1Z0-1085-26 Security Services — Timed 15 Questions

Question 1

A financial services company runs a three-tier web application in OCI. The security team wants to ensure that traffic to the database tier is restricted to only the application tier's subnet, and that all traffic is logged for auditing. They have already created a VCN with separate subnets for web, application, and database tiers. Which OCI feature should they use to enforce these subnet-level traffic restrictions?

15 minute time limit — choose an answer to begin.

Accepted Answer

Security Lists. Security lists are the correct choice because they operate at the subnet level, allowing rules that permit traffic only from specific CIDR blocks, such as the application subnet. They also integrate with VCN Flow Logs for auditing. NSGs, while useful, apply to VNICs and are not subnet-scoped. Route tables and Internet Gateways do not provide traffic filtering or logging for this purpose.

Answer

Route Tables

Answer

Network Security Groups (NSGs)

Answer

Internet Gateway

Question 2

A security engineer must ensure that a web application running on OCI compute instances can only be accessed from a specific corporate IP range, and that the instances themselves can reach the internet for software updates. The engineer decides to use security lists at the subnet level. Which statement correctly describes how security lists enforce these requirements?

Accepted Answer

Security lists are stateless, so the engineer must create ingress rules for incoming traffic and egress rules for outgoing traffic, including return traffic.. OCI security lists are stateless subnet-level firewalls, so both ingress and egress rules must be explicitly defined, including for return traffic. This is different from stateful firewalls that automatically allow return traffic. The engineer must create rules to permit the corporate IP range inbound and internet-bound traffic outbound, plus corresponding rules for return packets. This ensures the application is protected and functional.

Answer

Security lists are applied at the VNIC level and can have different rules for each instance, allowing granular per-instance control.

Answer

Security lists use stateful rules by default, meaning return traffic is automatically allowed for ingress and egress connections.

Answer

Security lists can only be applied to public subnets; private subnets require network security groups for traffic filtering.

Question 3

A security architect must ensure that all data written to Object Storage buckets in a regulated compartment is encrypted with keys that the organization generates, rotates, and can immediately disable, and that the encryption keys never leave an HSM-controlled boundary. The organization also wants the ability to move a key between OCI regions in a backup scenario. Which OCI service should the architect use to meet these requirements?

Accepted Answer

OCI Vault with a virtual private vault and customer-managed master encryption keys. The requirement is for customer-controlled encryption keys held in hardware security modules, with the ability to rotate, disable, and export for regional backup. OCI Vault is the only listed service that stores master encryption keys in FIPS 140-2 Level 3 HSMs, supports virtual private vaults, and allows key lifecycle operations including disabling and backup. Certificate and posture services do not manage data-encryption keys.

Answer

OCI Cloud Guard with a responder recipe targeting Object Storage

Answer

OCI Certificates service with a private certificate authority

Answer

OCI Key Management with Oracle-managed keys on the bucket

Question 4

A cloud administrator needs to grant a new employee read-only access to all resources in a specific compartment. The employee should not be able to modify or delete any resources. Which OCI IAM policy statement should the administrator use?

Accepted Answer

Allow group NewEmployees to inspect all-resources in compartment Production. In OCI IAM, the 'inspect' verb grants read-only access to resources, allowing the user to list and view metadata but not modify them. The 'read' verb is similar but may not include all read operations. 'Use' and 'manage' grant additional privileges that exceed the requirement. Therefore, 'inspect' is the correct verb for read-only access to all resources in a compartment.

Answer

Allow group NewEmployees to read all-resources in compartment Production

Answer

Allow group NewEmployees to use all-resources in compartment Production

Answer

Allow group NewEmployees to manage all-resources in compartment Production

Question 5

A company is deploying a web application on OCI and wants to protect it from common web threats such as SQL injection and cross-site scripting. They also want to control access based on geographic location. Which two OCI services should they use? (Choose two.)

Accepted Answer

Web Application Firewall (WAF). The correct services are WAF and WAF with geo-blocking rules, which together provide protection against web threats and geographic access control. WAF is designed to filter and monitor HTTP traffic, blocking SQL injection and XSS, and it can enforce geo-blocking. The other options operate at different layers or serve different purposes, such as network filtering, security posture management, or identity management.

Answer

Identity and Access Management (IAM) policies

Answer

Network Security Groups (NSGs)

Answer

Cloud Guard

Question 6

A financial services company stores sensitive data in an OCI Object Storage bucket. They need to ensure that data is encrypted at rest using their own encryption keys managed in OCI Vault, and that the keys are rotated every 90 days automatically. Which OCI feature should they use?

Accepted Answer

Customer-managed keys in OCI Vault with a rotation schedule defined in the key's lifecycle policy. OCI Vault enables customers to create and manage their own encryption keys (customer-managed keys) and define automatic rotation schedules. By configuring the Object Storage bucket to use a customer-managed key from Vault, the company can meet both encryption at rest and key rotation requirements. Oracle-managed keys lack customer control, client-side encryption bypasses Vault, and storing keys in metadata is not supported.

