1Z0-997-26 Security Practice Test 3 — 15 Questions

Question 1

You are configuring a site-to-site IPSec VPN between your on-premises datacenter and an OCI VCN. To ensure data confidentiality and integrity across the public internet, which encryption algorithms should you mandate in the IPSec configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AES-256 with SHA-256 hashing.. AES-256 provides strong symmetric encryption for confidentiality, and SHA-256 provides a cryptographic hash for integrity verification within the IPSec ESP (Encapsulating Security Payload) framework. Together they satisfy the confidentiality and integrity requirements of a site-to-site IPSec VPN over an untrusted network like the public internet. OCI's IPSec VPN supports AES-128/AES-192/AES-256 and SHA-1/SHA-256 for Phase 2 (IPSec) parameters.

Answer

Plaintext transmission without IPsec encapsulation.

Answer

RC4 stream cipher with no hashing.

Answer

DES with MD5 authentication.

Question 2

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

Accepted Answer

Allow group Developers to manage compute-instances in compartment ParentCompartment. OCI IAM policies are hierarchical: a policy statement that grants access at a parent compartment automatically applies to all child compartments within that hierarchy. By writing the policy at ParentCompartment, the developer group gets manage permissions on compute instances in all child compartments without granting tenancy-wide access. This follows the principle of least privilege while meeting the requirement.

Answer

Allow group Developers to manage compute-instances in tenancy

Answer

Allow group Developers to manage compute-instances in root

Answer

Write individual policies for every single child compartment separately without referencing the parent.

Question 3

What is the primary function of OCI Network Security Groups (NSGs)?

Accepted Answer

To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.. OCI Network Security Groups (NSGs) act as virtual firewalls that control inbound and outbound traffic for a specific set of VNICs. Unlike security lists, which apply to all VNICs in a subnet, NSGs allow you to apply security rules to a group of VNICs that you explicitly choose, enabling fine-grained, instance-level micro-segmentation.

Answer

To balance HTTP/HTTPS traffic across multiple backend web servers.

Answer

To encrypt data at rest in block storage volumes.

Answer

To manage human user passwords and multi-factor authentication.

Question 4

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

Accepted Answer

Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.. OCI Security Zones are hardened compartments that enforce a set of immutable security policies, one of which is that resources inside cannot have public IP addresses or public-facing endpoints. Because the policy is enforced at the platform level, the create-instance call fails regardless of IAM permissions or network configuration. This is by design to prevent external exposure of workloads in the zone.

Answer

The VCN lacks an Internet Gateway.

Answer

The OCI Vault service is offline.

Answer

The team lacks IAM permissions to create compute instances.

Question 5

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

Accepted Answer

Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.. A Remote Peering Connection (RPC) between two DRGs in different OCI regions is the native OCI mechanism for private, secure inter-region VCN connectivity. Once the RPC is established and the DRGs are attached to their respective VCNs, you must configure route tables in each VCN to direct traffic destined for the other VCN's CIDR to the DRG, and ensure security lists or NSGs allow the required traffic. This creates a private, encrypted connection over Oracle's backbone network without traversing the public internet.

Answer

Configure public IP addresses on all participating compute instances.

Answer

Route all inter-region traffic through public Internet Gateways with IPsec tunneling.

Answer

Deploy an OCI NAT Gateway in each region.

Question 6

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

Accepted Answer

OCI Audit Service. OCI Audit Service automatically records all API calls made against OCI resources, including who made the call, when, from which source IP, and the request/response details. Deleting a database instance is an API operation (e.g., TerminateDbSystem), so the exact event history — actor, timestamp, and resource — is captured in Audit logs and can be queried in the Console or via the Audit API/CLI. This makes it the authoritative source for forensic investigations of resource changes.

Answer

OCI Cloud Guard Responder Logs

Answer

OCI Database Performance Hub

Answer

OCI Monitoring Service

Question 7

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

Accepted Answer

To allow users to authenticate to OCI using their existing corporate credentials via SAML 2.0.. OCI IAM federation with an external IdP allows users to authenticate to OCI using their existing corporate credentials through the SAML 2.0 protocol, eliminating the need for separate OCI local users and passwords. The IdP asserts the user's identity, and OCI IAM maps IdP groups to OCI IAM groups to grant permissions. This centralizes authentication and enables single sign-on across cloud and on-premises systems.

