Security Services practice questions

Worked examples for Security Services

1. Question 1

   A policy statement is written as: `allow group NetworkAdmins to manage virtual-network-family in compartment Shared:Networking`. The compartment `Shared:Networking` contains two child compartments, `Prod-VCN` and `Dev-VCN`. What access does this single statement grant?

   1. A. Full management of virtual network resources in Shared:Networking only; the child compartments are excluded unless separate statements are written for each.

      Denies compartment inheritance. Access granted at a compartment automatically flows down to compartments nested inside it, so no per-child statement is required.

   2. B. Full management of virtual network resources in Shared:Networking and in its nested compartments Prod-VCN and Dev-VCN.Correct answer

      Correct. A policy granting access to a compartment applies to that compartment and, by inheritance, to all compartments nested beneath it, so the group manages virtual-network-family in the named compartment and both children.

   3. C. Full management of virtual network resources in Shared:Networking, its children, and the parent compartment Shared, because access propagates up the hierarchy to the enclosing compartment.

      Reverses the direction of inheritance. Compartment access flows downward to nested compartments, never upward to a parent or to sibling compartments.

   4. D. Read-only visibility of virtual network resources across the whole tenancy, because 'manage' only confers listing rights until an administrator approves the group.

      Misreads the verb and scope. 'manage' is the broadest verb, conferring full permissions including create and delete, and the scope clause limits it to the named compartment subtree, not the tenancy.

   Explanation

   An IAM policy attached to a compartment grants the stated access in that compartment and in every compartment nested inside it, because access is inherited downward through the compartment hierarchy. Inheritance never runs upward, so the parent compartment is not included, and writing a statement per child is unnecessary. The verb 'manage' is the broadest of the four verbs and confers full permissions on the resource family within the stated scope rather than mere visibility.

2. Question 2

   A cloud team has enabled Cloud Guard at the tenancy root with the Oracle-managed detector and responder recipes, and has also created a Security Zone (associated with the Maximum Security Zone recipe) over the compartment that holds their production resources. A developer then issues an API call to create a new Object Storage bucket with public visibility inside that compartment. Which outcome best describes how the two services handle this single request, and why?

   1. A. The bucket creation request is denied at the time of the call because it violates a Security Zone policy; Cloud Guard's role in this flow is to detect and report non-compliant resources, not to block the request.Correct answer

      Correct. Security Zones enforce security policies preventively — an operation that would violate a security-zone policy on a resource in a security-zone compartment is denied when it is requested. Cloud Guard is the detective control: it evaluates resources against detector recipes and opens problems, with responders acting after the fact.

   2. B. The bucket is created successfully, and the public-bucket detector rule in Cloud Guard blocks subsequent read access to the bucket until an administrator approves an exception.

      Represents the misconception that Cloud Guard detector rules act as an inline access-control gate. Detectors only identify risky configurations and open problems; they never intercept data-plane access, and Cloud Guard has no 'approve an exception to unblock access' workflow of that kind.

   3. C. The bucket is created successfully because Security Zones only produce compliance reports; Cloud Guard is the only service in the tenancy that can prevent the operation, and it does so through its responder recipe.

      Inverts the two services' roles — it treats Security Zones as report-only and Cloud Guard as the preventive control. Security Zones deny violating operations up front, while a Cloud Guard responder can only remediate a resource after a problem has already been detected.

   4. D. The bucket is created successfully, and neither service reacts, because posture management in OCI evaluates only compute and networking resources — Object Storage misconfigurations are outside the scope of both services.

      Assumes a scope limitation that does not exist. Both Cloud Guard detector recipes and Security Zone policies cover Object Storage alongside other resource types such as compute, networking, and database.

