1z0-1104-25
Oracle Cloud Infrastructure 2026 Security Professional
1Z0-1104-25 Oracle Cloud Infrastructure 2025 Security Professional Exam Guide
The 1Z0-1104-25 exam validates the ability to use OCI core security services to build and maintain secure cloud environments for applications and resources. Oracle positions it for security professionals, solution architects, IT administrators, cloud engineers, and others responsible for protecting OCI environments. This guide helps you decide whether your current OCI foundation is strong enough to begin, which security areas need hands-on practice, how to sequence your study, and when to move from learning into exam scheduling.
What does 1Z0-1104-25 validate?
1Z0-1104-25 is Oracle’s Oracle Cloud Infrastructure 2025 Security Professional exam. Its purpose is broader than recalling product definitions: the associated certification and training focus on applying OCI security services to protect applications and resources and to maintain a secure cloud environment.
Oracle announced the OCI 2025 Security Professional certification and course on March 17, 2025. The 2025 course reflects newer security capabilities and operational concerns, including Zero Trust Packet Routing, OS Management Hub, IAM Optimization and Object IAM, and troubleshooting OCI security issues.
The practical implication for a candidate is straightforward: prepare for decisions about identity, network controls, workload protection, data protection, and security posture rather than studying each OCI service as an isolated glossary entry. Build a mental link between a security requirement, the relevant control, its configuration, and the evidence that the control is working.
Who is the exam intended for?
Oracle identifies security professionals, solution architects, IT administrators, cloud engineers, and others responsible for securing OCI environments as the intended audience. This makes the exam relevant to both practitioners who configure controls and architects or administrators who must select and govern them.
The learning path lists foundational OCI understanding plus basic cloud-computing and security knowledge as prerequisites. Treat those prerequisites as a readiness checkpoint, not as an instruction to skip fundamentals. If compartments, policies, virtual cloud networks, or core OCI resource relationships are unfamiliar, address those gaps before concentrating on advanced security services.
What should a successful candidate be able to do?
A useful preparation target is the ability to explain why a control belongs in a design, configure or inspect it in an appropriate context, and identify what could weaken the intended protection. For example, do not stop at knowing that a service exists; be able to distinguish an identity control from a network control and explain how the two work together.
The certification is most useful when approached as an applied OCI security credential. It can support professionals who design, operate, or review OCI environments, but it should not be treated as a substitute for role-specific experience with an organization’s risk, compliance, or incident-response procedures.
Which skill areas should organize your study?
Oracle states that the 2025 course is structured around five key domains. The available learning-path description identifies the study areas as IAM, network security, OS and workload protection, data protection, and maintaining security posture. Use those domains as your study map because they provide a better sequence than jumping randomly between service pages.
No domain percentages are supplied in the official research available for this guide, so there is no verified weighting to reproduce or use for time allocation. Give each domain deliberate attention, then spend extra time on the areas where practice work or self-testing exposes uncertainty.
Identity and access management
Start by making IAM precise. Review how identities, groups, policies, compartments, and resource access fit together, then connect that foundation to the 2025 emphasis on IAM Optimization and Object IAM. Your notes should answer who can perform an action, on which resource, under what scope, and how excessive access would be reduced.
A practical exercise is to write a least-privilege access design for a small application with separate administration, deployment, and runtime responsibilities. For every proposed permission, record the principal, verb, resource family, compartment scope, and operational reason. This exposes vague policy thinking much faster than memorizing policy syntax.
Network security
Network security preparation should connect traffic flow to enforcement points. Study how network segmentation, routing, security rules, and security services contribute to the protection of OCI resources. Include Zero Trust Packet Routing in your review because Oracle lists it among the 2025 course updates.
Draw a traffic path before opening the console: source, destination, route, permitted service or port, inspection or filtering point, and logging location. Then verify the design in a lab or structured walkthrough. This method helps prevent a common error—assuming that a security service protects traffic simply because it has been enabled somewhere in the tenancy.
Operating-system and workload protection
For OS and workload protection, focus on the controls that reduce exposure after compute resources are deployed. Oracle’s 2025 updates include OS Management Hub, so include operating-system administration and workload maintenance in your revision rather than treating security as only an IAM or network topic.
Use a simple workload review: identify the asset, its administrative path, its patching or maintenance mechanism, its exposed interfaces, and the evidence an administrator would inspect after a change. The aim is not to reproduce an organization’s runbook; it is to understand how security controls are applied and maintained around running workloads.
Data protection
Data protection study should follow the data lifecycle. Review how sensitive data is protected at rest and in transit, how secrets and certificates are handled, and how access to protected material is controlled. Keep the distinction between data, keys, secrets, and certificates clear because each can require different handling and permissions.
