Courseiva

CCNA Security Questions

44 questions · Security · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

A.Object Storage Object Lock with Compliance mode.
B.OCI Cloud Guard data protection detectors.
C.OCI Object Storage Pre-Authenticated Requests (PAR).
D.OCI Vault key rotation policies.
AnswerA

Object Lock with Compliance mode enforces WORM protection, preventing any user—including tenancy administrators—from deleting or overwriting objects until the retention period expires. This directly satisfies the stem's requirement to protect backups against accidental deletion or ransomware encryption by administrators, since even privileged accounts cannot bypass Compliance-mode retention.

Why this answer

Object Lock with Compliance mode enforces a WORM (Write Once, Read Many) retention policy that cannot be removed or shortened by any user — including tenancy administrators — until the retention period expires. This directly protects backups against accidental deletion and ransomware encryption because objects cannot be overwritten or deleted during the retention window. Compliance mode is the strictest of the two Object Lock modes (the other being Governance mode, which privileged users can bypass).

Exam trap

1Z0-997-26 often tests the distinction between detection services (Cloud Guard), access-sharing features (PARs), and cryptographic controls (Vault) versus true immutability controls (Object Lock), so candidates who pick a 'security-sounding' service instead of the WORM feature get it wrong.

How to eliminate wrong answers

Option B is wrong because Cloud Guard is a threat-detection and posture-management service that identifies risky configurations and suspicious activity; it generates findings and can trigger remediation, but it does not enforce immutability on stored objects. Option C is wrong because Pre-Authenticated Requests grant time-limited, unauthenticated access to specific objects or buckets — they are an access-sharing mechanism, not a protection mechanism, and actually widen the attack surface. Option D is wrong because Vault key rotation policies only rotate the encryption keys used to protect data at rest; rotation does not prevent an administrator from deleting or overwriting bucket objects.

Practice this question →
2
MCQhard

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

A.Attach a broad administrative instance principal to the worker node pool.
B.Expose Object Storage via a public endpoint and permit anonymous read access.
C.Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.
D.Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.
AnswerD

Workload Identity maps Kubernetes service account tokens to OCI IAM dynamic groups, so pods obtain short-lived OCI credentials via instance principals rather than embedded API keys. This satisfies the requirement to avoid long-lived credentials stored inside the cluster.

Why this answer

OCI IAM Workload Identity for OKE lets individual Kubernetes pods authenticate to OCI services using their Kubernetes service account (KSA) tokens, which OCI IAM maps to dynamic groups via a defined identity provider. This eliminates the need to embed long-lived API signing keys or user credentials inside the cluster, satisfying the security best practice of short-lived, pod-scoped credentials. The KSA token is exchanged for an OCI session token, and IAM policies attached to the dynamic group grant only the required Object Storage permissions.

Exam trap

1Z0-997-26 often tests whether candidates confuse node-level instance principals (which grant all pods on a node the same identity) with pod-level workload identity, leading them to pick the broad instance principal option as a shortcut.

How to eliminate wrong answers

Option A is wrong because attaching a broad administrative instance principal to the worker node pool grants every pod on every node full admin-level OCI access, violating least privilege and still not scoping credentials to individual workloads. Option B is wrong because exposing Object Storage via a public endpoint with anonymous read access removes authentication entirely and exposes data to the internet, which is the opposite of hardening. Option C is wrong because embedding API signing keys of a service user in Kubernetes Secrets still stores long-lived credentials in the cluster, and Secrets are only base64-encoded, not encrypted by default, so they can be exfiltrated.

Practice this question →
3
Multi-Selectmedium

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Select 3 answers
A.Trigger responder recipes to remediate detected security risks automatically or manually.
B.Automatically patch kernel-level vulnerabilities on third-party on-premises servers.
C.Monitor tenancy resources for security misconfigurations and policy violations.
D.Provide point-to-point IPsec VPN tunneling between VCNs.
E.Calculate an overall security score for the tenancy based on detected problems.
AnswersA, C, E

Cloud Guard responder recipes define automated or manual remediation actions, such as stopping a public bucket or disabling an overly permissive user, triggered when a detector recipe flags a problem. This directly improves security posture by closing detected risks.

Why this answer

Option A is correct because Cloud Guard responder recipes define actions (such as stopping an instance, deleting a public bucket, or invoking a function) that can be triggered automatically or manually when a detector rule fires on a problem. Option C is correct because Cloud Guard continuously monitors tenancy resources against detector recipes that identify security misconfigurations, risky configurations, and policy violations across OCI services. Option E is correct because Cloud Guard aggregates detected problems into a security score for the tenancy, giving an at-a-glance measure of the overall cloud security posture.

Option B is incorrect because Cloud Guard is an OCI-native service and does not patch kernel-level vulnerabilities on third-party on-premises servers. Option D is incorrect because point-to-point IPsec VPN tunneling between VCNs is provided by OCI VPN Connect/FastConnect or DRG-based connectivity, not by Cloud Guard.

Exam trap

1Z0-997-26 often tests whether candidates confuse Cloud Guard with network security services (VPN, Bastion) or with patch management — candidates pick options that sound security-related but aren't Cloud Guard capabilities.

Practice this question →
4
MCQhard

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

A.Configure public IP addresses on all participating compute instances.
B.Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.
C.Route all inter-region traffic through public Internet Gateways with IPsec tunneling.
D.Deploy an OCI NAT Gateway in each region.
AnswerB

An RPC between the two DRGs carries traffic privately over Oracle's backbone, while matching route table entries and security rules permit the VCN CIDRs to communicate. This satisfies the requirement for secure, private transmission between regions.

Why this answer

A Remote Peering Connection (RPC) between two DRGs in different OCI regions is the native OCI mechanism for private, secure inter-region VCN connectivity. Once the RPC is established and the DRGs are attached to their respective VCNs, you must configure route tables in each VCN to direct traffic destined for the other VCN's CIDR to the DRG, and ensure security lists or NSGs allow the required traffic. This creates a private, encrypted connection over Oracle's backbone network without traversing the public internet.

Exam trap

1Z0-997-26 often tests the misconception that inter-region connectivity requires public IPs or internet gateways, confusing Remote Peering with VPN or NAT solutions.

How to eliminate wrong answers

Option A is wrong because public IP addresses are not required for private DRG-to-DRG peering; instances communicate using private IPs, and exposing public IPs would be a security risk. Option C is wrong because routing inter-region traffic through public Internet Gateways with IPsec tunneling describes a site-to-site VPN over the internet, not OCI's private remote peering, which uses Oracle's dedicated backbone and does not require IGWs. Option D is wrong because a NAT Gateway only provides outbound internet access for private subnets within a single VCN; it does not enable inter-VCN or inter-region connectivity and cannot replace an RPC.

Practice this question →
5
Multi-Selecthard

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Select 2 answers
A.An IAM policy granting the dynamic group permission to read secrets in the OCI Vault.
B.A dynamic group with matching rules defining which compute instances belong to the group (e.g., based on compartment OCID).
C.A public internet gateway attached to the vault storage endpoint.
D.Disabling all IAM policy enforcement across the tenancy.
E.Hardcoded passwords placed in the instance /etc/passwd file.
AnswersA, B

An IAM policy is mandatory because dynamic groups only establish instance identity; authorisation comes from policies. The policy must name the dynamic group as principal and grant `read secret-family` on the vault or compartment, satisfying the requirement that instances can read secrets from OCI Vault.

Why this answer

Option A is correct because the dynamic group itself only identifies the instances; authorization to call the OCI Vault secret-read API (e.g., `ReadSecretBundle` / `ReadSecrets`) must be granted through an IAM policy that names the dynamic group as principal and the vault or secrets as resource. Option B is correct because a dynamic group must be created with matching rules (for example, `instance.compartment.id = 'ocid1.compartment...'` or `instance.id = 'ocid1.instance...'`) so that the compute instances are recognized as members and can receive the policy permissions. Option C is wrong because a public internet gateway is a VPC networking component for internet traffic and has no role in authenticating instances to OCI Vault.

Option D is wrong because disabling IAM policy enforcement would remove the very authorization mechanism needed and is not a supported or sensible configuration. Option E is wrong because hardcoded passwords in /etc/passwd are insecure and unrelated to OCI instance principals, which use instance identity certificates rather than static credentials.

Exam trap

1Z0-997-26 often tests the confusion between dynamic groups (for resources) and regular groups (for users), and candidates may forget that both the dynamic group and the IAM policy are required — one without the other grants no access.

