1Z0-997-25 Question 50
Select 3An e-commerce company is building a new application on Oracle Cloud Infrastructure that processes and stores sensitive customer data. The solution includes a web front end, an application tier, and a database tier in separate subnets. The company wants to ensure data security in transit and at rest and mitigate common web-based threats. Which three approaches should the company implement to meet these security requirements? (Choose three.)
- A
Deploy an OCI Web Application Firewall (WAF) in front of the web tier to protect against threats like SQL injection and cross-site scripting.
- B
Configure an SSL-enabled Load Balancer with end-to-end encryption to protect data in transit between the client and the application tier.
- C
Use Oracle Cloud Infrastructure Vault to manage and rotate encryption keys for data stored in the database tier.
- D
Create a Security List with a wide open inbound rule that allows all traffic on all ports from any source.
- E
Disable database encryption at rest, relying only on Oracle-managed default encryption across all layers.
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement robust security in OCI, it is essential to protect data at every layer. Using a WAF helps mitigate common exploits targeting the web frontend. End-to-end encryption via SSL ensures data remains confidential in transit. OCI Vault enables secure storage and rotation of encryption keys, providing better control and compliance for data at rest. Refer to the Oracle Cloud Infrastructure Security documentation, including guidance on WAF services, Load Balancer SSL configurations, and OCI Vault best practices, for complete implementation details.
- A. Correct.
Correct. An OCI Web Application Firewall (WAF) provides protection from common web exploits like SQL injection and cross-site scripting, aligning with best practices for securing public-facing endpoints.
- B. Correct.
Correct. Configuring an SSL-enabled Load Balancer with end-to-end encryption ensures data is secured in transit, preventing unauthorized access to sensitive information while it traverses the network.
- C. Correct.
Correct. Storing and managing encryption keys in Oracle Cloud Infrastructure Vault is crucial for protecting data at rest. It allows for proper key rotation and separation of duties, reducing the risk of unauthorized decryption.
- D. Incorrect.
Incorrect. Wide open inbound rules expose the environment to potential attacks. You should use Security Lists or Network Security Groups with least privilege, allowing only required traffic on specific ports.
- E. Incorrect.
Incorrect. Relying solely on default encryption omits the additional control and security benefits of using customer-managed keys. Leveraging Oracle Cloud Infrastructure Vault allows greater oversight and compliance with data protection standards.