1Z0-997-25 Question 1
Select 2You are designing a new microservices-based application on Oracle Cloud Infrastructure (OCI). The plan is to run core services on Oracle Container Engine for Kubernetes (OKE) and event-driven tasks with Oracle Functions. You need to ensure secure and reliable internal communication for the microservices, while minimizing direct exposure to the public internet. Which two strategies should you implement to align with OCI best practices for cloud-native architectures?
- A
Use Oracle Service Mesh to manage internal communication, traffic policies, and service-to-service security.
- B
Expose every microservice publicly on individual ephemeral IP addresses to simplify client access.
- C
Front all external-facing microservices with Oracle API Gateway to handle request routing, authentication, and client throttling.
- D
Embed credentials within container images to avoid external secret references and reduce performance overhead.
Show answer and explanation
Correct answers: A, C
Explanation
Securing microservices� internal communication and limiting surface exposure to external clients are central principles of cloud-native architecture on OCI. Oracle Service Mesh supports traffic policies and security within Kubernetes clusters, while Oracle API Gateway manages external connectivity. These best practices help maintain security, scalability, and operational efficiency. For further details, refer to Oracle� service mesh and API Gateway documentation.
- A. Correct.
Option 1 is correct. Oracle Service Mesh (or a similar service mesh solution) enables fine-grained control over service-to-service communication, enforces zero-trust security models, and provides traffic metrics and policies for microservices. This is a recommended practice for securing and managing complex microservices architectures on OCI.
- B. Incorrect.
Option 2 is incorrect. Exposing microservices directly to the internet via ephemeral IP addresses increases the attack surface and complicates service discovery and security. A better design is to secure internal traffic within a private subnet and use managed services like API Gateway or a service mesh for external access and inter-service communication.
- C. Correct.
Option 3 is correct. Oracle API Gateway allows you to decouple external clients from your internal microservices by providing a single entry point for requests, handling security, authentication, request routing, and traffic throttling. This is a recommended pattern for cloud-native applications.
- D. Incorrect.
Option 4 is incorrect. Hardcoding credentials in container images is an insecure practice. Instead, you should store and manage secrets externally, such as using OCI Vault or Kubernetes Secrets, to ensure credentials remain protected and easily rotatable.