Answer

Server-side encryption with AES-256 keys stored in the Object Storage bucket's metadata

Answer

Oracle-managed encryption keys with automatic rotation

Answer

Client-side encryption using a third-party tool before uploading to Object Storage

Question 7

A platform team is designing protection for a fleet of Compute instances running a customer-facing API. They want to detect and block suspicious process execution and file integrity changes on the instances themselves, and they also want to centrally review the resulting alerts alongside other tenancy security findings. (Choose two.)

Accepted Answer

Deploy the Cloud Agent with the Compute Instance Scanning plug-in. Host-based threat detection on Compute instances requires two cooperating pieces: the Cloud Agent Compute Instance Scanning plug-in, which collects runtime and file telemetry from inside the OS, and Cloud Guard's instance security detector with a responder recipe, which evaluates that telemetry and produces centrally reviewable problems. Network controls and patch-oriented plug-ins operate at different layers and cannot substitute for runtime host monitoring.

Answer

Enable the Cloud Guard service and configure a reporting region for findings

Answer

Attach a network security group to the instances and enable flow logs

Answer

Deploy the Cloud Agent with the Vulnerability Scanning and Bastion plug-ins

Question 8

A company is deploying a multi-tier application on OCI. The security team needs to ensure that the web tier can communicate with the database tier only on port 1521, and that the database tier cannot initiate connections to the web tier. They also want to log all traffic for auditing. Which two OCI features should they use to achieve these requirements? (Choose two.)

Accepted Answer

Network security groups (NSGs) to define stateful rules that allow traffic only from the web tier to the database tier on port 1521.. Network security groups (NSGs) provide stateful, VNIC-level rules that can allow only specific traffic from the web tier to the database tier on port 1521, and prevent the database from initiating connections. VCN flow logs capture traffic details for auditing. Together, they meet the security and auditing requirements. Security lists are stateless and less granular, Audit service logs API calls, and WAF is for web application protection.

Answer

Security lists with stateless rules to allow ingress on port 1521 from the web tier subnet and egress from the database tier to the web tier.

Answer

OCI Audit service to log all API calls made to the OCI resources, including network configuration changes.

Answer

Web Application Firewall (WAF) to inspect and filter traffic between the web and database tiers.

Question 9

A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard is a cloud security posture management service that helps customers monitor, assess, identify, and maintain a strong security posture on OCI by detecting misconfigured resources and insecure user activities.

Answer

OCI Bastion

Answer

OCI Web Application Firewall

Answer

OCI Vault

Question 10

According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?

Accepted Answer

The customer. Under the OCI shared-responsibility model, Oracle secures the cloud infrastructure (physical data centers, hardware, hypervisor, and the core IAM service itself), while the customer is responsible for everything they put in the cloud — including managing their own user accounts, password policies, and MFA configurations. Identity management of the customer's users is a customer-side responsibility.

Answer

Oracle

Answer

Both Oracle and the customer jointly via shared IAM consoles

Answer

Third-party identity auditor

Question 11

Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?

Accepted Answer

Security Zones. OCI Security Zones enforce maximum security policies (recipes) by automatically validating and preventing misconfigurations, such as blocking public IP addresses on compute instances or ensuring buckets are private.

Answer

Cloud Guard

Answer

Web Application Firewall

Answer

Vault Service

Question 12

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

Accepted Answer

Guest operating system patching and configuration on the compute instances. In the OCI shared-responsibility model, the customer is responsible for the guest operating system, including patching and configuration, on compute instances. Oracle manages the physical infrastructure, hypervisor, and data center security, but the customer controls and secures the OS and applications running on the instances.

Answer

Hypervisor patching and firmware updates on the physical host

Answer

Redundancy and cooling of the physical networking hardware

Answer

Physical security of the data center hosting the compute instances

Question 13

A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?

Accepted Answer

Vault Secrets. OCI Vault Secrets is the service specifically designed to securely store and manage sensitive data such as database connection strings, API tokens, passwords, and certificates. It provides a centralized secrets management system with automatic rotation, versioning, and fine-grained access control via IAM policies. Applications can retrieve secrets dynamically through the OCI SDK, CLI, or REST API, eliminating hardcoded credentials. This directly addresses the developer's need for secure, dynamic retrieval of credentials.

Answer

Object Storage with customer-managed keys

Answer

Key Management Service Master Keys

Answer

Identity and Access Management Dynamic Groups

Question 14

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

Accepted Answer

OCI Web Application Firewall. OCI Web Application Firewall (WAF) is a cloud-based, PCI-compliant security service that protects applications from malicious internet traffic, including cross-site scripting (XSS), SQL injection, and HTTP floods.

Answer

Cloud Guard

Answer

Virtual Cloud Network Security Lists

Answer

Network Security Groups

Question 15

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?

Accepted Answer

Detector recipes. Cloud Guard problems are generated by detector recipes, which define the categories of misconfigurations and security issues that Cloud Guard monitors, such as overly permissive IAM policies. Detector recipes evaluate resources against rules and emit problems when violations are found. Responder recipes only define the automated remediation actions taken after a problem is detected, so they are not the source of the problems themselves.

Answer

Vault Master Encryption keys

Answer

Security Zone recipes

Answer

Responder recipes