1Z0-1104-25 Question 66
Select 2You have deployed a three-tier application in Oracle Cloud Infrastructure (OCI) with a public-facing front-end tier, a private middle tier, and a private database tier. You need to ensure that external users can only access the front-end servers through a secure Web Application Firewall (WAF), that malicious IP addresses are automatically blocked, and that traffic flow can be analyzed. Which two actions would best meet these requirements?
- A
- Deploy an OCI Public Load Balancer with WAF enabled, place your front-end servers in a private subnet, and use Security List rules to only allow incoming traffic from the Load Balancer subnet.
- B
- Enable OCI Cloud Guard threat detection to automatically block suspicious IP addresses at the WAF and log suspicious events in OCI Logging for analysis.
- C
- Place the front-end servers in a public subnet with an Internet Gateway, relying solely on operating system firewalls to filter malicious traffic.
- D
- Disable all stateful inspection in your Security Lists to reduce complexity and trust the WAF to handle every threat scenario.
- E
- Configure a NAT Gateway as the primary path for inbound internet traffic to the front-end servers, allowing the WAF to inspect traffic after it reaches the private subnet.
Show answer and explanation
Correct answers: A, B
Explanation
By leveraging an OCI Public Load Balancer with WAF and isolating front-end servers within a private subnet, you ensure that only inspected traffic reaches the application. Integrating OCI Cloud Guard provides automatic blocking of malicious IP addresses and logging of threats, adding a proactive layer of security. These approaches align with Oracle� recommended best practices for network security in OCI, as described in the official documentation on securing infrastructure and application tiers (see OCI documentation for details on WAF, Cloud Guard, and recommended network configurations).
- A. Correct.
Option 1 is correct. Using a public load balancer with WAF ensures that all incoming traffic passes through WAF protection. Placing front-end servers in a private subnet and creating Security List rules restricting traffic only from the load balancer helps prevent direct access from the public internet. This setup follows the principle of least privilege and ensures robust perimeter security.
- B. Correct.
Option 2 is correct. OCI Cloud Guard can integrate with the WAF to identify suspicious IP addresses and automatically block or challenge them. It can also forward related security events to OCI Logging for analysis. This real-time threat response and logging provide continuous monitoring and proactive protection.
- C. Incorrect.
Option 3 is incorrect. Placing front-end servers directly in a public subnet with an Internet Gateway and relying only on OS firewalls can expose your servers to direct attacks from the internet. Additional security layers like a WAF and private subnet isolation are essential for best practices.
- D. Incorrect.
Option 4 is incorrect. Disabling stateful inspection in Security Lists removes a critical layer of security. While WAF is powerful, it is best used in combination with other network security controls, including Security Lists or Network Security Groups, to address different threat vectors.
- E. Incorrect.
Option 5 is incorrect. A NAT Gateway is for outbound connections from private subnets to the internet, not for inbound traffic. It would not help in filtering or inspecting incoming requests before they reach the front-end servers. Inbound requests should be directed through the public load balancer with WAF.