1Z0-1104-25 Question 17
Select 3Your team is deploying a multi-tier web application in Oracle Cloud Infrastructure (OCI) that processes confidential consumer data. As the Security Architect, you want to ensure the design aligns with OCI security principles to protect data and reduce the attack surface. Which three guidelines from the list below best adhere to these security design principles?
- A
Deploy all components on a single public subnet to simplify access management
- B
Use separate subnets for the front-end and backend, with the backend restricted by security lists or network security groups
- C
Enforce strict IAM policies and employ multiple compartments to isolate applications with different risk profiles
- D
Disable in-transit encryption to improve network performance
- E
Implement regular key rotation and encrypt sensitive data both at rest and in transit
Show answer and explanation
Correct answers: B, C, E
Explanation
When designing secure architectures in OCI, it� vital to limit the attack surface by adopting layered security controls (defense in depth), practicing the principle of least privilege, and isolating workloads or environments through compartments and network segmentation. Additionally, consistent key rotation and encryption at all stages (at rest and in transit) align with OCI security best practices. Refer to the Oracle Cloud Infrastructure Security Best Practices documentation for further guidance on designing secure multi-tier architectures.
- A. Incorrect.
Option 1 (Incorrect): Placing all components in a single public subnet violates the principle of least privilege. It increases your attack surface, as all services could be exposed directly to the internet and share the same security controls.
- B. Correct.
Option 2 (Correct): Segmenting the network into separate private and public subnets (or using security lists or network security groups) aligns with best practices for defense in depth. This design limits unauthorized access and reduces the blast radius in case of a breach.
- C. Correct.
Option 3 (Correct): Strict IAM policies enforce the principle of least privilege, and multiple compartments help isolate projects or workloads with different security requirements. This approach contains potential compromises within a limited scope.
- D. Incorrect.
Option 4 (Incorrect): Disabling encryption in transit leaves data vulnerable to eavesdropping or tampering. This goes against OCI� recommended approach of encrypting data at all stages to maximize security.
- E. Correct.
Option 5 (Correct): Regularly rotating keys ensures that compromised keys become invalid in a timely manner, while encrypting sensitive data at rest and in transit is a fundamental security design principle that helps protect data from unauthorized access.