1Z0-1104-25 Question 170
Select 2You are a security administrator at an e-commerce company running workloads on Oracle Cloud Infrastructure (OCI). Your operations team requires immediate alerts whenever a Compute instance is terminated or any changes are made to IAM policies. You decide to leverage OCI Logging and OCI Events for this functionality. Which TWO actions should you take to meet this requirement?
- A
Create an OCI Events rule with 'TerminateInstance' for the Compute resource type and specify an OCI Notifications topic as the action.
- B
Create an OCI Events rule that monitors 'CreatePolicy' or 'UpdatePolicy' operations and triggers an OCI Notifications topic for alerts.
- C
Enable the 'Auto Alert' feature in OCI Logging to automatically send notifications whenever a Compute instance is stopped or terminated.
- D
Configure a Dynamic Group to monitor all read operations for the tenancy and allow it via a policy to manage compute resources.
- E
Use an OCI Functions application to continuously poll your log files for changes and manually send notifications if a policy is updated.
Show answer and explanation
Correct answers: A, B
Explanation
To achieve immediate alerts for both Compute instance terminations and IAM policy changes, you must configure OCI Events rules that match the appropriate operations (terminate compute, create or update IAM policies) and set OCI Notifications topics as the actions. OCI Logging stores logs, but alerting is facilitated by OCI Events and Notifications. For more information, see the official OCI documentation on Events (https://docs.oracle.com/en-us/iaas/Content/Events/Concepts/eventsoverview.htm) and Logging (https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/loggingoverview.htm).
- A. Correct.
CORRECT. Creating an OCI Events rule that specifically matches 'TerminateInstance' allows you to trigger an alert through OCI Notifications whenever a Compute instance is terminated. This accurately addresses the need for an immediate alert on instance termination.
- B. Correct.
CORRECT. By setting up an OCI Events rule to detect 'CreatePolicy' or 'UpdatePolicy' operations, you will be notified of any changes to IAM policies via OCI Notifications. This meets the requirement to receive alerts on IAM policy changes.
- C. Incorrect.
INCORRECT. OCI Logging provides logs and log groups but does not include any 'Auto Alert' feature. Alerts come from either OCI Notifications triggered by Events or from OCI Monitoring Alarms, not from an automatic alert feature in Logging.
- D. Incorrect.
INCORRECT. Configuring a Dynamic Group solely to monitor read operations does not provide alerts for policy changes or instance terminations. A Dynamic Group plus associated IAM policies might help you grant access to resources or logs, but it does not fulfill the alerting requirement in this scenario.
- E. Incorrect.
INCORRECT. While an OCI Functions application can be used to process events, polling log files manually is inefficient and unnecessary. OCI Events directly integrates with OCI Notifications, eliminating the need for a continuous manual poll.