1Z0-997-25 Question 57
Single answerYou are designing a multi-tier e-commerce application on Oracle Cloud Infrastructure (OCI). The architecture requires that only the web tier APIs be exposed to the public internet, the application tier remain private but able to consume the web tier, and the database only accept connections from the application tier. Additionally, all inbound traffic from the internet should pass through a layer of protection that can filter requests based on application signatures. Which design approach best satisfies these security requirements?
- A
Place the entire application in a single public subnet and allow external access solely through a single configured security list that restricts inbound traffic to HTTPS.
- B
Deploy an OCI WAF in front of a public load balancer for the web tier, place the application tier in a private subnet with network security groups allowing only load balancer traffic, and configure the database tier in another private subnet allowing traffic only from the application tier.
- C
Provision the web and application tiers in the same public subnet using a regional subnet. Use a security list to allow web traffic to both tiers and a separate list to allow application-to-database connections.
- D
Leverage a single private subnet for all tiers and attach a public IP to the application tier. Restrict database access by creating an IAM policy only for database administrators.
Show answer and explanation
Correct answer: B
Explanation
OCI Security Best Practices recommend placing publicly accessible services behind an OCI Web Application Firewall (WAF) and load balancer, while sensitive application and database tiers reside in private subnets. Network security groups should be configured so that only the necessary traffic flows between the tiers. For more information, refer to the official OCI documentation on security architecture patterns and network segmentation (https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm). This layered approach provides defense in depth using both network and application-level protections.
- A. Incorrect.
Option 1 is incorrect: Placing all components in a single public subnet with one security list does not properly isolate the application or database tiers. It also does not ensure traffic passes through a layer-7 filtering solution.
- B. Correct.
Option 2 is correct: Using an OCI WAF in front of a public load balancer protects your web tier from malicious internet traffic. Deploying the application and database tiers in private subnets, with each tier only permitted access from the preceding layer via network security groups, ensures proper isolation and minimizes attack surface.
- C. Incorrect.
Option 3 is incorrect: Putting the web and application tiers in the same public subnet fails to isolate the application tier from external access. Although using a security list can provide some layer of control, it does not offer the recommended layered security approach or WAF-based filtering.
- D. Incorrect.
Option 4 is incorrect: Placing all tiers in a single private subnet and simply attaching a public IP to the application tier bypasses the layered security requirements. IAM policies alone cannot restrict inbound network traffic at the layer-7 level.