1Z0-1104-25 Question 72
Select 3You have deployed a multi-tier web application on Oracle Cloud Infrastructure (OCI) with a public subnet hosting a load balancer and a private subnet hosting the application servers. You need to ensure only HTTPS traffic from the internet reaches the load balancer, while only the load balancer can reach the application servers on the appropriate port. Additionally, you want to incorporate an advanced inspection mechanism. Which of the following configurations should you consider to enhance your overall VCN security?
- A
Configure the Security List for the public subnet with an ingress rule allowing TCP port 443 from 0.0.0.0/0.
- B
Create a Network Security Group for the application servers that only allows inbound connections from the load balancer� NSG on the required application port.
- C
Deploy a network firewall in your VCN for advanced packet inspection and threat intelligence blocking.
- D
Disable the Security List on the private subnet to rely solely on NSGs for traffic control.
Show answer and explanation
Correct answers: A, B, C
Explanation
For a multi-tier OCI deployment, it is best practice to configure subnet-level Security Lists as a baseline to allow only the necessary traffic (like HTTPS from the internet). Further refine security at the instance level by applying Network Security Groups that allow inbound traffic only from trusted sources�such as a specific load balancer NSG. Additionally, using a network firewall adds another layer of security with features like advanced threat intelligence and deep packet inspection, as recommended in Oracle documentation for secure VCN design.
- A. Correct.
Correct. The public subnet hosting the load balancer must allow TCP traffic on port 443 from the internet. Configuring an ingress rule in the Security List ensures the load balancer can receive HTTPS requests from any external host.
- B. Correct.
Correct. Using a Network Security Group (NSG) for the application servers, with a rule allowing inbound traffic only from the load balancer� NSG, ensures that only legitimate traffic from the load balancer on the specified port reaches the private subnet instances.
- C. Correct.
Correct. A network firewall (e.g., OCI Network Firewall) can provide additional capabilities such as deep packet inspection, intrusion detection/prevention, and blocking known malicious IPs, enhancing overall security beyond basic ingress/egress filtering.
- D. Incorrect.
Incorrect. Disabling the Security List on the private subnet is not recommended. While NSGs can control traffic at the instance level, Security Lists at the subnet level offer an additional layer of protection. Using NSGs together with Security Lists can improve defense-in-depth and reduce misconfiguration risks.