Practice this question →
6
MCQhard

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

A.Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.
B.Enable OCI Cloud Guard with default responder rules.
C.Deploy OCI Network Firewall to inspect all control plane traffic.
D.Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.
AnswerA

Object Lock in Compliance mode makes exported Audit log objects immutable and undeletable for the retention period, even by administrators. This satisfies the tamper-proofing and retention evidence the auditor demands, which standard Logging retention alone cannot provide.

Why this answer

OCI Audit captures all API activity in a tenancy automatically, and OCI Logging can export those Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode, providing tamper-proof, WORM retention that satisfies auditor evidence requirements. Object Lock in Compliance mode prevents any user, including tenancy administrators, from deleting or altering the retained audit objects until the retention period expires. This combination delivers capture, immutability, and long-term retention in one architecture.

Exam trap

1Z0-997-26 often tests the confusion between Cloud Guard (posture/threat detection) and Audit Logging with Object Lock (immutable compliance evidence) — candidates must recognize that only the latter provides tamper-proof retention.

How to eliminate wrong answers

Option B is wrong because Cloud Guard is a posture management and threat detection service that identifies misconfigurations and risky activity — it does not capture, tamper-proof, or retain API activity logs for compliance evidence. Option C is wrong because OCI Network Firewall inspects network traffic (north-south and east-west packet flows), not control plane API calls, and it does not provide immutable log retention. Option D is wrong because streaming API activities to an external SIEM over unencrypted HTTP violates both the tamper-proofing requirement and basic data-in-transit security, and OCI Events is an event-routing service, not an audit retention mechanism.

Practice this question →
7
MCQeasy

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

A.Allow group Auditors to use database-families in root
B.Allow group Auditors to read all-resources in compartment Production
C.Allow group Auditors to read compartments in tenancy
D.Allow group Auditors to manage all-resources in tenancy
AnswerB

The verb 'read' grants view-only access to all resource types, and scoping the statement to compartment Production confines the auditor to that compartment, satisfying both constraints: no modification rights and no visibility into other compartments.

Why this answer

The policy statement 'Allow group Auditors to read all-resources in compartment Production' grants read-only access to all resources within the Production compartment, without allowing modifications or access to other compartments. This precisely meets the requirement for a third-party auditor to view resources in a specific compartment.

Exam trap

1Z0-997-26 often tests the difference between 'read', 'use', and 'manage' verbs, and the scope of compartments; candidates may choose 'manage' or 'use' thinking it's necessary, but 'read' is sufficient for read-only access.

How to eliminate wrong answers

Option A is wrong because 'use database-families in root' grants use of database resources in the root compartment, which is not read-only and not limited to a specific compartment. Option C is wrong because 'read compartments in tenancy' allows reading compartment metadata, not the resources within them. Option D is wrong because 'manage all-resources in tenancy' grants full management access across the entire tenancy, which is far too permissive.

Practice this question →
8
MCQeasy

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

A.IAM Group
B.Compartment
C.Federation Provider
D.Dynamic Group
AnswerA

IAM groups aggregate users sharing a job function so that a single set of IAM policies grants identical permissions to every member. This directly satisfies the stem's requirement to group users by function and assign one common permission set, rather than attaching policies to each user individually.

Why this answer

An IAM Group in OCI is a collection of users who share the same job function and require the same permissions. Policies are written against groups rather than individual users, so grouping users by role simplifies permission management and follows the principle of least privilege at scale. This is the standard identity construct for role-based access control in OCI.

Exam trap

The trap is confusing IAM Groups (for users) with Dynamic Groups (for resources/instances) — candidates often pick Dynamic Group because it also contains the word 'group,' but it serves a completely different purpose.

How to eliminate wrong answers

Option B is wrong because a Compartment is a logical container for organizing and isolating OCI resources (compute, storage, networking) for billing and access control — it is not a grouping of users. Option C is wrong because a Federation Provider enables identity federation with external IdPs (e.g., Okta, Azure AD) via SAML/OIDC, not grouping users for permission assignment. Option D is wrong because a Dynamic Group contains compute instances (or other resources) that match a rule, used to grant permissions to resources like instance principals — it does not contain human users.

Practice this question →
9
Multi-Selectmedium

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

Select 3 answers
A.Allocation of BGP routing tables for on-premises FastConnect circuits.
B.Rate limiting to mitigate denial of service (DoS) and brute-force attacks.
C.Protection against OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS).
D.Management of hardware security module (HSM) crypto keys for database volumes.
E.Access control rules based on geographic location, IP addresses, or HTTP headers.
AnswersB, C, E

Rate limiting caps request volume per client over a defined window, absorbing the flood of repeated requests that characterise DoS and brute-force attempts. This throttling mechanism directly satisfies the stem's requirement for WAF features, preventing resource exhaustion before requests reach the origin.

Why this answer

OCI Web Application Firewall (WAF) includes rate limiting (Option B), which caps the number of requests from a client within a time window to mitigate DoS and brute-force attacks. It also provides protection against OWASP Top 10 vulnerabilities (Option C), using managed rule sets to detect and block threats such as SQL injection and cross-site scripting (XSS). Additionally, WAF supports access control rules (Option E) that allow or deny traffic based on geographic location, IP addresses, or HTTP headers, enabling granular filtering.

Option A is incorrect because BGP routing for FastConnect is handled by OCI networking services, not WAF. Option D is incorrect because HSM key management for database volumes is provided by OCI Vault and Database services, not WAF.

Exam trap

The trap is mixing WAF layer-7 security features with unrelated OCI services like FastConnect routing or Vault HSM key management; candidates must recognize WAF as an HTTP/S inspection service only.

Practice this question →
10
Multi-Selectmedium

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Select 2 answers
A.Configure a public load balancer pointing directly to port 22 of all backend private compute instances.
B.Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.
C.Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.
D.Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.
E.Establish an OCI Site-to-Site VPN or FastConnect circuit from the on-premises datacenter to the VCN, enabling direct administrative access.
AnswersD, E

OCI Bastion provisions a managed jump host inside the target private subnet, so sessions reach instances over the private network without any public IP or internet gateway. Its timed, session-based SSH access with IAM-controlled permissions satisfies the administrative-access-without-public-exposure constraint directly.

Why this answer

Option D is correct because the OCI Bastion service is purpose-built for this scenario: it creates a managed, time-limited SSH session to private compute instances in a target subnet without requiring any public IP or public exposure, and access is controlled through IAM policies and session types (e.g., managed SSH). Option E is correct because an OCI Site-to-Site VPN (IPSec) or FastConnect (private dedicated connectivity) extends the on-premises network into the VCN, so administrators can reach private instances over the private network path without exposing them to the internet. Option A is wrong because a public load balancer would expose port 22 to the internet and load balancers are not an administrative access mechanism for SSH.

Option B is wrong because attaching ephemeral public IPs directly exposes the instances to the internet, contradicting the requirement. Option C is wrong because an unauthenticated public API Gateway endpoint does not provide secure administrative SSH access and would itself be an unsecured public exposure.

Exam trap

1Z0-997-26 often tests the misconception that adding a public IP with tight security lists or a public load balancer on port 22 counts as 'secure administrative access,' when the exam's intent is that any public internet exposure disqualifies the option — the correct answers must keep instances fully private.

Practice this question →
11
MCQeasy

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

A.OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).
B.OCI Database Management service.
C.OCI Identity and Access Management (IAM) password policies.
D.OCI Vault service to create and manage Customer-Managed Keys (CMK).
AnswerD

OCI Vault provides Customer-Managed Keys (CMK) with configurable rotation schedules, satisfying the policy's strict rotation requirement. Object Storage encrypts data with AES-256; using a Vault master key gives the administrator full control over key lifecycle and rotation, unlike Oracle-managed keys.

Why this answer

OCI Vault is the service for creating and managing customer-managed encryption keys (CMKs). By using OCI Vault, the administrator can generate and manage keys with strict rotation schedules and use them to encrypt data in Object Storage. This satisfies the requirement for customer-managed keys with rotation.

Exam trap

1Z0-997-26 often tests the difference between Oracle-managed keys and customer-managed keys; candidates may choose SSE-S3, but that does not meet the requirement for customer-managed keys with rotation schedules.

