1Z0-997-25 Question 62
Select 2You�re tasked with designing a three-tier application on Oracle Cloud Infrastructure (OCI). Your design places a public load balancer and web servers in a public subnet, application servers in a private subnet, and a database in another private subnet. You need to ensure: (a) only the public tier is reachable from the internet, (b) the application tier only accepts traffic from the public tier, (c) the database tier only accepts traffic from the application tier, (d) you use OCI Web Application Firewall (WAF) to protect HTTP/HTTPS traffic, and (e) you store all encryption keys securely in OCI Vault. Which two design considerations should you implement to meet these requirements?
- A
Place a single Security List on the entire VCN allowing all inbound traffic to the application and database tiers, then rely on IAM policies to limit public access.
- B
Use Network Security Groups (NSGs) to restrict traffic flows between the public, application, and database subnets, ensuring each tier can only communicate with the required upstream/downstream tier.
- C
Configure OCI Web Application Firewall (WAF) to protect the backend application servers� ports directly; do not apply WAF to the public load balancer since the load balancer already handles traffic routing.
- D
Deploy OCI Vault to manage and store encryption keys, and configure your database and application servers to use these keys for both data-at-rest and data-in-transit encryption where applicable.
- E
Place application servers in the public subnet with a public IP for each instance to simplify administrative access, and rely on host-based firewalls to control traffic.
Show answer and explanation
Correct answers: B, D
Explanation
Designing a secure multi-tier architecture on OCI involves applying best-practice security measures at each layer. First, enforce traffic restrictions with NSGs or appropriately scoped Security Lists, ensuring only the necessary paths (public subnet → application subnet → database subnet) are open. Next, place WAF in front of the public-facing load balancer to filter malicious traffic at the edge. Finally, store and manage your encryption keys in OCI Vault to maintain secure key management for data-at-rest and, where applicable, data-in-transit. For more details, refer to Oracle� documentation on Network Security Groups, OCI Web Application Firewall, and OCI Vault configuration.
- A. Incorrect.
Incorrect. A single Security List allowing all inbound traffic to the application and database tiers is insecure. IAM policies control who can manage OCI resources, not inbound network traffic. Network security in a multi-tier app should be enforced at the network level (Security Lists or NSGs) rather than solely relying on IAM.
- B. Correct.
Correct. NSGs enable you to define granular ingress and egress rules for each tier, ensuring that only the allowed source and destination ports and protocols are permitted. This directly enforces the principle of least privilege between tiers (public→app→database).
- C. Incorrect.
Incorrect. WAF is most effective when applied in front of your public-facing endpoints (i.e., the public load balancer). Attaching WAF to protect backend ports directly is not a recommended pattern for standard multi-tier setups, as external HTTP/HTTPS traffic should be filtered first at the load balancer level to reduce risk.
- D. Correct.
Correct. Storing and managing encryption keys in OCI Vault follows best practices for secure key management. Configuring your services (database, block volumes, etc.) to use Vault-managed keys helps ensure data-at-rest encryption. Data-in-transit encryption can be managed by SSL/TLS certificates, which can also be securely stored or referenced from the Vault.
- E. Incorrect.
Incorrect. Placing application servers in a public subnet with public IP addresses runs counter to the requirement of restricting direct internet access to the application tier. Instead, you should keep the application servers in a private subnet and manage administrative access via a bastion or other secure channel.