Verified 1z0-1104-23 Exam Dumps Q&As - Provide 1z0-1104-23 with Correct Answers
Pass Your 1z0-1104-23 Dumps Free Latest Oracle Practice Tests
Oracle 1z0-1104-23 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION # 43
As a security administrator, you found out that there are users outside your co network who are accessing OCI Object Storage Bucket. How can you prevent these users from accessing OCI resources in corporate network?
- A. Make OCI resources private instead of public
- B. Create an 1AM policy and create WAF rules
- C. Create PAR to restrict access the access
- D. Create an 1AM policy and add a network source
Answer: D
Explanation:
Explanation
Graphical user interface, text, application Description automatically generated
NEW QUESTION # 44
Which IAM policy should be created to give XYZ the ability to list contents of a resource excluding the fneeds to authenticatein prod compartment ? Principle of least priviledge should be used.
- A. Allow group XYZ to use all resources in compartment != prod
- B. Allow group XYZ to manage all resources in compartment != prod
- C. Allow group XYZ to read all resources in tenancy where target.compartment.name != prod
- D. Allow group XYZ to inspect all resources in tenancy where target.compartment.name != prod
Answer: D
Explanation:
NEW QUESTION # 45
Challenge 4 - Task 5 of 6
Configure Web Application Firewall to Protect Web Server Against XSS Attack Scenario You have to protect web applications hosted on OCI from cross-site scripting (XSS) attacks. You can use the OCI Web Application Firewall (WAF) capabilities to create rules that compare against incoming requests to determine if the request contains an XSS attack payload. If a request is determined to be an attack, WAF should return the HTTP Service Unavailable (503) error.
To ensure that the configured WAF blocks the XSS attack, run the following script: [http://<public- ip-enforcement-point>/index.html?<p style="background:url(javascript:alert(1))"](http://<public- ip-enforcement-point>/index.html?<p style="background:url(javascript:alert(1))">) To complete this deployment, you have to perform the following tasks in the environment provisioned for you:
Configure a Virtual Cloud Network (VCN)
Create a Compute Instance and install the Web Server
Create a Load Balancer and update Security List
Create a WAF policy
Configure Protection Rules against XSS attacks
Verify the created environment against XSS attacks
Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99233424-C01 and Region us-ashburn-1.
Complete the following task in the provisioned OCI environment:
1. Create a Protection Rule with name WAF-PBT-XSS-Protection against XSS attack. for protecting web server
2. Create a New Rule Action with name WAF-PBT-XSS-Action where http response code will be 503 (Service Unavailable).
Answer:
Explanation:
See the solution below in Explanation
Explanation:
SOLUTION:
From the navigation menu, select Identity & Security. Navigate to Web Application Firewall and click Policies under it.
In the left navigation pane, under List Scope, select the working compartment from the drop-down menu.
Click the IAD-SP-PBT-WAF-01_99233424-lab.user01 WAF policy to add a protection rule.
On the policy details page, click Protections under Policy.
In the Protection section on the console, click Manage request protection rules.
Click Add Request Protection Rule.
In the Add protection rule dialog box, enter the following details:
a) Name: WAF-PBT-XSS-Protection
b) Conditions: Do not add any condition.
c) Under Rule action - Action name: Select Create New Action from the drop-down menu.
In the Add Action dialog box, enter the following details:
a) Name: WAF-PBT-XSS-Action
b) Type: Return HTTP Response
c) Response code: Select "503 Service unavailable" from the drop-down menu.
d) Response page body: Type "Service Unavailable: Web Server is secured against XSS attacks." e) Click Add action.
Under Protection Capabilities, click Choose protection capabilities.
In the Choose protection capabilities dialog box, complete the following:
a) Filter by tags: Type "xss" and press Enter.
b) Filter by version: Latest
c) Protection list: Check all protections. Select the check box in the header to add all.
d) Click Choose protection capabilities.
e) Review and click Add request protection rule.
f) Click Save Changes in the Manage Request Protection Rules dialog box.
The rule you created appears in the list. The WAF policy will update and get back to Active state.
NEW QUESTION # 46
Which statements are CORRECT about Multi-Factor Authentication in OCI ? Select TWO correct answers
- A. A user can registermultiple devices to use for MFA.