How to eliminate wrong answers

Option A is wrong because Oracle-managed keys (SSE-S3) do not provide customer control over key management or rotation schedules. Option B is wrong because OCI Database Management is for managing databases, not for encrypting objects in Object Storage. Option C is wrong because IAM password policies govern user passwords, not encryption keys for data at rest.

Practice this question →
12
MCQmedium

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

A.OCI NAT Gateway.
B.OCI Load Balancer with TCP routing.
C.OCI API Gateway.
D.OCI Bastion service.
AnswerD

OCI Bastion service creates a session-based, time-limited tunnel to targets in private subnets, so administrators reach the database compute instances without any inbound SSH rule or public exposure. That satisfies the constraint of performing maintenance while keeping SSH ports closed to the internet and corporate network.

Why this answer

OCI Bastion service provides secure, time-limited, and audited SSH access to private subnet compute instances without exposing any public IP or opening inbound SSH ports. It creates a bastion session that tunnels SSH traffic through the OCI service, and access is controlled by IAM policies and session TTLs. This directly meets the requirement of performing maintenance on private database instances without internet or corporate network exposure.

Exam trap

1Z0-997-26 often tests whether candidates confuse outbound-only NAT Gateway functionality with inbound administrative access, causing them to pick NAT Gateway when the requirement is secure inbound SSH.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway only allows outbound traffic from private subnets to the internet; it does not provide inbound SSH access for administrators. Option B is wrong because a Load Balancer with TCP routing would expose the SSH port through a public listener, which is exactly what the question says to avoid. Option C is wrong because OCI API Gateway is designed for HTTP/REST API traffic and cannot proxy raw SSH sessions to compute instances.

Practice this question →
13
Multi-Selectmedium

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

Select 3 answers
A.Expose all database management ports to the 0.0.0.0/0 CIDR block.
B.Isolate workloads into private subnets whenever public access is not required.
C.Implement stateful security rules to automatically allow return traffic for established connections.
D.Use Network Security Groups (NSGs) for granular, VNIC-level traffic filtering.
E.Attach an Internet Gateway to every private subnet by default.
AnswersB, C, D

Placing workloads in private subnets removes unnecessary internet exposure, so only intended traffic reaches instances. This satisfies the hardening requirement by shrinking the attack surface, with public access provided solely through controlled gateways or load balancers where genuinely required.

Why this answer

Option B is correct because placing workloads in private subnets when they don't need inbound internet access removes their exposure to the public internet, and OCI private subnets have no route to an Internet Gateway, so they can only be reached via controlled paths such as a NAT Gateway, Service Gateway, or bastion. Option C is correct because OCI security rules are stateful by default, meaning return traffic for an established connection is automatically permitted, which reduces the need for wide inbound rules and lowers the risk of misconfiguration. Option D is correct because Network Security Groups (NSGs) apply at the VNIC level and let you write granular rules that reference other NSGs as sources or destinations, enabling least-privilege, application-tier-based filtering rather than broad subnet-level CIDR rules.

Option A is not recommended because exposing database management ports (e.g., 1521, 3306, 5432) to 0.0.0.0/0 makes them reachable from the entire internet and invites brute-force and exploitation attempts. Option E is not recommended because attaching an Internet Gateway to a private subnet would make it public and defeat the purpose of isolation; private subnets should instead use a NAT Gateway for outbound traffic and a Service Gateway for OCI services.

Exam trap

The trap is that candidates may select 'attach an Internet Gateway to every private subnet' thinking it improves connectivity — but the exam tests whether you understand that private subnets should never have direct internet exposure by default.

Practice this question →
14
MCQmedium

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

A.Disable the OCI Internet Gateway on the VCN route table.
B.Enable OCI Bastion service on the database subnet.
C.Configure OCI IAM policies to block network ingress at the user level.
D.Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.
AnswerD

Attaching a Network Security Group to the instance VNICs enforces stateful ingress filtering at the network interface, satisfying the subnet-wide default-deny requirement. NSG rules are evaluated by priority, so an explicit deny-all rule blocks inbound traffic while lower-priority allow rules permit only administrative sources. This gives per-instance control regardless of subnet-level configuration.

Why this answer

Network Security Groups (NSGs) in OCI are virtual firewalls applied directly to the VNICs of instances, and they support stateful ingress/egress rules. By attaching an NSG with a default-deny posture (no allow rules for unwanted traffic) plus explicit allow rules for administrative ports (e.g., SSH 22 from a bastion CIDR), all other inbound traffic is dropped at the VNIC level. This is the granular, instance-scoped enforcement point OCI provides for subnet-level or VNIC-level traffic control.

Exam trap

1Z0-997-26 often tests the confusion between routing controls (Internet Gateway, route tables), identity controls (IAM policies), and packet-filtering controls (Security Lists vs. NSGs), tempting candidates to pick a routing or IAM answer when the question asks for default-deny ingress enforcement at the instance level.

How to eliminate wrong answers

Option A is wrong because removing or disabling an Internet Gateway only affects traffic entering from the internet via that gateway; it does not block intra-VCN, peering, VPN, or FastConnect traffic, and it is a routing change rather than a security rule. Option B is wrong because the OCI Bastion service provides controlled, time-limited SSH sessions to private targets — it is an access mechanism, not a default-deny ingress firewall, and enabling it does not reject inbound traffic. Option C is wrong because IAM policies govern OCI API authorization (who can call which OCI resources), not packet-level network ingress; IAM cannot filter TCP/UDP traffic to a VNIC.

Practice this question →
15
MCQmedium

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

A.Attach API signing keys to each federated user profile manually through the OCI Console.
B.Create dynamic groups in OCI with matching rules checking the user's corporate email domain string.
C.Configure a Federation in OCI IAM using SAML 2.0, establish the IdP trust, and then create IdP Group Mappings to OCI IAM groups.
D.Write a custom Python script running on compute instances that synchronizes user passwords from the IdP to OCI local users every hour.
AnswerC

SAML 2.0 federation establishes the trust between the external IdP and OCI IAM; IdP Group Mappings then translate IdP group claims into OCI IAM group membership, so users inherit the correct policies at login. This directly satisfies the group-to-permissions mapping requirement.

Why this answer

OCI IAM federation with SAML 2.0 establishes trust with the external IdP, and IdP Group Mappings map the IdP's group claims to OCI IAM groups. When a user logs in, OCI reads the group attribute from the SAML assertion and grants the permissions associated with the mapped OCI groups. This provides automatic, centralized authorization based on corporate group membership.

Exam trap

1Z0-997-26 often tests the difference between authentication (SAML federation) and authorization (IdP group mappings) — candidates incorrectly pick dynamic groups or API keys, which are for OCI resources and programmatic access, not for mapping human IdP groups.

How to eliminate wrong answers

Option A is wrong because API signing keys are used for programmatic API access, not for mapping IdP group memberships to OCI groups — attaching keys to federated users does not grant group-based permissions. Option B is wrong because dynamic groups match OCI compute instances or other resources, not federated human users; dynamic group rules cannot evaluate an IdP's group claims. Option D is wrong because synchronizing passwords is unnecessary and insecure — federation uses SAML assertions, not password replication, and local OCI users are not used for federated identities.

Practice this question →
16
Multi-Selectmedium

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Select 3 answers
A.Hardcode IAM user passwords directly in instance metadata.
B.Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.
C.Use IAM groups to organize users based on job functions rather than writing policies for individual users.
D.Assign all human users directly to the Administrators group for operational simplicity.
E.Leverage compartment hierarchy so that policies defined on parent compartments cascade to child compartments.
AnswersB, C, E

Least privilege means granting only the weakest verb that satisfies the task: inspect, read, use or manage, in ascending order. Scoping policies to the narrowest verb and compartment limits blast radius if credentials are misused.

Why this answer

Option B is correct because OCI IAM verbs are ordered from least to most permissive (inspect < read < use < manage), and granting only the minimum verb needed for a task enforces least privilege and limits blast radius at scale. Option C is correct because attaching policies to IAM groups mapped to job functions lets you manage entitlements centrally; adding or removing a user from a group changes their access without rewriting individual user policies, which is essential in large tenancies. Option E is correct because OCI policies are inherited down the compartment hierarchy, so a policy written at a parent compartment applies to all child compartments, drastically reducing the number of policies you must author and maintain.

Option A is wrong because storing credentials in instance metadata exposes secrets and violates OCI security guidance; instances should use instance principals instead. Option D is wrong because assigning every human user to the Administrators group grants full tenancy-wide privileges, directly violating least privilege and defeating the purpose of groups and compartment-scoped policies.