   Explanation

   The distinction is preventive versus detective. A Security Zone is a compartment with an attached security-zone recipe whose policies are enforced when a resource is created, moved, or updated: a request that would violate a policy — such as making a bucket public — is denied outright, so the non-conforming resource never exists. Cloud Guard works the other way around: it continuously evaluates resources against detector recipes, opens problems for what it finds, and can invoke responders to remediate afterwards. Answers that have Cloud Guard intercepting or gating the request confuse detection with enforcement; answers that make Security Zones report-only invert the two roles; and the claim that Object Storage is out of scope is simply false, since both services evaluate buckets.

3. Question 3

   A customer asks what they must configure to be protected against common volumetric network-layer DDoS attacks, such as SYN floods and UDP reflection, aimed at their OCI infrastructure. Which statement is accurate?

   1. A. The customer must deploy the Bastion service in front of each public endpoint so that attack traffic terminates there

      Misassigns Bastion's role. Bastion brokers administrative sessions to private resources; it does not sit in front of public endpoints absorbing attack traffic.

   2. B. The customer must create stateless security list rules on every subnet, because stateful rules cannot absorb a flood

      Assumes DDoS mitigation is something the tenant builds from security rules. Security lists filter by protocol, port, and address per VNIC; they are not a volumetric-attack absorption mechanism.

   3. C. Protection against common volumetric layer 3 and layer 4 DDoS attacks is provided by Oracle at the network level for all customers, with no per-tenancy configuration requiredCorrect answer

      Correct. Under the shared security model, Oracle operates the underlying network infrastructure and provides always-on mitigation of common volumetric layer 3/4 DDoS attacks.

   4. D. The customer must purchase and attach a dedicated Vault key to each load balancer to enable DDoS filtering

      Wrong service entirely. Vault manages encryption keys and secrets and has no role in traffic filtering or attack mitigation.

   Explanation

   In the shared responsibility model, Oracle secures the underlying cloud infrastructure, which includes always-on detection and mitigation of common high-volume layer 3 and layer 4 DDoS attacks against the OCI network — the tenant does not enable it per tenancy. Security list and NSG rules are per-VNIC packet filters rather than volumetric-attack defences, Bastion exists to give controlled administrative access to private resources, and Vault handles keys and secrets rather than network traffic. Application-layer protection for web apps is a separate, customer-configured concern addressed by Web Application Firewall.

4. Question 4

   An architect must let a fleet of compute instances running in the `AppTier` compartment write objects to Object Storage without any API keys, passwords, or credentials being stored on the instances themselves. Which TWO statements about the IAM constructs that make this possible are correct? (Select TWO.)

   1. A. A dynamic group is defined by matching rules that automatically include qualifying resources — such as the compute instances in a given compartment — rather than by an explicitly maintained list of members.Correct answer

      Correct. A dynamic group's membership is derived from matching rules evaluated against resource attributes (for example, instances residing in a specified compartment), so instances join and leave automatically as the fleet scales.

   2. B. The compute instances act as resource principals (instance principals), a principal type that IAM policies can name as the subject of a permission grant, so no credentials need to be stored on the instance.Correct answer

      Correct. IAM recognizes resource principals alongside human user principals; an instance authenticates to OCI services as itself via the instance principal, and a policy written against the dynamic group authorizes it.

   3. C. A dynamic group is a compartment that contains compute instances, so placing the instances in that compartment is what grants them the required permissions.

      Conflates a dynamic group with a compartment. A compartment is a logical container that organizes and isolates resources; a dynamic group is a principal grouping used as the subject of a policy statement. Placing a resource in a compartment grants it nothing.

   4. D. Because instances are not users, the policy authorizing this access must omit a subject and instead be written as an unattached statement scoped only to the Object Storage resource type.

      Misunderstands policy syntax. Every statement requires a subject — `Allow <group|dynamic-group> to <verb> <resource-type> in <scope>`; there is no subjectless form, and a dynamic group supplies the subject for non-human principals.

   5. E. The individual compute instances must first be created as IAM users inside an identity domain so that they can be added to a group that the policy grants access to.

      Treats machine identity as human identity. Users in an identity domain represent people or service accounts authenticating with credentials; the whole point of instance principals is that the resource is itself a principal, so no user object or stored credential is required.