For each service or feature in your notes, write the threat it addresses, the object it protects, the identity that may use it, and the failure mode if it is misconfigured. This turns a list of names into a design reference and makes scenario questions easier to reason through.
Maintaining security posture
Security posture is the operational layer that ties the other domains together. Study how an administrator detects misconfiguration, reviews security findings, maintains controls, and troubleshoots OCI security issues. Oracle specifically lists troubleshooting OCI security issues among the 2025 course updates.
Practice investigating a deliberately incomplete design. Ask what should be checked first, which observation would confirm the suspected cause, and what corrective change would avoid creating a new exposure. A strong answer usually follows evidence from identity to network to workload or data rather than changing several controls at once.
What preparation resources should you use first?
Begin with Oracle’s official preparation path and exam page, then use hands-on work and the associated practice exam to test application. The learning path lists 22+ hours of expert training, 18 skill checks, and an Oracle University lab. Those resources are useful only when you actively explain and reproduce the security decisions, not when you passively play lessons.
The learning path is scheduled for archival on September 30, 2026, according to Oracle. Because training pages and exam versions can change, check the live Oracle pages before building a long study schedule or purchasing an attempt.
How to use the learning path
Use the learning path as the backbone of your study, but do not treat completion as proof of readiness. After each topic, write a short decision record: the security objective, the OCI service or control involved, the configuration dependency, and the symptom of a likely mistake.
The five domains give you a natural review cycle. Complete a first pass across all five, then return to weak areas with targeted labs and scenario explanations. This is more efficient than spending the entire preparation period on a familiar service while leaving an unfamiliar domain untouched.
How to use the preparation course
Oracle’s 59-minute preparation course includes HPE preparation, walkthroughs for Network Source, Network Firewall, OCI Certificates, Bastion, Vault Secret, WAF, and Custom Security Zone, plus sample questions. Use it as a focused orientation and checklist, not as the complete substitute for the learning path.
For every walkthrough, pause before the explanation and predict the next configuration step. Afterward, describe what would happen if the relevant policy, route, certificate, secret, or security-zone condition were wrong. That habit is particularly valuable for scenario-based reasoning.
How to use the practice exam
Oracle’s associated practice exam requires a score of 80% or higher to pass and includes three sample hands-on performance challenges: Security Zone, Certificates, and Network Firewall. Treat the result as a diagnostic signal, not a prediction of the certification outcome.
Review every missed or guessed response. Classify the cause as a terminology gap, a service-selection error, a permissions misunderstanding, a network-flow mistake, or a failure to read the requirement carefully. Then return to the relevant official lesson and perform a related configuration or explanation before attempting another assessment.
How should you build hands-on competence?
Hands-on work should test cause and effect: make a controlled change, observe the result, and explain why the result occurred. The official preparation material and practice resource reference Oracle University lab environments, but availability and scheduling information can vary, so confirm the current status in MyLearn before relying on a lab date.
Do not use training environments to collect screenshots without understanding them. Instead, keep a compact lab journal with four fields: objective, change made, evidence observed, and security trade-off. This gives you revision material tied to actual OCI behavior.
A useful lab sequence
Start with identity and compartment structure, because nearly every later security exercise depends on access. Continue with network segmentation and filtering, then move to certificates, secrets, bastion access, workload controls, and security-zone or posture scenarios. Finish by troubleshooting a design in which more than one control could be responsible.
The sequence is a practical recommendation, not an Oracle-mandated order. It reduces confusion by establishing authorization and resource scope before you investigate traffic, workload, or data-protection behavior. If your OCI fundamentals are already strong, shorten the first stage and spend the saved time on troubleshooting.
How to manage a scheduled lab
If Oracle assigns a lab environment, follow the current lab instructions rather than relying on copied credentials or old screenshots. The preparation material says to check back 12 hours before the lab starts for the username and password; another lab page says access details can be available at 9:00am local time on the scheduled day. Because the pages show different timing language, verify the instruction displayed for your specific reservation.
The lab material also describes testing and configuring the system through ouconnect.oracle.com, using the assigned environment from the training interface, and contacting Oracle support for lab issues. Do not post lab credentials in a community question. If the environment provides an extension control, use it before the displayed lab end time and confirm the current rules in the live lab page.
What if the lab is unavailable?
Do not postpone all preparation because a lab slot is unavailable. Build a paper design, use the official walkthroughs, explain expected traffic and authorization paths, and return to the lab when access is available. The practice page includes scheduling messages indicating that some weeks may be unavailable and that lab resources can be in use.
