1Z0-1104-25 Question 98
Single answerYour finance department has engaged a third-party auditor who needs short-lived direct SSH access to an instance in a private subnet for an urgent compliance check. You want to allow them a maximum of 90 minutes of access, after which their entry is automatically revoked. Which approach should you implement to meet this requirement using OCI Bastion?
- A
Create a Bastion session with an ephemeral key, specifying a session duration of 90 minutes.
- B
Provide the auditor with a permanent public key, and instruct them to connect directly over the public IP of the instance.
- C
Create a local user on the instance, place the auditor� SSH key in the authorized_keys file, and remove it manually after 90 minutes.
- D
Write an IAM policy granting indefinite ssh access to the private subnet, but rely on manual revocation once the audit is complete.
Show answer and explanation
Correct answer: A
Explanation
Oracle Cloud Infrastructure Bastion enables administrators to offer secure, time-limited SSH sessions to private instances. By specifying a session duration (for example, 90 minutes) and leveraging ephemeral keys, access automatically terminates once the session expires. This approach aligns with best practices outlined in OCI documentation, ensuring minimal exposure for short-term access needs and reducing the risk of human error.
- A. Correct.
Option 1 is correct. OCI Bastion allows you to create time-limited sessions with ephemeral keys. You can set a maximum session duration (up to 3 hours) to ensure access automatically expires, addressing the requirement for a 90-minute limit.
- B. Incorrect.
Option 2 is incorrect. Providing a permanent public key and instructing access via public IP does not use OCI Bastion, and it does not automatically expire. This approach also exposes the instance to public traffic unnecessarily.
- C. Incorrect.
Option 3 is incorrect. While manually removing SSH keys from the instance� authorized_keys file may work, it is not an automated solution and is prone to human error. It also bypasses OCI Bastion� built-in features for time-limited access.
- D. Incorrect.
Option 4 is incorrect. Granting indefinite access and relying on manual revocation conflicts with the requirement for an automated 90-minute window. This approach leaves room for oversight and does not leverage Bastion� time-limited capabilities.