1Z0-1104-25 Question 88
Single answerYour organization has configured an Oracle Cloud Infrastructure Web Application Firewall (WAF) policy with rules to block malicious traffic. However, despite confirming the policy settings in the OCI Console, you discover that SQL injection and cross-site scripting attempts are still reaching your backend servers. Which step should you verify to ensure the WAF is actually protecting your site?
- A
Use the WAF� quick start wizard to block all requests from unknown IP addresses by default.
- B
Attach the WAF policy as a rule set directly to the backend servers� subnet security list.
- C
Enable WAF metrics for extended logging and analysis within the OCI Monitoring service.
- D
Reconfigure your domain� DNS to point traffic to the WAF edge endpoint rather than directly to the origin.
Show answer and explanation
Correct answer: D
Explanation
When using Oracle Cloud Infrastructure WAF, it is critical to route traffic through the WAF endpoint or an OCI Load Balancer configured with a WAF policy. If your domain� DNS still directs requests to the backend origin or a load balancer without the WAF policy, the malicious traffic bypasses inspection. Refer to OCI� Web Application Firewall documentation for best practices on properly routing your application domain through the WAF edge endpoints.
- A. Incorrect.
Option 1 is incorrect. While the WAF Wizard assists in rule creation, simply blocking all unknown IP addresses is not a recommended or standard WAF configuration step. It may accidentally block legitimate traffic and does not ensure that traffic routes through the WAF.
- B. Incorrect.
Option 2 is incorrect. Attaching WAF policy to a subnet security list is not how OCI WAF intercepts and inspects traffic. Security lists control network port access rather than providing full application-layer inspection. In OCI, you must explicitly ensure traffic flows through the WAF endpoint or load balancer integration rather than relying on subnet security lists.
- C. Incorrect.
Option 3 is incorrect. Enabling WAF metrics aids in monitoring and troubleshooting but does not itself guarantee that malicious requests are blocked. If traffic is not routed through the WAF in the first place, logs and metrics will not address the underlying issue.
- D. Correct.
Option 4 is correct. To protect your application, you need to ensure that all incoming traffic is routed through the WAF. In many implementations, this requires updating your DNS records so the domain points to the WAF� edge endpoint (or the OCI Load Balancer that has the WAF policy attached), rather than allowing requests to go directly to the application servers or the origin load balancer.