1Z0-997-25 Question 59
Select 2Your organization is planning to deploy a multi-tier web application in Oracle Cloud Infrastructure (OCI) with a public-facing front-end, an internal application tier, and a private database tier. The security team requires end-to-end protection, with the application and data minimally exposed to the public internet. Which two approaches should you recommend as part of a secure architecture design on OCI?
- A
Place the web servers in a public subnet behind an OCI Load Balancer, deploy WAF to defend against common web exploits, and confine the application and database tiers to private subnets accessible only by the front-end tier.
- B
Attach a public Internet Gateway to each tier to allow direct traffic to every layer, ensuring faster connectivity with minimal overhead.
- C
Use Oracle Cloud Guard to continuously monitor the environment for misconfigurations or suspicious activity, and integrate it with other OCI security services to automate remediation.
- D
Disable encryption at rest for the database tier to reduce processing overhead and improve performance.
Show answer and explanation
Correct answers: A, C
Explanation
A well-architected, secure OCI deployment places public-facing components behind a Load Balancer and WAF, with private subnets hosting sensitive application and database tiers. Oracle Cloud Guard helps maintain a strong security posture by monitoring configurations and proactively detecting threats. Refer to Oracle Cloud Infrastructure documentation for details on best practices for multi-tier architectures, network security, and encryption (docs.oracle.com/en/).
- A. Correct.
CORRECT: Placing the front-end servers behind a Load Balancer in a public subnet, implementing WAF, and isolating the app and database tiers in private subnets are recommended OCI security best practices. This design limits direct external traffic and reduces the attack surface.
- B. Incorrect.
INCORRECT: Providing each tier with direct public access via an Internet Gateway is contrary to best practices. It significantly increases the attack surface and exposes internal resources unnecessarily.
- C. Correct.
CORRECT: Oracle Cloud Guard helps identify and remediate misconfigurations and suspicious activity. Integrating it with other security services like Security Zones and Vulnerability Scanning provides proactive monitoring and enforcement of secure configurations.
- D. Incorrect.
INCORRECT: Disabling encryption at rest is strongly discouraged. OCI provides tools like Oracle Cloud Infrastructure Vault and autonomous database encryption by default to protect data. The performance impact is usually minimal, so turning it off to gain performance is insecure.