1Z0-1104-25 Question 162
Select 2Your finance department reports that the user 'John_Doe' has been creating multiple Compute instances in an unfamiliar region, causing a sudden cost spike. Oracle Threat Intelligence flags the IP address John_Doe used to log in as tied to known malicious activity. The security team suspects the account may be compromised by a rogue entity. Which two actions should you take to confirm the suspicious activity and disrupt any unauthorized access using Oracle Cloud Infrastructure (OCI)? (Choose two.)
- A
Immediately terminate the 'John_Doe' user from the OCI tenancy.
- B
Cross-reference the flagged IP address with Oracle Threat Intelligence to verify it is indeed malicious.
- C
Review the OCI Audit logs to identify unauthorized actions performed by 'John_Doe'.
- D
Disable region-level access globally for all users in the tenancy.
- E
Restrict 'John_Doe' to 'read-only' permissions pending further investigation.
Show answer and explanation
Correct answers: B, C
Explanation
To identify a rogue or compromised user in OCI, it is crucial to correlate threat intelligence signals (like malicious IP alerts) with system activity logs. Oracle Threat Intelligence helps validate malicious source indicators, while OCI Audit logs detail user actions, clearly revealing suspicious or unauthorized behavior. These combined insights guide whether to restrict or revoke access, ensuring continued security and compliance. Refer to Oracle Cloud Security documentation on Threat Intelligence and OCI Audit for best practices on investigation and remediation.
- A. Incorrect.
Option 1: Terminating a user account prematurely may delete critical forensic evidence needed for an investigation. Best practice is to gather sufficient data before revoking access entirely.
- B. Correct.
Option 2: Correct. Validating the IP address against Oracle Threat Intelligence confirms whether the address is associated with malicious activities, helping to justify further remedial steps if it turns out to be hostile.
- C. Correct.
Option 3: Correct. Reviewing OCI Audit logs is an essential step in identifying anomalous actions, such as creating unauthorized resources or changing configurations, which helps confirm whether the account is compromised.
- D. Incorrect.
Option 4: Disabling region-level access for all users is too broad and can disrupt legitimate business operations. A more targeted approach is recommended to address the suspicious user's activity.
- E. Incorrect.
Option 5: While limiting privileges can be part of a response plan, simply assigning read-only access does not confirm malicious activity. The question specifically asks how to confirm the suspicious behavior and disrupt unauthorized access, which is best achieved by cross-checking logs and threat intelligence.