1Z0-1104-25 Question 22
Select 3You are deploying an e-commerce application on Oracle Cloud Infrastructure (OCI) with the front-end web servers in a public subnet and the database in a private subnet. The application must be accessible only via HTTPS (port 443) from the internet. Additionally, all data at rest must be encrypted using your own keys, and operational access to the front-end VMs must be secure while avoiding direct SSH exposure to the internet. Which three actions should you take using OCI� core security services to meet these requirements?
- A
Create a security list rule that allows inbound TCP 443 from 0.0.0.0/0 to the front-end subnet and blocks all other public inbound traffic.
- B
Use an Internet Gateway on the private subnet to allow port 1521 database connections from the public subnet.
- C
Use the OCI Bastion service (or a jump host in a private subnet) to provide SSH access, removing direct SSH ingress rules from front-end security lists.
- D
Enable database-level encryption using default system-managed keys for transparent data encryption.
- E
Use OCI Vault to store and manage your custom encryption keys, attaching them to block volumes or databases for encryption at rest.
Show answer and explanation
Correct answers: A, C, E
Explanation
By allowing traffic only on port 443 to the public subnet and blocking all other inbound ports, you minimize external attack vectors. Using OCI Bastion (or a private jump host) instead of direct SSH to the public subnet further enhances security by preventing direct inbound SSH connections. Finally, storing and managing customer-managed keys in OCI Vault ensures that you have full control of your encryption at rest, satisfying the requirement to use your own keys rather than system-generated ones. Refer to the Oracle Cloud Infrastructure Security Best Practices guide for more details on secure subnet configuration, Bastion or jump host usage, and encryption key management in OCI Vault.
- A. Correct.
Correct: Allowing inbound HTTPS traffic (TCP 443) from 0.0.0.0/0 to the public subnet is necessary for external users to access your application over HTTPS. Blocking other public inbound traffic follows the principle of least privilege.
- B. Incorrect.
Incorrect: Placing an Internet Gateway in the private subnet with an open port to the database is a poor security practice. You typically isolate the database in a private subnet without direct internet connectivity.
- C. Correct.
Correct: By using OCI Bastion or a jump host within a private subnet, you avoid exposing SSH (port 22) directly to the public internet. This reduces attack surface and follows best practices for secure administration.
- D. Incorrect.
Incorrect: Enabling default system-managed keys does encrypt your data, but it does not satisfy the requirement of using your own customer-managed keys. You must use a custom key for full ownership and control of encryption keys.
- E. Correct.
Correct: Storing and managing customer-managed encryption keys in OCI Vault meets the requirement of encrypting data at rest with your own keys. You can attach these keys to resources like block volumes and databases.