- B. Members of the Administrators group cannot enable MFA for another user
- C. Members of the Administrators group can disable MFA for other users
- D. Users cannot enable MFA for themselves
Answer: B,C
Explanation:
Explanation
Graphical user interface, text, application, email Description automatically generated
Graphical user interface, text, application Description automatically generated
NEW QUESTION # 47
You have a tenancy that has five compartments across two regions, Ashburn (home region) and Phoenix. Which three steps would you perform in Cloud Guard to ensure that Cloud Guard monitors your entire tenancy accurately? (Choose three.)
- A. Create a target in your root compartment.
- B. Choose your reporting region while enabling Cloud Guard.
- C. Schedule a scan recipe for each target
- D. Attach detector recipes and the responder recipe to your target.
- E. Enable Cloud Guard in compartment settings for each of your five compartments.
Answer: A,B,C
NEW QUESTION # 48
Which Cloud Guard component identifies issues with resources or user actions and alerts you when an issue is found?
- A. Targets
- B. Problems
- C. Detectors
- D. Responders
Answer: C
Explanation:
Explanation
Detector
Performs checks to identify potential security problems based on activities or configurations. Rules followed to identify problems are the same for allcompartments in a target.
https://docs.oracle.com/en-us/iaas/cloud-guard/using/part-start.htm
NEW QUESTION # 49
Which challenge is generally the first level of bot mitigation, but not sufficient with more advanced bot tools?
- A. CAPTCHA challenge
- B. Device fingerprint challenge
- C. JavaScript challenge
- D. Human interaction challenge
Answer: A
Explanation:
Explanation
CAPTCHA challenge is generally the first level of bot mitigation, but it is not sufficient with more advanced bot tools
NEW QUESTION # 50
you want to create a stateless rule forSSH in security list and the ingress role has already been properly configured what combination should you use on the engress role what commination should you use on the egress rule?
- A. select tcp for protocol: enter 22 for source port" and all for destinationport
- B. select udp for protocol: enter 22 for source port" and all for destination port
- C. select tcp for protocol: enter 22 for source port" and 22 for destination port
- D. select tcp for protocol: enter all for source port" and 22 for destination port.
Answer: D
Explanation:
Explanation
For SSH traffic, which uses TCP protocol and port 22, you would want to allow all source ports to connect to your destination port 22. This is because the source port for an SSH client can be any available port number.
NEW QUESTION # 51
A company has OCI tenancy which has mount target associated with two File Systems, CG_1 and CG_2.
These FileSystems are accessed by IP-based clients AB_1 and AB_2 respectively. As a security administrator, how can you provide access to both clients such that CGI has Read only access on AB1 and CG_2 has Read/Write access on AB_2?
- A. NFS v3 Unix Security
- B. Vault
- C. NFS Export Option
- D. Access Control Lists
Answer: A,C
Explanation:
Explanation
Graphical user interface, text, application, email Description automatically generated
NEW QUESTION # 52
Which challenge is generally the first level of bot mitigation, but not sufficient with more advanced bot tools?
- A. CAPTCHA challenge
- B. Device fingerprint challenge
- C. JavaScript challenge
- D. Human interaction challenge
Answer: A
Explanation:
CAPTCHA challenge is generally the first level of bot mitigation, but it is not sufficient with more advanced bot tools
NEW QUESTION # 53
Which type of FastConnect supports configuring Oracle Cloud Infrastructure (OCI) Site-to-Site VPN for encryption? (Choose the best Answer.)
- A. FastConnect Cross-Connect group
- B. FastConnect Privat Peering
- C. FastConnect Partner
- D. FastConnect Public Peering
Answer: D
NEW QUESTION # 54
Which two reasons would a crytpo admin have to select the Virtual Private Vault option when creating an Oracle Cloud Infrastructure Vault? (Choose two.)
- A. ability to export keys from the vault
- B. to scale to over 10,000 keys
- C. banking requirements, including chip card reloading and PIN Processing
- D. ability to back up and restore the Vault for redundancy.
- E. more isolation for encryption keys with a dedicated HSM partition
Answer: D,E
NEW QUESTION # 55
Which cache rules criterion matches if the concatenation of the requested URL path and query are identical to the contents of the value field?
