Courseiva

CCNA Security Questions

52 questions · Security · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

A.Object Storage Object Lock with Compliance mode.
B.OCI Cloud Guard data protection detectors.
C.OCI Object Storage Pre-Authenticated Requests (PAR).
D.OCI Vault key rotation policies.
AnswerA

Object Lock prevents deletion or overwriting of objects, even by users with administrative privileges, ensuring backup integrity.

Why this answer

Object Storage Object Lock enables WORM (Write Once, Read Many) storage, preventing objects from being deleted or modified until a retention period expires or indefinitely in compliance mode.

Practice this question →
2
Multi-Selecthard

An OCI Security Administrator is designing a multi-tenancy IAM architecture using compartments and dynamic groups. Which TWO best practices should be implemented to ensure least-privilege access and scalable policy management?

Select 2 answers
A.Write all IAM policies at the tenancy level referencing compartment-scoped dynamic groups to minimize the total number of policy statements.
B.Disable multi-factor authentication (MFA) for federation users relying on external IdPs to streamline administrative logins.
C.Assign users directly to administrative compartments using inline policies instead of defining groups.
D.Leverage tag-based access control by defining IAM policies that evaluate resource tags (e.g., where target.resource.tag.department.value = 'Finance').
E.Use dynamic group matching rules based on resource OCIDs rather than compartment OCIDs for maximum flexibility.
AnswersA, D

Placing policies at the root/tenancy level while delegating administrative control via compartment definitions makes management cleaner and avoids policy sprawl.

Why this answer

Best practices for IAM at scale include using tenancy-level policies pointing to compartment-scoped dynamic groups for cross-compartment automation, and leveraging groups with dynamic matching rules based on resource attributes rather than static user assignments.

Practice this question →
3
MCQhard

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

A.Attach a broad administrative instance principal to the worker node pool.
B.Expose Object Storage via a public endpoint and permit anonymous read access.
C.Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.
D.Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.
AnswerD

Workload Identity integrates OKE service accounts with OCI IAM, providing short-lived security tokens without static credentials.

Why this answer

OCI Identity and Access Management (IAM) Workload Identity for OKE allows Kubernetes pods to assume OCI IAM roles securely using service account tokens, eliminating long-lived credentials.

Practice this question →
4
Multi-Selectmedium

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Select 3 answers
A.Trigger responder recipes to remediate detected security risks automatically or manually.
B.Automatically patch kernel-level vulnerabilities on third-party on-premises servers.
C.Monitor tenancy resources for security misconfigurations and policy violations.
D.Provide point-to-point IPsec VPN tunneling between VCNs.
E.Calculate an overall security score for the tenancy based on detected problems.
AnswersA, C, E

Responder recipes provide automated or manual remediation capabilities for security findings.

Why this answer

Cloud Guard detects misconfigurations, computes security scores, and can trigger automated or manual responders to mitigate security risks.

Practice this question →
5
MCQhard

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

A.Configure public IP addresses on all participating compute instances.
B.Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.
C.Route all inter-region traffic through public Internet Gateways with IPsec tunneling.
D.Deploy an OCI NAT Gateway in each region.
AnswerB

RPCs leverage Oracle's private backbone, requiring proper DRG configuration, peering acceptance, route tables, and security lists.

Why this answer

Remote VCN peering across regions requires a DRG attachment for each VCN, an RPC configured on both DRGs, and a peering connection request accepted by the target region's DRG, with appropriate security lists and routing tables.

Practice this question →
6
Multi-Selecthard

An enterprise security architect is designing a defense-in-depth strategy for an OCI environment hosting sensitive financial data. Which TWO architectural practices should be implemented to ensure robust network and data security? (Choose two.)

