Security practice questions

Enable OCI Audit logs and configure automated notifications via OCI Notifications service.

Why wrong: OCI Audit and Notifications provide logging and alerting, but they do not actively block or mitigate incoming attacks.

Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.

Why wrong: While OCI Network Firewall inspects layer 3-7 traffic, OCI WAF is specifically designed for application-layer attacks like XSS and SQL injection.

Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.

Why wrong: Security Zones enforce cloud guard policies on infrastructure configurations, not application source code vulnerabilities.

OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).

Why wrong: SSE-S3 uses Oracle-managed keys, which do not satisfy the requirement for customer-managed keys and custom rotation policies.

OCI Database Management service.

Why wrong: Database Management is for performance and operations monitoring, not encryption key lifecycle management.

OCI Identity and Access Management (IAM) password policies.

Why wrong: IAM password policies govern console user passwords, not data encryption keys for Object Storage.

Dynamic Routing Gateway (DRG) with internet breakout enabled.

Why wrong: DRG routes traffic between VCNs and on-premises networks, but enabling internet breakout introduces security risks.

Internet Gateway with strict Security List rules.

Why wrong: Using an Internet Gateway requires public IP addresses, which violates private network communication best practices.

OCI Bastion service.

Why wrong: OCI Bastion provides secure, managed access to target resources for administrative SSH/RDP sessions, not persistent microservice communication.

A NAT Gateway combined with a public IP address on the database.

Why wrong: A NAT Gateway allows outbound internet access, but public IPs expose resources unnecessarily and violate private architecture requirements.

A Site-to-Site VPN connection back to the corporate data center.

Why wrong: A VPN connects on-premises networks to OCI, but is unnecessary and introduces latency when connecting VCN resources to OCI managed services.

An Internet Gateway attached to the VCN route table.

Why wrong: An Internet Gateway provides bi-directional communication with the public internet, which introduces security risks for private databases.

Enable OCI Cloud Guard with default responder rules.

Why wrong: Cloud Guard detects threats and misconfigurations, but does not handle log immutability or compliance retention.

Deploy OCI Network Firewall to inspect all control plane traffic.

Why wrong: OCI Network Firewall inspects data plane traffic in VCNs, whereas control plane API calls are handled by IAM and the Audit service.

Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

Why wrong: Unencrypted HTTP endpoints violate data transit security best practices and do not guarantee tamper-proof log storage.

OCI Audit.

Why wrong: OCI Audit records API calls for logging and forensics, but does not actively score or analyze security posture.

OCI Web Application Firewall.

Why wrong: WAF protects web applications from HTTP/HTTPS attacks rather than monitoring tenancy-wide posture.

OCI Vulnerability Scanning Service.

Why wrong: Vulnerability Scanning focuses specifically on host-level OS and container image vulnerabilities, not overall tenancy security posture.

Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

Why wrong: This violates the principle of least privilege by over-granting access across all compartments.

Disable compartment security boundaries and assign all users to the Administrators group.

Why wrong: Disabling compartments and using the Administrators group completely destroys tenant isolation and security posture.

Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

Why wrong: Hardcoding user credentials is a severe security anti-pattern; dynamic groups should be used for instance authentication.

OCI IAM compartments with default root-level policies.

Why wrong: Standard IAM policies govern authorization, but do not automatically block insecure configurations like public buckets.

OCI Cloud Guard targets with active detector recipes.

Why wrong: Cloud Guard detects misconfigurations and can trigger alerts or responders, but Security Zones proactively prevent non-compliant resources from being created.

OCI Network Security Groups (NSGs) applied to the VCN.

Why wrong: NSGs control network-level traffic to virtual machine VNICs, not storage bucket visibility or general cloud security guardrails.

Use Oracle-managed encryption keys with automatic key rotation enabled.

Why wrong: Oracle-managed keys do not give the customer direct control over immediate key revocation or hardware security module ownership.

Rely on OCI Database Vault to manage cloud-level master encryption keys.

Why wrong: OCI Database Vault restricts database user access to application data, but does not manage VCN-level or storage-level master encryption keys.

Store plain-text keys in OCI Object Storage with restricted IAM policies.

Why wrong: Storing plain-text encryption keys in object storage is a critical security vulnerability and violates compliance standards.

OCI Cloud Guard

Why wrong: Cloud Guard monitors misconfigurations and posture, whereas VSS performs deep host and container vulnerability scanning.

