1Z0-997-26 Security Practice Test 2 — 15 Questions

Question 1

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An OCI Service Gateway.. An OCI Service Gateway provides a private, secure path from a VCN to supported Oracle services like Autonomous Database without exposing traffic to the public internet. It is the most performant option because traffic stays on Oracle's private backbone, avoiding internet latency and inspection. The Service Gateway is attached to the VCN and referenced in route rules, so only resources in the VCN can use it, and access can be further restricted with IAM policies and security rules.

Answer

A NAT Gateway combined with a public IP address on the database.

Answer

A Site-to-Site VPN connection back to the corporate data center.

Answer

An Internet Gateway attached to the VCN route table.

Question 2

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

Accepted Answer

Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.. OCI Audit captures all API activity in a tenancy automatically, and OCI Logging can export those Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode, providing tamper-proof, WORM retention that satisfies auditor evidence requirements. Object Lock in Compliance mode prevents any user, including tenancy administrators, from deleting or altering the retained audit objects until the retention period expires. This combination delivers capture, immutability, and long-term retention in one architecture.

Answer

Enable OCI Cloud Guard with default responder rules.

Answer

Deploy OCI Network Firewall to inspect all control plane traffic.

Answer

Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

Question 3

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

Accepted Answer

OCI Cloud Guard.. OCI Cloud Guard is the native Cloud Security Posture Management (CSPM) service that continuously monitors tenancy resources against security misconfigurations and risky operational behaviors using detector recipes and responder recipes. It aggregates findings into a unified 'Security Score' visible in the Cloud Guard console, giving a single tenancy-wide posture metric. This matches the question's requirement of continuous monitoring plus a unified security score.

Answer

OCI Audit.

Answer

OCI Web Application Firewall.

Answer

OCI Vulnerability Scanning Service.

Question 4

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

Accepted Answer

Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.. OCI IAM best practice for multi-tenancy is to define dynamic groups whose matching rules are scoped to specific compartment OCIDs or instance tags, then attach policies at the compartment level rather than the tenancy root. This ensures workloads authenticate automatically via instance principals with least-privilege access limited to the resources they need. Using tags (e.g., defined tags like Operations.CostCenter) in matching rules further tightens scope and supports policy reuse across environments.

Answer

Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

Answer

Disable compartment security boundaries and assign all users to the Administrators group.

Answer

Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

Question 5

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.

Question 6

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Accepted Answer

OCI Vulnerability Scanning Service. The OCI Vulnerability Scanning Service (VSS) is designed to scan compute instances and container images for known software vulnerabilities and malware. It inspects OS packages and application dependencies against vulnerability databases and reports findings, which is exactly the capability described.

Answer

OCI Cloud Guard

Answer

OCI Identity and Access Management

Answer

OCI Application Performance Monitoring

Question 7

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

Accepted Answer

OCI Bastion service.. OCI Bastion service provides secure, time-limited, and audited SSH access to private subnet compute instances without exposing any public IP or opening inbound SSH ports. It creates a bastion session that tunnels SSH traffic through the OCI service, and access is controlled by IAM policies and session TTLs. This directly meets the requirement of performing maintenance on private database instances without internet or corporate network exposure.

Answer

OCI NAT Gateway.

Answer

OCI Load Balancer with TCP routing.

Answer

OCI API Gateway.

Question 8

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

Accepted Answer

Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.. Network Security Groups (NSGs) in OCI are virtual firewalls applied directly to the VNICs of instances, and they support stateful ingress/egress rules. By attaching an NSG with a default-deny posture (no allow rules for unwanted traffic) plus explicit allow rules for administrative ports (e.g., SSH 22 from a bastion CIDR), all other inbound traffic is dropped at the VNIC level. This is the granular, instance-scoped enforcement point OCI provides for subnet-level or VNIC-level traffic control.

Answer

Disable the OCI Internet Gateway on the VCN route table.

Answer

Enable OCI Bastion service on the database subnet.

Answer

Configure OCI IAM policies to block network ingress at the user level.

Question 9

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

Accepted Answer

Allow group Auditors to read all-resources in compartment Production. The policy statement 'Allow group Auditors to read all-resources in compartment Production' grants read-only access to all resources within the Production compartment, without allowing modifications or access to other compartments. This precisely meets the requirement for a third-party auditor to view resources in a specific compartment.

Answer

Allow group Auditors to use database-families in root

Answer

Allow group Auditors to read compartments in tenancy

Answer

Allow group Auditors to manage all-resources in tenancy

Question 10

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

Accepted Answer

Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.. OCI Vault is a regional service, and customer-managed keys are stored in the region where the vault is created. To ensure encryption keys never leave their home regions, you must provision separate OCI Vaults and keys in each region where workloads reside. This design keeps keys within their respective regions and complies with data residency requirements.

Answer

Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

Answer

Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

Answer

Store all keys in the home region and use the OCI Service Gateway for remote decryption.

Question 11

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

Accepted Answer

Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.. To isolate a compromised instance while preserving storage, the best action is to update its Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic. This revokes network access without terminating the instance or deleting volumes, allowing forensic analysis. This can be automated with OCI Events (triggered by a security alert) and Functions.

Answer

Delete the VCN containing the instance to stop all routing.

Answer

Terminate the compute instance and delete all attached block volumes immediately.

Answer

Revoke the IAM user credentials of the administrator who launched the instance.

Question 12

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

Accepted Answer

Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.. OCI Vault is the managed secrets service designed to store and rotate sensitive values such as database credentials, and OCI Functions can retrieve them at runtime using the OCI SDK. Authentication to Vault is achieved through a dynamic group that matches the function's resource principal, so no long-lived credentials are embedded anywhere. This eliminates the insecure environment-variable pattern while providing auditability and centralized rotation.

Answer

Hardcode the credentials inside the function source code repository.

Answer

Store secrets in OCI Object Storage with public read access.

Answer

Encode the credentials in Base64 and store them in IAM policy descriptions.

Question 13

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

Accepted Answer

Object Storage Object Lock with Compliance mode.. Object Lock with Compliance mode enforces a WORM (Write Once, Read Many) retention policy that cannot be removed or shortened by any user — including tenancy administrators — until the retention period expires. This directly protects backups against accidental deletion and ransomware encryption because objects cannot be overwritten or deleted during the retention window. Compliance mode is the strictest of the two Object Lock modes (the other being Governance mode, which privileged users can bypass).

Answer

OCI Cloud Guard data protection detectors.

Answer

OCI Object Storage Pre-Authenticated Requests (PAR).

Answer

OCI Vault key rotation policies.

Question 14

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

Accepted Answer

IAM Group. An IAM Group in OCI is a collection of users who share the same job function and require the same permissions. Policies are written against groups rather than individual users, so grouping users by role simplifies permission management and follows the principle of least privilege at scale. This is the standard identity construct for role-based access control in OCI.

Answer

Compartment

Answer

Federation Provider

Answer

Dynamic Group

Question 15

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

Accepted Answer

OCI Cloud Guard Managed Recipes and Responder Rules.. OCI Cloud Guard uses Managed Recipes (detector and responder recipes) to continuously monitor a tenancy for security misconfigurations and risky activity, and Responder Rules can automatically or manually remediate findings — including one-click remediation from the Cloud Guard console. This centralized posture view with actionable remediation is exactly what Cloud Guard provides.

Answer

OCI Bastion Service session manager.

Answer

OCI Database Migration Service.

Answer

OCI IAM Policy Generator.