Select 2 answers
A.Store all master encryption keys in OCI Vault using customer-managed keys with strict rotation and access policies.
B.Rely entirely on default VCN security lists without implementing Network Security Groups.
C.Disable OCI Audit logging to prevent log tampering by administrators.
D.Expose all database instances directly to the public internet for easier management.
E.Implement granular network segmentation using private subnets, Local VCN Peering, and Network Security Groups (NSGs).
AnswersA, E

Customer-managed keys in OCI Vault ensure data at rest is cryptographically protected and strictly controlled.

Why this answer

Encrypting data at rest using customer-managed keys in OCI Vault and enforcing strict network segmentation using VCN subnets and NSGs are core pillars of a defense-in-depth architecture.

Practice this question →
7
Multi-Selecthard

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Select 2 answers
A.An IAM policy granting the dynamic group permission to read secrets in the OCI Vault.
B.A dynamic group with matching rules defining which compute instances belong to the group (e.g., based on compartment OCID).
C.A public internet gateway attached to the vault storage endpoint.
D.Disabling all IAM policy enforcement across the tenancy.
E.Hardcoded passwords placed in the instance /etc/passwd file.
AnswersA, B

IAM policies are required to authorize the dynamic group to access vault secrets.

Why this answer

Using dynamic groups requires writing matching rules based on instance attributes and creating IAM policies granting the dynamic group access to vaults.

Practice this question →
8
MCQhard

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

A.Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.
B.Enable OCI Cloud Guard with default responder rules.
C.Deploy OCI Network Firewall to inspect all control plane traffic.
D.Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.
AnswerA

Object Storage Object Lock in Compliance mode ensures that logs cannot be deleted or modified by anyone, even root users, fulfilling strict audit requirements.

Why this answer

OCI Audit logs all API calls automatically. To ensure tamper-proofing and long-term compliance retention, administrators should use Object Storage buckets configured with WORM (Write Once, Read Many) policies via Object Storage Object Lock.

Practice this question →
9
MCQeasy

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

A.Allow group Auditors to use database-families in root
B.Allow group Auditors to read all-resources in compartment Production
C.Allow group Auditors to read compartments in tenancy
D.Allow group Auditors to manage all-resources in tenancy
AnswerB

This grants read-only access strictly to resources within the specified 'Production' compartment.

Why this answer

The verb 'inspect' allows users to list resources without viewing sensitive metadata, while 'read' allows viewing resource metadata. Scoping the policy to a specific compartment restricts access appropriately.

Practice this question →
10
MCQhard

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

A.Create separate tenancies for administrators and developers.
B.Write IAM policies with conditional statements checking the user's IP address.
C.Configure OCI IAM identity federation with your enterprise IdP for developers, and apply an IAM authentication policy enforcing MFA for native console administrators.
D.Disable native IAM users entirely and force all users to share a single administrator account with MFA.
AnswerC

Federating enterprise users delegates authentication to the IdP, while IAM authentication policies enforce MFA for local or native accounts.

Why this answer

OCI IAM supports identity federation with SAML 2.0-compliant IdPs for enterprise users while enforcing local or native MFA policies for native console accounts, configured via IAM authentication policies and IdP federation.

Practice this question →
11
MCQeasy

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

A.IAM Group
B.Compartment
C.Federation Provider
D.Dynamic Group
AnswerA

IAM groups are collections of users that simplify policy administration.

Why this answer

An IAM user group is used to aggregate users with similar roles so that policies can be applied to the group collectively.

Practice this question →
12
Multi-Selectmedium

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

Select 3 answers
A.Allocation of BGP routing tables for on-premises FastConnect circuits.
B.Rate limiting to mitigate denial of service (DoS) and brute-force attacks.
C.Protection against OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS).
D.Management of hardware security module (HSM) crypto keys for database volumes.
E.Access control rules based on geographic location, IP addresses, or HTTP headers.
AnswersB, C, E

Rate limiting controls traffic volume from specific clients.

Why this answer

OCI WAF protects web applications using access control rules, protection rules against OWASP top 10, and rate limiting.

