1Z0-1104-25 Question 85
Single answerYour team recently created an Oracle Cloud Infrastructure (OCI) Web Application Firewall (WAF) policy for a public-facing e-commerce application. The policy includes a rule to block suspicious IP ranges that are repeatedly probing for vulnerabilities. However, you are still seeing malicious requests reaching the backend service. Which additional step must you take to ensure that the WAF policy actually filters the application traffic?
- A
Associate the WAF policy with the OCI resource (such as the load balancer) that serves the application.
- B
Recreate the entire WAF policy in the same compartment as the suspicious IP addresses.
- C
Configure the WAF policy to only allow traffic from OCI IP addresses using a pass rule.
- D
Enable the default DDoS protection feature in the WAF policy settings so that all malicious IP ranges are automatically blocked.
Show answer and explanation
Correct answer: A
Explanation
When working with Oracle Cloud Infrastructure Web Application Firewall, creating a policy is only part of the process. You must attach the WAF policy to the relevant resource (for example, an OCI load balancer or edge endpoint) so that traffic to your application is inspected and managed by the policy. Refer to the official OCI documentation on 'WAF Policies' for detailed steps on attaching and configuring policies to protect your applications.
- A. Correct.
Correct. Creating a WAF policy alone does not protect your application. You must attach or associate the WAF policy with the OCI resource handling your traffic, such as a public load balancer, so that incoming requests are inspected according to the policy rules. This is a key step in enforcing WAF protection.
- B. Incorrect.
Incorrect. Compartment placement of the policy does not directly determine whether the policy is enforced. While it is important to manage resources in the correct compartment, simply recreating the WAF policy in another compartment does not ensure that your application traffic is filtered.
- C. Incorrect.
Incorrect. This option would significantly restrict legitimate traffic. A pass rule is used to explicitly allow certain traffic, but it would not solve the immediate need to block malicious IP ranges. Moreover, such a restrictive rule for all OCI IP addresses is neither recommended nor aligned with best practices unless you have a very specific traffic profile.
- D. Incorrect.
Incorrect. While OCI WAF includes configurable protection features and can integrate with DDoS mitigation, simply enabling a default DDoS protection setting does not automatically block all malicious IP ranges. You still need to attach the WAF policy to the resource and define the specific block rules.