Exam trap

1Z0-997-26 often tests the misconception that 'operational simplicity' justifies broad access (like adding everyone to Administrators) or that per-user policies scale better than groups — the exam rewards least privilege, group-based policy attachment, and compartment inheritance instead.

Practice this question →
17
Multi-Selectmedium

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

Select 3 answers
A.Direct routing of BGP peering sessions for on-premises routers.
B.Automated or manual key rotation policies.
C.Unlimited free public storage of plaintext database files.
D.Creation and management of customer-managed master encryption keys (CMK).
E.Hardware Security Module (HSM) backing for cryptographic keys (FIPS 140-2 Level 3).
AnswersB, D, E

OCI Vault supports both automated rotation schedules and manual rotation, letting you define rotation intervals per key version. This satisfies the key lifecycle management requirement, ensuring cryptographic keys are periodically replaced without application changes, while retaining older versions for decrypting existing data.

Why this answer

Option B is correct because OCI Vault lets you define key rotation policies that rotate master encryption keys either automatically on a schedule or manually on demand. Option D is correct because OCI Vault is the service used to create and manage customer-managed master encryption keys (CMKs) in key vaults, which can then be used to encrypt data across OCI services. Option E is correct because OCI Vault keys are protected by Hardware Security Modules validated to FIPS 140-2 Level 3, providing strong hardware-backed key protection.

Option A is not a Vault capability; BGP peering for on-premises routers is handled by OCI networking services such as FastConnect and dynamic routing gateways. Option C is not provided by Vault, since Vault manages encryption keys and secrets, not free unlimited public storage of plaintext database files.

Exam trap

1Z0-997-26 often tests the boundary of OCI Vault's responsibilities — candidates may confuse Vault with networking (BGP) or storage (plaintext files), but Vault is strictly for key and secret management, and the exam expects you to recognize that routing and file storage are outside its scope.

Practice this question →
18
MCQmedium

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

A.Use OCI Cloud Guard to block any unauthorized IP connection attempts to the database.
B.Attach a public IP to the database servers and use a public load balancer to filter database ports.
C.Configure a Network Security Group (NSG) for the database tier with an ingress rule allowing traffic solely from the application tier's NSG.
D.Deploy a DRG with a firewall ruleset between the app subnet and DB subnet.
AnswerC

NSGs apply stateful rules to specific VNICs, so referencing the application tier's NSG as the source restricts database ingress to those instances alone, regardless of subnet CIDR overlap. This satisfies the stem's requirement that only application servers reach the database, while security lists alone cannot filter by NSG membership.

Why this answer

NSGs in OCI allow ingress rules to reference another NSG as the source, so the database tier's NSG can permit traffic only from the application tier's NSG. This provides VNIC-level micro-segmentation that is independent of subnet CIDRs and ensures no external traffic can reach the database even if routing changes. This is the canonical OCI pattern for tiered application isolation.

Exam trap

The trap is that candidates pick DRG or Cloud Guard because they sound like security controls — but DRG is for external connectivity and Cloud Guard is detective, not preventive; only NSG-to-NSG referencing provides the required inline, private-only enforcement.

How to eliminate wrong answers

Option A is wrong because Cloud Guard is a detection and response service that identifies misconfigurations and threats — it does not enforce inline traffic blocking at the packet level. Option B is wrong because attaching a public IP to database servers directly exposes them to the internet, which is the opposite of the requirement, and a public load balancer does not provide the private-only isolation needed. Option D is wrong because a DRG (Dynamic Routing Gateway) is used for connectivity between a VCN and external networks (on-premises, other VCNs), not for intra-VCN traffic filtering between subnets.

Practice this question →
19
MCQhard

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

A.OCI Security Zones
B.IAM Policy Condition statements with 'request.time'
C.OCI Audit Log Service with Event-Driven Automation
D.OCI Tag Defaults with validation rules
AnswerA

Security Zones apply a curated, immutable policy set at compartment level, blocking public buckets and open security list rules the moment resources are created. This meets the mandate for automatic guardrails at creation time, rather than detective controls that only flag drift afterwards.

Why this answer

OCI Security Zones are a feature of Cloud Guard that enforce a set of security policies on compartments, preventing actions that violate the policies. When you create a security zone, you specify a security zone policy that includes restrictions such as blocking public buckets and disallowing open security list rules. Any attempt to create or modify resources in the compartment that violates the policy is denied.

This enforces guardrails at creation time.

Exam trap

1Z0-997-26 often tests the difference between preventive (Security Zones) and detective (Cloud Guard, Audit) controls; candidates may choose Audit Logs with automation, but that is reactive, not preventive at creation time.

How to eliminate wrong answers

Option B is wrong because IAM policy conditions with 'request.time' are used for time-based access control, not for enforcing security baselines on resource configurations. Option C is wrong because OCI Audit Log Service with Event-Driven Automation can detect and respond to events after they occur, but it does not prevent the creation of non-compliant resources. Option D is wrong because OCI Tag Defaults with validation rules only enforce tagging, not security configurations like public bucket access or security list rules.

Practice this question →
20
MCQmedium

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

A.OCI Cloud Guard Responder Logs
B.OCI Audit Service
C.OCI Database Performance Hub
D.OCI Monitoring Service
AnswerB

OCI Audit Service records every API call against your tenancy, capturing the principal, timestamp, source IP and request details. It retains this event history for 90 days by default, covering last week's deletion. Filtering on the DeleteDbSystem action identifies exactly who removed the database instance, satisfying the forensic requirement.

Why this answer

OCI Audit Service automatically records all API calls made against OCI resources, including who made the call, when, from which source IP, and the request/response details. Deleting a database instance is an API operation (e.g., TerminateDbSystem), so the exact event history — actor, timestamp, and resource — is captured in Audit logs and can be queried in the Console or via the Audit API/CLI. This makes it the authoritative source for forensic investigations of resource changes.

Exam trap

1Z0-997-26 often tests the distinction between Audit (who did what API call) and Monitoring/Cloud Guard (metrics and threat detection), so candidates who pick Monitoring or Cloud Guard for 'who deleted X' lose the point.

How to eliminate wrong answers

Option A is wrong because Cloud Guard Responder Logs are generated by Cloud Guard's threat-detection recipes and responder actions, not a complete record of every API call — they only surface problems and remediations Cloud Guard itself detects. Option C is wrong because Database Performance Hub provides performance metrics (AWR-style reports, SQL monitoring) for databases, not an audit trail of control-plane API events. Option D is wrong because OCI Monitoring Service collects metric data points (CPU, memory, throughput) for alarms and dashboards; it does not log API calls or the identity of the caller.

Practice this question →
21
MCQhard

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

A.Hardcode the credentials inside the function source code repository.
B.Store secrets in OCI Object Storage with public read access.
C.Encode the credentials in Base64 and store them in IAM policy descriptions.
D.Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.
AnswerD

OCI Vault stores secrets encrypted, and Functions retrieve them at runtime via the SDK using dynamic group authentication, so no credentials persist in environment variables. This satisfies the requirement to eliminate insecure credential exposure in function configuration.

Why this answer

OCI Vault is the managed secrets service designed to store and rotate sensitive values such as database credentials, and OCI Functions can retrieve them at runtime using the OCI SDK. Authentication to Vault is achieved through a dynamic group that matches the function's resource principal, so no long-lived credentials are embedded anywhere. This eliminates the insecure environment-variable pattern while providing auditability and centralized rotation.

Exam trap

1Z0-997-26 often tests whether candidates confuse encoding (Base64) with encryption, or assume Object Storage is an acceptable secret store — the trap is picking any option that 'hides' the credential rather than one that provides managed, auditable secret retrieval.

How to eliminate wrong answers

Option A is wrong because hardcoding credentials in source code exposes them to anyone with repository access and makes rotation extremely difficult — it is the exact anti-pattern the audit flagged. Option B is wrong because Object Storage with public read access makes secrets world-readable; even with IAM policies, Object Storage lacks the secret-specific lifecycle, rotation, and audit features of Vault. Option C is wrong because Base64 is encoding, not encryption — it is trivially reversible — and IAM policy descriptions are not a secret store; they are visible to anyone who can read policies.