Record which actions you could not verify. This keeps an untested assumption visible rather than allowing it to become false confidence. When access returns, test those assumptions first instead of repeating familiar exercises.
What is a practical study roadmap?
A workable roadmap has four passes: establish prerequisites, learn each security domain, verify behavior through labs and practice, and perform an exam-readiness review. Set your own calendar around available study time and the current Oracle exam page; the supplied research does not establish a universal preparation duration.
The roadmap below is deliberately activity-based. Move forward when you can explain and apply a topic, not merely when a video or page has been marked complete.
Pass one: check the foundation
Confirm that you can navigate core OCI concepts, including compartments, policies, networking, compute resources, and basic cloud-security principles. Create a gap list before starting detailed security lessons. If you cannot explain the scope of a policy or trace a basic network path, repair that weakness first.
Your next action is to select one small OCI design and label its identities, resources, network boundaries, protected data, and operational responsibilities. This baseline gives every later security topic a concrete context.
Pass two: cover the five domains
Work through IAM, network security, OS and workload protection, data protection, and maintaining security posture. For each domain, produce a one-page summary that links objective, service, configuration dependency, evidence, and common failure. Avoid copying long definitions; your summary should help you make a choice under a scenario.
At the end of this pass, explain the same application design from each domain’s perspective. For example, identify its required permissions, traffic restrictions, workload maintenance needs, data protections, and posture checks. If one perspective is vague, mark it for hands-on review.
Pass three: verify with labs and assessment
Use the Oracle University lab or equivalent official exercises to reproduce representative configurations. Then take the associated practice exam under conditions that make the result meaningful. Review uncertain answers even when they are correct, because guessing can hide a fragile understanding.
Give priority to errors that cross domains. A network issue may actually be an identity permission problem; a certificate issue may involve secret access; a posture finding may reflect an operational gap. Cross-domain troubleshooting is a better final exercise than repeating isolated definitions.
Pass four: consolidate and schedule
Schedule only after you can explain the main controls without notes, complete the relevant practice activities, and identify a recovery method for your weakest domain. Before registering, confirm the current exam page, delivery type, eligibility or prerequisite information, price currency, and available appointment options.
The final review should be short and selective. Revisit your error log, service distinctions, policy scope, network paths, and troubleshooting sequence. Do not replace this review with leaked questions or exam dumps; unauthorized material cannot establish real skill and may violate certification rules.
Which preparation mistakes cause avoidable problems?
Most avoidable problems come from confusing recognition with application, ignoring the delivery requirements, or studying stale information. Correct those risks before adding more material. A candidate who can explain why a control is needed is in a stronger position than one who has memorized a long list of service names.
Use the following checks during the final stage.
Mistake: studying services in isolation
A service name is not a security design. Always connect it to a resource, identity, traffic path, data type, or operational finding. If your notes contain definitions but no examples of when a control should or should not be used, rewrite them as decisions.
Mistake: treating the practice score as the target
The official practice exam’s 80% threshold is a practice requirement, not a published certification passing score. Oracle says the passing score for each exam version is set independently. Use practice results to expose weaknesses and do not infer an exam score, question count, or guarantee from them.
Mistake: ignoring version changes
The 2025 material includes updates such as Zero Trust Packet Routing, OS Management Hub, IAM Optimization and Object IAM, and security troubleshooting. Check the current MyLearn exam page and Oracle learning content close to registration so that your notes match the exam version identified as 1Z0-1104-25.
Mistake: postponing equipment checks
For an Oracle University-delivered proctored exam, the official preparation page requires a supported operating system and browser, administrator rights, a reliable connection, a single display, at least 8 GB of RAM, a webcam and microphone, and an English QWERTY keyboard. Test these before exam day rather than discovering a restriction at check-in.
Mistake: using unsupported study aids in the exam
Oracle’s preparation instructions say pen and paper are not allowed during the exam, although a digital whiteboard is available in the exam delivery platform. Prepare to work within the permitted platform. Also remember that the Oracle University preparation details do not apply to exams scheduled and delivered by Pearson VUE, so follow the instructions for your registered delivery method.
What should you verify before scheduling?
Verify the exam identity, delivery provider, current price currency, appointment rules, identification requirements, and technical setup on Oracle’s live pages before paying or selecting a date. The supplied research identifies 1Z0-1104-25 as the OCI 2025 Security Professional exam, but operational details can depend on how and where the exam is delivered.
A scheduling decision is sound when your preparation evidence and your logistics are both ready: you know which weak areas remain, your identification matches the registration, and your equipment has passed the relevant readiness checks.