- A. URL_PART_ENDS_WITH
- B. URL_STARTS_WITH
- C. URL_PART_CONTAINS
- D. URL_IS
Answer: D
Explanation:
Explanation
URL_IS: Matches if the concatenation of request URL path and query is identical to the contents of the value field. URL must start with a /.
https://docs.oracle.com/en-us/iaas/tools/terraform-provider-oci/4.57.0/docs/d/waas_waas_policy.html
NEW QUESTION # 56
You have configured Management Agent on an Oracle Cloud Infrastructure (OCI) Linux instance for log Ingestion purposes. OR When using Management Agent to collect logs continuously. Which is required configuration for OCI Logging Analytics service to collect data from multiple logs of this Instance? (Choose the best Answer.)
- A. Log-Log Group Association
- B. Entity Log Association
- C. Source-Entity Association
- D. Log Group-Source Association
Answer: C
NEW QUESTION # 57
You have subscribed to a tenancy, in which you want to isolate the OCI resources from different users logically for governance. Which OCI resource will help you achieve logical separation? (Choose the best Answer.)
- A. Availability Domain
- B. Dynamic Group
- C. Compartment
- D. Fault Domain
Answer: C
NEW QUESTION # 58
what is the use case for Oracle cloudinfrastructure logging analytics service?
- A. labels data packets that pass through the internet gateway
- B. automatically create instances to collect logs analysis and send reports
- C. automatically and manage any log based on a subscription model
- D. monitors, aggregates, indexes and analyzes all log data from on-premises.
Answer: D
Explanation:
Oracle Cloud Infrastructure Logging Analytics is a machine learning-based cloud service that monitors, aggregates, indexes, and analyzes all log data from on-premises and multicloud environments. Enabling users to search, explore, and correlate this data to troubleshoot and resolve problems faster and derive insights to make better operational decisions.
https://www.oracle.com/manageability/logging-analytics/
NEW QUESTION # 59
Which is NOT a compliance document?
- A. Bridge letter
- B. Penetration test report
- C. Attestation
- D. Certificate
Answer: B
Explanation:
Explanation
Types of Compliance Documents
When viewing compliance documents, you can filter onthe following types:
Attestation. A Payment Card Industry (PCI) Data Security Standard (DSS) Attestation of Compliance document.
Audit. A general audit report.
Bridge Letter (BridgeLetter). A bridge letter. Bridge letters provide compliance information forthe period of time between the end date of an SOC report and the date of the release of a new SOC report.
Certificate. A document indicating certification by a particular authority, with regard to certification requirements and examination results conforming to said requirements.
SOC3. A Service Organization Controls 3 audit report that provides information relating to a service organization's internal controls for security, availability, confidentiality, and privacy.
Other. A compliance document that doesn't fit into any of the preceding, more specific categories.
https://docs.oracle.com/en-us/iaas/Content/ComplianceDocuments/Concepts/compliancedocsoverview.htm
NEW QUESTION # 60
When creating an OCI Vault, which factors may lead to select the Virtual Private Vault? Select TWO correct answers
- A. Need for more than 9211 key versions
- B. Ability to back up the vault
- C. To mask Pll data for non-production environment
- D. Greater degree of isolation
Answer: B,D
Explanation:
Explanation
Graphical user interface, text, application Description automatically generated
NEW QUESTION # 61
Challenge 3 - Task 1 of 4
Set Up a Bastion Host to Access the Compute Instance in a Private Subnet Scenario A compute instance is provisioned in a private subnet that is not accessible through the Internet. To access the compute instance resource in a private subnet, you must provide a time-bound SSH session without deploying and maintaining a public subnet and a jump server, which eliminates the hassle and potential attack surface from remote access.
To complete this deployment, you have to perform the following tasks in the environment provisioned for you:
* Configure a Virtual Cloud Network (VCN) and a Private Subnet.
* Provision a Compute Instance in the private subnet and enable Bastion Plugin.
* Create a Bastion and Bastion session.
* Connect to a compute instance using Managed SSH session.
Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99233424-C01 and Region us-ashburn-1 Complete the following tasks in the provisioned OCI environment:
Create a Virtual Cloud Network (VCN) with the name PBT-BAS-VCN-01
Create a Private Subnet with the name PBT-BAS-SNET-01
Create a Service Gateway with the name PBT-BAS-SG-01, using the service "All IAD Services in Oracle Services Network" Add Route Rules for Service Gateway
Answer:
Explanation:
See the solution below in Explanation
Explanation:
Solutions:
Sign in to your OCI free tier account.