Practice this question →
22
MCQmedium

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

A.Local VCN Peering.
B.Dynamic Routing Gateway (DRG) with internet breakout enabled.
C.Internet Gateway with strict Security List rules.
D.OCI Bastion service.
AnswerA

Local VCN peering connects two VCNs within the same region over Oracle's private backbone, so development microservices reach the production database without any internet exposure. It satisfies the segregation constraint because each VCN retains its own route tables, security lists and CIDR blocks, keeping workloads logically distinct while permitting the required private east-west traffic.

Why this answer

Local VCN Peering connects two VCNs in the same region over Oracle's private backbone, allowing resources in the development VCN to reach the production database privately without internet exposure. It is the recommended construct for intra-region, cross-VCN private communication.

Exam trap

The trap is assuming any private connectivity option works, but the exam distinguishes Local VCN Peering (intra-region, private) from DRG (inter-region/on-prem) and Internet Gateway (public), so candidates pick DRG or IGW incorrectly.

How to eliminate wrong answers

Option B is wrong because a DRG with internet breakout is for connecting to on-premises or other regions and would route traffic via the internet, violating the no-internet-exposure requirement. Option C is wrong because an Internet Gateway inherently exposes traffic to the public internet, even with strict security lists, which the requirement forbids. Option D is wrong because OCI Bastion service provides managed SSH/RDP access to private subnets for administrators, not service-to-service database connectivity between VCNs.

Practice this question →
23
Multi-Selecthard

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Select 2 answers
A.Disable versioning on all buckets to save storage space.
B.Grant 'manage' permissions on the bucket to all anonymous users.
C.Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.
D.Store all files without encryption to ensure faster deletion.
E.Implement least-privilege IAM policies restricting bucket deletion and management to authorized security groups.
AnswersC, E

Object Lock enforces WORM retention, blocking deletion or modification for a fixed period regardless of user privileges. Compliance mode cannot be bypassed even by tenancy administrators, directly satisfying the stem's requirement to prevent accidental or malicious deletion under strict compliance frameworks. Governance mode offers weaker protection, so Compliance mode best fits regulated workloads.

Why this answer

Option C is correct because OCI Object Storage Object Lock enforces WORM (Write Once, Read Many) retention policies: in Compliance mode, retention rules cannot be removed or shortened even by tenancy administrators until the retention period expires, directly preventing accidental or malicious deletion for strict compliance frameworks, while Governance mode offers similar protection with privileged override capability. Option E is correct because implementing least-privilege IAM policies ensures that only authorized security groups hold permissions such as BUCKET_DELETE or BUCKET_UPDATE, reducing the risk of accidental or malicious deletion by unauthorized or overly privileged users. Option A is incorrect because disabling versioning removes the ability to recover overwritten or deleted objects and does nothing to prevent deletion.

Option B is incorrect because granting 'manage' permissions to all anonymous users exposes the bucket to anyone, enabling rather than preventing malicious deletion. Option D is incorrect because storing files without encryption weakens security and compliance and has no bearing on preventing deletion.

Exam trap

1Z0-997-26 often tests the difference between Object Lock (immutability/WORM) and versioning (recoverability) — candidates incorrectly pick 'disable versioning' or 'no encryption' as deletion-prevention measures, missing that only Object Lock plus least-privilege IAM actually prevents deletion.

Practice this question →
24
MCQmedium

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

A.Create a single global vault in the root tenancy that replicates master keys across all regions automatically.
B.Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.
C.Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.
D.Store all keys in the home region and use the OCI Service Gateway for remote decryption.
AnswerB

OCI Vaults are regional constructs, so customer-managed keys are created and stored within a single region and cannot be replicated across regions. Provisioning a separate vault and key set per region therefore guarantees keys never leave their home region, meeting the residency constraint.

Why this answer

OCI Vault is a regional service, and customer-managed keys are stored in the region where the vault is created. To ensure encryption keys never leave their home regions, you must provision separate OCI Vaults and keys in each region where workloads reside. This design keeps keys within their respective regions and complies with data residency requirements.

Exam trap

1Z0-997-26 often tests the regional nature of OCI Vault; candidates may assume a global vault or cross-region key replication, but OCI Vault is strictly regional.

How to eliminate wrong answers

Option A is wrong because OCI Vault does not support a single global vault with automatic key replication across regions; vaults are regional. Option C is wrong because Object Storage cross-region replication is for objects, not for keys; keys cannot be copied via Object Storage replication. Option D is wrong because storing keys in one region and using Service Gateway for remote decryption would still require keys to be used outside their home region, violating the policy.

Practice this question →
25
MCQeasy

What is the primary function of OCI Network Security Groups (NSGs)?

A.To balance HTTP/HTTPS traffic across multiple backend web servers.
B.To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.
C.To encrypt data at rest in block storage volumes.
D.To manage human user passwords and multi-factor authentication.
AnswerB

NSGs are virtual firewalls applied at the VNIC level, letting you define inbound and outbound rules that govern traffic for a chosen set of VNICs regardless of subnet. This VNIC-scoped enforcement is precisely what the question asks for.

Why this answer

OCI Network Security Groups (NSGs) act as virtual firewalls that control inbound and outbound traffic for a specific set of VNICs. Unlike security lists, which apply to all VNICs in a subnet, NSGs allow you to apply security rules to a group of VNICs that you explicitly choose, enabling fine-grained, instance-level micro-segmentation.

Exam trap

1Z0-997-26 often tests the distinction between NSGs and security lists, and candidates may incorrectly think NSGs are subnet-level or that they perform load balancing or encryption.

How to eliminate wrong answers

Option A is wrong because load balancing is handled by OCI Load Balancer or Network Load Balancer services, not NSGs. Option C is wrong because encryption at rest for block volumes is handled by OCI Block Volume encryption (using Vault keys), not NSGs. Option D is wrong because user password and MFA management is part of OCI IAM, not network security groups.

Practice this question →
26
MCQmedium

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

A.Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.
B.The VCN lacks an Internet Gateway.
C.The OCI Vault service is offline.
D.The team lacks IAM permissions to create compute instances.
AnswerA

Security Zones enforce a policy that blocks public IP addresses on compute instances, preventing direct internet exposure. The create operation fails because the requested public IP violates this recipe, satisfying the stem's constraint that Security Zones prohibit such exposure.

Why this answer

OCI Security Zones are hardened compartments that enforce a set of immutable security policies, one of which is that resources inside cannot have public IP addresses or public-facing endpoints. Because the policy is enforced at the platform level, the create-instance call fails regardless of IAM permissions or network configuration. This is by design to prevent external exposure of workloads in the zone.

Exam trap

1Z0-997-26 often tests whether candidates confuse a network misconfiguration (no Internet Gateway) with an enforced Security Zone policy — the giveaway is that the operation itself fails at creation, not at connectivity time.

How to eliminate wrong answers

Option B is wrong because a missing Internet Gateway would only prevent outbound internet access; it would not cause instance creation with a public IP to fail, and Security Zones block public IPs anyway. Option C is wrong because OCI Vault availability is unrelated to compute instance creation and Vault is a regional HA service. Option D is wrong because an IAM permission gap would return an authorization error, not a policy violation specific to public IP attachment.

Practice this question →
27
MCQhard

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

A.Delete the VCN containing the instance to stop all routing.
B.Terminate the compute instance and delete all attached block volumes immediately.
C.Revoke the IAM user credentials of the administrator who launched the instance.
D.Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.
AnswerD

Replacing the instance's NSGs with a quarantine NSG that denies all traffic severs network access immediately, while the boot and block volumes remain attached and untouched. This satisfies both isolation and forensic storage preservation without terminating the instance.

Why this answer

To isolate a compromised instance while preserving storage, the best action is to update its Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic. This revokes network access without terminating the instance or deleting volumes, allowing forensic analysis. This can be automated with OCI Events (triggered by a security alert) and Functions.

Exam trap

1Z0-997-26 often tests the trade-off between isolation and preservation; candidates may choose termination or deletion, but the question emphasizes preserving storage for forensics, so the correct answer must avoid destructive actions.

How to eliminate wrong answers

Option A is wrong because deleting the VCN would disrupt all resources in the VCN, not just the compromised instance, and is overly destructive. Option B is wrong because terminating the instance and deleting volumes destroys forensic evidence and may not be necessary for isolation. Option C is wrong because revoking IAM credentials of the administrator does not isolate the compromised instance's network access and may not stop the attacker if they have other credentials.

