1Z0-1104-25 Question 173
Select 2Your organization wants to be immediately notified whenever any changes are made to Security Lists within a specific compartment, and also wants to retain logs for long-term compliance. You have decided to use OCI Logging and OCI Events to achieve this. Which two actions must you take to implement a secure monitoring and alerting mechanism for Security List modifications?
- A
Configure the OCI Audit Logs source in OCI Logging to capture all Security List changes within the compartment.
- B
Create an OCI Event Rule that triggers on 'UpdateSecurityList' and configure the rule to publish to an OCI Notifications topic.
- C
Create a custom Monitoring metric based on 'SecurityListModified' logs and set an alarm threshold for changes to the Security List.
- D
Enable Flow Logs for the VCN subnets to detect and log all changes to Security Lists.
Show answer and explanation
Correct answers: A, B
Explanation
To monitor changes to Security Lists and receive alerts, you should rely on OCI Events to detect the 'UpdateSecurityList' event and notify your team via OCI Notifications. In parallel, routing Audit Logs to OCI Logging helps maintain an immutable record of those configuration changes for compliance and forensic analysis. Refer to the Oracle Cloud Infrastructure documentation on Logging (docs.oracle.com/en/cloud/paas/logging) and Events (docs.oracle.com/en/cloud/paas/event) for detailed configuration steps and best practices.
- A. Correct.
Correct. OCI Audit Logs can capture all modifications to Security Lists, and directing these logs to OCI Logging allows you to store them for compliance and further analysis.
- B. Correct.
Correct. OCI Events enables you to create an event rule that checks for the 'UpdateSecurityList' event and triggers a notification via OCI Notifications (e.g., email, PagerDuty).
- C. Incorrect.
Incorrect. While Monitoring can work with custom metrics, there is no direct mechanism to create a custom metric specifically for Security List changes. OCI Events and Logging are the recommended path for this use case.
- D. Incorrect.
Incorrect. VCN Flow Logs capture network traffic flow information at the subnet level and do not track or record configuration changes to Security Lists.