1z0-1104-23 Exam Dumps - Oracle Cloud Infrastructure 2023 Security Professional

Go to page:

Question # 33

Challenge 1 - Task 5 of 5

Authorize OCI Resources to Retrieve the Secret from the Vault

Scenario

You are working on a Python program running on a compute instance that needs to access an external service. To access the external service, the program needs credentials (password). Given that it is not a best security practice, you decide not to hard code the credential in the program. Instead, you store the password (secret) in a vault using the OCI Vault service. The requirement now is to authorize the compute instance so that the Python program can retrieve the password (secret) by making an API call to the OCI Vault.

Preconfigured

To complete this requirement, you are provided with:

An OCI Vault to store the secret required by the program, which is created in the root compartment as PBT_Vault_SP.
An instance principal IAM service, which enables instances to be authorized actors (principals) that can retrieve the secret from the OCI Vault.
A dynamic group named PBT_Dynamic_Group_SP with permissions to access the OCI Vault. This dynamic group includes all of the instances in your compartment.
Access to Cloud Shell.
Permissions to perform only the tasks within the challenge.

Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99234021-C01 and Region us-ashburn-1.

Full Access

Question # 34

Challenge 4 - Task 2 of 6

Configure Web Application Firewall to Protect Web Server Against XSS Attack

Scenario

You have to protect web applications hosted on OCI from cross-site scripting (XSS) attacks. You can use the OCI Web Application Firewall (WAF) capabilities to create rules that compare against incoming requests to determine if the request contains an XSS attack payload. If a request is determined to be an attack, WAF should return the HTTP Service Unavailable (503) error.

To ensure that the configured WAF blocks the XSS attack, run the following script:Â [http:// /index.html?

/index.html?

)

To complete this deployment, you have to perform the following tasks in the environment provisioned for you:

Configure a Virtual Cloud Network (VCN)
Create a Compute Instance and install the Web Server
Create a Load Balancer and update Security List
Create a WAF policy
Configure Protection Rules against XSS attacks
Verify the created environment against XSS attacks

Note:Â You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99233424-C01 and Region us-ashburn-1.

Complete the following task in the provisioned OCI environment:

Create a Compute Instance with the nameÂ IAD-SP-PBT-VM-01, using theÂ Oracle Linux 8Â image andÂ VM.Standard2.1Â shape.
SSH to the compute instance using Cloud Shell.
Install and configure Apache web server:a. Install Apache server:

sudo yum -y install httpd

b. Enable Apache and start Apache server:

bash

sudo systemctl enable httpd
sudo systemctl restart httpd

c. Create a firewall rule to enable HTTP connection through port 80 and reload the firewall:

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

d. Create an index file for your web server:

vbnet

sudo bash -c 'echo You are visiting Web Server 1 >>
/var/www/html/index.html'

Full Access

Answer:

Explanation:

SOLUTION:

From the navigation menu, select Compute and then click Instances.
In the left navigation pane, under List Scope, select from the drop-down menu.
Click Create Instance. In the Create Instance dialogue box, provide the following details:a) Name: IAD-SP-PBT-VM-01b) Placement: ADIc) Note: If the Service Limit error is displayed, choose a different availability domain.d) Image: Oracle Linux 8e) Shape: Click Change shape; then select Ampere shape series and select VM.Standard2.1.f) Networking: IAD-WAF-PBT-VCN-01 and Public Subnetg) Public Address: Assign a Public IPv4 address.h) Generate (or upload) SSH Keys:i) Click Generate a key pair for me.j) Click Save private key. This will save the private key to your local workstation.k) Click Save public key. This will save the public key to your local workstation.l) Click Create.Note: After a few minutes, you can see that the instance has been successfully created and the state is Running.
Under instance access, copy the Public IP address value to a Notepad file. We refer to it as the VM-O1-Public IP address.
Click the Developer Tools icon at the right of the OCI console header and click Cloud Shell to launch your Cloud Shell and use SSH to log in to your instance, IAD-SP-PBT-VM-01, by using the following command:

Reminders: a) Upload the private key to the Cloud Shell you downloaded to your workstation earlier. Change the permission of the private key file by executingÂ chmod 400 . Reference to upload file to cloud shell b)Â Â is the full path and name of the file that contains the private key associated with the instance you want to access. c)Â Â is the default user opc. d)Â Â is the Public IP address of the instance. In our case, we refer to it as VM-01-Public IP. Note: Enter yes in response to â€œAre you sure you want to continue connecting (yes/no)?" e) You are now connected to the instance IAD-SP-PBT-VM-01.

While connected to your compute instance via SSH, run the following commands to install and configure the Apache web server: a) Install Apache Server:

sudo yum -y install httpd.

b) Enable Apache and start Apache server:

bash

sudo systemctl enable httpd.sudo systemctl restart httpd

c) Create a firewall rule to enable HTTP connection through port 80 and reload the firewall:

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

d) Create an index file for your web server:

sudo bash -c 'echo You are visiting Web Server 1 >> /var/www/html/index.html'

e) Exit the SSH connection:

bash

After executing all the commands successfully, open a browser in your local system and enter the URL http://.Note: Your browser will not return anything because port 80 is not opened yet for the instance subnet.

Question # 35

Challenge 4 - Task 3 of 6

Configure Web Application Firewall to Protect Web Server Against XSS Attack

Scenario

To ensure that the configured WAF blocks the XSS attack, run the following script:Â [http:// /index.html?

