1Z0-1104-25 Question 63
Single answerYour organization hosts a mission-critical web application on Oracle Cloud Infrastructure behind a public load balancer. You need to ensure that only traffic from your organization's IP addresses is allowed, block known malicious IP sources, and gain real-time visibility into blocked requests. Which approach best meets these requirements with minimal operational overhead?
- A
Configure the subnet� Security List to allow HTTPS (TCP/443) from all IP addresses and rely on the load balancer logs to monitor and block malicious traffic.
- B
Implement the Oracle Cloud Infrastructure Web Application Firewall (WAF) with an Access Control Rule to whitelist your organization� IP range, blacklist known malicious IPs, and enable event logging.
- C
Use a custom route table to explicitly deny traffic from known malicious IP addresses and permit only your organization� IP range at the route level.
- D
Configure a NAT Gateway for your back-end subnets to ensure all inbound traffic must originate from your internal sources.
Show answer and explanation
Correct answer: B
Explanation
To protect your web application, a layered approach is recommended, often including both network-level controls and application-level controls. In Oracle Cloud Infrastructure, the Web Application Firewall (WAF) enables IP-based whitelisting and blacklisting, as well as logging and monitoring. This ensures only trusted traffic is allowed through and provides real-time visibility into any blocked or suspicious requests. Refer to the Oracle Cloud Infrastructure documentation on 'Web Application Firewall' for detailed configuration steps and best practices.
- A. Incorrect.
Option 1: Incorrect. A Security List that allows traffic from all sources on port 443 does not selectively restrict inbound connections. Relying solely on load balancer logs might help identify malicious traffic, but you cannot effectively block it in real time. Security Lists operate at the subnet level and provide port-based filtering, not the IP-based whitelisting and blacklisting needed here.
- B. Correct.
Option 2: Correct. The Oracle Cloud Infrastructure Web Application Firewall (WAF) can be placed in front of your application to control which IP addresses are allowed or blocked using Access Control Rules (ACRs). Whitelisting your organization� IP range ensures only authorized traffic arrives, while blacklisting known malicious IPs filters nefarious sources. Enabling WAF event logging provides real-time visibility into blocked requests�fully meeting the stated requirements.
- C. Incorrect.
Option 3: Incorrect. Although route tables can conditionally route or block specific IP addresses, they are designed primarily to route network traffic rather than provide granular application-level access control. Route tables are not intended for blocking malicious sources in real time; they cannot provide the logging and rule-based security features of a WAF.
- D. Incorrect.
Option 4: Incorrect. A NAT Gateway is used for outbound connections from private subnets, not for filtering inbound public traffic. It does not provide IP-based whitelisting of external requests or the visibility required to monitor and block malicious traffic in real time.