1Z0-1104-25 Question 169
Select 3You are a security engineer tasked with monitoring unauthorized configuration changes to Security Lists in your Oracle Cloud Infrastructure (OCI) environment. You want to capture relevant information about each update and promptly alert your security team whenever a Security List modification occurs. Which three steps must you configure to implement secure monitoring and alerts for these changes using OCI Logging and OCI Events?
- A
Enable Audit logs in the tenancy or the target compartment to capture user-initiated changes to Security Lists
- B
Create an OCI Events rule that triggers when the 'UpdateSecurityList' operation is called on the Security List resource
- C
Configure an OCI Notifications topic as the rule action to send email alerts to the security team
- D
Deploy a Service Connector Hub pipeline to stream VCN Flow Logs into Logging Analytics for Security List configuration changes
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely monitor and alert on Security List updates, rely on the combination of OCI Logging (particularly Audit logs) and OCI Events. By enabling Audit logs, you record the necessary details of each API call. An Events rule configured to detect the 'UpdateSecurityList' action can then route alerts through OCI Notifications for real-time visibility. This approach aligns with best practices outlined in the official OCI documentation for monitoring and auditing changes to network configurations.
- A. Correct.
Correct: Audit logs capture all API calls (including Security List updates) across your tenancy. To ensure these logs are retained and accessible for analysis, you must have Audit logging enabled in the tenancy or the compartment where the Security List resides.
- B. Correct.
Correct: Configuring an OCI Events rule that listens for the specific 'UpdateSecurityList' event ensures that you receive near-real-time triggers whenever a Security List is updated. This is essential to detect unauthorized changes quickly.
- C. Correct.
Correct: Once the Events rule is triggered, you need a Notifications topic to forward alerts (for example, by email or PagerDuty) to your security team. Without setting up a Notification topic (or another action like Function invocation), the Events rule won�t provide proper alerts.
- D. Incorrect.
Incorrect: Flow Logs capture network traffic information rather than configuration changes. They are useful for investigating network flow issues or suspicious traffic patterns but not for capturing changes to Security List configurations.