/index.html?

)

To complete this deployment, you have to perform the following tasks in the environment provisioned for you:

Configure a Virtual Cloud Network (VCN)
Create a Compute Instance and install the Web Server
Create a Load Balancer and update Security List
Create a WAF policy
Configure Protection Rules against XSS attacks
Verify the created environment against XSS attacks

Complete the following task in the provisioned OCI environment:

Go to the VCN IAD-WAF-PBT-VCN-01.
Create a Security List with the name IAD-SP-PBT-LB-SL-01.
Create a Public subnet named LB-Subnet-IAD-SP-PBT-SNET-02 and attach the above-created security list.
Create a Load Balancer with the name IAD-SP-PBT-LB-01.
Create a Listener Name with the name IAD_SP_PBT_LB_LISN_01.
Add appropriate Ingress and Egress rules to IAD-SP-PBT-LB-SL-01, to allow http traffic to the Load Balancer subnet.

Full Access

Question # 36

Challenge 1 - Task 3 of 5

Authorize OCI Resources to Retrieve the Secret from the Vault

Scenario

Preconfigured

To complete this requirement, you are provided with:

An OCI Vault to store the secret required by the program, which is created in the root compartment as PBT_Vault_SP.
An instance principal IAM service, which enables instances to be authorized actors (principals) that can retrieve the secret from the OCI Vault.
A dynamic group named PBT_Dynamic_Group_SP with permissions to access the OCI Vault. This dynamic group includes all of the instances in your compartment.
Access to Cloud Shell.
Permissions to perform only the tasks within the challenge.

Complete the following task in the OCI environment provisioned:

Create a new VCNÂ with the nameÂ PBT_SECRET_VCN01Â andÂ public subnetÂ within your assigned compartment.

Full Access

Question # 37

Challenge 3 - Task 2 of 4

Set Up a Bastion Host to Access the Compute Instance in a Private Subnet Scenario

A compute instance is provisioned in a private subnet that is not accessible through the Internet. To access the compute instance resource in a private subnet, you must provide a time-bound SSH session without deploying and maintaining a public subnet and a jump server, which eliminates the hassle and potential attack surface from remote access.

To complete this deployment, you have to perform the following tasks in the environment provisioned for you:

â€¢ Configure a Virtual Cloud Network (VCN) and a Private Subnet.

â€¢ Provision a Compute Instance in the private subnet and enable Bastion Plugin.

â€¢ Create a Bastion and Bastion session.

â€¢ Connect to a compute instance using Managed SSH session.

Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99233424-C01 and Region us-ashburn-1

Complete the following tasks in the provisioned OCI environment:

Create a Compute Instance with the name PBT-BAS-VM-01, using the "Oracle Linux 8" image and shape "VM.Standard2.1", without SSH key and enable Bastion plugin.

Full Access

Question # 38

Challenge 1 - Task 4 of 5

Authorize OCI Resources to Retrieve the Secret from the Vault

Scenario

Preconfigured

To complete this requirement, you are provided with:

An OCI Vault to store the secret required by the program, which is created in the root compartment as PBT_Vault_SP.
An instance principal IAM service, which enables instances to be authorized actors (principals) that can retrieve the secret from the OCI Vault.
A dynamic group named PBT_Dynamic_Group_SP with permissions to access the OCI Vault. This dynamic group includes all of the instances in your compartment.
Access to Cloud Shell.
Permissions to perform only the tasks within the challenge.

Complete the following tasks in the OCI environment provisioned:

Create a Linux Instance with the nameÂ [Provide Name Here]Â within the compartment.

Provide your own public key to SSH the instance.

Full Access

Question # 39

Challenge 4 - Task 6 of 6

Configure Web Application Firewall to Protect Web Server Against XSS Attack

Scenario

To ensure that the configured WAF blocks the XSS attack, run the following script:Â [http:// /index.html?

/index.html?

)

To complete this deployment, you have to perform the following tasks in the environment provisioned for you:

Configure a Virtual Cloud Network (VCN)
Create a Compute Instance and install the Web Server
Create a Load Balancer and update Security List
Create a WAF policy
Configure Protection Rules against XSS attacks
Verify the created environment against XSS attacks

Complete the following task in the provisioned OCI environment:

You will connect to the web server and append an XSS script. The protection rule will evaluate the requests and respond accordingly.

Full Access

Question # 40

Challenge 3 - Task 1 of 4

Set Up a Bastion Host to Access the Compute Instance in a Private Subnet Scenario

To complete this deployment, you have to perform the following tasks in the environment provisioned for you:

â€¢ Configure a Virtual Cloud Network (VCN) and a Private Subnet.

â€¢ Provision a Compute Instance in the private subnet and enable Bastion Plugin.

â€¢ Create a Bastion and Bastion session.

â€¢ Connect to a compute instance using Managed SSH session.

Note: You are provided with access to an OCI Tenancy, an assigned compartment, and OCI credentials. Throughout your exam, ensure to use the assigned Compartment 99233424-C01 and Region us-ashburn-1

Complete the following tasks in the provisioned OCI environment:

Create a Virtual Cloud Network (VCN) with the name PBT-BAS-VCN-01
Create a Private Subnet with the name PBT-BAS-SNET-01
Create a Service Gateway with the name PBT-BAS-SG-01, using the service "All IAD Services in Oracle Services Network"
Add Route Rules for Service Gateway