1Z0-997-25 Question 61
Select 2You are designing a three-tier web application on Oracle Cloud Infrastructure (OCI) with the following requirements: The front-end web servers run in a public subnet and must be accessible from the internet over HTTPS only. The middle-tier application servers run in a private subnet and should accept traffic only from the front-end tier. The database tier also runs in a private subnet and should only be accessible from the middle-tier. You want to incorporate OCI Security Services to protect this multi-tier architecture. Which two design choices help ensure a secure environment according to best practices?
- A
A. Place front-end servers behind an OCI Load Balancer with an attached Web Application Firewall (WAF) policy for traffic inspection and blocking malicious requests.
- B
B. Use Security Lists allowing database subnet access from anywhere on the internet to ensure the database is reachable.
- C
C. Use Network Security Groups (NSGs) to restrict traffic between the middle-tier and database tier to the necessary application ports only.
- D
D. Serve traffic through HTTP on the front-end subnet to simplify SSL certificate management and reduce overhead.
Show answer and explanation
Correct answers: A, C
Explanation
A secure multi-tier design in OCI typically includes placing front-end instances behind a Load Balancer configured with an OCI WAF, using private subnets for both the application and database tiers, and leveraging NSGs for fine-grained access control. Restricting traffic flow to the necessary protocols and subnets, along with using encryption over HTTPS, helps mitigate common attack vectors. Refer to the official OCI documentation on 'Best Practices for Securing a Multi-tier Web Application' and 'Using Network Security Groups' for more details.
- A. Correct.
A. Correct. Placing front-end servers behind an OCI Load Balancer and using an OCI WAF policy is a recommended security approach to filter malicious traffic, enforce HTTPS, and inspect inbound requests. This leverages OCI� built-in security features to reduce exposure.
- B. Incorrect.
B. Incorrect. Allowing direct database access from the public internet is a significant security risk. Database resources should not be publicly exposed. Traffic to the database should be strictly controlled to only the middle-tier subnet.
- C. Correct.
C. Correct. Network Security Groups (NSGs) provide granular control of ingress and egress rules, ensuring only necessary ports and IP ranges from the middle-tier can reach the database tier. This is a best practice for multi-tier deployments to minimize lateral movement and enhance security.
- D. Incorrect.
D. Incorrect. Serving traffic over HTTP on the front-end subnet is not a best practice because it does not encrypt data in transit. OCI Load Balancer and WAF can handle SSL certificates to secure front-end communication over HTTPS.