1Z0-1104-25 Question 76
Single answerYour company is deploying a business-critical web application in the Phoenix region on Oracle Cloud Infrastructure (OCI). The application must meet a 99.99% uptime SLA and requires end-to-end encryption for sensitive financial transactions. You have multiple Availability Domains (ADs) in the region. How should you configure your OCI load balancer to ensure high availability and maintain the required encryption standards?
- A
Deploy a regional public load balancer with SSL termination at the load balancer and enable SSL between the load balancer and backend servers, distributing traffic across multiple ADs.
- B
Deploy a private load balancer in each Availability Domain without configuring SSL on the load balancer, relying on Oracle-provided certificates for encryption.
- C
Use a public load balancer in a single Availability Domain with SSL termination at the load balancer, but no encryption for traffic to the backend servers.
- D
Rely on an external WAF to handle encryption and configure a public load balancer with no SSL termination at all.
Show answer and explanation
Correct answer: A
Explanation
To achieve true high availability on OCI, you should use a regional load balancer spanning multiple Availability Domains. Configuring SSL for both the client-to-load-balancer connection and the load-balancer-to-backend connection ensures secure end-to-end encryption. Refer to Oracle Cloud Infrastructure Load Balancer documentation for best practices on deploying a regional load balancer and implementing SSL certificates to meet stringent security and availability requirements.
- A. Correct.
Option 1 is correct. A regional public load balancer can span multiple Availability Domains, providing high availability in case one AD becomes unavailable. Configuring SSL termination at the load balancer secures traffic from clients to the load balancer, and enabling SSL between the load balancer and backend servers ensures end-to-end encryption. This setup meets both the availability and encryption requirements.
- B. Incorrect.
Option 2 is incorrect. While private load balancers can be used for internal scenarios, you need a public endpoint for external traffic if you're operating a web application. Additionally, relying on Oracle-provided certificates without configuring your own SSL certificates on the load balancer does not guarantee end-to-end encryption as required for sensitive financial data.
- C. Incorrect.
Option 3 is incorrect. Using a load balancer in only one Availability Domain undermines high availability, as a single AD can become a single point of failure. Furthermore, not encrypting traffic between the load balancer and backends violates the end-to-end encryption requirement for sensitive transactions.
- D. Incorrect.
Option 4 is incorrect. An external WAF can provide additional security features, but it does not negate the need for an SSL configuration on the load balancer itself. Relying on the WAF alone results in unencrypted traffic between the WAF and the load balancer or backends, breaching the end-to-end encryption requirement.