CCNA Security Services Questions

Guest OS patching and configuration sits entirely with the customer, since OCI's shared-responsibility model places everything above the hypervisor under tenant control. Oracle secures the physical hosts, network fabric and virtualisation layer, but the operating system running inside your compute instances — its patches, hardening and settings — remains your sole obligation.

Dynamic groups match resources such as instances by their attributes, so the instance becomes a principal that can be granted permissions without any stored secret. A policy granting that dynamic group read access on the bucket in data-prod authorizes the calls. The instance then uses its instance principals through the metadata service, and no credentials are written to disk.

OCI Bastion creates a session-based, time-limited connection through the service's own managed endpoint, so no public IP, VPN or permanently open SSH port is needed. This satisfies the constraint of reaching the private database without exposing inbound access.

Security Zones enforce immutable, compartment-level policies that automatically deny any action violating the specified security policy, including attaching a public IP to a compute instance. Because the rule is recipe-based and cannot be overridden or disabled by users, it satisfies the compliance requirement for guaranteed, continuous enforcement in the production compartment.

Vault Secrets stores credentials such as connection strings and API tokens in encrypted vaults, letting applications retrieve them programmatically at runtime. This directly satisfies the requirement to avoid hardcoding credentials, unlike plain Object Storage or config files, because secrets are centrally managed, audited and rotated without redeployment.

OCI Audit automatically records all API calls and actions performed on resources in the tenancy. It provides a comprehensive log that can be used for security auditing, compliance, and detecting suspicious activities. The logs are immutable and retained for 90 days by default, and can be exported for longer retention. This meets the requirement for centralized access auditing.

OCI WAF inspects HTTP and HTTPS requests at Layer 7 and ships with managed rule sets that detect common web exploits including cross-site scripting and SQL injection. It can automatically add offending client IPs to an access-control block list for a configurable duration, which directly matches the automatic blocking requirement. It reduces operational burden because Oracle maintains and updates the managed rule sets.

OCI Cloud Guard aggregates security findings across tenancies and compartments into one dashboard, satisfying the consolidated monitoring constraint. It detects misconfigurations and risky activity via detectors and responder recipes, reporting centrally through the Cloud Guard console. This cross-tenancy visibility is precisely what the security officer requires.

This is correct because OCI Bastion service supports both SSH and RDP session types. When creating a session, you specify a maximum TTL, and the session is automatically terminated after that period. This enhances security by limiting the duration of access. The service also provides auditing of sessions. This meets the administrator's requirement for secure, temporary access.

OCI Web Application Firewall inspects Layer 7 HTTP traffic, filtering malicious requests and blocking SQL injection payloads before they reach the application. It directly addresses both the HTTP flood and injection constraints named in the stem, unlike network-layer defences that cannot parse application content.

Identity domains are the OCI IAM construct that provides an isolated container for users, groups, and identity-provider configuration within a tenancy. Each domain has its own namespace, so business units can be separated while the tenancy remains centrally billed. Policies can then grant a group in that domain access scoped to specific compartments or resources.

The customer configures identity controls within OCI Identity and Access Management, including user accounts, password policies and MFA enforcement. Oracle secures the underlying cloud infrastructure, but identity governance remains a tenant responsibility, satisfying the stem's requirement for account, credential and authentication management ownership.

This policy grants the group ComputeAdmins the ability to manage instances within the Production compartment only. The 'manage' verb allows full control over instances, and the scope is limited to the specified compartment. This meets the requirement of granting access to manage compute instances without granting access to other resources.

Customer-managed keys in OCI Vault allow the organization to create, manage, and rotate keys according to their own policies. They can set a rotation schedule of 90 days and maintain control over key access. Object Storage supports encryption with customer-managed keys, and this meets the compliance requirement for customer-managed encryption with defined rotation.

Detector recipes define the conditions and rules that Cloud Guard evaluates against resources in each compartment. Overly permissive IAM policies matching those conditions generate the reported problems, so the findings originate from detector recipes rather than responders or targets.