Practice this question →
13
Multi-Selectmedium

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Select 2 answers
A.Configure a public load balancer pointing directly to port 22 of all backend private compute instances.
B.Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.
C.Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.
D.Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.
E.Establish an OCI Site-to-Site VPN or FastConnect circuit from the on-premises datacenter to the VCN, enabling direct administrative access.
AnswersD, E

OCI Bastion provides secure, restricted, and audited access to private instances without requiring public IPs or running custom bastion hosts.

Why this answer

Secure private access can be achieved via OCI Bastion service (which provides managed SSH/SFTP access) or through a site-to-site VPN / FastConnect hybrid connection combined with private subnets.

Practice this question →
14
MCQeasy

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

A.OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).
B.OCI Database Management service.
C.OCI Identity and Access Management (IAM) password policies.
D.OCI Vault service to create and manage Customer-Managed Keys (CMK).
AnswerD

OCI Vault provides customer-managed encryption keys stored in hardware security modules (HSM) for high security.

Why this answer

OCI Vault allows customers to manage their own master encryption keys (CMK) and provides full lifecycle management including key rotation and usage tracking.

Practice this question →
15
MCQmedium

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

A.OCI NAT Gateway.
B.OCI Load Balancer with TCP routing.
C.OCI API Gateway.
D.OCI Bastion service.
AnswerD

OCI Bastion provides secure, audited, and time-bound access to private compute instances without public IP addresses.

Why this answer

OCI Bastion provides restricted and secure transient access to target resources that do not have public endpoints, using SSH or Port Forwarding through a managed service.

Practice this question →
16
MCQmedium

An enterprise customer wants to restrict OCI API access so that developers can only invoke management APIs from corporate office public IP addresses. Which OCI feature implements this restriction?

A.OCI WAF rules configured for API Gateway.
B.OCI Network Security Groups with CIDR block filters.
C.IAM policies with conditions checking the 'request.ip' against corporate CIDR blocks.
D.OCI Service Gateway IP whitelisting.
AnswerC

IAM conditions allow administrators to restrict API access based on source IP addresses.

Why this answer

IAM policy conditions support request evaluation based on source IP address ranges using the 'request.ip' evaluation clause.

Practice this question →
17
Multi-Selectmedium

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

Select 3 answers
A.Expose all database management ports to the 0.0.0.0/0 CIDR block.
B.Isolate workloads into private subnets whenever public access is not required.
C.Implement stateful security rules to automatically allow return traffic for established connections.
D.Use Network Security Groups (NSGs) for granular, VNIC-level traffic filtering.
E.Attach an Internet Gateway to every private subnet by default.
AnswersB, C, D

Private subnets protect workloads from direct internet exposure.

Why this answer

VCN security hardening includes subnets, NSGs, and limiting internet gateways.

Practice this question →
18
MCQmedium

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

A.Disable the OCI Internet Gateway on the VCN route table.
B.Enable OCI Bastion service on the database subnet.
C.Configure OCI IAM policies to block network ingress at the user level.
D.Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.
AnswerD

NSGs apply stateful firewall rules directly to VNICs, allowing precise traffic filtering and default-deny implementation.

Why this answer

Network Security Groups (NSGs) or Security Lists control packet-level traffic. NSGs are applied directly to specific VNICs, providing granular control over instance-level traffic isolation.

Practice this question →
19
MCQmedium

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

A.Attach API signing keys to each federated user profile manually through the OCI Console.
B.Create dynamic groups in OCI with matching rules checking the user's corporate email domain string.
C.Configure a Federation in OCI IAM using SAML 2.0, establish the IdP trust, and then create IdP Group Mappings to OCI IAM groups.
D.Write a custom Python script running on compute instances that synchronizes user passwords from the IdP to OCI local users every hour.
AnswerC

SAML 2.0 federation links the external IdP, and IdP group mapping translates external group claims into OCI group memberships.

Why this answer

Federation in OCI is established by setting up an Identity Provider relationship using SAML 2.0 and configuring Identity Provider Groups mapped to OCI IAM groups.

