1Z0-1104-25 Question 70
Single answerYour organization hosts a multi-tier application in Oracle Cloud Infrastructure (OCI) with a public subnet for the load balancer and a private subnet for application servers. You need to strictly allow only HTTPS (port 443) traffic originating from the load balancer to the application servers, while also leveraging the new OCI Network Firewall for advanced policy enforcement and threat detection. Which approach best meets these requirements?
- A
Use only a Security List on the private subnet that allows inbound traffic on port 443 from all public IP addresses, relying on the Network Firewall for any further inspection.
- B
Attach a Network Security Group (NSG) to the private subnet's application servers, allowing inbound port 443 specifically from the load balancer's NSG, and leverage the Network Firewall for advanced inspection.
- C
Keep the default Security List rules for the private subnet and rely on the Network Firewall alone to restrict all traffic except port 443 originating from the load balancer.
- D
Eliminate the Security List and NSG configurations entirely and rely solely on the Network Firewall to manage all inbound traffic restrictions.
Show answer and explanation
Correct answer: B
Explanation
Network Security Groups (NSGs) and Security Lists both provide layer 3/4 controls in OCI, but NSGs offer more granular and flexible protection by grouping resources and selectively allowing traffic from other NSGs or specific IP ranges. In this scenario, attaching an NSG to the application servers that strictly accepts inbound traffic only from the load balancer NSG on port 443 follows the principle of least privilege. The OCI Network Firewall can then perform advanced traffic inspection and threat detection for additional security. For detailed best practices, refer to the OCI documentation on Network Security Groups and OCI Network Firewall integration.
- A. Incorrect.
Incorrect. Allowing port 443 from all public IP addresses in the Security List will permit any external host to reach your application servers, which violates the strict source restriction requirement.
- B. Correct.
Correct. By attaching an NSG to the application servers and specifying a rule that allows port 443 only from the load balancer� NSG, you ensure traffic is restricted to the desired source. The Network Firewall then adds advanced threat detection and inspection capabilities on top.
- C. Incorrect.
Incorrect. OCI Security Lists with default rules may allow undesirable traffic or not be granular enough to restrict only the load balancer� sources. Relying solely on the Network Firewall without proper subnet-level rules can expose you to misconfiguration risks.
- D. Incorrect.
Incorrect. Although the Network Firewall provides advanced inspection, best practice in OCI is to use Security Lists or NSGs to enforce least privileged access at the subnet or instance level. Relying solely on the firewall for all traffic restrictions is not a recommended approach.