Oracle 1Z0-1104-25 OCI Security Professional Guide

What Does the Oracle 1Z0-1104-25 Exam Cover?

Oracle 1Z0-1104-25, the Oracle Cloud Infrastructure 2025 Security Professional exam, is a 55-question, 90-minute multiple-choice assessment requiring 68 percent to pass, priced at $245 USD. It covers six domains: OCI security introduction, identity and access management, network and application protection, OS and workload protection, data protection, and detection with monitoring.

Pacing and question style

Roughly 98 seconds per question is comfortable, which suits an exam whose questions frequently describe a requirement and ask which service or configuration satisfies it. The absence of published weightings means you should assume the six domains are broadly comparable and audit your coverage across all of them.

• OCI Security Introduction – shared responsibility, core security services
• Identity and Access Management – users, groups, policies, dynamic groups, MFA
• Network and Application Protection – security lists, NSGs, load balancers, WAF, certificates
• OS and Workload Protection – Bastion, vulnerability scanning, OS Management
• Protecting Data – Vault, Key Management, secrets, Data Safe
• Detecting and Monitoring – Cloud Guard, Security Zones, threat intelligence, logging

Why the 2025 version matters

The version suffix matters. This is the 2025 refresh, and OCI’s security service set has expanded meaningfully across recent versions – material written for older exam versions will under-cover Cloud Guard and Security Zones in particular. Current paths are listed on Oracle’s certification portal.

Where Does Oracle’s Responsibility End and Yours Begin?

The shared responsibility model divides security between Oracle, which secures the cloud infrastructure itself, and the customer, who secures what they deploy on it. The exam tests the boundary with specific scenarios rather than the general principle.

What Oracle secures

Oracle is responsible for physical security, the hypervisor, and the underlying network fabric. Customers are responsible for identity configuration, network topology, operating system patching, application security, and data classification and encryption choices. The examinable cases are the ones near the line.

Patching, split by layer

The clearest example is patching. Oracle patches the infrastructure beneath your compute instance, but the operating system running inside it is yours – which is why OS Management exists as a customer-facing service. Candidates who assume the platform handles everything get these questions wrong.

Encryption responsibilities

Encryption follows a similar split. Oracle provides encryption at rest by default for block volumes and object storage using Oracle-managed keys. Choosing customer-managed keys, controlling their rotation, and deciding what additional protection sensitive data requires are all customer decisions – and the exam consistently frames key control as the customer’s choice to make. The OCI security overview sets out the model formally.

How Do OCI IAM Policies Actually Work?

OCI IAM policies are written as human-readable statements granting a group permission to act on a resource type within a compartment. Policy syntax and compartment scoping are the most heavily examined mechanics in the whole exam, and OCI’s model differs enough from other clouds to require deliberate study.

Policy statement structure

The statement structure is fixed: allow a subject to perform a verb on a resource type in a location, optionally with conditions. The four verbs escalate in scope – inspect permits listing, read adds retrieving metadata and content, use adds working with existing resources, and manage adds creating and deleting. Choosing the least permissive verb that satisfies a requirement is the recurring correct answer.

Compartments

Compartments are OCI’s distinctive organising construct and the concept candidates most often underestimate. They are logical containers for resources, and policies are attached at a compartment or tenancy level. Two behaviours matter: policies attached to a parent compartment apply to its children, and a policy attached to the tenancy applies everywhere.

Compartment inheritance

That inheritance is what makes compartment design a security decision rather than an organisational one. A policy written broadly at the tenancy level to solve one team’s problem grants that access across the entire estate, and the exam presents exactly this scenario.

Deny by default

Understand also that OCI IAM denies by default – permissions exist only where a policy grants them, and there is no explicit deny statement. Restricting access means writing narrower grants rather than adding denials, which surprises engineers arriving from other platforms. Details are in the OCI IAM documentation.

What Problem Do Dynamic Groups Solve?

Dynamic groups let policies grant permissions to compute instances and other resources rather than to human users. They exist so a workload can call OCI services without embedding credentials, and they are named explicitly in the syllabus.

The problem they solve

The problem is familiar: an application on a compute instance needs to read from object storage. The naive solution stores an API key on the instance, which means a credential now exists on a server, in a configuration file, probably in version control eventually, and never rotates.

Matching rules

Dynamic groups solve it through matching rules. A rule defines membership by resource attributes – instances in a particular compartment, or carrying a particular tag – and policies then grant permissions to that dynamic group. An instance matching the rule receives the permissions automatically, with no stored credential anywhere.

Writing matching rules

The examinable detail is the matching rule itself. Rules can match on compartment, instance OCID, or tags, and a rule that is too broad grants workload permissions to instances that should not have them. Tag-based matching is generally the most maintainable because it survives infrastructure changes that compartment-based rules do not.

Instance principals

Instance principals are the related term worth knowing: the mechanism by which an instance authenticates as itself. When a scenario describes an application needing OCI access without stored credentials, dynamic groups and instance principals together are the answer.

How Is Network and Application Traffic Protected?

Network protection covers security lists, network security groups, load balancers, certificates, and the web application firewall. The distinction between the two firewall constructs is the most reliably examined topic in the domain.

