Security

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

What is the primary function of OCI Network Security Groups (NSGs)?

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

Your organization's security policy requires that all OCI Block Volume data be encrypted with customer-managed keys that can be rotated, disabled, or deleted independently of the volume lifecycle. You have configured a Vault in OCI Key Management. Which key type must you create and assign to the Block Volume to meet this requirement?

You are configuring a site-to-site IPSec VPN between your on-premises datacenter and an OCI VCN. To ensure data confidentiality and integrity across the public internet, which encryption algorithms should you mandate in the IPSec configuration?

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)