1Z0-997-26 Security — 30 Questions

Question 1

An organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Virtual Private Vault backed by dedicated hardware security module (HSM) partitions and manage master encryption keys.. A Virtual Private Vault in OCI is a dedicated vault backed by dedicated HSM partitions that are not shared with other tenants, and the master encryption keys are stored within those dedicated HSMs. This satisfies the regulatory requirement that keys reside outside Oracle's shared managed infrastructure and can be revoked immediately by the customer. Because the customer controls the vault and its keys, they can schedule deletion or revoke key versions at any time, rendering the encrypted database volumes inaccessible.

Answer

Use Oracle-managed encryption keys with automatic key rotation enabled.

Answer

Rely on OCI Database Vault to manage cloud-level master encryption keys.

Answer

Store plain-text keys in OCI Object Storage with restricted IAM policies.

Question 2

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

Accepted Answer

Configure OCI IAM identity federation with your enterprise IdP for developers, and apply an IAM authentication policy enforcing MFA for native console administrators.. OCI IAM supports identity federation with an external SAML 2.0 IdP, so developers authenticate against the enterprise IdP and receive federated sessions mapped to OCI groups. For native console administrators, an IAM authentication policy can enforce MFA at sign-in, satisfying the requirement that all admin console access use MFA while developers use SSO.

Answer

Create separate tenancies for administrators and developers.

Answer

Write IAM policies with conditional statements checking the user's IP address.

Answer

Disable native IAM users entirely and force all users to share a single administrator account with MFA.

Question 3

An enterprise customer wants to restrict OCI API access so that developers can only invoke management APIs from corporate office public IP addresses. Which OCI feature implements this restriction?

Accepted Answer

IAM policies with conditions checking the 'request.ip' against corporate CIDR blocks.. OCI IAM policies support conditions that can evaluate the request's source IP against a CIDR block using the 'request.ip' variable (or 'request.remote.ip'). By writing a policy with a condition like 'where request.ip in ("203.0.113.0/24")', you restrict API calls to corporate office IP ranges. This is the native OCI mechanism for IP-based API access control.

Answer

OCI WAF rules configured for API Gateway.

Answer

OCI Network Security Groups with CIDR block filters.

Answer

OCI Service Gateway IP whitelisting.

Question 4

An enterprise security architect is designing a defense-in-depth strategy for an OCI environment hosting sensitive financial data. Which TWO architectural practices should be implemented to ensure robust network and data security? (Choose two.)

Accepted Answer

Store all master encryption keys in OCI Vault using customer-managed keys with strict rotation and access policies.. Option A is correct because storing master encryption keys in OCI Vault with customer-managed keys (CMKs) gives the organization full control over key lifecycle, enables strict rotation policies, and enforces least-privilege access through IAM policies and key-level permissions, which is essential for protecting sensitive financial data at rest. Option E is correct because defense-in-depth network security in OCI relies on layered segmentation: private subnets prevent direct internet exposure, Local VCN Peering enables controlled east-west traffic between VCNs, and Network Security Groups (NSGs) apply granular, resource-level stateful firewall rules rather than relying on broad subnet-level security lists. Option B is incorrect because default VCN security lists are permissive and subnet-scoped; NSGs provide more precise, instance-level control and are a recommended best practice. Option C is incorrect because disabling OCI Audit logging removes the immutable audit trail needed for compliance, forensics, and tamper detection, weakening rather than strengthening security. Option D is incorrect because exposing databases directly to the public internet drastically increases the attack surface; databases should reside in private subnets and be accessed via bastion hosts, VPN, or FastConnect.

Answer

Rely entirely on default VCN security lists without implementing Network Security Groups.

Answer

Disable OCI Audit logging to prevent log tampering by administrators.

Answer

Expose all database instances directly to the public internet for easier management.

Question 5

Which THREE methods can be used to establish secure, private connectivity from an on-premises datacenter to an OCI VCN without traversing the public internet? (Choose three.)