Security lists

Security lists apply to entire subnets – every resource in the subnet inherits the rules. Network security groups apply to individual virtual network interfaces, so resources within the same subnet can carry different rules. The examinable consequence is that NSGs allow granular segmentation without splitting workloads across subnets purely for security reasons.

Network security groups

NSGs have a second property worth knowing: they can reference other NSGs as source or destination. That allows rules expressed as “the application tier may reach the database tier” rather than by IP range, which survives address changes and expresses intent far more clearly.

Stateful versus stateless rules

Both constructs support stateful and stateless rules. Stateful rules automatically permit return traffic; stateless rules require an explicit rule in each direction. Questions describing traffic that reaches its destination but whose responses never return usually point at a stateless rule missing its counterpart.

The web application firewall

The web application firewall protects at the application layer, inspecting HTTP for injection, cross-site scripting, and similar attacks that network rules cannot see. The layering principle the exam wants is that network controls decide who may connect while WAF inspects what they send once connected – neither substitutes for the other.

What Does OS and Workload Protection Involve?

OS and workload protection covers Bastion service access, vulnerability scanning, and OS Management. It addresses securing the compute layer, which sits squarely on the customer side of the responsibility model.

The Bastion service

The Bastion service is the access topic and the one with the clearest security argument. It provides time-limited, audited sessions to instances in private subnets without exposing SSH to the internet and without maintaining a permanently running jump host. Sessions have a defined lifetime and expire automatically.

Bastion versus a public jump host

The exam contrasts this with the traditional alternative: an instance in a public subnet with SSH open, which must be patched, monitored, and hardened, and which remains reachable whether or not anyone needs it. Whenever a scenario describes needing occasional administrative access to private instances, Bastion is the intended answer.

Vulnerability scanning

Vulnerability scanning assesses instances for known CVEs and configuration weaknesses on a recurring schedule. The point the exam draws out is that scanning is detective rather than preventive – it tells you what is wrong, and remediation remains a separate action.

OS Management

OS Management handles patching and package management across instances centrally, which is the remediation half. Together the two close the loop: scanning identifies the exposure, OS Management resolves it, and the recurring schedule confirms the resolution held.

How Are Keys, Secrets, and Databases Protected?

Data protection covers the Vault service for key management, secrets management, and Data Safe for database security. Understanding what each protects – and the difference between a key and a secret – is the domain’s core.

What Vault does

Vault performs two distinct jobs that candidates frequently conflate. Key management stores and controls encryption keys used to protect resources such as block volumes and object storage buckets. Secrets management stores credentials, passwords, and tokens that applications retrieve at runtime rather than embedding in configuration.

Keys versus secrets

The distinction the exam tests: a key encrypts data, while a secret is data that happens to be sensitive. A database password belongs in secrets management; the key encrypting the database’s storage belongs in key management.

Customer- versus Oracle-managed keys

Customer-managed versus Oracle-managed keys is the other examinable decision. Oracle-managed keys require no configuration and no operational burden. Customer-managed keys give control over rotation and the ability to revoke access to encrypted data by disabling the key – which is frequently a regulatory requirement rather than a preference. Understand that this control carries responsibility: losing a customer-managed key means losing the data it protects.

Data Safe

Data Safe is the database-specific service, providing security assessment, user assessment, data discovery, masking, and activity auditing. Masking deserves particular attention because it addresses the recurring problem of production data being copied into non-production environments – masked copies preserve realistic structure without exposing real values.

Which Detection and Monitoring Services Are Tested?

The final domain covers Cloud Guard, Security Zones, threat intelligence, monitoring, logging, and alerting. Cloud Guard and Security Zones are the two services to know precisely, because they solve related problems in opposite ways.

Cloud Guard (detective)

Cloud Guard is detective. It monitors the tenancy for misconfigurations and suspicious activity using detector recipes, generates problems when it finds them, and can apply responder recipes to remediate automatically. It tells you something is wrong after it happened.

Security Zones (preventive)

Security Zones are preventive. A compartment designated as a security zone enforces policies at creation time – a bucket that would be public simply cannot be created there. The examinable contrast is exactly this: Cloud Guard detects the public bucket, Security Zones prevent it existing.

Detective versus preventive

That contrast answers a category of scenario question. If the requirement is to know about misconfigurations across an existing estate, Cloud Guard applies. If the requirement is that certain configurations must never occur in a sensitive environment, Security Zones apply. The Cloud Guard documentation details the detector and responder model.

Logging and audit

Logging underpins both. Audit logs record every API call against the tenancy and are the primary forensic source, while service logs and custom logs cover resource-specific and application activity. The examinable point is that audit logging is automatic and tenancy-wide, whereas service logging must be deliberately enabled – so a scenario describing missing service logs usually traces back to configuration that was never done.

Who Should Pursue the OCI Security Professional Credential?

1Z0-1104-25 suits cloud security engineers working with Oracle Cloud, OCI architects with security responsibility, and consultants securing OCI deployments. It is a professional-level credential assuming working OCI familiarity rather than teaching cloud fundamentals.