Practice this question →
20
Multi-Selectmedium

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Select 3 answers
A.Hardcode IAM user passwords directly in instance metadata.
B.Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.
C.Use IAM groups to organize users based on job functions rather than writing policies for individual users.
D.Assign all human users directly to the Administrators group for operational simplicity.
E.Leverage compartment hierarchy so that policies defined on parent compartments cascade to child compartments.
AnswersB, C, E

Using least-privilege verbs limits potential damage from compromised credentials.

Why this answer

Effective IAM design at scale relies on groups, least-privilege verbs, and compartment hierarchy inheritance.

Practice this question →
21
Multi-Selectmedium

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

Select 3 answers
A.Direct routing of BGP peering sessions for on-premises routers.
B.Automated or manual key rotation policies.
C.Unlimited free public storage of plaintext database files.
D.Creation and management of customer-managed master encryption keys (CMK).
E.Hardware Security Module (HSM) backing for cryptographic keys (FIPS 140-2 Level 3).
AnswersB, D, E

Vault supports scheduling and executing key rotations.

Why this answer

OCI Vault provides master key creation, key rotation, and hardware security module (HSM) backed protection.

Practice this question →
22
MCQmedium

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

A.Use OCI Cloud Guard to block any unauthorized IP connection attempts to the database.
B.Attach a public IP to the database servers and use a public load balancer to filter database ports.
C.Configure a Network Security Group (NSG) for the database tier with an ingress rule allowing traffic solely from the application tier's NSG.
D.Deploy a DRG with a firewall ruleset between the app subnet and DB subnet.
AnswerC

NSGs allow grouping of resources and enable referencing other NSGs as sources for stateful firewall rules, providing granular micro-segmentation.

Why this answer

To isolate database tiers, use regional or subnet-level Security Lists (or Network Security Groups) where the ingress rule explicitly references the application subnet CIDR or application NSQ, combined with a private subnet layout.

Practice this question →
23
MCQhard

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

A.OCI Security Zones
B.IAM Policy Condition statements with 'request.time'
C.OCI Audit Log Service with Event-Driven Automation
D.OCI Tag Defaults with validation rules
AnswerA

Security Zones enforce maximum-security recipes that prevent non-compliant resource creation (e.g., blocking public buckets or open security lists).

Why this answer

OCI Security Zones enforce strict security postures on compartments from the moment they are created by blocking any actions or configurations that violate predefined recipes.

Practice this question →
24
MCQmedium

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

A.OCI Cloud Guard Responder Logs
B.OCI Audit Service
C.OCI Database Performance Hub
D.OCI Monitoring Service
AnswerB

Audit logs capture all control plane API activities, including resource deletions.

Why this answer

OCI Audit service records calls to all OCI API endpoints as log events, detailing who performed the action, when, and from what IP address.

Practice this question →
25
Multi-Selectmedium

Which THREE methods can be used to establish secure, private connectivity from an on-premises datacenter to an OCI VCN without traversing the public internet? (Choose three.)

Select 3 answers
A.OCI FastConnect dedicated private circuit.
B.OCI Internet Gateway attached to a public subnet.
C.OCI Site-to-Site IPsec VPN.
D.OCI FastConnect via a Partner virtual circuit.
E.Unencrypted public IP address assignment on database instances.
AnswersA, C, D

FastConnect provides high-speed, private connectivity bypassing the public internet.

Why this answer

OCI FastConnect, Site-to-Site IPsec VPN, and Oracle Cloud VMware Solution private links provide secure private connectivity.

Practice this question →
26
MCQhard

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

A.Hardcode the credentials inside the function source code repository.
B.Store secrets in OCI Object Storage with public read access.
C.Encode the credentials in Base64 and store them in IAM policy descriptions.
D.Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.
AnswerD

Storing secrets in OCI Vault and fetching them dynamically ensures credentials are encrypted at rest and in transit without exposure in configurations.