Accepted Answer

OCI FastConnect dedicated private circuit.. Option A is correct because an OCI FastConnect dedicated private circuit provides a private, dedicated physical connection between the on-premises datacenter and the OCI VCN that does not traverse the public internet. Option C is correct because OCI Site-to-Site IPsec VPN establishes an encrypted tunnel over the internet between the on-premises CPE and the OCI Dynamic Routing Gateway, keeping traffic private and secure. Option D is correct because OCI FastConnect via a Partner virtual circuit also delivers private connectivity through a FastConnect partner's private network rather than the public internet. Option B is incorrect because an Internet Gateway provides public internet access to a public subnet, which is the opposite of private connectivity. Option E is incorrect because assigning unencrypted public IP addresses to database instances exposes them to the public internet and provides no private path.

Answer

OCI Internet Gateway attached to a public subnet.

Answer

Unencrypted public IP address assignment on database instances.

Question 6

When configuring OCI Security Zones, which TWO restrictions are automatically enforced on resources within that zone? (Choose two.)

Accepted Answer

Resources are strictly prohibited from having public IP addresses.. Option A is correct because OCI Security Zones enforce a policy that prevents resources from being assigned public IP addresses, blocking public exposure at the network layer. Option C is correct because Security Zones require Object Storage buckets to be private, disallowing any public access to bucket contents. Option B is incorrect since Security Zones restrict public connectivity rather than mandating Internet Gateways, which would contradict the zone's purpose. Option D is incorrect because IAM administrators can still create compartments; Security Zones limit resource-level public exposure, not compartment management. Option E is incorrect because Security Zones do not require unencrypted boot volumes; encryption of boot volumes is standard and unrelated to the public-access restrictions enforced by Security Zones.

Answer

All VCNs must have Internet Gateways attached by default.

Answer

IAM administrators are prohibited from creating any compartments.

Answer

All compute instances must use unencrypted local boot volumes.

Question 7

An OCI Security Administrator is designing a multi-tenancy IAM architecture using compartments and dynamic groups. Which TWO best practices should be implemented to ensure least-privilege access and scalable policy management?

Accepted Answer

Write all IAM policies at the tenancy level referencing compartment-scoped dynamic groups to minimize the total number of policy statements.. Option A is correct because writing IAM policies at the tenancy level and referencing compartment-scoped dynamic groups centralizes policy authoring, reduces statement sprawl, and keeps permissions scoped to the compartments where the dynamic groups are defined, supporting scalable least-privilege management. Option D is correct because tag-based access control (TBAC) lets policies evaluate resource tags such as where target.resource.tag.department.value = 'Finance', so permissions can be granted dynamically by attribute rather than by enumerating every resource, which scales well and enforces least privilege. Option B is wrong because disabling MFA for federated administrators weakens security and violates least-privilege/defense-in-depth principles. Option C is wrong because assigning users directly to compartments with inline policies bypasses group-based management and does not scale. Option E is wrong because dynamic group matching rules should use compartment OCIDs (or other stable attributes) rather than resource OCIDs, since resource OCIDs are unique per resource and make rules brittle and unmanageable.

Answer

Disable multi-factor authentication (MFA) for federation users relying on external IdPs to streamline administrative logins.

Answer

Assign users directly to administrative compartments using inline policies instead of defining groups.

Answer

Use dynamic group matching rules based on resource OCIDs rather than compartment OCIDs for maximum flexibility.

Question 8

An enterprise customer needs to restrict access to an OCI Object Storage bucket so that only requests originating from a specific Virtual Cloud Network (VCN) via a Service Gateway can read objects. Which combination of Identity and Access Management (IAM) and network policies should be implemented?

Accepted Answer

Configure a bucket policy that denies all read requests unless the request comes through a Service Gateway using the condition 'request.region, target.bucket.id, and request.network.source'.. OCI IAM policies support network-based conditions such as request.network.source.vcn.id and request.network.source.ip, which allow you to restrict Object Storage access to requests originating from a specific VCN via a Service Gateway. Combined with a Service Gateway in the VCN and a bucket policy that denies reads unless the request traverses that gateway, this creates a defense-in-depth control that blocks all other network paths. The Service Gateway ensures traffic never leaves the OCI network fabric, and the IAM condition enforces the source restriction at the authorization layer.

Answer

Enable OCI Cloud Guard Security Zones on the compartment and automatically enforce a deny-all policy on the bucket.

