1Z0-1104-25 Question 61
Select 2Your retail organization hosts a critical e-commerce website on Oracle Cloud Infrastructure (OCI) using a public load balancer fronting web servers in a public subnet, with back-end application servers in a private subnet. You need to protect the application from malicious traffic and common exploits while ensuring only the load balancer can communicate with the back-end tier. Which two actions should you take to achieve these goals?
- A
- Deploy an OCI Web Application Firewall (WAF) with appropriate protection rules and attach it to the public load balancer.
- B
- Use a single security list with all inbound ports open from 0.0.0.0/0 to your web servers for maximum access.
- C
- Configure a network security group on the back-end servers to only allow traffic from the load balancer� subnet on required ports.
- D
- Disable TLS termination on the load balancer to allow unencrypted traffic directly to the web servers.
Show answer and explanation
Correct answers: A, C
Explanation
In OCI, a recommended best practice is to terminate SSL/TLS at the load balancer for secure traffic inspection and attach an OCI Web Application Firewall for advanced threat protection. Then, use granular network security rules, such as network security groups (NSGs), to limit access to only necessary sources and destinations on the back-end subnets. Refer to the Oracle Cloud Infrastructure Security Guide for further details on designing secure network and application architectures.
- A. Correct.
Correct. OCI WAF helps protect web applications from common vulnerabilities like SQL injection and XSS. By attaching WAF to the load balancer, you can inspect and filter malicious traffic at the edge, improving overall security.
- B. Incorrect.
Incorrect. Opening all inbound ports from all IP ranges (0.0.0.0/0) leaves your web servers fully exposed to the Internet. This contradicts best practices for the principle of least privilege.
- C. Correct.
Correct. Restricting inbound traffic to only the load balancer� subnet ensures that no direct external traffic can reach the private subnet. This approach enforces granular control and prevents bypassing the load balancer security policies.
- D. Incorrect.
Incorrect. Disabling TLS termination on the load balancer means the load balancer passes unencrypted traffic to your servers, which can expose sensitive data. Secure end-to-end encryption is highly recommended for any critical application.