1Z0-1104-25 Question 64
Select 2Your organization hosts a three-tier e-commerce application on Oracle Cloud Infrastructure (OCI). The web tier is fronted by a public load balancer in a public subnet, the application servers are in a private subnet, and the database tier is in a separate private subnet. The security team wants to ensure that only valid HTTP/HTTPS traffic from the internet can reach the application and that the private subnets remain inaccessible to unauthorized sources. Which two configurations are recommended to protect this infrastructure?
- A
Create a custom route table in the private subnet directing all inbound traffic to the public load balancer interface
- B
Use a Network Security Group (NSG) for the application servers that restricts inbound traffic to only the load balancer� IP and ports, and place the database tier in a separate NSG that only allows traffic from the application subnet on database ports
- C
Deploy Oracle Web Application Firewall (WAF) in front of your public load balancer to filter malicious HTTP/HTTPS requests before they reach the application servers
- D
Configure a NAT Gateway on the public subnet to allow inbound traffic directly to the application servers, bypassing the load balancer
- E
Keep the default security lists for the private subnets to allow inbound connections from any IP range for HTTP/HTTPS traffic
Show answer and explanation
Correct answers: B, C
Explanation
Using Network Security Groups (NSGs) tailored to each tier and deploying Oracle Web Application Firewall (WAF) for HTTP/HTTPS filtering are best practices for protecting a multi-tier application on OCI. NSGs enforce port-level restrictions at the instance level, preventing unauthorized inbound connections. WAF provides critical application-layer threat protection by filtering malicious requests before they reach the application servers. Refer to the OCI documentation on NSGs and WAF configuration for comprehensive guidance on these security measures.
- A. Incorrect.
Option 1: Incorrect. A custom route table simply governs where traffic goes after it enters the subnet. It does not enforce security rules or filter inbound traffic. Relying solely on a route table entry to control inbound traffic does not provide the protection needed for private subnets.
- B. Correct.
Option 2: Correct. Network Security Groups let you define specific ingress and egress rules at the application server level. Restricting inbound traffic to the load balancer� subnet and limiting the database subnet access to only the application servers significantly reduces unauthorized entry points.
- C. Correct.
Option 3: Correct. Oracle Web Application Firewall (WAF) provides layer 7 protection, enabling you to filter malicious HTTP/HTTPS requests before they reach your application servers. This ensures malicious traffic is blocked at the edge, enhancing the overall security posture.
- D. Incorrect.
Option 4: Incorrect. A NAT Gateway is typically used for outbound access to the internet from private subnets, not for inbound traffic. Bypassing the load balancer would leave the private subnet more exposed and defeat the purpose of having a public load balancer in a secure front-end configuration.
- E. Incorrect.
Option 5: Incorrect. Default security lists often allow broad or overly permissive access, which poses risks. Keeping these default rules unchanged could permit unwanted traffic into the private subnets, undermining the principle of least privilege.