Where the value lies

Its value follows Oracle’s enterprise footprint. OCI adoption is concentrated in organisations already running Oracle databases and applications – often in finance, healthcare, and government, where security and compliance requirements are heaviest and specialist skills command a premium.

For engineers from other clouds

For engineers with security experience on other clouds, most concepts transfer but the implementations genuinely differ. Compartments have no exact equivalent elsewhere, OCI’s policy syntax is distinctive, and the absence of explicit deny statements changes how you approach restriction. Assuming equivalence with another provider’s model is the most common preparation mistake.

Where it fits in Oracle’s tracks

Within Oracle’s certification structure this sits at professional level alongside the architect and developer tracks. Practitioners frequently hold an adjacent OCI credential first – those who have worked through the OCI developer professional path will already have the compartment and IAM grounding this exam builds on, while broader Oracle practitioners may come from tracks such as Java SE development.

How Should You Prepare for 1Z0-1104-25?

Six to eight weeks at six to eight hours per week suits engineers with OCI experience. Effective preparation runs in a real tenancy – Oracle’s free tier covers most of what you need – because the exam describes configurations and expects you to know how they behave.

1. Weeks one to two – IAM and compartments. The heaviest conceptual area. Build a compartment hierarchy, write policies with each of the four verbs, and deliberately write one too broadly at tenancy level to see how far it reaches.
2. Week three – dynamic groups. Configure an instance to call an OCI service with no stored credentials, using a dynamic group and instance principal. Vary the matching rule and observe which instances gain access.
3. Week four – network protection. Configure both security lists and NSGs on the same subnet so the granularity difference is concrete. Create a stateless rule and experience traffic that arrives but never returns.
4. Week five – workload and data. Use Bastion to reach a private instance, run a vulnerability scan, then create both a customer-managed key and a secret in Vault so the distinction sticks.
5. Weeks six to eight – detection and review. Enable Cloud Guard and trigger a problem deliberately, then create a Security Zone and attempt the same misconfiguration to see it refused. Finish with timed practice.

The one habit that pays off

The habit that matters most is choosing the least permissive option that satisfies the requirement. This exam consistently offers a working answer alongside a minimal one, and the minimal one is correct – in policy verbs, in NSG rules, in key access. Timed work through the 1Z0-1104-25 practice exam questions is the fastest way to confirm that instinct at the 68 percent standard.

Frequently Asked Questions

How many questions are on the 1Z0-1104-25 exam?

The exam contains 55 multiple-choice questions to be completed in 90 minutes, allowing roughly 98 seconds per question. The pace suits its scenario-based style.

What is the passing score for 1Z0-1104-25?

You need 68 percent, meaning approximately 38 of the 55 questions correct. There is no penalty for incorrect answers.

How much does the OCI Security Professional exam cost?

The exam fee is $245 USD, varying by region. Oracle periodically offers free certification periods and discounted vouchers through its learning subscriptions.

What are compartments in OCI?

Logical containers for resources that policies attach to. Policies on a parent compartment apply to its children, and a policy at tenancy level applies everywhere – which makes compartment design a security decision.

What are the four OCI policy verbs?

Inspect permits listing, read adds retrieving metadata and content, use adds working with existing resources, and manage adds creating and deleting. Choosing the least permissive verb that meets the requirement is usually correct.

What is the difference between security lists and network security groups?

Security lists apply to an entire subnet so all resources inherit the rules. NSGs apply to individual network interfaces, allowing different rules within the same subnet, and can reference other NSGs as source or destination.

What problem do dynamic groups solve?

They let policies grant permissions to compute instances rather than users, so a workload can call OCI services without any stored credential. Membership is defined by matching rules on compartment, OCID, or tags.

What is the difference between Cloud Guard and Security Zones?

Cloud Guard is detective – it finds misconfigurations after they occur and can remediate them. Security Zones are preventive – they refuse non-compliant resource creation in a designated compartment outright.

When should you use customer-managed keys?

When you need control over key rotation or the ability to revoke access to encrypted data by disabling the key, which is often a regulatory requirement. The trade-off is responsibility: losing the key means losing the data.

How long should I study for 1Z0-1104-25?

Six to eight weeks at six to eight hours per week suits engineers with OCI experience. Weight the time toward IAM policies and compartments, which underpin every other domain.

Conclusion

Oracle 1Z0-1104-25 is a configuration exam organised around the layers an attacker moves through – identity, network, workload, data, and detection. Because Oracle publishes no domain weightings, even coverage is the only defensible strategy, and a neglected domain is a real risk at 68 percent.

Two things carry disproportionate weight. IAM policies and compartment inheritance underpin every other domain, and a policy written too broadly at tenancy level is the most common security failure the exam describes. And the Cloud Guard versus Security Zones contrast – detective versus preventive – answers an entire category of scenario question on its own.

Prepare in a live tenancy and make the mistakes deliberately. Write the over-broad policy, create the stateless rule, attempt the misconfiguration inside a Security Zone. The exam describes those outcomes, and having produced them is the difference between recognising the answer and reasoning toward it with the clock running.