Practice this question →
28
MCQmedium

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

A.Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.
B.Disable compartment security boundaries and assign all users to the Administrators group.
C.Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.
D.Use IAM user credentials hardcoded inside the application configuration files on the compute instances.
AnswerC

Matching rules scoped to specific compartment OCIDs or instance tags restrict which workloads assume a dynamic group, and compartment-level policies then grant only the permissions needed there. This avoids the overly broad tenancy-wide grants that violate least privilege in multi-tenant designs.

Why this answer

OCI IAM best practice for multi-tenancy is to define dynamic groups whose matching rules are scoped to specific compartment OCIDs or instance tags, then attach policies at the compartment level rather than the tenancy root. This ensures workloads authenticate automatically via instance principals with least-privilege access limited to the resources they need. Using tags (e.g., defined tags like Operations.CostCenter) in matching rules further tightens scope and supports policy reuse across environments.

Exam trap

1Z0-997-26 often tests whether candidates understand that dynamic group matching rules must be scoped (by compartment OCID or tags) and that root-level policies for broad dynamic groups violate least privilege — the tempting 'simplest' answer is usually the wrong one.

How to eliminate wrong answers

Option A is wrong because a single dynamic group spanning all compute instances with a root-level policy grants overly broad permissions across the entire tenancy, violating least privilege and compartment isolation. Option B is wrong because disabling compartment security boundaries and assigning everyone to Administrators destroys the tenancy's security model and is a critical anti-pattern. Option D is wrong because hardcoding IAM user credentials in application config files exposes long-lived secrets, prevents rotation, and defeats the purpose of instance principals and dynamic groups.

Practice this question →
29
MCQeasy

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

A.To replicate OCI database backups to external cloud providers.
B.To allow users to authenticate to OCI using their existing corporate credentials via SAML 2.0.
C.To automatically provision network security groups across regions.
D.To bypass OCI encryption key management requirements.
AnswerB

Federation trusts an external IdP's SAML 2.0 assertions, so users authenticate with existing corporate credentials and receive OCI access without separate local accounts. This satisfies the requirement to centralise identity management and reduce credential sprawl.

Why this answer

OCI IAM federation with an external IdP allows users to authenticate to OCI using their existing corporate credentials through the SAML 2.0 protocol, eliminating the need for separate OCI local users and passwords. The IdP asserts the user's identity, and OCI IAM maps IdP groups to OCI IAM groups to grant permissions. This centralizes authentication and enables single sign-on across cloud and on-premises systems.

Exam trap

1Z0-997-26 often tests whether candidates understand that federation is about authentication (identity) and group mapping is about authorization (permissions) — the trap is selecting an option that confuses federation with unrelated services like backup, networking, or encryption.

How to eliminate wrong answers

Option A is wrong because database backup replication is a data-management function handled by services like OCI Database Backup or cross-region replication, not by IAM federation. Option C is wrong because network security group provisioning is an infrastructure automation task, typically done with Terraform or OCI Network Firewall, not identity federation. Option D is wrong because federation has no relationship to encryption key management — key management is handled by OCI Vault, and federation cannot bypass or alter encryption requirements.

Practice this question →
30
MCQeasy

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

A.OCI Cloud Guard
B.OCI Vulnerability Scanning Service
C.OCI Identity and Access Management
D.OCI Application Performance Monitoring
AnswerB

OCI Vulnerability Scanning Service inspects compute instances and container images for known software vulnerabilities and malware, satisfying the stem's requirement for both targets. It combines host-based scanning of running instances with registry image scanning, unlike services limited to one surface. This dual coverage directly matches the question's scope.

Why this answer

The OCI Vulnerability Scanning Service (VSS) is designed to scan compute instances and container images for known software vulnerabilities and malware. It inspects OS packages and application dependencies against vulnerability databases and reports findings, which is exactly the capability described.

Exam trap

1Z0-997-26 often tests the boundary between Cloud Guard (posture/threat detection) and Vulnerability Scanning Service (CVE scanning), so candidates may pick Cloud Guard when the question specifically mentions software vulnerabilities and malware.

How to eliminate wrong answers

Option A is wrong because Cloud Guard is a posture-management and threat-detection service that identifies misconfigurations and suspicious activity across the tenancy, not a vulnerability scanner for instance and image contents. Option C is wrong because IAM handles authentication and authorization — identities, policies, and compartments — and does not scan for vulnerabilities. Option D is wrong because Application Performance Monitoring (APM) tracks application traces, response times, and errors for performance, not security vulnerabilities or malware.

Practice this question →
31
MCQeasy

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

A.OCI Audit.
B.OCI Web Application Firewall.
C.OCI Vulnerability Scanning Service.
D.OCI Cloud Guard.
AnswerD

OCI Cloud Guard continuously assesses tenancy resources against security zones and detector recipes, flagging misconfigurations and risky operational behaviours. It aggregates these findings into a unified security score, directly satisfying the stem's requirement for continuous monitoring with a single tenancy-wide risk metric.

Why this answer

OCI Cloud Guard is the native Cloud Security Posture Management (CSPM) service that continuously monitors tenancy resources against security misconfigurations and risky operational behaviors using detector recipes and responder recipes. It aggregates findings into a unified 'Security Score' visible in the Cloud Guard console, giving a single tenancy-wide posture metric. This matches the question's requirement of continuous monitoring plus a unified security score.

Exam trap

1Z0-997-26 often tests the distinction between Cloud Guard (posture management with a security score) and Audit (activity logging) — candidates pick Audit because both sound 'security-related,' but only Cloud Guard produces the unified score.

How to eliminate wrong answers

Option A (OCI Audit) is wrong because Audit only records API activity as immutable log events for compliance and forensics — it does not evaluate configurations or produce a security score. Option B (OCI Web Application Firewall) is wrong because WAF only inspects inbound HTTP/HTTPS traffic at the edge to block OWASP-style attacks like SQLi and XSS; it has no visibility into tenancy-wide misconfigurations. Option C (OCI Vulnerability Scanning Service) is wrong because it scans compute instances and container images for software CVEs on a scheduled basis, not continuous configuration/behavior monitoring, and it does not generate a unified tenancy security score.

Practice this question →
32
MCQmedium

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

A.OCI IAM compartments with default root-level policies.
B.OCI Cloud Guard targets with active detector recipes.
C.OCI Network Security Groups (NSGs) applied to the VCN.
D.OCI Security Zones.
AnswerD

Security Zones enforce a curated set of maximum-security policies on every compartment they cover, automatically blocking public Object Storage buckets and preventing audit logging from being disabled. This satisfies the requirement that newly created compartments inherit hardened controls without manual configuration.

Why this answer

OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Exam trap

1Z0-997-26 often tests the distinction between preventive controls (Security Zones) and detective controls (Cloud Guard), so candidates who see 'security best practices' and jump to Cloud Guard pick the wrong answer.

How to eliminate wrong answers

Option A is wrong because IAM compartments with root-level policies only control who can perform actions (authorization), not what configurations are permitted — policies cannot prohibit a public bucket or prevent audit log disabling. Option B is wrong because Cloud Guard targets with detector recipes are detective and reactive: they identify and report risky configurations after the fact, and can respond, but they do not prevent the creation of non-compliant resources. Option C is wrong because Network Security Groups are VCN-level virtual firewalls controlling packet flow to compute resources; they have no relationship to Object Storage bucket visibility or audit log settings.

Practice this question →
33
Multi-Selecthard

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

Select 2 answers
A.Configure IPsec VPN tunnels with strong encryption algorithms (e.g., AES-256) for on-premises connectivity.
B.Transmit all database traffic over unencrypted public internet connections.
C.Rely on plain-text HTTP for all inter-microservice communication within a VCN.
D.Disable VCN security lists to allow unhindered packet sniffing.
E.Enforce TLS (Transport Layer Security) for applications and HTTPS endpoints communicating across services.
AnswersA, E

IPsec VPN tunnels encrypt packets between on-premises networks and OCI, directly satisfying the requirement to secure data in transit across networking components. AES-256 provides strong cryptographic protection for traffic traversing untrusted paths such as the public internet, ensuring confidentiality and integrity during transmission.

Why this answer

Option A is correct because IPsec VPN tunnels using strong encryption such as AES-256 protect data in transit between on-premises networks and OCI over untrusted paths like the internet. Option E is correct because TLS/HTTPS encrypts application-layer traffic between services and endpoints, preventing eavesdropping or tampering across OCI networking components. Option B is incorrect because sending database traffic unencrypted over the public internet exposes sensitive data to interception.

