Security Services practice questions

A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?

Trap 1: OCI Bastion

OCI Bastion provides secure, managed access to private resources without public IP addresses.

Trap 2: OCI Web Application Firewall

WAF protects web applications from malicious internet traffic and attacks.

Trap 3: OCI Vault

OCI Vault is used for centralized secret management and encryption key generation.

A
OCI Cloud Guard
Cloud Guard aggregates security findings across compartments and tenancies into a single dashboard.
B
OCI Bastion
Why wrong: OCI Bastion provides secure, managed access to private resources without public IP addresses.
C
OCI Web Application Firewall
Why wrong: WAF protects web applications from malicious internet traffic and attacks.
D
OCI Vault
Why wrong: OCI Vault is used for centralized secret management and encryption key generation.

Question 2easymultiple choice

According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?

Trap 1: Oracle

Oracle provides the IAM platform capability, but configuring users, roles, and password policies is a customer responsibility.

Trap 2: Both Oracle and the customer jointly via shared IAM consoles

IAM configuration is entirely a customer responsibility.

Trap 3: Third-party identity auditor

Third parties may audit, but do not manage OCI IAM.

A
Oracle
Why wrong: Oracle provides the IAM platform capability, but configuring users, roles, and password policies is a customer responsibility.
B
Both Oracle and the customer jointly via shared IAM consoles
Why wrong: IAM configuration is entirely a customer responsibility.
C
The customer
Identity management, role assignments, and authentication policies are part of security IN the cloud managed by the customer.
D
Third-party identity auditor
Why wrong: Third parties may audit, but do not manage OCI IAM.

Question 3mediummultiple choice

Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?

Trap 1: Cloud Guard

Cloud Guard detects misconfigurations and generates problems, but it does not automatically block configuration actions unless paired with responder rules, whereas Security Zones enforce strict guardrails at creation.

Trap 2: Web Application Firewall

WAF focuses on HTTP/HTTPS layer traffic filtering, not compute IP addressing.

Trap 3: Vault Service

Vault Service manages cryptographic keys and secrets.

A
Security Zones
Security Zones use pre-built security recipes to enforce preventive guardrails that block non-compliant resource creation.
B
Cloud Guard
Why wrong: Cloud Guard detects misconfigurations and generates problems, but it does not automatically block configuration actions unless paired with responder rules, whereas Security Zones enforce strict guardrails at creation.
C
Web Application Firewall
Why wrong: WAF focuses on HTTP/HTTPS layer traffic filtering, not compute IP addressing.
D
Vault Service
Why wrong: Vault Service manages cryptographic keys and secrets.

Question 4easymultiple choice

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

Trap 1: Hypervisor patching and firmware updates on the physical host

Hypervisor management and underlying hardware maintenance are Oracle's responsibility.

Trap 2: Redundancy and cooling of the physical networking hardware

Physical network resilience is maintained by Oracle.

Trap 3: Physical security of the data center hosting the compute instances

Physical security of data centers is managed entirely by Oracle.

A
Guest operating system patching and configuration on the compute instances
The customer owns the operating system configuration, updates, and application security.
B
Hypervisor patching and firmware updates on the physical host
Why wrong: Hypervisor management and underlying hardware maintenance are Oracle's responsibility.
C
Redundancy and cooling of the physical networking hardware
Why wrong: Physical network resilience is maintained by Oracle.
D
Physical security of the data center hosting the compute instances
Why wrong: Physical security of data centers is managed entirely by Oracle.

Question 5mediummultiple choice

A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?

Trap 1: Object Storage with customer-managed keys

Object Storage stores files, not application secrets or connection strings.

Trap 2: Key Management Service Master Keys

Master encryption keys are used for encrypting data at rest across OCI services, not for storing plaintext application secrets.

Trap 3: Identity and Access Management Dynamic Groups

Dynamic Groups are used for instance authentication, not for storing secrets.

A
Object Storage with customer-managed keys
Why wrong: Object Storage stores files, not application secrets or connection strings.
B
Key Management Service Master Keys
Why wrong: Master encryption keys are used for encrypting data at rest across OCI services, not for storing plaintext application secrets.
C
Vault Secrets
Vault Secrets allows secure storage and dynamic retrieval of sensitive application configuration data.
D
Identity and Access Management Dynamic Groups
Why wrong: Dynamic Groups are used for instance authentication, not for storing secrets.

Question 6hardmultiple choice

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

Trap 1: Cloud Guard

Cloud Guard detects configuration posture issues, not real-time HTTP application layer attacks.

Trap 2: Virtual Cloud Network Security Lists

Security Lists are stateful firewall rules for subnets operating at Layers 3 and 4.

Trap 3: Network Security Groups

NSGs act at OSI Layer 3 and 4 (TCP/UDP ports and IPs), whereas WAF operates at Layer 7 for HTTP/S traffic.

A
Cloud Guard
Why wrong: Cloud Guard detects configuration posture issues, not real-time HTTP application layer attacks.
B
Virtual Cloud Network Security Lists
Why wrong: Security Lists are stateful firewall rules for subnets operating at Layers 3 and 4.
C
Network Security Groups
Why wrong: NSGs act at OSI Layer 3 and 4 (TCP/UDP ports and IPs), whereas WAF operates at Layer 7 for HTTP/S traffic.
D
OCI Web Application Firewall
WAF inspects HTTP/S traffic to protect web applications against Layer 7 application exploits.

Question 7mediummultiple choice

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?

Trap 1: Vault Master Encryption keys

Vault keys encrypt data and have no role in generating Cloud Guard IAM findings.

Trap 2: Security Zone recipes

Security Zone recipes are used by Security Zones, not Cloud Guard.

Trap 3: Responder recipes

Responder recipes define automated or manual remediation actions taken after a problem is detected.

A
Detector recipes
Cloud Guard detector recipes define the rules and checks used to scan OCI resources for security misconfigurations.
B
Vault Master Encryption keys
Why wrong: Vault keys encrypt data and have no role in generating Cloud Guard IAM findings.
C
Security Zone recipes
Why wrong: Security Zone recipes are used by Security Zones, not Cloud Guard.
D
Responder recipes
Why wrong: Responder recipes define automated or manual remediation actions taken after a problem is detected.

Read the full VPN explanation →

Question 8hardmultiple choice

; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?

Trap 1: Dynamic Routing Gateway

A DRG connects VCNs to on-premises networks or other VCNs, but does not manage administrative login sessions.

Trap 2: NAT Gateway

A NAT Gateway allows internal private instances to initiate outbound connections to the internet, not inbound administrative access.

Trap 3: Site-to-Site VPN

While a VPN provides private connectivity, it connects an entire corporate network rather than providing on-demand administrator access.

A
Dynamic Routing Gateway
Why wrong: A DRG connects VCNs to on-premises networks or other VCNs, but does not manage administrative login sessions.
B
OCI Bastion
OCI Bastion provides secure, managed, zero-public-IP access to private target resources.
C
NAT Gateway
Why wrong: A NAT Gateway allows internal private instances to initiate outbound connections to the internet, not inbound administrative access.
D
Site-to-Site VPN
Why wrong: While a VPN provides private connectivity, it connects an entire corporate network rather than providing on-demand administrator access.