A financial services company runs a three-tier web application in OCI. The security team wants to ensure that traffic to the database tier is restricted to only the application tier's subnet, and that all traffic is logged for auditing. They have already created a VCN with separate subnets for web, application, and database tiers. Which OCI feature should they use to enforce these subnet-level traffic restrictions?
A security engineer must ensure that a web application running on OCI compute instances can only be accessed from a specific corporate IP range, and that the instances themselves can reach the internet for software updates. The engineer decides to use security lists at the subnet level. Which statement correctly describes how security lists enforce these requirements?
A security architect must ensure that all data written to Object Storage buckets in a regulated compartment is encrypted with keys that the organization generates, rotates, and can immediately disable, and that the encryption keys never leave an HSM-controlled boundary. The organization also wants the ability to move a key between OCI regions in a backup scenario. Which OCI service should the architect use to meet these requirements?
A cloud administrator needs to grant a new employee read-only access to all resources in a specific compartment. The employee should not be able to modify or delete any resources. Which OCI IAM policy statement should the administrator use?
A company is deploying a web application on OCI and wants to protect it from common web threats such as SQL injection and cross-site scripting. They also want to control access based on geographic location. Which two OCI services should they use? (Choose two.)
A financial services company stores sensitive data in an OCI Object Storage bucket. They need to ensure that data is encrypted at rest using their own encryption keys managed in OCI Vault, and that the keys are rotated every 90 days automatically. Which OCI feature should they use?
A platform team is designing protection for a fleet of Compute instances running a customer-facing API. They want to detect and block suspicious process execution and file integrity changes on the instances themselves, and they also want to centrally review the resulting alerts alongside other tenancy security findings. (Choose two.)
A company is deploying a multi-tier application on OCI. The security team needs to ensure that the web tier can communicate with the database tier only on port 1521, and that the database tier cannot initiate connections to the web tier. They also want to log all traffic for auditing. Which two OCI features should they use to achieve these requirements? (Choose two.)
A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?
According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?
Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?
An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?
A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?
An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?
Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?
; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?
A healthcare organization stores sensitive patient data in an OCI Object Storage bucket. Compliance requires that all data be encrypted at rest with a key that the organization manages and rotates every 90 days. The organization already uses OCI Vault. Which encryption approach should they implement?
A cloud administrator is configuring a new tenancy and wants each business unit to have its own isolated set of users and groups while still being centrally billed and governed. The administrator also wants to give a specific group permission to manage only the networking resources inside one of those units. Which OCI IAM construct should be used to create that isolated container of users and groups?
A financial services company runs a web application on OCI behind a public load balancer. Auditors require that all inbound traffic be inspected for common web exploits such as cross-site scripting and that malicious source IPs be blocked automatically for a period of time. The security team also wants to keep management overhead low by using managed rule sets. Which OCI service should be deployed in front of the application?
A system administrator needs to grant a new employee access to manage compute instances in a specific compartment. The employee should not have access to any other resources. Which OCI IAM policy statement should the administrator use?
A security administrator is configuring a bastion host in OCI to provide secure SSH access to private compute instances. The administrator wants to use OCI Bastion service to minimize exposure. Which statement accurately describes the OCI Bastion service?
A company wants to centrally manage and audit access to their OCI tenancy. They need to ensure that all user actions are logged and that they can detect suspicious activities. Which OCI service should they use?
A developer is building an application on a Compute instance that must read objects from an Object Storage bucket. The security policy forbids storing API keys or auth tokens on the instance. The instance runs in a compartment called app-prod, and the bucket lives in a different compartment called data-prod. Which approach allows the instance to access the bucket without embedding credentials?