Option C is incorrect because plain-text HTTP provides no confidentiality or integrity for inter-microservice communication within a VCN. Option D is incorrect because disabling security lists and enabling packet sniffing removes access controls and exposes traffic rather than securing it.

Exam trap

The trap is assuming that OCI automatically encrypts all traffic within a VCN — candidates must recognize that east-west traffic inside a VCN is unencrypted unless TLS or IPsec is explicitly configured.

Practice this question →
34
MCQhard

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

A.A NAT Gateway combined with a public IP address on the database.
B.An OCI Service Gateway.
C.A Site-to-Site VPN connection back to the corporate data center.
D.An Internet Gateway attached to the VCN route table.
AnswerB

A Service Gateway gives private subnet resources access to Oracle services over the OCI backbone, never touching the internet. Traffic to Autonomous Database stays on Oracle's network, avoiding NAT and internet gateways while delivering the lowest latency.

Why this answer

An OCI Service Gateway provides a private, secure path from a VCN to supported Oracle services like Autonomous Database without exposing traffic to the public internet. It is the most performant option because traffic stays on Oracle's private backbone, avoiding internet latency and inspection. The Service Gateway is attached to the VCN and referenced in route rules, so only resources in the VCN can use it, and access can be further restricted with IAM policies and security rules.

Exam trap

1Z0-997-26 often tests the misconception that a NAT Gateway provides private access to Oracle services, but it actually routes traffic over the public internet; the Service Gateway is the only option that keeps traffic on Oracle's private backbone.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway allows outbound internet access for private subnets, but it still routes traffic over the public internet and requires a public IP on the database, which violates the requirement for no public internet traversal and is less secure. Option C is wrong because a Site-to-Site VPN connects to a corporate data center, not directly to Oracle services, and it adds unnecessary network hops and complexity while still potentially traversing the internet. Option D is wrong because an Internet Gateway provides public internet connectivity, which directly contradicts the requirement to avoid the public internet and would expose the database to public endpoints.

Practice this question →
35
MCQeasy

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

A.OCI Cloud Guard
B.OCI Bastion Service
C.OCI Vault
D.OCI Vulnerability Scanning Service
AnswerA

OCI Cloud Guard continuously detects misconfigurations across OCI resources using detector recipes, then responds automatically through responder recipes that trigger remediation actions such as stopping or deleting offending resources. This satisfies the stem's requirement for automatic remediation without manual intervention, which standalone monitoring or auditing services cannot provide.

Why this answer

OCI Cloud Guard is the native service designed to continuously monitor OCI resources for security misconfigurations and automatically remediate violations. It uses detectors to identify risky configurations, and responders to take corrective actions such as deleting public buckets or stopping instances. This aligns with the requirement for continuous monitoring and automatic remediation without manual intervention.

Exam trap

1Z0-997-26 often tests the distinction between monitoring and remediation services; candidates may confuse Cloud Guard with Vulnerability Scanning Service, but only Cloud Guard provides automatic remediation of misconfigurations.

How to eliminate wrong answers

Option B is wrong because OCI Bastion Service provides secure, time-limited SSH access to private subnets; it does not monitor or remediate misconfigurations. Option C is wrong because OCI Vault is a key management service for storing and managing encryption keys and secrets; it does not perform security posture monitoring or remediation. Option D is wrong because OCI Vulnerability Scanning Service scans compute instances and containers for vulnerabilities (CVEs) but does not automatically remediate misconfigurations; it only reports findings.

Practice this question →
36
MCQeasy

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

A.OCI Bastion Service session manager.
B.OCI Database Migration Service.
C.OCI Cloud Guard Managed Recipes and Responder Rules.
D.OCI IAM Policy Generator.
AnswerC

OCI Cloud Guard Managed Recipes continuously assess resources against Oracle-defined security best practices, surfacing misconfigurations in a centralised dashboard. Responder Rules then automate remediation, including one-click corrective actions, satisfying the stem's requirement for both a consolidated recommendations view and single-click remediation.

Why this answer

OCI Cloud Guard uses Managed Recipes (detector and responder recipes) to continuously monitor a tenancy for security misconfigurations and risky activity, and Responder Rules can automatically or manually remediate findings — including one-click remediation from the Cloud Guard console. This centralized posture view with actionable remediation is exactly what Cloud Guard provides.

Exam trap

1Z0-997-26 often tests confusion between Cloud Guard (posture management and remediation) and other OCI security services like Security Zones or Bastion — candidates pick Bastion thinking it 'secures' access.

How to eliminate wrong answers

Option A is wrong because the Bastion Service provides secure, time-limited SSH/RDP access to private hosts; it is not a security-posture or remediation tool. Option B is wrong because Database Migration Service moves databases to OCI; it has nothing to do with security recommendations. Option D is wrong because the IAM Policy Generator is a console helper for authoring IAM policies — it does not detect or remediate misconfigurations.

Practice this question →
37
MCQmedium

Your organization's security policy requires that all OCI Block Volume data be encrypted with customer-managed keys that can be rotated, disabled, or deleted independently of the volume lifecycle. You have configured a Vault in OCI Key Management. Which key type must you create and assign to the Block Volume to meet this requirement?

A.An SSH key pair generated in the tenancy
B.A data encryption key stored in the Block Volume
C.A master encryption key in the Vault
D.A secret in OCI Vault
AnswerC

OCI Vault master encryption keys are customer-managed keys that can be rotated, disabled, and deleted, and they are used to encrypt Block Volume data. Assigning a master encryption key to a Block Volume satisfies the policy because the key lifecycle is independent of the volume, and you control its state through Key Management.

Why this answer

Block Volume encryption with customer-managed keys requires a master encryption key from OCI Vault. That key can be rotated, disabled, or deleted by the customer, and its lifecycle is separate from the volume. Other key types either are not customer-managed or serve different purposes such as authentication or secret storage.

Exam trap

The trap here is confusing secrets in OCI Vault with master encryption keys, assuming any customer-managed object in Vault can encrypt Block Volumes.

Practice this question →
38
MCQmedium

You are configuring a site-to-site IPSec VPN between your on-premises datacenter and an OCI VCN. To ensure data confidentiality and integrity across the public internet, which encryption algorithms should you mandate in the IPSec configuration?

A.Plaintext transmission without IPsec encapsulation.
B.RC4 stream cipher with no hashing.
C.AES-256 with SHA-256 hashing.
D.DES with MD5 authentication.
AnswerC

AES-256 in Galois/Counter Mode or CBC provides the confidentiality required over the public internet, while SHA-256 supplies integrity and authentication for the IPSec security association. This pairing satisfies OCI's supported Phase 2 parameters for site-to-site VPN, meeting the stem's confidentiality and integrity constraints without relying on deprecated algorithms such as 3DES or SHA-1.

Why this answer

AES-256 provides strong symmetric encryption for confidentiality, and SHA-256 provides a cryptographic hash for integrity verification within the IPSec ESP (Encapsulating Security Payload) framework. Together they satisfy the confidentiality and integrity requirements of a site-to-site IPSec VPN over an untrusted network like the public internet. OCI's IPSec VPN supports AES-128/AES-192/AES-256 and SHA-1/SHA-256 for Phase 2 (IPSec) parameters.

Exam trap

The trap here is that candidates may pick DES or RC4 because they recognize them as 'encryption algorithms' without realizing both are cryptographically obsolete — the exam tests whether you know that modern IPSec mandates AES with SHA-2 family hashing.

How to eliminate wrong answers

Option A is wrong because plaintext transmission without IPsec encapsulation provides neither confidentiality nor integrity — the entire purpose of the IPSec tunnel is defeated. Option B is wrong because RC4 is a deprecated, cryptographically broken stream cipher (vulnerable to biases in its keystream) and using it with no hashing eliminates integrity protection entirely. Option D is wrong because DES has an effective 56-bit key that is trivially brute-forced today, and MD5 is collision-broken and unsuitable for integrity in modern IPSec configurations.

Practice this question →
39
MCQhard

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

A.Allow group Developers to manage compute-instances in compartment ParentCompartment
B.Allow group Developers to manage compute-instances in tenancy
C.Allow group Developers to manage compute-instances in root
D.Write individual policies for every single child compartment separately without referencing the parent.
AnswerA

Placing the policy on the parent compartment lets the Developers group manage compute instances in every child compartment through Oracle Cloud Infrastructure's compartment hierarchy inheritance, since child compartments inherit parent policies. This satisfies the requirement of covering all child compartments without granting root tenancy-level permissions.

