1Z0-1067-25 practice question 14 of 15

You set up a bastion host in your VCN to only allow your IP address (140.19.2.140) to establish SSH connections to your Compute Instances that are…

You set up a bastion host in your VCN to only allow your IP address (140.19.2.140) to establish SSH connections to your Compute Instances that are deployed in a private subnet. The Compute Instances have an attached Network Security Group with a Source Type: Network Security Group (NSG), Source NSG: NSG-050504. To secure the bastion host, you added the following ingress rules to its Network Security Group: However, after checking the bastion host logs, you discovered that there are IP addresses other than your own that can access your bastion host. What is the root cause of this issue? (Choose the best)

Answer options

A. The port 22 provides unrestricted access to 140.19.2.140 and to other IP address.

B. A netmask of /32 allows all IP address in the 140.19.2.0 network, other than your IP 140.19.2.140

C. All compute instances associated with NSG-050504 are also able to connect to the bastion host.

Correct answer

D. The Security List allows access to all IP address which overrides the Network Security Group ingress rules.

Correct Answer:

C. C. All compute instances associated with NSG-050504 are also able to connect to the bastion host.

Explanation

The root cause is the NSG rule that allows Source Type: Network Security Group with Source NSG: NSG-050504. This rule permits any compute instance associated with NSG-050504 to connect to the bastion host, regardless of their IP addresses. While the administrator's specific IP (140.19.2.140) may also be allowed through another rule, this NSG-to-NSG rule creates an additional access path that explains the unauthorized connections observed in the logs.

Why Incorrect

A. NSG rules with specific sources do provide restricted access, not unrestricted.
B. A /32 netmask represents only a single IP address, not a network range.
D. Security Lists and NSGs work together; neither overrides the other in OCI.

References

1. Oracle Cloud Infrastructure Documentation, "Network Security Groups" - Details NSG-to-NSG communication rules and source types

2. Oracle Cloud Infrastructure Security Best Practices, "Bastion Host Configuration" - Covers proper isolation of bastion hosts

3. Oracle Cloud Infrastructure Networking Overview, "Security Rules Evaluation" - Explains how Security Lists and NSGs work together

Keep practicing

Take the free 1Z0-1067-25 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test