1Z0-1104-25 Question 87
Single answerYou are configuring an Oracle Cloud Infrastructure (OCI) Web Application Firewall (WAF) to protect a public-facing web application. The application is fronted by an OCI Load Balancer in a public subnet and is served by multiple compute instances in private subnets. You want to ensure that all inbound traffic is inspected and filtered by the WAF before reaching the backend instances. Which step is essential to achieve this configuration?
- A
Create a WAF policy in a different region than your Load Balancer to leverage region-based high availability.
- B
Create a WAF policy, specify the Load Balancer as the origin, and update the DNS record to point traffic to the WAF� public endpoint.
- C
Attach the WAF policy directly to each compute instance� VNIC and set the load balancer to direct traffic through the instance-level WAF policies.
- D
Configure the WAF to use IPsec tunnels for inspection by routing all traffic through an on-premises gateway before it reaches OCI.
Show answer and explanation
Correct answer: B
Explanation
When configuring OCI WAF with public Load Balancers, you must set the Load Balancer as the WAF� origin and update the DNS record to point traffic to the WAF endpoint. This ensures all traffic is routed through the WAF for inspection and filtering before it reaches the backend instances. Refer to Oracle� Web Application Firewall documentation for details on WAF policy configuration, origin settings, and DNS updates to ensure proper traffic flow.
- A. Incorrect.
Incorrect. Placing the WAF policy in a different region than the Load Balancer does not ensure the traffic is filtered before hitting the backend instances. Region-based WAF deployments are possible, but they do not by themselves enforce inspection unless the WAF is correctly integrated with your routing and DNS.
- B. Correct.
Correct. When you create a WAF policy and designate the Load Balancer as the origin, you can direct incoming traffic through the WAF by pointing your DNS record to the WAF� global public endpoint. This ensures traffic is inspected by the WAF before reaching the Load Balancer, effectively protecting backend instances.
- C. Incorrect.
Incorrect. Attaching a WAF policy to each compute instance� VNIC is not a standard OCI practice. The WAF is intended to intercept traffic before it reaches any backend hosts. This option also fails to address the requirement to filter all traffic at the entry point.
- D. Incorrect.
Incorrect. Using IPsec tunnels through an on-premises gateway for WAF inspection is neither a common nor required setup. OCI WAF can be configured within OCI itself without routing traffic off-premises, which introduces unnecessary complexity and latency.