Why this answer

OCI IAM policies are hierarchical: a policy statement that grants access at a parent compartment automatically applies to all child compartments within that hierarchy. By writing the policy at ParentCompartment, the developer group gets manage permissions on compute instances in all child compartments without granting tenancy-wide access. This follows the principle of least privilege while meeting the requirement.

Exam trap

1Z0-997-26 often tests the misconception that you must write policies for each child compartment individually — candidates must remember that OCI policies inherit down the compartment hierarchy, so a parent-level policy covers all children.

How to eliminate wrong answers

Option B is wrong because granting 'manage compute-instances in tenancy' gives permissions across the entire tenancy, including compartments outside the parent, violating the requirement to avoid root-level access. Option C is wrong because 'in root' is not valid OCI policy syntax — the root compartment is referred to as 'tenancy' in policies, and using 'root' would cause a policy error. Option D is wrong because writing individual policies for every child compartment is operationally inefficient and error-prone; OCI's hierarchical inheritance makes a single parent-level policy sufficient and more maintainable.

Practice this question →
40
MCQhard

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

A.Attach public IP addresses directly to all backend web servers.
B.Rely entirely on default VCN Security Lists without route table modifications.
C.Route inbound traffic from the Internet Gateway through a firewall appliance subnet before forwarding it to backend subnets via route tables.
D.Use OCI Object Storage to filter incoming HTTP packets.
AnswerC

Directing Internet Gateway traffic into a firewall appliance subnet, then routing to backend subnets via route tables, forces all inbound flows through inspection. This satisfies the mandate that internet traffic be inspected before reaching web servers.

Why this answer

To force all inbound internet traffic through a next-generation firewall before it reaches backend web servers, you place the firewall appliance in its own subnet and use route tables to steer traffic: the Internet Gateway routes inbound traffic to the firewall subnet, and the firewall subnet's route table forwards inspected traffic to the backend subnet. This is the standard hub-and-spoke or DMZ architecture in OCI, where the firewall is the next hop for the backend subnet's ingress path.

Exam trap

1Z0-997-26 often tests whether candidates understand that security lists alone do not provide inspection — the trap is picking 'default security lists' or 'public IPs' instead of the route-table-based firewall insertion.

How to eliminate wrong answers

Option A is wrong because attaching public IPs directly to backend servers bypasses the firewall entirely — traffic reaches the servers without inspection, violating the security mandate. Option B is wrong because default security lists only provide stateless packet filtering at the subnet level; they do not perform next-generation inspection, and without route table changes traffic cannot be redirected through a firewall. Option D is wrong because Object Storage is a data storage service and cannot filter or inspect HTTP packets — it has no role in network traffic inspection.

Practice this question →
41
MCQhard

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

A.OCI IAM token-based database authentication combined with Oracle Autonomous Database.
B.Disabling all authentication to maximize application performance.
C.Hardcoded administrator passwords stored in plain text configuration files.
D.Using static API signing keys for database connection strings.
AnswerA

OCI IAM token-based database authentication issues short-lived tokens that Oracle Autonomous Database accepts in place of a static password. The token expiry is the mechanism enforcing zero-trust, satisfying the requirement that developers authenticate with short-lived credentials rather than long-term database passwords.

Why this answer

OCI IAM token-based database authentication, when combined with Oracle Autonomous Database, allows developers to authenticate using short-lived tokens issued by OCI IAM instead of long-term database passwords. This supports zero-trust principles by eliminating static credentials and enabling centralized identity management with token expiration and revocation.

Exam trap

1Z0-997-26 often tests the confusion between static API keys and short-lived IAM tokens, and candidates may pick static keys thinking they are more secure, when the question explicitly asks for token-based authentication.

How to eliminate wrong answers

Option B is wrong because disabling all authentication is a severe security risk and does not support token-based access. Option C is wrong because hardcoded administrator passwords in plaintext files are insecure and contradict the requirement for short-lived tokens. Option D is wrong because static API signing keys are long-term credentials, not short-lived tokens, and they are used for OCI API calls, not database authentication.

Practice this question →
42
MCQeasy

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

A.OCI Events Service
B.OCI Audit Service
C.OCI Logging Analytics
D.Database Audit Vault
AnswerB

OCI Audit Service automatically records API calls, console sign-ins and resource changes across the tenancy and retains them for the compliance window. That native, immutable event log is precisely the evidence the auditor requested for the past 365 days.

Why this answer

OCI Audit Service automatically records all API calls and console actions across the tenancy, including administrative actions, logins, and resource modifications, and retains them for 365 days by default. It is the native auditing capability that satisfies compliance and forensic requirements without additional configuration. Auditors can access events via the Console, API, or CLI.

Exam trap

1Z0-997-26 often tests the distinction between Audit Service (immutable 365-day API audit trail) and Logging/Logging Analytics (configurable operational logs) — candidates pick Logging Analytics because it sounds like it covers auditing, missing that Audit Service is the native, always-on record.

How to eliminate wrong answers

Option A is wrong because OCI Events Service is a pub/sub mechanism that reacts to state changes by triggering Functions, Notifications, or Streaming — it does not store a historical audit trail. Option C is wrong because Logging Analytics is a log ingestion and analysis platform for operational and security logs, but it is not the native audit record of API activity and requires configuration to ingest audit logs. Option D is wrong because Database Audit Vault is a database-specific auditing solution for Oracle Database, not a tenancy-wide API audit service.

Practice this question →
43
MCQhard

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

A.Enable OCI Audit logs and configure automated notifications via OCI Notifications service.
B.Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.
C.Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.
D.Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.
AnswerC

WAF protection rules inspect inbound HTTP traffic at the edge, blocking XSS and SQL injection payloads before they reach the application, and attaching the policy to the Load Balancer enforces this without modifying application code.

Why this answer

OCI Web Application Firewall (WAF) is a cloud-native service that protects web applications from common exploits like SQL injection and XSS. By configuring a WAF policy with protection rules and attaching it to the Load Balancer, you can inspect incoming traffic at the edge and block malicious requests without modifying application code. This directly addresses the requirement.

Exam trap

1Z0-997-26 often tests the difference between network firewall (L3/L4) and WAF (L7); candidates may choose Network Firewall with SSL decryption, but that does not provide application-layer protection against XSS and SQL injection.

How to eliminate wrong answers

Option A is wrong because OCI Audit logs and Notifications are for auditing and alerting, not for preventing application-layer attacks. Option B is wrong because OCI Network Firewall operates at layers 3-4 and, even with SSL decryption, is not designed to detect and block application-layer attacks like XSS and SQL injection; it lacks the deep packet inspection for HTTP payloads. Option D is wrong because OCI Cloud Guard Security Zones enforce security policies on resources but do not remediate application code flaws or protect against runtime application attacks.

Practice this question →
44
Multi-Selecthard

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Select 2 answers
A.Routing all log data to unencrypted public FTP servers.
B.OCI Audit service to capture all control plane API activities and resource modifications.
C.Disabling all logging services to save storage costs.
D.Relying solely on user memory dumps for audit compliance.
E.OCI Logging service to ingest, store, and analyze log data from VCN flow logs and compute instances.
AnswersB, E

OCI Audit service records every control plane API call and resource modification across the tenancy, providing the immutable audit trail the stem demands for security auditing and threat detection. It captures who did what, when, and from where, satisfying the comprehensive audit-trail requirement that data-plane-only logging cannot fulfil.

Why this answer

Option B is correct because the OCI Audit service automatically records all control plane API calls and resource modifications across the tenancy, providing an immutable, tamper-evident audit trail that is essential for security investigations and compliance. Option E is correct because the OCI Logging service ingests, stores, and analyzes log data from sources such as VCN flow logs and compute instances, enabling centralized visibility and threat detection across the environment. Option A is wrong because routing log data to unencrypted public FTP servers exposes sensitive audit information to interception and tampering, violating security best practices.

Option C is wrong because disabling logging eliminates the audit trail entirely, making threat detection and compliance impossible. Option D is wrong because relying on user memory dumps is not a reliable or comprehensive audit mechanism and does not provide the continuous, structured logging required for security monitoring.

Exam trap

1Z0-997-26 often tests the confusion between OCI Audit (control plane API activity) and OCI Logging (data plane and service logs), expecting candidates to know both are needed for comprehensive security.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security questions.

Start 20-question session