1Z0-1104-25 Question 23
Select 3An organization is deploying a sensitive HR application on Oracle Cloud Infrastructure (OCI). They need to ensure encryption at rest, secure access control, and proper logging to meet compliance requirements. Which three steps are essential to secure the deployment using OCI� core security services and align with best practices?
- A
Create an IAM policy granting the HR department broad 'manage all-resources' privileges in their compartment
- B
Use Vault to store and automatically rotate encryption keys for the database
- C
Enable OCI Logging for all compartments to capture relevant logs and send them to the Logging Analytics service
- D
Deploy the compute instances in a public subnet to simplify troubleshooting
- E
Restrict inbound and outbound network traffic using Security Lists or Network Security Groups with tightly scoped rules
Show answer and explanation
Correct answers: B, C, E
Explanation
Using core OCI security services such as Vault for key management, IAM with least privilege policies, Logging for auditing, and properly configured network security controls is essential for safeguarding sensitive workloads. References: Oracle Cloud Infrastructure Security Best Practices (docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm) and OCI Logging Documentation (docs.oracle.com/en-us/iaas/Content/Logging/Concepts/loggingoverview.htm).
- A. Incorrect.
Option 1: INCORRECT. Granting broad 'manage all-resources' privileges violates the principle of least privilege and increases security risk. It is better to define policies granting only the necessary actions on specific resources.
- B. Correct.
Option 2: CORRECT. Storing and automatically rotating encryption keys in OCI Vault is a best practice for securing sensitive data at rest. This minimizes the risk of key compromise and simplifies key management.
- C. Correct.
Option 3: CORRECT. Enabling OCI Logging and sending logs to Logging Analytics helps centralize monitoring and auditing, making it easier to detect and investigate security incidents.
- D. Incorrect.
Option 4: INCORRECT. Placing compute resources in a public subnet unnecessarily exposes them to the internet. Sensitive, internal-facing applications should generally reside in private subnets with controlled access.
- E. Correct.
Option 5: CORRECT. Restricting network traffic with Security Lists or Network Security Groups helps enforce a zero-trust model by allowing only required ports and IP ranges, reducing the application's attack surface.