Answer

To replicate OCI database backups to external cloud providers.

Answer

To automatically provision network security groups across regions.

Answer

To bypass OCI encryption key management requirements.

Question 8

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

Accepted Answer

Route inbound traffic from the Internet Gateway through a firewall appliance subnet before forwarding it to backend subnets via route tables.. To force all inbound internet traffic through a next-generation firewall before it reaches backend web servers, you place the firewall appliance in its own subnet and use route tables to steer traffic: the Internet Gateway routes inbound traffic to the firewall subnet, and the firewall subnet's route table forwards inspected traffic to the backend subnet. This is the standard hub-and-spoke or DMZ architecture in OCI, where the firewall is the next hop for the backend subnet's ingress path.

Answer

Attach public IP addresses directly to all backend web servers.

Answer

Rely entirely on default VCN Security Lists without route table modifications.

Answer

Use OCI Object Storage to filter incoming HTTP packets.

Question 9

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

Accepted Answer

OCI IAM token-based database authentication combined with Oracle Autonomous Database.. OCI IAM token-based database authentication, when combined with Oracle Autonomous Database, allows developers to authenticate using short-lived tokens issued by OCI IAM instead of long-term database passwords. This supports zero-trust principles by eliminating static credentials and enabling centralized identity management with token expiration and revocation.

Answer

Disabling all authentication to maximize application performance.

Answer

Hardcoded administrator passwords stored in plain text configuration files.

Answer

Using static API signing keys for database connection strings.

Question 10

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Accepted Answer

Trigger responder recipes to remediate detected security risks automatically or manually.. Option A is correct because Cloud Guard responder recipes define actions (such as stopping an instance, deleting a public bucket, or invoking a function) that can be triggered automatically or manually when a detector rule fires on a problem. Option C is correct because Cloud Guard continuously monitors tenancy resources against detector recipes that identify security misconfigurations, risky configurations, and policy violations across OCI services. Option E is correct because Cloud Guard aggregates detected problems into a security score for the tenancy, giving an at-a-glance measure of the overall cloud security posture. Option B is incorrect because Cloud Guard is an OCI-native service and does not patch kernel-level vulnerabilities on third-party on-premises servers. Option D is incorrect because point-to-point IPsec VPN tunneling between VCNs is provided by OCI VPN Connect/FastConnect or DRG-based connectivity, not by Cloud Guard.

Answer

Automatically patch kernel-level vulnerabilities on third-party on-premises servers.

Answer

Provide point-to-point IPsec VPN tunneling between VCNs.

Question 11

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

Accepted Answer

Configure IPsec VPN tunnels with strong encryption algorithms (e.g., AES-256) for on-premises connectivity.. Option A is correct because IPsec VPN tunnels using strong encryption such as AES-256 protect data in transit between on-premises networks and OCI over untrusted paths like the internet. Option E is correct because TLS/HTTPS encrypts application-layer traffic between services and endpoints, preventing eavesdropping or tampering across OCI networking components. Option B is incorrect because sending database traffic unencrypted over the public internet exposes sensitive data to interception. Option C is incorrect because plain-text HTTP provides no confidentiality or integrity for inter-microservice communication within a VCN. Option D is incorrect because disabling security lists and enabling packet sniffing removes access controls and exposes traffic rather than securing it.

Answer

Transmit all database traffic over unencrypted public internet connections.

Answer

Rely on plain-text HTTP for all inter-microservice communication within a VCN.

Answer

Disable VCN security lists to allow unhindered packet sniffing.