Answer

Route all Object Storage traffic through a DRG (Dynamic Routing Gateway) and apply stateful network firewall rules to drop non-VCN traffic.

Answer

Create an IAM policy with the condition 'where request.vcn.id = <vcn-ocid>' and attach a security list to the VCN subnet allowing outbound traffic to Object Storage.

Question 9

An organization requires high security for its cryptographic keys stored in OCI Vault. Which THREE architectural practices must be enforced when configuring and using Master Encryption Keys (MEKs)?

Accepted Answer

Apply least-privilege IAM policies separating the management of Vaults/Keys from the cryptographic operations (crypto-admin vs crypto-user).. Option A is correct because OCI IAM policies should enforce least privilege by separating key/vault administration (manage keys and vaults) from cryptographic use (use keys for encrypt/decrypt), preventing administrators from accessing plaintext data and limiting who can perform crypto operations. Option B is correct because OCI Vault offers Virtual Vaults (software-protected, FIPS 140-2 Level 1) and HSM-protected Vaults (FIPS 140-2 Level 3); using HSM-backed vaults for production MEKs provides hardware-level key protection and tamper resistance, while Virtual Vaults are acceptable for lower-security development environments. Option E is correct because rotating MEKs on a defined schedule (OCI supports automatic rotation for AES/RSA keys, and manual rotation via versioning) limits the amount of data protected by any single key version, reducing the blast radius if a key is compromised. Option C is incorrect because storing backup passphrases in plain text in Object Storage exposes the recovery secret and defeats the purpose of key protection; passphrases must be stored securely (e.g., in a separate vault or offline). Option D is incorrect because MEKs are regional resources and cannot be shared directly across regions; multi-region encryption requires separate keys per region or replication of encrypted data with region-specific keys, not sharing one MEK globally.

Answer

Store the Vault master key backup passphrases in plain text inside an Object Storage bucket for easy disaster recovery access.

Answer

Share the Vault master encryption key directly across all global regions to simplify multi-region database encryption.

Question 10

Your security team is designing network isolation for a three-tier application in OCI. The web tier is in a public subnet, the application tier is in a private subnet, and the database tier is in another private subnet. You need to ensure that the application tier can initiate connections to the database tier on port 1521, but the database tier cannot initiate connections back to the application tier. Which TWO configurations achieve this? (Choose two.)

Accepted Answer

A stateful ingress security rule in the database tier's network security group allowing TCP port 1521 from the application tier's NSG. Stateful security rules simplify bidirectional traffic. An ingress rule in the database tier's NSG allowing the application tier's NSG, or a stateful egress rule in the application tier's security list allowing the database tier's CIDR, both permit the application to initiate connections and receive responses while preventing the database from initiating connections. Stateless rules would require both directions to be explicitly allowed.

Answer

A stateful egress security rule in the database tier's security list allowing all traffic to the application tier's CIDR

Answer

A stateless ingress security rule in the database tier's security list allowing TCP port 1521 from the application tier's CIDR

Answer

A stateful ingress security rule in the application tier's security list allowing TCP port 1521 from the database tier's CIDR

Question 11

A developer in your tenancy needs to read objects from a specific Object Storage bucket but must not be able to delete or modify any objects. You want to grant the minimum necessary permissions. Which OCI IAM policy statement should you use?

Accepted Answer

Allow group Developers to read objects in tenancy where target.bucket.name='AppBucket'. The policy verb 'read' for Object Storage grants permission to list and get objects, which is exactly what is needed to read object contents without allowing deletion or modification. Using 'manage' would grant full control, while 'inspect' only allows listing metadata and 'use' is not applicable for reading objects.

Answer

Allow group Developers to use objects in tenancy where target.bucket.name='AppBucket'

Answer

Allow group Developers to inspect objects in tenancy where target.bucket.name='AppBucket'

Answer

Allow group Developers to manage objects in tenancy where target.bucket.name='AppBucket'

Question 12

Your company must ensure that all OCI Object Storage buckets in a compartment are encrypted with customer-managed keys. You have created a Vault and a master encryption key. Which step is required to enforce this for all new buckets?

