Oracle Cloud Infrastructure 2023 Security Professional - 1z0-1104-23 Exam Practice Test
Question 1
Which two responsibilities must be taken care of by a customer while managing Web Application Firewall (WAF)? (Choose two.)
Correct Answer: C,D
Question 2
Challenge 1 - Task 1 of 5
Authorize OCI Resources to Retrieve the Secret from the Vault
Scenario:
You are working on a Python program running on a compute instance that needs to access an external service. To access the external service, the program needs credentials (password). Given that it is not a best security practice, you decide not to hard code the credential in the program. Instead, you store the password (secret) in a vault using the OCI Vault service. The requirement now is to authorize the compute instance so that the Python program can retrieve the password (secret) by making an API call to the OCI Vault.
Preconfigured:
To complete this requirement, you are provided with:
An OCI Vault to store the secret required by the program, which is created in the root compartment as PBT_Vault_SP.
An instance principal IAM service, which enables instances to be authorized actors (principals) that can retrieve the secret from the OCI Vault.
A dynamic group named PBT_Dynamic_Group_SP with permissions to access the OCI Vault. This dynamic group includes all of the instances in your compartment.
Access to Cloud Shell.
Permissions to perform only the tasks within the challenge.
Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99234021-C01 and Region us-ashburn-1.
Complete the following tasks in the OCI environment provisioned:
Create Master Encryption Key with the name my_pbt_msk with 256 bits shape.
Create a Secret with the name my-pbt-secret_99234021-lab.user01 and secret content.
For example: If your user name is 99346163-lab.user02, then the secret should be named as my-pbt-secret_99346163-lab.user02.
Authorize OCI Resources to Retrieve the Secret from the Vault
Scenario:
You are working on a Python program running on a compute instance that needs to access an external service. To access the external service, the program needs credentials (password). Given that it is not a best security practice, you decide not to hard code the credential in the program. Instead, you store the password (secret) in a vault using the OCI Vault service. The requirement now is to authorize the compute instance so that the Python program can retrieve the password (secret) by making an API call to the OCI Vault.
Preconfigured:
To complete this requirement, you are provided with:
An OCI Vault to store the secret required by the program, which is created in the root compartment as PBT_Vault_SP.
An instance principal IAM service, which enables instances to be authorized actors (principals) that can retrieve the secret from the OCI Vault.
A dynamic group named PBT_Dynamic_Group_SP with permissions to access the OCI Vault. This dynamic group includes all of the instances in your compartment.
Access to Cloud Shell.
Permissions to perform only the tasks within the challenge.
Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99234021-C01 and Region us-ashburn-1.
Complete the following tasks in the OCI environment provisioned:
Create Master Encryption Key with the name my_pbt_msk with 256 bits shape.
Create a Secret with the name my-pbt-secret_99234021-lab.user01 and secret content.
For example: If your user name is 99346163-lab.user02, then the secret should be named as my-pbt-secret_99346163-lab.user02.
Correct Answer:
See the solution below in Explanation
Explanation:
SOLUTION:
From the navigation menu, select "Identity & Security" and then click "Vault." From the left navigation pane, under "List Scope," select the working compartment from the "Compartment" drop-down menu.
Select "PBT_Vault_SP."
From the left navigation pane under "Resources," click "Master Encryption Keys," and then click "Create Key." On the "Create Key" page, enter the following details:
Create in compartment: <your working compartment>
Protection Mode: HSM
Name: my_pbt_msk
Key Shape: Algorithm (Accept the default values)
Key Shape: Length (256 bits)
Click "Create Key" to save. "It will take about a minute to create the master encryption key. The keys will go through the Creating state to the Active state." From the left navigation pane under "Resources," select "Secrets" and click "Create Secret." On the "Create Secret" page, enter the following details:
Create in compartment: <your working compartment>
Name: my-pbt-secret_99234021-lab.user01
Description: "My application secret key"
Encryption Key: Select the my_pbt_msk key created earlier.