Question 12

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Accepted Answer

Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.. Option B is correct because OCI IAM verbs are ordered from least to most permissive (inspect < read < use < manage), and granting only the minimum verb needed for a task enforces least privilege and limits blast radius at scale. Option C is correct because attaching policies to IAM groups mapped to job functions lets you manage entitlements centrally; adding or removing a user from a group changes their access without rewriting individual user policies, which is essential in large tenancies. Option E is correct because OCI policies are inherited down the compartment hierarchy, so a policy written at a parent compartment applies to all child compartments, drastically reducing the number of policies you must author and maintain. Option A is wrong because storing credentials in instance metadata exposes secrets and violates OCI security guidance; instances should use instance principals instead. Option D is wrong because assigning every human user to the Administrators group grants full tenancy-wide privileges, directly violating least privilege and defeating the purpose of groups and compartment-scoped policies.

Answer

Hardcode IAM user passwords directly in instance metadata.

Answer

Assign all human users directly to the Administrators group for operational simplicity.

Question 13

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Accepted Answer

Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.. Option C is correct because OCI Object Storage Object Lock enforces WORM (Write Once, Read Many) retention policies: in Compliance mode, retention rules cannot be removed or shortened even by tenancy administrators until the retention period expires, directly preventing accidental or malicious deletion for strict compliance frameworks, while Governance mode offers similar protection with privileged override capability. Option E is correct because implementing least-privilege IAM policies ensures that only authorized security groups hold permissions such as BUCKET_DELETE or BUCKET_UPDATE, reducing the risk of accidental or malicious deletion by unauthorized or overly privileged users. Option A is incorrect because disabling versioning removes the ability to recover overwritten or deleted objects and does nothing to prevent deletion. Option B is incorrect because granting 'manage' permissions to all anonymous users exposes the bucket to anyone, enabling rather than preventing malicious deletion. Option D is incorrect because storing files without encryption weakens security and compliance and has no bearing on preventing deletion.

Answer

Disable versioning on all buckets to save storage space.

Answer

Grant 'manage' permissions on the bucket to all anonymous users.

Answer

Store all files without encryption to ensure faster deletion.

Question 14

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

Accepted Answer

Isolate workloads into private subnets whenever public access is not required.. Option B is correct because placing workloads in private subnets when they don't need inbound internet access removes their exposure to the public internet, and OCI private subnets have no route to an Internet Gateway, so they can only be reached via controlled paths such as a NAT Gateway, Service Gateway, or bastion. Option C is correct because OCI security rules are stateful by default, meaning return traffic for an established connection is automatically permitted, which reduces the need for wide inbound rules and lowers the risk of misconfiguration. Option D is correct because Network Security Groups (NSGs) apply at the VNIC level and let you write granular rules that reference other NSGs as sources or destinations, enabling least-privilege, application-tier-based filtering rather than broad subnet-level CIDR rules. Option A is not recommended because exposing database management ports (e.g., 1521, 3306, 5432) to 0.0.0.0/0 makes them reachable from the entire internet and invites brute-force and exploitation attempts. Option E is not recommended because attaching an Internet Gateway to a private subnet would make it public and defeat the purpose of isolation; private subnets should instead use a NAT Gateway for outbound traffic and a Service Gateway for OCI services.

Answer

Expose all database management ports to the 0.0.0.0/0 CIDR block.

Answer

Attach an Internet Gateway to every private subnet by default.

Question 15

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

Accepted Answer

Automated or manual key rotation policies.. Option B is correct because OCI Vault lets you define key rotation policies that rotate master encryption keys either automatically on a schedule or manually on demand. Option D is correct because OCI Vault is the service used to create and manage customer-managed master encryption keys (CMKs) in key vaults, which can then be used to encrypt data across OCI services. Option E is correct because OCI Vault keys are protected by Hardware Security Modules validated to FIPS 140-2 Level 3, providing strong hardware-backed key protection. Option A is not a Vault capability; BGP peering for on-premises routers is handled by OCI networking services such as FastConnect and dynamic routing gateways. Option C is not provided by Vault, since Vault manages encryption keys and secrets, not free unlimited public storage of plaintext database files.

Answer

Direct routing of BGP peering sessions for on-premises routers.

Answer

Unlimited free public storage of plaintext database files.