1Z0-997-26 Security — 20 Questions

Question 1

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.. OCI Web Application Firewall (WAF) provides centralized protection against web application attacks, such as SQL injection, XSS, and other OWASP Top 10 vulnerabilities, by inspecting HTTP/HTTPS traffic.

Answer

Enable OCI Audit logs and configure automated notifications via OCI Notifications service.

Answer

Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.

Answer

Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.

Question 2

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

Accepted Answer

OCI Vault service to create and manage Customer-Managed Keys (CMK).. OCI Vault allows customers to manage their own master encryption keys (CMK) and provides full lifecycle management including key rotation and usage tracking.

Answer

OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).

Answer

OCI Database Management service.

Answer

OCI Identity and Access Management (IAM) password policies.

Question 3

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

Accepted Answer

Local VCN Peering.. VCN Peering (specifically Local VCN Peering within the same region) allows resources in different VCNs to communicate privately using private IP addresses.

Answer

Dynamic Routing Gateway (DRG) with internet breakout enabled.

Answer

Internet Gateway with strict Security List rules.

Answer

OCI Bastion service.

Question 4

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

Accepted Answer

An OCI Service Gateway.. OCI Service Gateway allows private access from a VCN to Oracle services (like Autonomous Database and Object Storage) without using public IPs or traversing the public internet.

Answer

A NAT Gateway combined with a public IP address on the database.

Answer

A Site-to-Site VPN connection back to the corporate data center.

Answer

An Internet Gateway attached to the VCN route table.

Question 5

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

Accepted Answer

Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.. OCI Audit logs all API calls automatically. To ensure tamper-proofing and long-term compliance retention, administrators should use Object Storage buckets configured with WORM (Write Once, Read Many) policies via Object Storage Object Lock.

Answer

Enable OCI Cloud Guard with default responder rules.

Answer

Deploy OCI Network Firewall to inspect all control plane traffic.

Answer

Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

Question 6

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

Accepted Answer

OCI Cloud Guard.. OCI Cloud Guard provides continuous monitoring of your OCI resources for security vulnerabilities, configuration drifts, and risky user behaviors.

Answer

OCI Audit.

Answer

OCI Web Application Firewall.

Answer

OCI Vulnerability Scanning Service.

Question 7

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

Accepted Answer

Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.. Using fine-grained matching rules in dynamic groups based on specific compartment OCIDs or resource tags ensures that workloads only receive the exact permissions needed, adhering to the principle of least privilege.

Answer

Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

Answer

Disable compartment security boundaries and assign all users to the Administrators group.

Answer

Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

Question 8

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones enforce strict guardrails by automatically validating resource creation and configuration changes against a predefined set of security policies, preventing non-compliant actions.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.

Question 9

An organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?

Accepted Answer

Configure a Virtual Private Vault backed by dedicated hardware security module (HSM) partitions and manage master encryption keys.. Using an OCI Vault with external key management (or dedicated Virtual Private Vaults backed by dedicated HSM partitions) allows organizations to retain full control over their keys, including immediate revocation.

Answer

Use Oracle-managed encryption keys with automatic key rotation enabled.

Answer

Rely on OCI Database Vault to manage cloud-level master encryption keys.

Answer

Store plain-text keys in OCI Object Storage with restricted IAM policies.

Question 10

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Accepted Answer

OCI Vulnerability Scanning Service. OCI Vulnerability Scanning Service (VSS) routinely inspects host operating systems and container images for security vulnerabilities and missing patches.

Answer

OCI Cloud Guard

Answer

OCI Identity and Access Management

Answer

OCI Application Performance Monitoring

Question 11

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

Accepted Answer

OCI Bastion service.. OCI Bastion provides restricted and secure transient access to target resources that do not have public endpoints, using SSH or Port Forwarding through a managed service.

Answer

OCI NAT Gateway.

Answer

OCI Load Balancer with TCP routing.

Answer

OCI API Gateway.

Question 12

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

Accepted Answer

Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.. Network Security Groups (NSGs) or Security Lists control packet-level traffic. NSGs are applied directly to specific VNICs, providing granular control over instance-level traffic isolation.

Answer

Disable the OCI Internet Gateway on the VCN route table.

Answer

Enable OCI Bastion service on the database subnet.

Answer

Configure OCI IAM policies to block network ingress at the user level.

Question 13

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

Accepted Answer

Allow group Auditors to read all-resources in compartment Production. The verb 'inspect' allows users to list resources without viewing sensitive metadata, while 'read' allows viewing resource metadata. Scoping the policy to a specific compartment restricts access appropriately.

Answer

Allow group Auditors to use database-families in root

Answer

Allow group Auditors to read compartments in tenancy

Answer

Allow group Auditors to manage all-resources in tenancy

Question 14

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

Accepted Answer

Configure OCI IAM identity federation with your enterprise IdP for developers, and apply an IAM authentication policy enforcing MFA for native console administrators.. OCI IAM supports identity federation with SAML 2.0-compliant IdPs for enterprise users while enforcing local or native MFA policies for native console accounts, configured via IAM authentication policies and IdP federation.

Answer

Create separate tenancies for administrators and developers.

Answer

Write IAM policies with conditional statements checking the user's IP address.

Answer

Disable native IAM users entirely and force all users to share a single administrator account with MFA.

Question 15

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

Accepted Answer

Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.. OCI Vault keys are regional resources. To comply with data residency and security policies, you must provision separate vaults and master encryption keys in each operating region.

Answer

Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

Answer

Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

Answer

Store all keys in the home region and use the OCI Service Gateway for remote decryption.

Question 16

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

Accepted Answer

Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.. To isolate a compromised instance while keeping volumes intact, the automated function should remove the instance's existing NSGs and attach a restrictive quarantine NSG that blocks all traffic, or disassociate its VNIC from active subnets, while leaving block volumes untouched.

Answer

Delete the VCN containing the instance to stop all routing.

Answer

Terminate the compute instance and delete all attached block volumes immediately.

Answer

Revoke the IAM user credentials of the administrator who launched the instance.

Question 17

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

Accepted Answer

Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.. OCI Vault Secrets management allows applications and functions to securely store and retrieve credentials at runtime using OCI SDKs, eliminating plaintext secrets in environment variables or code.

Answer

Hardcode the credentials inside the function source code repository.

Answer

Store secrets in OCI Object Storage with public read access.

Answer

Encode the credentials in Base64 and store them in IAM policy descriptions.

Question 18

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

Accepted Answer

Object Storage Object Lock with Compliance mode.. Object Storage Object Lock enables WORM (Write Once, Read Many) storage, preventing objects from being deleted or modified until a retention period expires or indefinitely in compliance mode.

Answer

OCI Cloud Guard data protection detectors.

Answer

OCI Object Storage Pre-Authenticated Requests (PAR).

Answer

OCI Vault key rotation policies.

Question 19

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

Accepted Answer

IAM Group. An IAM user group is used to aggregate users with similar roles so that policies can be applied to the group collectively.

Answer

Compartment

Answer

Federation Provider

Answer

Dynamic Group

Question 20

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

Accepted Answer

OCI Cloud Guard Managed Recipes and Responder Rules.. OCI Cloud Guard provides managed problem remediation and configuration recommendations across your tenancy.

Answer

OCI Bastion Service session manager.

Answer

OCI Database Migration Service.

Answer

OCI IAM Policy Generator.