   Explanation

   OCI IAM authorizes principals, and principals are not limited to human users: a resource such as a compute instance can act as its own principal (an instance principal), which is what removes the need to store credentials on the host. Membership in a dynamic group is computed from matching rules over resource attributes rather than curated by hand, so a policy naming the dynamic group as its subject automatically covers instances as the fleet changes. A compartment is only a container for organizing and isolating resources — residency in one confers no permissions — and every policy statement requires a subject, so there is no subjectless form and no need to model instances as users in an identity domain. See OCI IAM overview: https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/overview.htm

5. Question 5

   An auditor asks a cloud architect to explain the difference between encryption at rest and encryption in transit for a workload that writes files to Object Storage over the public internet. Which TWO statements correctly describe these controls in OCI? (Select all that apply.)

   1. A. Encryption at rest protects the data written to storage media, and OCI encrypts data at rest by default using keys managed by Oracle unless the customer supplies their own key from Vault.Correct answer

      OCI storage services encrypt customer data at rest by default; customers may optionally bring a customer-managed master encryption key from Vault to control the key lifecycle instead of relying on Oracle-managed keys.

   2. B. Encryption in transit protects the data as it moves over the network, and is provided by TLS on the connection to the service endpoint.Correct answer

      In-transit protection is a transport-layer control: TLS secures the data on the wire between the client and the service endpoint, defending against interception and tampering while the data is in motion.

   3. C. Encryption at rest also protects the data while it travels over the public internet to the service endpoint, so TLS is redundant.

      The classic 'one control covers the other' misconception. At-rest encryption applies only once the data has been written to storage; it says nothing about the network path, which is why TLS is still required.

   4. D. Because Object Storage is a managed service, no data is stored in encrypted form unless the customer creates a Vault key first.

      Assumes OCI storage is unencrypted by default. Encryption at rest is on by default with Oracle-managed keys; creating a Vault key changes who controls the key, not whether the data is encrypted.

   Explanation

   The two controls cover different phases of a data lifecycle and are complementary rather than substitutable. Encryption at rest applies to data once it is persisted to storage — OCI enables it by default with Oracle-managed keys, with the option to use a customer-managed master encryption key from Vault — while encryption in transit is provided by TLS and protects the data only while it moves across the network. Claiming that at-rest encryption also secures the network path ignores the fact that it takes effect only after the data lands in storage, and claiming that OCI storage is unencrypted until a Vault key exists misreads customer-managed keys as the trigger for encryption rather than as a change in key ownership.

6. Question 6

   An architect is comparing OCI Cloud Guard with OCI Security Zones for a regulated workload. Which TWO statements accurately describe how these two posture-management services behave?

   1. A. Cloud Guard monitors a target compartment and its subcompartments, raising problems when a detector rule matches a risky configuration or activity.Correct answer

      Correct. A Cloud Guard target scopes monitoring to a compartment and everything beneath it, and matching detector rules produce problems in the Cloud Guard console.

   2. B. Security Zones apply their policies to resources in an associated compartment, denying operations that would leave a resource in a non-conforming state.Correct answer

      Correct. A security zone is a compartment tied to a security zone recipe, and OCI rejects any create or update operation in that compartment that would violate one of the recipe's policies.

   3. C. Cloud Guard prevents a non-conforming resource from ever being created by rejecting the API call that would create it.

      This is the 'Cloud Guard blocks actions' misconception. Cloud Guard is detective — it evaluates resources that already exist and raises problems; only Security Zones rejects the operation itself.

   4. D. Security Zones periodically re-scan existing resources and email an administrator a list of violations found since the previous scan.

      This is the 'Security Zones only reports' misconception, assigning Cloud Guard's periodic detection-and-reporting behaviour to a service whose whole design point is refusing the offending operation up front.

   5. E. Both services require the workload's encryption keys to be imported into them before any policy or detector rule can be evaluated.