Price and currency
Oracle stated on August 6, 2025 that exam attempts for non-foundational core OCI certifications, including OCI Security Professional, cost US$245, while the learning path and practice tests were free. Treat that as a dated official statement, not a permanent quote. Oracle says currency conversions are reviewed and updated annually and that daily exchange-rate changes can make local prices differ.
Before purchase, check the current Oracle or test-vendor page for the currency accepted in your country. Oracle’s guidelines say candidates may purchase a voucher through Oracle University in the offered currency or purchase directly from the test vendor in the vendor’s offered currency when the accepted currencies differ.
Appointment changes
Oracle’s exam-preparation and certification pages state that cancellation and rescheduling must be completed at least 24 hours before the appointment time. Missing that window can put the exam attempt at risk, so do not book an appointment you cannot realistically protect.
Record the cancellation and rescheduling cutoff when you book. If circumstances change, act through the official scheduling system rather than assuming that an email or support request automatically changes the appointment.
Identification and check-in
For Oracle University-delivered exams, government-issued identification is required and the first and last name must exactly match the exam registration name. The official preparation page also requires a valid ID with a recent recognizable photo. Candidates checking in for a proctored exam are required to begin at least 30 minutes before the scheduled start time.
These are official requirements for the stated delivery context. If your confirmation identifies Pearson VUE instead, use Pearson VUE and Oracle instructions applicable to that appointment because the Oracle University exam-preparation details explicitly exclude Pearson VUE-delivered exams.
Technical readiness
The Oracle University preparation page specifies supported Windows and Mac operating systems and browsers, at least 3 mb/sec upload and download with a ping of less than 100 ms, no VPN or proxy connection, at least 8 GB of RAM, one display, a webcam minimum of 640x490 at 10 fps, and a working microphone. It also says mobile devices, Chromebooks, and Linux are not supported.
Run the official readiness check on the same computer, network, browser, camera, and microphone you intend to use. Keep the exam room and application setup consistent with the instructions, close other applications, and leave only the permitted MyLearn exam page open when directed.
What happens after passing or failing?
Plan for both outcomes without treating either as a reason to lower preparation standards. Oracle’s guidelines say OCI certifications are valid for 24 months from the date the credential is earned. Oracle also says a passed exam cannot be retaken, while a failed exam may be scheduled for an earliest appointment date permitted after the failed appointment.
After a pass, verify the credential through Oracle’s certification systems and record the validity period for future planning. After a fail, use the result and your error log to choose a narrower remediation plan rather than immediately repeating the same study routine.
Credential verification
Oracle’s guidelines describe several ways to share and verify certification, including an eCertificate available from the Credential Management section of the Oracle Certified Candidate portal at CertView. Use the official credential record when documenting the certification for an employer or client.
Retake decisions
Do not create a new identity to bypass a retake policy. Oracle says attempts taken that way can be invalidated and that further program action may follow. Check the current guidelines for the earliest permitted retake appointment and use the waiting period to address specific knowledge or application gaps.
Keeping the credential current
Because Oracle states that OCI certifications are valid for 24 months from the date earned, add a renewal or recertification reminder to your professional calendar. Confirm current Oracle policy before acting; the available research establishes the validity period but does not provide a particular renewal path for this exam.
What should you do next?
First, open the official MyLearn page for 1Z0-1104-25 and confirm that the exam version and current scheduling information match your plan. Next, use the Oracle learning path to assess your foundation and build a five-domain gap list. Then complete targeted hands-on work, take the official practice exam, and schedule only after reviewing every uncertain result.
Keep your final notes practical: identity scope, network flow, workload protection, data handling, posture maintenance, and the evidence used to troubleshoot each area. That preparation style aligns your study with the credential’s stated purpose and gives you a defensible basis for deciding whether you are ready.
Conclusion
1Z0-1104-25 is best approached as an applied OCI security exam. Establish the required OCI foundation, study the five named security domains, use Oracle’s labs and practice assessment to test decisions, and verify delivery and scheduling rules immediately before registration. The strongest final checkpoint is not memorization; it is the ability to explain how an OCI control protects a resource, what permission or configuration it depends on, and how you would investigate when the protection does not behave as intended.
Related exams
- 1z0-1067-24 exam — Oracle Cloud Infrastructure 2024 Cloud Operations Professional
- 1z0-1067-25 exam — Oracle Cloud Infrastructure 2026 Cloud Ops Professional
- 1z0-1084-25 exam — Oracle Cloud Infrastructure 2026 Developer Professional
- 1z0-1085-24 exam — Oracle Cloud Infrastructure 2024 Foundations Associate
- 1z0-1085-25 exam — Oracle Cloud Infrastructure 2026 Foundations Associate
- 1z0-1105-23 exam — Oracle Cloud Data Management 2023 Foundations Associate