Why this answer

OCI Vault Secrets management allows applications and functions to securely store and retrieve credentials at runtime using OCI SDKs, eliminating plaintext secrets in environment variables or code.

Practice this question →
27
MCQmedium

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

A.Local VCN Peering.
B.Dynamic Routing Gateway (DRG) with internet breakout enabled.
C.Internet Gateway with strict Security List rules.
D.OCI Bastion service.
AnswerA

Local VCN Peering connects two VCNs in the same region privately, enabling secure inter-VCN traffic without internet exposure.

Why this answer

VCN Peering (specifically Local VCN Peering within the same region) allows resources in different VCNs to communicate privately using private IP addresses.

Practice this question →
28
Multi-Selecthard

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Select 2 answers
A.Disable versioning on all buckets to save storage space.
B.Grant 'manage' permissions on the bucket to all anonymous users.
C.Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.
D.Store all files without encryption to ensure faster deletion.
E.Implement least-privilege IAM policies restricting bucket deletion and management to authorized security groups.
AnswersC, E

Object Lock prevents objects from being deleted or overwritten during the specified retention period.

Why this answer

Object Storage Object Lock provides WORM capabilities, and IAM policies control who can manage or delete storage resources.

Practice this question →
29
MCQmedium

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

A.Create a single global vault in the root tenancy that replicates master keys across all regions automatically.
B.Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.
C.Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.
D.Store all keys in the home region and use the OCI Service Gateway for remote decryption.
AnswerB

Provisioning regional vaults ensures that keys remain localized to their respective regions without crossing geographic boundaries.

Why this answer

OCI Vault keys are regional resources. To comply with data residency and security policies, you must provision separate vaults and master encryption keys in each operating region.

Practice this question →
30
MCQmedium

An enterprise customer needs to restrict access to an OCI Object Storage bucket so that only requests originating from a specific Virtual Cloud Network (VCN) via a Service Gateway can read objects. Which combination of Identity and Access Management (IAM) and network policies should be implemented?

A.Configure a bucket policy that denies all read requests unless the request comes through a Service Gateway using the condition 'request.region, target.bucket.id, and request.network.source'.
B.Enable OCI Cloud Guard Security Zones on the compartment and automatically enforce a deny-all policy on the bucket.
C.Route all Object Storage traffic through a DRG (Dynamic Routing Gateway) and apply stateful network firewall rules to drop non-VCN traffic.
D.Create an IAM policy with the condition 'where request.vcn.id = <vcn-ocid>' and attach a security list to the VCN subnet allowing outbound traffic to Object Storage.
AnswerA

Object Storage bucket policies support advanced conditions such as request.network.source to restrict traffic exclusively to specified Service Gateways or VCNs.

Why this answer

To restrict access to a VCN via a Service Gateway, you must use IAM policy conditional statements utilizing the target.orcl.ocid for the service gateway or the request.vcn.id, combined with an appropriate Object Storage bucket policy or IAM policy.

Practice this question →
31
MCQeasy

What is the primary function of OCI Network Security Groups (NSGs)?

A.To balance HTTP/HTTPS traffic across multiple backend web servers.
B.To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.
C.To encrypt data at rest in block storage volumes.
D.To manage human user passwords and multi-factor authentication.
AnswerB

NSGs provide granular, VNIC-level network traffic filtering.

Why this answer

NSGs provide virtual firewall rules that apply to a specific set of VNICs of your choosing, unlike Security Lists which apply to all VNICs in a subnet.

Practice this question →
32
MCQmedium

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

A.Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.
B.The VCN lacks an Internet Gateway.
C.The OCI Vault service is offline.
D.The team lacks IAM permissions to create compute instances.
AnswerA

Security Zones enforce maximum security policies, which include blocking public IP creation on compute resources.

Why this answer

Security Zones strictly prohibit resources from having public IP addresses to prevent accidental exposure to the internet, blocking non-compliant API requests.