      This confuses posture management with key management. Encryption keys live in OCI Vault, and neither Cloud Guard detectors nor Security Zone policies need key material to evaluate resource configuration.

   Explanation

   The two services are complementary halves of posture management: Cloud Guard is detective, scoped by a target to a compartment and its subcompartments, where detector recipes raise problems that responder recipes can remediate. Security Zones is preventive — associating a compartment with a security zone recipe causes OCI to deny any operation that would leave a resource non-conforming. Reversing those roles (a blocking Cloud Guard or a merely reporting Security Zone) is the classic confusion, and neither service depends on encryption keys, which are managed separately by OCI Vault.

7. Question 7

   A public-facing e-commerce site hosted in OCI is being probed with SQL injection and cross-site scripting attempts embedded in HTTP request parameters. Which OCI service is purpose-built to inspect and block this class of attack?

   1. A. Security lists on the web tier subnet

      Confuses packet filtering with application inspection. Security list rules match on protocol, ports, and IP ranges; they cannot see the malicious payload inside an otherwise legitimate HTTPS request.

   2. B. The OCI Bastion service

      Assigns a task to the wrong service. Bastion provides controlled administrative access to private resources; it does not filter inbound application traffic from customers.

   3. C. Web Application Firewall (WAF)Correct answer

      WAF inspects HTTP/HTTPS traffic against rules that detect application-layer threats such as SQL injection and cross-site scripting, and blocks matching requests before they reach the origin (OCI Security overview).

   4. D. Network security groups applied to the web server VNICs

      Misconception that NSGs perform deep inspection. Like security lists they are stateful Layer 3/4 rules keyed on addresses and ports, with no visibility into HTTP request content.

   Explanation

   SQL injection and cross-site scripting are Layer 7 attacks carried inside well-formed HTTP requests on permitted ports, so only a control that parses the application protocol can detect them; WAF is the OCI service designed for that inspection and enforcement. Security lists and network security groups both operate on addresses, protocols, and ports and would allow the request through because port 443 is legitimately open. Bastion serves administrative access to private resources and plays no part in filtering customer web traffic.

8. Question 8

   A policy statement `allow group NetworkAdmins to manage virtual-network-family in compartment Corp` is attached to the compartment named `Corp`. The compartment `Corp` contains a child compartment named `Prod`, and `Corp` itself is a child of the tenancy (root). How does this policy apply?

   1. A. It applies only to resources created directly in Corp; resources in the child compartment Prod are excluded unless a second policy is written for them.

      Misconception that compartment scope stops at the immediate compartment. Access granted on a compartment is inherited by the compartments nested inside it, so no separate policy is required for Prod.

   2. B. It applies to every compartment in the tenancy because policies are always evaluated at the tenancy level regardless of where the compartment is named in the statement.

      Confuses where a policy may be attached with the scope named in the statement. The `in compartment <name>` clause is what limits the scope; naming a compartment restricts the grant to that subtree.

   3. C. It applies to Corp and, because policies are inherited by the parent, also to the tenancy and every other compartment in it.

      Reverses the direction of inheritance. Policy scope flows downward into nested compartments, never upward to the parent or outward to siblings; only a policy written at the tenancy level covers the whole tenancy.

   4. D. It applies to Corp and to all compartments nested beneath Corp, including Prod, but not to sibling compartments or the tenancy itself.Correct answer

      Correct. Per the IAM overview, a policy granting access to a compartment also grants that access to its child compartments; inheritance flows downward only, so siblings and the parent (tenancy) are unaffected.

   Explanation

   In OCI IAM, the `in compartment <name>` clause sets the scope of a policy statement, and access granted on a compartment is inherited by the compartments nested inside it — so a grant on a parent covers its children automatically. Inheritance is strictly downward: it never propagates up to the parent compartment or the tenancy, and it never spreads sideways to sibling compartments. A grant covering the whole tenancy requires `in tenancy`, and evaluating every policy at the tenancy level regardless of the named scope would defeat the purpose of compartment-scoped statements.