Security Services

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

A developer is building an application on a Compute instance that must read objects from an Object Storage bucket. The security policy forbids storing API keys or auth tokens on the instance. The instance runs in a compartment called app-prod, and the bucket lives in a different compartment called data-prod. Which approach allows the instance to access the bucket without embedding credentials?

; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?

Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?

A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?

A company wants to centrally manage and audit access to their OCI tenancy. They need to ensure that all user actions are logged and that they can detect suspicious activities. Which OCI service should they use?

A financial services company runs a web application on OCI behind a public load balancer. Auditors require that all inbound traffic be inspected for common web exploits such as cross-site scripting and that malicious source IPs be blocked automatically for a period of time. The security team also wants to keep management overhead low by using managed rule sets. Which OCI service should be deployed in front of the application?

A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?

A security administrator is configuring a bastion host in OCI to provide secure SSH access to private compute instances. The administrator wants to use OCI Bastion service to minimize exposure. Which statement accurately describes the OCI Bastion service?

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

A cloud administrator is configuring a new tenancy and wants each business unit to have its own isolated set of users and groups while still being centrally billed and governed. The administrator also wants to give a specific group permission to manage only the networking resources inside one of those units. Which OCI IAM construct should be used to create that isolated container of users and groups?

According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?

A system administrator needs to grant a new employee access to manage compute instances in a specific compartment. The employee should not have access to any other resources. Which OCI IAM policy statement should the administrator use?

A healthcare organization stores sensitive patient data in an OCI Object Storage bucket. Compliance requires that all data be encrypted at rest with a key that the organization manages and rotates every 90 days. The organization already uses OCI Vault. Which encryption approach should they implement?

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?