Question 1

"Your company is building a highly available and secure web application on OCI. Because of increasing malicious web-based attacks, the security team has mandated that web servers should not be exposed directly to the Internet. How should you architect the solution while ensuring fault tolerance and security?

Options :

A : Deploy at least three web servers in different fault domains within a public subnet, each with a public IP address. Deploy Web Application Firewall (WAF), and configure an origin for each public IP.

B : Deploy at least three web servers in different fault domains within a private subnet. Place a public load balancer in a public subnet, but skip WAF configuration.

C : Deploy at least three web servers in different fault domains within a private subnet. Place a public load balancer in a public subnet and configure a back-end set for all web servers. Deploy Web Application Firewall (WAF) and set the load balancer public IP address as the origin.

D : Deploy at least three web servers in different fault domains within a public subnet. Use OCI Traffic Management service for DNS-based load balancing."

Answer: C

Question 2

In Oracle Cloud Infrastructure (OCI), bare metal instances provide customers with direct access to the underlying hardware. To mitigate security risks when a customer terminates a bare metal instance, OCI utilizes Root-of-Trust hardware. What is the primary function of the Root-of-Trust hardware in this context?

Options :

A : It automatically encrypts data at rest on the bare metal instance.

B : It ensures all non-volatile memory on the terminated instance is securely wiped before reuse.

C : It guarantees complete isolation between customer workloads on different instances.

D : It eliminates the need for hypervisors, reducing the potential attack surface.

Answer: B

Question 3

You're managing an Oracle Cloud Infrastructure (OCI) environment where a public website hosts downloadable assets stored in Object Storage buckets. These buckets need to be publicly accessible for website visitors, but Cloud Guard keeps flagging them as security risks. How can Cloud Guard be configured to ignore problems specific to public buckets while still ensuring security checks are applied to other resources that require them?

Options :

A : A public bucket is a security risk, so Cloud Guard will keep detecting it.

B : Resolve or remediate the problems by making the buckets private.

C : Dismiss problems associated with those resources.

D : Fix the baseline by configuring the Conditional groups for the detector.

Answer: D

Question 4

During your investigation of a load balancer issue, you discovered that all back-end servers associated with one of the affected listeners were reported as unhealthy. However, when you checked the back-end servers, they seemed to be working just fine. What might be causing this issue?

Options :

A : Incorrect subnet configuration

B : Misconfigured security rule

C : Incorrect DNS configuration

D : Overloaded back-end servers

E : Misconfigured health check

Answer: E

Question 5

An E-commerce company running on Oracle Cloud Infrastructure (OCI) wants to prevent accidental misconfigurations that could expose sensitive data. They need an OCI service that can enforce predefined security rules when creating or modifying cloud resources. Which OCI service should they use?

Options :

A : OCI Web Application Firewall (WAF)

B : OCI Identity and Access Management (IAM)

C : OCI Security Zone

D : OCI Certificates

Answer: C