OCI Identity and Access Management

Why wrong: IAM handles authentication and authorization, not vulnerability detection.

OCI Application Performance Monitoring

Why wrong: APM is used for monitoring application availability and performance metrics.

OCI NAT Gateway.

Why wrong: A NAT Gateway allows private resources to initiate outbound connections to the internet, but does not provide secure inbound administrative access.

OCI Load Balancer with TCP routing.

Why wrong: A Load Balancer distributes incoming application traffic, not secure administrative terminal access.

OCI API Gateway.

Why wrong: API Gateway is designed to publish, secure, and route REST APIs, not provide SSH terminal access to compute nodes.

Disable the OCI Internet Gateway on the VCN route table.

Why wrong: Disabling the Internet Gateway stops all internet traffic for the entire VCN, which is not granular enough for specific instance subnets.

Enable OCI Bastion service on the database subnet.

Why wrong: OCI Bastion provides administrative session tunneling, not stateful packet inspection rules.

Configure OCI IAM policies to block network ingress at the user level.

Why wrong: IAM policies control API permissions and resource access, not packet-level network filtering.

Allow group Auditors to use database-families in root

Why wrong: This grants execution rights on databases at the root tenancy level, violating least privilege.

Allow group Auditors to read compartments in tenancy

Why wrong: This only allows reading compartment metadata, not the resources inside the target compartment.

Allow group Auditors to manage all-resources in tenancy

Why wrong: The 'manage' verb grants full administrative control, which is overly permissive for an auditor.

Create separate tenancies for administrators and developers.

Why wrong: Managing separate tenancies introduces administrative overhead and is unnecessary when OCI IAM supports fine-grained authentication policies.

Write IAM policies with conditional statements checking the user's IP address.

Why wrong: IP-based conditions restrict network locations, but do not satisfy the requirement for IdP federation and MFA enforcement.

Disable native IAM users entirely and force all users to share a single administrator account with MFA.

Why wrong: Sharing a single account destroys accountability, auditability, and security best practices.

Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

Why wrong: OCI Vault keys cannot be automatically replicated globally across regions in a single global vault; they are strictly regional resources.

Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

Why wrong: Object Storage replication does not manage or replicate Vault master encryption keys.

Store all keys in the home region and use the OCI Service Gateway for remote decryption.

Why wrong: Relying on a single home region for decryption introduces latency and violates regional key locality policies.

Delete the VCN containing the instance to stop all routing.

Why wrong: Deleting the entire VCN disrupts all other workloads in that network, which is overly destructive.

Terminate the compute instance and delete all attached block volumes immediately.

Why wrong: Terminating the instance and deleting volumes destroys critical forensic evidence needed for incident investigation.

Revoke the IAM user credentials of the administrator who launched the instance.

Why wrong: Revoking the administrator's credentials does not stop an already running, compromised compute instance.

Hardcode the credentials inside the function source code repository.

Why wrong: Hardcoding credentials in code repositories is a major security vulnerability.

Store secrets in OCI Object Storage with public read access.

Why wrong: Public read access on object storage exposes secrets to the entire internet.

Encode the credentials in Base64 and store them in IAM policy descriptions.

Why wrong: Base64 encoding is not encryption, and IAM policies are not designed to store application secrets.

OCI Cloud Guard data protection detectors.

Why wrong: Cloud Guard detects issues but does not enforce WORM storage policies on buckets.

OCI Object Storage Pre-Authenticated Requests (PAR).

Why wrong: PARs provide temporary URL-based access to objects, increasing exposure rather than protecting against deletion.

OCI Vault key rotation policies.

Why wrong: Key rotation manages encryption key lifecycles, not Object Storage retention or deletion policies.

Compartment

Why wrong: Compartments are logical containers for organizing cloud resources, not users.

Federation Provider

Why wrong: Federation providers link external identity providers to OCI.

Dynamic Group

Why wrong: Dynamic groups contain OCI compute instances or other resources, not human users.

OCI Bastion Service session manager.

Why wrong: Bastion manages administrative shell sessions.

OCI Database Migration Service.

Why wrong: Database Migration is used for moving databases, not security remediation.

OCI IAM Policy Generator.

Why wrong: The policy generator assists in writing IAM syntax, not remediating infrastructure security misconfigurations.