IP flagged by the threat feed. You suspect that a rogue user within your tenancy is attempting to leverage stolen credentials. Which single method would most effectively help you identify this potential rogue user while leveraging OCI� Threat Intelligence capabilities?
- A
Use Oracle Cloud Guard to correlate the flagged IP address with tenancy-wide login activity and automatically create an incident for suspicious user behavior.
- B
Rely on the default IAM password policy to prompt users for passphrase resets every 30 days, resolving suspicious logins automatically.
- C
Enable auto-scaling on all compute instances so that suspicious processes run in isolated compartments and cannot affect core resources.
- D
Create a manual blocklist entry in the OCI Firewall for each suspicious IP address you observe and periodically update it.
Show answer and explanation
Correct answer: A
Explanation
Leveraging Oracle Cloud Guard with OCI� Threat Intelligence feed is the most efficient method to detect suspicious IP activity, tie those IPs to specific user accounts, and raise an incident. Cloud Guard can generate insights and alerts based on login attempts from known malicious IPs, enabling swift identification and remediation of potential rogue individuals. Refer to official OCI documentation on Cloud Guard and Threat Intelligence integration for configuration steps and best practices.
- A. Correct.
Option 1 is correct. Oracle Cloud Guard can integrate with OCI Threat Intelligence feeds to detect malicious IP activity, associate it with user login behavior, and raise incidents or automated responses. This holistic approach helps identify rogue users quickly.
- B. Incorrect.
Option 2 is incorrect. While enforcing a strong IAM password policy is important, it does not actively correlate IP-based threat intelligence with user activity or isolate potentially compromised accounts in real time.
- C. Incorrect.
Option 3 is incorrect. Auto-scaling adds or removes compute resources to meet demand; it does not directly track suspicious user behavior or stop rogue access attempts. Threat intelligence correlation is needed for identifying user-based threats.
- D. Incorrect.
Option 4 is incorrect. Manually updating a blocklist might help in a limited way, but it is reactive and does not provide user attribution or deeper insight through automated threat intelligence correlation.