1Z0-1104-25 Question 69
Select 2An organization is deploying a new e-commerce system in Oracle Cloud Infrastructure. The environment includes multiple subnets: a public subnet hosting web servers with public IP addresses and a private subnet hosting database servers. The company wants to allow inbound HTTP/HTTPS traffic only to the web servers (TCP ports 80 and 443) from the public internet, while preventing any direct external access to the database servers. Additionally, the web servers must be able to communicate with the database on TCP port 1521. The organization also plans to use host-based firewalls on both server tiers. Which two configuration steps will help ensure only authorized traffic reaches the applications while keeping the database private?
- A
- Create a Security List with stateful ingress rules for TCP ports 80 and 443 from 0.0.0.0/0, apply it to the web subnet, and configure a separate rule allowing traffic from the web subnet to the database subnet on port 1521.
- B
- Place both the web servers and database servers in the same Network Security Group (NSG) with a single rule allowing inbound traffic on TCP ports 80, 443, and 1521 from 0.0.0.0/0.
- C
- Implement separate NSGs: one for the web tier allowing inbound HTTP/HTTPS (TCP ports 80/443) from 0.0.0.0/0, and another for the database tier allowing only inbound traffic from the web tier's NSG on port 1521.
- D
- Disable host-based firewalls on the web servers to avoid conflicts and rely solely on Security List or NSG rules.
- E
- Assign public IP addresses directly to database servers to simplify connectivity and monitoring of traffic from the internet.
Show answer and explanation
Correct answers: A, C
Explanation
In Oracle Cloud Infrastructure, layering Security Lists or NSGs with host-based firewalls is a recommended approach to achieve defense in depth. Traffic rules on NSGs or Security Lists ensure tier-based connectivity, while host-based firewalls provide another protective layer at the operating system level. By segregating the web tier and database tier using separate NSGs or Security Lists and carefully controlling inbound/outbound rules, you minimize the risk of unauthorized access. For more details, consult Oracle Cloud Infrastructure documentation on VCN security best practices.
- A. Correct.
Option 1 is correct. Using a Security List on the web subnet to allow inbound HTTP/HTTPS traffic (TCP ports 80 and 443) from the public internet is a valid way to protect the front end. Adding a rule in the same list or a separate list to allow traffic from the web subnet to the database subnet on port 1521 ensures the database is only accessible through the web tier. This setup prevents direct external access to the database subnet while allowing required application traffic.
- B. Incorrect.
Option 2 is incorrect. Placing both tiers in the same NSG with a single rule allowing inbound traffic on multiple ports from 0.0.0.0/0 would expose the database servers directly to the internet. This defeats the purpose of isolating the database tier.
- C. Correct.
Option 3 is correct. Creating separate NSGs for the web tier (allowing traffic from the internet on ports 80 and 443) and the database tier (allowing traffic only from the web tier� NSG on port 1521) effectively segregates the layers. This is a best practice that helps minimize exposure of the database servers.
- D. Incorrect.
Option 4 is incorrect. Disabling the host-based firewall removes an extra layer of security. Best practices recommend using both NSGs or Security Lists and host-based firewalls for defense in depth.
- E. Incorrect.
Option 5 is incorrect. Assigning public IP addresses to database servers allows direct internet traffic, which violates the requirement of keeping the database subnet private. This would unnecessarily increase the attack surface.