Accepted Answer

Configure a default master encryption key for the compartment in the Vault. Assigning a default master encryption key for the compartment in OCI Vault ensures that any new Object Storage bucket created in that compartment automatically uses that key for encryption. This enforces the use of customer-managed keys without requiring manual configuration for each bucket.

Answer

Create a bucket policy that requires encryption with the specified key

Answer

Use a pre-authenticated request to enforce encryption on bucket creation

Answer

Enable a Security Zone that prohibits buckets without customer-managed keys

Question 13

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

Accepted Answer

Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.. OCI Web Application Firewall (WAF) is a cloud-native service that protects web applications from common exploits like SQL injection and XSS. By configuring a WAF policy with protection rules and attaching it to the Load Balancer, you can inspect incoming traffic at the edge and block malicious requests without modifying application code. This directly addresses the requirement.

Answer

Enable OCI Audit logs and configure automated notifications via OCI Notifications service.

Answer

Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.

Answer

Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.

Question 14

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

Accepted Answer

OCI Vault service to create and manage Customer-Managed Keys (CMK).. OCI Vault is the service for creating and managing customer-managed encryption keys (CMKs). By using OCI Vault, the administrator can generate and manage keys with strict rotation schedules and use them to encrypt data in Object Storage. This satisfies the requirement for customer-managed keys with rotation.

Answer

OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).

Answer

OCI Database Management service.

Answer

OCI Identity and Access Management (IAM) password policies.

Question 15

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

Accepted Answer

Local VCN Peering.. Local VCN Peering connects two VCNs in the same region over Oracle's private backbone, allowing resources in the development VCN to reach the production database privately without internet exposure. It is the recommended construct for intra-region, cross-VCN private communication.

Answer

Dynamic Routing Gateway (DRG) with internet breakout enabled.

Answer

Internet Gateway with strict Security List rules.

Answer

OCI Bastion service.

Question 16

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

Accepted Answer

An OCI Service Gateway.. An OCI Service Gateway provides a private, secure path from a VCN to supported Oracle services like Autonomous Database without exposing traffic to the public internet. It is the most performant option because traffic stays on Oracle's private backbone, avoiding internet latency and inspection. The Service Gateway is attached to the VCN and referenced in route rules, so only resources in the VCN can use it, and access can be further restricted with IAM policies and security rules.

Answer

A NAT Gateway combined with a public IP address on the database.

Answer

A Site-to-Site VPN connection back to the corporate data center.

Answer

An Internet Gateway attached to the VCN route table.

Question 17

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

Accepted Answer

Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.. OCI Audit captures all API activity in a tenancy automatically, and OCI Logging can export those Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode, providing tamper-proof, WORM retention that satisfies auditor evidence requirements. Object Lock in Compliance mode prevents any user, including tenancy administrators, from deleting or altering the retained audit objects until the retention period expires. This combination delivers capture, immutability, and long-term retention in one architecture.

Answer

Enable OCI Cloud Guard with default responder rules.

Answer

Deploy OCI Network Firewall to inspect all control plane traffic.

Answer

Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

Question 18

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

Accepted Answer

OCI Cloud Guard.. OCI Cloud Guard is the native Cloud Security Posture Management (CSPM) service that continuously monitors tenancy resources against security misconfigurations and risky operational behaviors using detector recipes and responder recipes. It aggregates findings into a unified 'Security Score' visible in the Cloud Guard console, giving a single tenancy-wide posture metric. This matches the question's requirement of continuous monitoring plus a unified security score.

Answer

OCI Audit.

Answer

OCI Web Application Firewall.

Answer

OCI Vulnerability Scanning Service.

Question 19

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

Accepted Answer

Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.. OCI IAM best practice for multi-tenancy is to define dynamic groups whose matching rules are scoped to specific compartment OCIDs or instance tags, then attach policies at the compartment level rather than the tenancy root. This ensures workloads authenticate automatically via instance principals with least-privilege access limited to the resources they need. Using tags (e.g., defined tags like Operations.CostCenter) in matching rules further tightens scope and supports policy reuse across environments.

Answer

Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

Answer

Disable compartment security boundaries and assign all users to the Administrators group.

Answer

Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

Question 20

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.