Secret Contents: <Your secret here>
Click "Create Secret."
After the secret is created, click "my-pbt-secret_99234021-lab.user01." Click the "Copy" link located to the right of the Secret Key's OCID value. Later, it will be included in a Python script. "Sample: ocid1.vaultsecret.oc1.iad.XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Explanation:
SOLUTION:
From the navigation menu, select "Identity & Security" and then click "Vault." From the left navigation pane, under "List Scope," select the working compartment from the "Compartment" drop-down menu.
Select "PBT_Vault_SP."
From the left navigation pane under "Resources," click "Master Encryption Keys," and then click "Create Key." On the "Create Key" page, enter the following details:
Create in compartment: <your working compartment>
Protection Mode: HSM
Name: my_pbt_msk
Key Shape: Algorithm (Accept the default values)
Key Shape: Length (256 bits)
Click "Create Key" to save. "It will take about a minute to create the master encryption key. The keys will go through the Creating state to the Active state." From the left navigation pane under "Resources," select "Secrets" and click "Create Secret." On the "Create Secret" page, enter the following details:
Create in compartment: <your working compartment>
Name: my-pbt-secret_99234021-lab.user01
Description: "My application secret key"
Encryption Key: Select the my_pbt_msk key created earlier.
Secret Contents: <Your secret here>
Click "Create Secret."
After the secret is created, click "my-pbt-secret_99234021-lab.user01." Click the "Copy" link located to the right of the Secret Key's OCID value. Later, it will be included in a Python script. "Sample: ocid1.vaultsecret.oc1.iad.XXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Question 3
Which resources can be used to create and manage from Vault Service ? Select TWO correct answers
Correct Answer: B,D
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 4
Which Security Zone policy is NOT valid?
Correct Answer: A
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 5
Which type of FastConnect supports configuring Oracle Cloud Infrastructure (OCI) Site-to-Site VPN for encryption? (Choose the best Answer.)
Correct Answer: C
Question 6
A company has OCI tenancy which has mount target associated with two File Systems, CG_1 and CG_2. These FileSystems are accessed by IP-based clients AB_1 and AB_2 respectively. As a security administrator, how can you provide access to both clients such that CGI has Read only access on AB1 and CG_2 has Read/Write access on AB_2?
Correct Answer: B,C
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 7
What do the features of OS Management Service do?
Correct Answer: C
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 8
When configuring inter-tenancy virtual cloud network (VCN) peering using local peering gateways (LPG), which OCID do you need from the other tenancy to properly configure the Requestor and Acceptor identity Access Management (IAM) policies? (Choose the best Answer.)
Correct Answer: B
Question 9
Pods running in your Oracle Container Engine for Kubernetes (OKE) cluster often need to communicate with other pods in the cluster or with services outside the cluster. As the OKE cluster administrator, you have been tasked with configuring permissions to restrict pod-to-pod communications except as explicitly allowed. Where can you define these permissions? (Choose the best Answer.)
Correct Answer: D
Question 10
Which solution enables you to privately connect two Virtual Cloud Networks (VCNS) across different Oracle Cloud Infrastructure (OCI) regions without routing traffic over the public Internet? (Choose the best Answer.)
Correct Answer: A
Question 11
You create a new compartment, "apps," to host some production apps and you create an apps_group and added users to it.
What would you do to ensure the users have access to the apps compartment?
What would you do to ensure the users have access to the apps compartment?
Correct Answer: B
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 12
Select the component that encompasses the overall configuration of your WAF service on OCI.
Correct Answer: D
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 13
Which statement is true about origin management in WAF?
Statement A: Multiple origins can be defined.
Statement B: Only a single origin can be active fora WAF.
Statement A: Multiple origins can be defined.
Statement B: Only a single origin can be active fora WAF.
Correct Answer: B
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
Question 14
What information do youget by using the Network Visualizer tool?
Correct Answer: B
Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).