Practice this question →
33
MCQhard

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

A.Delete the VCN containing the instance to stop all routing.
B.Terminate the compute instance and delete all attached block volumes immediately.
C.Revoke the IAM user credentials of the administrator who launched the instance.
D.Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.
AnswerD

Applying a quarantine NSG instantly cuts off network communication for the instance while preserving OS memory and storage volumes for forensics.

Why this answer

To isolate a compromised instance while keeping volumes intact, the automated function should remove the instance's existing NSGs and attach a restrictive quarantine NSG that blocks all traffic, or disassociate its VNIC from active subnets, while leaving block volumes untouched.

Practice this question →
34
MCQmedium

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

A.Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.
B.Disable compartment security boundaries and assign all users to the Administrators group.
C.Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.
D.Use IAM user credentials hardcoded inside the application configuration files on the compute instances.
AnswerC

Targeted compartment-level policies combined with precise dynamic group matching rules provide secure and isolated workload authentication.

Why this answer

Using fine-grained matching rules in dynamic groups based on specific compartment OCIDs or resource tags ensures that workloads only receive the exact permissions needed, adhering to the principle of least privilege.

Practice this question →
35
MCQeasy

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

A.To replicate OCI database backups to external cloud providers.
B.To allow users to authenticate to OCI using their existing corporate credentials via SAML 2.0.
C.To automatically provision network security groups across regions.
D.To bypass OCI encryption key management requirements.
AnswerB

Identity federation integrates external IdPs for single sign-on (SSO) into OCI.

Why this answer

Federation allows users to sign in to OCI using their corporate credentials managed by an external IdP (like Azure AD or Okta) via SAML 2.0.

Practice this question →
36
MCQeasy

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

A.OCI Cloud Guard
B.OCI Vulnerability Scanning Service
C.OCI Identity and Access Management
D.OCI Application Performance Monitoring
AnswerB

VSS automatically scans compute hosts and container images to identify security flaws and vulnerabilities.

Why this answer

OCI Vulnerability Scanning Service (VSS) routinely inspects host operating systems and container images for security vulnerabilities and missing patches.

Practice this question →
37
MCQeasy

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

A.OCI Audit.
B.OCI Web Application Firewall.
C.OCI Vulnerability Scanning Service.
D.OCI Cloud Guard.
AnswerD

Cloud Guard aggregates security findings across the tenancy and computes a security score to help assess posture.

Why this answer

OCI Cloud Guard provides continuous monitoring of your OCI resources for security vulnerabilities, configuration drifts, and risky user behaviors.

Practice this question →
38
Multi-Selecthard

An organization requires high security for its cryptographic keys stored in OCI Vault. Which THREE architectural practices must be enforced when configuring and using Master Encryption Keys (MEKs)?

Select 3 answers
A.Apply least-privilege IAM policies separating the management of Vaults/Keys from the cryptographic operations (crypto-admin vs crypto-user).
B.Use Virtual Vaults for development environments and Hardware Security Module (HSM) protected Vaults with FIPS 140-2 Level 3 validation for production.
C.Store the Vault master key backup passphrases in plain text inside an Object Storage bucket for easy disaster recovery access.
D.Share the Vault master encryption key directly across all global regions to simplify multi-region database encryption.
E.Implement automated or manual key rotation policies for your Master Encryption Keys to limit the blast radius of a compromised key.
AnswersA, B, E

Separation of duties requires distinct roles for managing vaults/keys versus invoking encrypt/decrypt operations.

Why this answer

Key management best practices include using Hardware Security Modules (HSMs) of FIPS 140-2 Level 3 validation, rotating keys periodically, and restricting access to keys using strict IAM policies and Vault management operations.

Practice this question →
39
MCQmedium

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

A.OCI IAM compartments with default root-level policies.
B.OCI Cloud Guard targets with active detector recipes.
C.OCI Network Security Groups (NSGs) applied to the VCN.
D.OCI Security Zones.
AnswerD

Security Zones enforce maximum security policies upon resource creation and block any action that violates these policies.

