1Z0-1085-26 Security Services — 20 Questions

Question 1

A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard is a cloud security posture management service that helps customers monitor, assess, identify, and maintain a strong security posture on OCI by detecting misconfigured resources and insecure user activities.

Answer

OCI Bastion

Answer

OCI Web Application Firewall

Answer

OCI Vault

Question 2

According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?

Accepted Answer

The customer. IAM user lifecycle management, password policies, and MFA configurations are the sole responsibility of the customer.

Answer

Oracle

Answer

Both Oracle and the customer jointly via shared IAM consoles

Answer

Third-party identity auditor

Question 3

Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?

Accepted Answer

Security Zones. OCI Security Zones enforce maximum security policies (recipes) by automatically validating and preventing misconfigurations, such as blocking public IP addresses on compute instances or ensuring buckets are private.

Answer

Cloud Guard

Answer

Web Application Firewall

Answer

Vault Service

Question 4

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

Accepted Answer

Guest operating system patching and configuration on the compute instances. In the OCI shared-responsibility model, OCI is responsible for security OF the cloud, including the underlying physical infrastructure, virtualization, and global network. The customer is responsible for security IN the cloud, which includes guest OS patching, data classification, firewall configurations, and identity and access management.

Answer

Hypervisor patching and firmware updates on the physical host

Answer

Redundancy and cooling of the physical networking hardware

Answer

Physical security of the data center hosting the compute instances

Question 5

A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?

Accepted Answer

Vault Secrets. OCI Vault provides secrets management capabilities that allow you to securely store, manage, and retrieve secrets such as passwords, database connection strings, and certificates.

Answer

Object Storage with customer-managed keys

Answer

Key Management Service Master Keys

Answer

Identity and Access Management Dynamic Groups

Question 6

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

Accepted Answer

OCI Web Application Firewall. OCI Web Application Firewall (WAF) is a cloud-based, PCI-compliant security service that protects applications from malicious internet traffic, including cross-site scripting (XSS), SQL injection, and HTTP floods.

Answer

Cloud Guard

Answer

Virtual Cloud Network Security Lists

Answer

Network Security Groups

Question 7

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?

Accepted Answer

Detector recipes. Cloud Guard uses detector recipes to continuously analyze resources, including IAM policies, network configurations, and storage buckets, to identify security posture deviations.

Answer

Vault Master Encryption keys

Answer

Security Zone recipes

Answer

Responder recipes

Question 8

; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?

Accepted Answer

OCI Bastion. OCI Bastion service provides restricted and time-limited secure access to target resources that do not have public IPs, using ephemeral SSH or port forwarding sessions without maintaining a permanent bastion host.

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Answer

Site-to-Site VPN