1Z0-997-25 Question 58
Select 2Your organization is deploying a multi-tier e-commerce application on Oracle Cloud Infrastructure (OCI), consisting of a public-facing web tier, an internal application tier, and a private database tier. You must ensure that only necessary services are exposed to the public, traffic paths between tiers are restricted, and traffic inspection occurs at the front end. Which two steps are recommended to achieve a secure architecture that meets these requirements?
- A
A) Deploy all tiers in a single subnet and rely solely on the default security list for network protection.
- B
B) Place the web tier in a public subnet protected by the OCI Web Application Firewall (WAF), and use network security groups to control traffic from the internet.
- C
C) Deploy the application tier in a private subnet, allowing inbound traffic only from the web tier through tightly scoped security rules.
- D
D) Provide internet access directly to the database tier for ease of management.
Show answer and explanation
Correct answers: B, C
Explanation
To design a secure multi-tier architecture on OCI, you should segment each tier into separate subnets and use OCI security services like WAF for the public front-end, network security groups or security lists for the appropriate traffic filters, and private subnets for critical tiers such as the application and database layers. Refer to the latest OCI Networking and Security documentation for best practices on implementing multi-tier segmentation, WAF configuration, and the principle of least privilege.
- A. Incorrect.
A) Incorrect: Putting all tiers in a single subnet relies too heavily on a single security boundary (the default security list) and makes it difficult to apply the principle of least privilege. It also increases the attack surface because there is no segmented network layer.
- B. Correct.
B) Correct: Using a public subnet for the web tier ensures it can receive traffic from the internet. Pairing it with OCI WAF and network security groups provides advanced threat detection, traffic filtering, and the flexibility to apply fine-grained rules.
- C. Correct.
C) Correct: Placing the application tier in a separate private subnet and allowing inbound traffic only from the web tier follows the principle of least privilege. Tightly scoped security rules minimize exposure and limit the possible attack vectors.
- D. Incorrect.
D) Incorrect: Directly exposing the database tier to the internet greatly increases the risk of attack, violates best practices for data confidentiality, and does not use the layered security approach advocated by OCI.