1Z0-997-25 Question 63
Select 3You are building a multi-tier application with a front-end web tier, an application tier, and a back-end database tier in Oracle Cloud Infrastructure (OCI). The front-end traffic from the public Internet should be inspected for malicious payloads, while internal communications between tiers must remain protected and segmented. You also need to monitor for potential intrusions to meet compliance requirements and store database passwords securely. Which three design recommendations best address these requirements?
- A
Use OCI Web Application Firewall (WAF) integrated with the public load balancer to inspect and filter inbound traffic.
- B
Leverage Oracle Cloud Guard to continuously monitor resource configurations and detect potential security threats.
- C
Use a single Network Security Group for all tiers to simplify network rules and group traffic flows.
- D
Store database credentials and encryption keys in OCI Vault to protect sensitive secrets.
- E
Expose the database tier to the public Internet, allowing unrestricted administrative access from anywhere.
Show answer and explanation
Correct answers: A, B, D
Explanation
A secure multi-tier architecture in OCI requires multiple layers of protection. OCI Web Application Firewall (WAF) inspects traffic for malicious content before it reaches the web tier. Oracle Cloud Guard continuously monitors the environment for misconfigurations and threats, helping maintain compliance. Storing secrets in OCI Vault ensures sensitive credentials are protected with encryption and access controls. Network segmentation should be implemented through separate Network Security Groups or other network controls for each tier, preventing lateral movement within your environment. Refer to the Oracle Cloud Infrastructure Security documentation for detailed best practices and configuration guidelines.
- A. Correct.
Correct. Using OCI Web Application Firewall (WAF) in front of the load balancer helps detect and filter common exploits (e.g., SQL injection, cross-site scripting) before they reach your web servers. This addresses the requirement to inspect inbound traffic from the public Internet.
- B. Correct.
Correct. Oracle Cloud Guard helps you detect misconfigurations and suspicious activities in your tenancy. Enabling Cloud Guard allows you to continuously monitor configurations and resources for potential threats, thereby addressing the compliance requirement for threat detection.
- C. Incorrect.
Incorrect. While Network Security Groups (NSGs) are a good practice for controlling traffic, using just one NSG for all tiers would overly simplify the rules and not properly segment traffic between tiers. Each tier should have its own NSGs or at least carefully scoped NSGs to control ingress and egress at a granular level.
- D. Correct.
Correct. OCI Vault provides a secure location to store and manage secrets, such as database credentials and encryption keys. Centralizing sensitive secrets in Vault ensures they are protected with robust security controls and helps meet compliance mandates for password protection.
- E. Incorrect.
Incorrect. Exposing the database tier directly to the Internet is a high-risk practice. It creates a large attack surface and violates the requirement to keep internal tiers protected from external access.