1Z0-1127-25 Deploying and Managing Generative AI on OCI Practice Question
A healthcare company is using OCI Generative AI to analyze patient records and generate clinical summaries. The company must comply with HIPAA regulations, which require that all protected health information (PHI) be encrypted at rest and in transit, and that access be logged and audited. The current architecture uses an OCI Data Science model deployment with a public endpoint. The model is stored in an OCI Object Storage bucket that is publicly accessible for testing. The company is now moving to production. The compliance officer has flagged the following issues: (1) The model endpoint is publicly accessible. (2) The bucket containing the model is public. (3) No audit logs are enabled. The company wants to remediate these issues while maintaining the ability to invoke the model from on-premises applications via a secure connection. Which set of actions should the architect take?
⚠ Common exam trap
Candidates often think IP restrictions or pre-authenticated requests are sufficient for HIPAA compliance, but HIPAA requires that PHI be encrypted at rest and in transit and that access be logged and audited—public endpoints and shared URLs violate the 'encryption in transit' and 'audit' requirements because they rely on internet-exposed paths and lack proper access controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch the model endpoint to a private subnet with a service gateway, update the bucket policy to block all public access, enable OCI Audit service, and set up a VPN or FastConnect for on-premises access.
It addresses all three compliance issues: moving the model endpoint to a private subnet with a service gateway removes public exposure, making the bucket private with a policy that blocks all public access secures the model artifacts, and enabling OCI Audit provides the required logging. Additionally, setting up a VPN or FastConnect allows secure on-premises access without exposing the endpoint to the public internet, fully satisfying HIPAA encryption and audit requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch the model endpoint to a private subnet with a service gateway, change the bucket to be accessible only via pre-authenticated requests, and enable OCI Logging for the model deployment.
Why it's wrong here
Pre-authenticated requests are still public; the bucket remains accessible via URLs.
- ✗
Keep the public endpoint but restrict access using IAM policies and source IP addresses, make the bucket private, and enable OCI Audit.
Why it's wrong here
Public endpoint still exposes the service to the internet, even with IP restrictions.
- ✓
Switch the model endpoint to a private subnet with a service gateway, update the bucket policy to block all public access, enable OCI Audit service, and set up a VPN or FastConnect for on-premises access.
Why this is correct
This ensures private endpoint, private bucket, audit logging, and secure on-premises connectivity.
- ✗
Use a public load balancer with SSL termination, restrict bucket access to the load balancer's OCID, and enable OCI Audit.
Why it's wrong here
Public load balancer still exposes a public endpoint; bucket access based on OCID is not a standard feature.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 1Z0-1127-25 question from scratch — 768 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-1127-25 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-1127-25 exam.