Select Networking from the navigation menu and click Virtual Cloud Networks (VCNs).
Select your working compartment under List Scope from the drop-down menu in the left navigation pane.
Click Create VCN.
In the Create a Virtual Cloud Network dialogue box, enter the following details:
a. Name: PBT-BAS-VCN-01
b. IPV4CIDR Blocks: 10.0.0.0/16 c. Note: Leave all the other options in their default setting.
d. Click Create VCN. You can now see that the VCN has been created successfully.
Click Create Subnet.
In the Create Subnet dialogue box, enter the following details:
a. Name: PBT-BAS-SNET-01
b. Subnet Type: Regional
c. IPV4CIDR Blocks: 10.01.0/24 d. Subnet Access: Private Subnet
e. Note: Leave all the other options in their default setting.
f. Click Create Subnet. You can see that the subnet has been created successfully.
Under Resources, click Service Gateways in the left navigation pane.
Click Create Service Gateway and enter the following details:
a. Name: PBT-BAS-SG-01
b. Services: All <region> Services in Oracle Services Network.
c. Click Create Service Gateway. You can see that the service gateway has been created successfully.
d. Click Close.
Under Resources, click Route Tables in the left navigation pane.
Click the Default Route Table from the list.
Click Add Route Rules and enter the following values:
a. Target Type: Service Gateway
b. Destination Service: All <region> Services in Oracle Services Network.
c. Target Service Gateway: PBT-BAS-SG-01
d. Description: Description for Service gateway route rule e. Click Add Route Rules
NEW QUESTION # 62
Which storage type is most effective when you want to move some unstructured data, consisting of images and videos, to cloud storage?
- A. File storage
- B. Standard storage
- C. Block volume
- D. Archivestorage
Answer: B
Explanation:
Use Oracle Cloud Infrastructure Object Storage for data to which you need fast, immediate, and frequent access. Data accessibility and performance justifies a higher price point to store data in the Object Storage tier.
The Object Storage service can store an unlimited amount of unstructured data of any content type, including analytic data and rich content, like images and videos.
https://docs.oracle.com/en/solutions/learn-migrate-app-data-to-cloud/considerations-object-storage.html#GUID-AC192B08-5160-4DA7-B43E-001753D99CF1
NEW QUESTION # 63
A http web server hosted on an Oracle cloud infrastructure compute instance in a public subnet of the vcsl virtual cloudnetwork has a stateless security ingress rule for port 80 access through internet gateway stateful network security group notification for port 80 how will the Oci vcn handle request response traffic to the compute instance for a web page from the http server with port 80?
- A. network security group would supersede the security utility list and allow both inbound and outbound traffic
- B. due to the conflict in security configuration inbound request traffic would not be allowed
- C. the union of both configuration would happen and allow both inbound and outbound traffic
- D. Because there is no Egress ruled defined in Security List, The Response would not pass through Internet Gateway.
Answer: C
Explanation:
In OCI, if there's a stateless rule in the security list and a stateful rule in the network security group, both rules are evaluated. The union of both configurations would happen, allowing both inbound and outbound traffic. This means that if an incoming packet is allowed by either the security lists or the network security groups, then it's allowed into the instance. Similarly, if an outgoing packet is allowed by either, then it's allowed out of the instance
NEW QUESTION # 64
As a solutions architect, you need to assist operations team to write an I AM policy to give users in group-uat1 and group- uat2 access to manage all resources in the compartment Uat. Which is the CORRECT IAM policy
?
- A. Allow group /group-uat*/ to manage all resources in compartment Uat
- B. Allow group group-uat1 group-uat2 tomanage all resources in compartment Uat
- C. Allow any-user to manage all resources in tenancy where target.compartment= Uat
- D. Allow any-user to manage all resources in compartment Uat where request.group=/group-uat/*
Answer: A
Explanation:
Explanation
This policy allows users in groups whose names start with "group-uat" to manage all resources in the compartment named "Uat"12.
NEW QUESTION # 65
......
Get Top-Rated Oracle 1z0-1104-23 Exam Dumps Now: https://validdumps.free4torrent.com/1z0-1104-23-valid-dumps-torrent.html