Security

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

An organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

You are configuring a site-to-site IPSec VPN between your on-premises datacenter and an OCI VCN. To ensure data confidentiality and integrity across the public internet, which encryption algorithms should you mandate in the IPSec configuration?

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

What is the primary function of OCI Network Security Groups (NSGs)?

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

An enterprise customer wants to restrict OCI API access so that developers can only invoke management APIs from corporate office public IP addresses. Which OCI feature implements this restriction?

An enterprise security architect is designing a defense-in-depth strategy for an OCI environment hosting sensitive financial data. Which TWO architectural practices should be implemented to ensure robust network and data security? (Choose two.)

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Which THREE methods can be used to establish secure, private connectivity from an on-premises datacenter to an OCI VCN without traversing the public internet? (Choose three.)

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

When configuring OCI Security Zones, which TWO restrictions are automatically enforced on resources within that zone? (Choose two.)

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

An OCI Security Administrator is designing a multi-tenancy IAM architecture using compartments and dynamic groups. Which TWO best practices should be implemented to ensure least-privilege access and scalable policy management?

An enterprise customer needs to restrict access to an OCI Object Storage bucket so that only requests originating from a specific Virtual Cloud Network (VCN) via a Service Gateway can read objects. Which combination of Identity and Access Management (IAM) and network policies should be implemented?

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

An organization requires high security for its cryptographic keys stored in OCI Vault. Which THREE architectural practices must be enforced when configuring and using Master Encryption Keys (MEKs)?

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?