Oracle Cloud Infrastructure Security Professional (2025) — Lesson 2: Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns

Learning Objectives

• Break down the roles, prerequisites, records, and decision points involved in Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns.
• Complete a controlled activity for Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns and capture network security design and connectivity test.
• Challenge the result with a scenario involving an exposed service bypassing the approved inspection path, then justify the corrective action.

Detailed Topics

• Network security groups
• Security lists
• Firewalls
• Bastions
• Private access
• WAF
• And Zero Trust patterns
• Decision ownership, prerequisites, and acceptance evidence for Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns
• Relevant access, data, integration, performance, recovery, and support considerations

Instructor Demonstration

The instructor configures and tests Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns within a scenario aimed at a defense-in-depth OCI environment with governed identity, network, data, workload, monitoring, and incident-response controls. The walkthrough contrasts a valid setup with a flawed one and uses network security design and connectivity test to make the difference explicit.

Hands-On Exercise

Complete a guided task covering Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns. After establishing a working baseline, reproduce “an exposed service bypassing the approved inspection path,” isolate the responsible setting or data condition, apply a reversible fix, and update network security design and connectivity test with before-and-after proof.

1. Record the starting state, assumptions, identities, data, and expected outcome.
2. Execute the planned workflow and collect evidence at each material checkpoint.
3. Test one valid path, one boundary condition, and the stated failure scenario.
4. Document the correction, retest result, rollback option, and follow-up owner.

Scenario Analysis

• Clarify the business trigger, affected roles, required records, and acceptable result for Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns.
• Compare at least two implementation or correction choices and identify which evidence would distinguish them.
• Decide how network security design and connectivity test should be reviewed, approved, retained, and handed to the next owner.

Troubleshooting Guidance

Diagnose Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns by checking effective settings, ownership, source records, dependencies, and recent releases. Use network security design and connectivity test to locate the earliest divergence. Treat “an exposed service bypassing the approved inspection path” as a hypothesis until the same test passes after correction and still passes for a boundary case.

Validation Checklist

• Prerequisites and role permissions for Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns have been confirmed before execution.
• The result agrees with the expected values documented in network security design and connectivity test.
• Exceptions are explained with evidence rather than hidden by manual correction.
• The final record names the approver, monitoring point, and next improvement action.

Lesson Outcome

Learners can apply Network security groups, security lists, firewalls, bastions, private access, WAF, and Zero Trust patterns, explain the decisions made, and defend the result with network security design and connectivity test.