Why this answer

OCI Security Zones enforce strict guardrails by automatically validating resource creation and configuration changes against a predefined set of security policies, preventing non-compliant actions.

Practice this question →
40
Multi-Selecthard

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

Select 2 answers
A.Configure IPsec VPN tunnels with strong encryption algorithms (e.g., AES-256) for on-premises connectivity.
B.Transmit all database traffic over unencrypted public internet connections.
C.Rely on plain-text HTTP for all inter-microservice communication within a VCN.
D.Disable VCN security lists to allow unhindered packet sniffing.
E.Enforce TLS (Transport Layer Security) for applications and HTTPS endpoints communicating across services.
AnswersA, E

IPsec VPNs encrypt all data traversing between on-premises datacenters and OCI VCNs.

Why this answer

Data in transit across OCI networking is secured using IPsec VPN tunnels for hybrid connectivity and TLS/SSL encryption for application and service endpoints.

Practice this question →
41
MCQhard

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

A.A NAT Gateway combined with a public IP address on the database.
B.An OCI Service Gateway.
C.A Site-to-Site VPN connection back to the corporate data center.
D.An Internet Gateway attached to the VCN route table.
AnswerB

Service Gateways enable secure, private communication from VCN subnets to Oracle public services within the Oracle network.

Why this answer

OCI Service Gateway allows private access from a VCN to Oracle services (like Autonomous Database and Object Storage) without using public IPs or traversing the public internet.

Practice this question →
42
MCQeasy

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

A.OCI Cloud Guard
B.OCI Bastion Service
C.OCI Vault
D.OCI Vulnerability Scanning Service
AnswerA

Cloud Guard aggregates security telemetry, detects misconfigurations, and executes responder rules for automated remediation.

Why this answer

OCI Cloud Guard provides threat detection and automated remediation (via responder recipes) to continuously monitor the security posture of OCI resources.

Practice this question →
43
MCQeasy

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

A.OCI Bastion Service session manager.
B.OCI Database Migration Service.
C.OCI Cloud Guard Managed Recipes and Responder Rules.
D.OCI IAM Policy Generator.
AnswerC

Cloud Guard provides detector recipes to find problems and responder recipes to automatically or manually remediate them.

Why this answer

OCI Cloud Guard provides managed problem remediation and configuration recommendations across your tenancy.

Practice this question →
44
MCQmedium

You are configuring a site-to-site IPSec VPN between your on-premises datacenter and an OCI VCN. To ensure data confidentiality and integrity across the public internet, which encryption algorithms should you mandate in the IPSec configuration?

A.Plaintext transmission without IPsec encapsulation.
B.RC4 stream cipher with no hashing.
C.AES-256 with SHA-256 hashing.
D.DES with MD5 authentication.
AnswerC

AES-256 combined with SHA-256 provides strong, industry-standard cryptographic security for IPSec VPN tunnels.

Why this answer

Modern security standards recommend robust encryption algorithms such as AES-256 for phase 1 and phase 2 IPSec tunnels to ensure strong confidentiality and integrity.

Practice this question →
45
MCQhard

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

A.Allow group Developers to manage compute-instances in compartment ParentCompartment
B.Allow group Developers to manage compute-instances in tenancy
C.Allow group Developers to manage compute-instances in root
D.Write individual policies for every single child compartment separately without referencing the parent.
AnswerA

Permissions granted on a parent compartment automatically cascade to all nested child compartments in OCI IAM.

Why this answer

Policies can be scoped to compartments using the 'in compartment' clause. By targeting a parent compartment, permissions automatically flow down to all nested child compartments.

Practice this question →
46
MCQhard

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

A.Attach public IP addresses directly to all backend web servers.
B.Rely entirely on default VCN Security Lists without route table modifications.
C.Route inbound traffic from the Internet Gateway through a firewall appliance subnet before forwarding it to backend subnets via route tables.
D.Use OCI Object Storage to filter incoming HTTP packets.
AnswerC

Routing traffic through a security appliance subnet enforces perimeter defense and inspection before reaching internal workloads.

Why this answer

To inspect inbound internet traffic with a firewall appliance, traffic must enter via an Internet Gateway, route to the firewall appliance VNIC in a DMZ subnet, and then route through a DRG or local routing to backend subnets. Alternatively, OCI Network Firewall can be deployed inline.

Practice this question →
47
MCQhard

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

A.OCI IAM token-based database authentication combined with Oracle Autonomous Database.
B.Disabling all authentication to maximize application performance.
C.Hardcoded administrator passwords stored in plain text configuration files.
D.Using static API signing keys for database connection strings.
AnswerA

OCI IAM database authentication allows users and applications to authenticate to the database using OCI IAM tokens instead of database-specific passwords.

Why this answer

OCI IAM can integrate with Oracle Autonomous Database using OAuth2 / OpenID Connect tokens or OCI IAM database token authentication, allowing users to connect using token-based credentials.

Practice this question →
48
MCQeasy

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

A.OCI Events Service
B.OCI Audit Service
C.OCI Logging Analytics
D.Database Audit Vault
AnswerB

The Audit service automatically records API events for governance, compliance, and security investigations.

Why this answer

OCI Audit service automatically records calls to all supported Oracle Cloud Infrastructure public API endpoints as log events for security and compliance tracking.

Practice this question →
49
MCQhard

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

A.Enable OCI Audit logs and configure automated notifications via OCI Notifications service.
B.Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.
C.Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.
D.Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.
AnswerC

OCI WAF integrates directly with OCI Load Balancers or can run edge enforcement to protect applications against web vulnerabilities.

Why this answer

OCI Web Application Firewall (WAF) provides centralized protection against web application attacks, such as SQL injection, XSS, and other OWASP Top 10 vulnerabilities, by inspecting HTTP/HTTPS traffic.

Practice this question →
50
Multi-Selecthard

When configuring OCI Security Zones, which TWO restrictions are automatically enforced on resources within that zone? (Choose two.)

Select 2 answers
A.Resources are strictly prohibited from having public IP addresses.
B.All VCNs must have Internet Gateways attached by default.
C.All Object Storage buckets must be private and cannot allow public access.
D.IAM administrators are prohibited from creating any compartments.
E.All compute instances must use unencrypted local boot volumes.
AnswersA, C

Security Zones prevent any resource from acquiring a public IP address.

Why this answer

Security Zones prohibit public IP addresses on compute instances and require all storage buckets to be private.

Practice this question →
51
Multi-Selecthard

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Select 2 answers
A.Routing all log data to unencrypted public FTP servers.
B.OCI Audit service to capture all control plane API activities and resource modifications.
C.Disabling all logging services to save storage costs.
D.Relying solely on user memory dumps for audit compliance.
E.OCI Logging service to ingest, store, and analyze log data from VCN flow logs and compute instances.
AnswersB, E

OCI Audit records all API calls for accountability and forensics.

Why this answer

OCI Audit and OCI Logging are core services for capturing control plane and data plane events for security analysis.

Practice this question →
52
MCQhard

An organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?

A.Use Oracle-managed encryption keys with automatic key rotation enabled.
B.Rely on OCI Database Vault to manage cloud-level master encryption keys.
C.Store plain-text keys in OCI Object Storage with restricted IAM policies.
D.Configure a Virtual Private Vault backed by dedicated hardware security module (HSM) partitions and manage master encryption keys.
AnswerD

Dedicated vaults provide isolated HSM partitions exclusively for a single tenant, meeting rigorous regulatory standards for key ownership and revocation.

Why this answer

Using an OCI Vault with external key management (or dedicated Virtual Private Vaults backed by dedicated HSM partitions) allows organizations to retain full control over their keys, including immediate revocation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security questions.

Start 20-question session