1Z0-1104-25 Oracle Cloud Infrastructure 2025 Security Professional Exam Guide
The 1Z0-1104-25 exam validates knowledge of using OCI core security services to build and maintain secure cloud environments for applications and resources. Oracle positions the certification for security professionals, solution architects, IT administrators, cloud engineers, and others responsible for protecting OCI environments. This guide helps you decide whether your current experience is enough to begin, which skills to study first, how to use Oracle’s learning and lab resources, and what to verify before booking an exam attempt.
What does 1Z0-1104-25 validate?
1Z0-1104-25 is the Oracle Cloud Infrastructure 2025 Security Professional exam. Its purpose is to assess practical understanding of OCI security services and the decisions required to build and maintain secure environments, rather than knowledge of a general security theory syllabus alone.
Oracle announced the OCI 2025 Security Professional certification and course on March 17, 2025. The certification focuses on core OCI security services used to protect applications and resources. That focus makes the exam relevant to candidates who must translate security requirements into OCI configurations, controls, and operating practices.
The credential is a sensible target when your work involves securing OCI resources, reviewing cloud architecture, administering identities and access, protecting networks or workloads, or maintaining an organization’s security posture. It is less suitable as a first exposure to both cloud computing and security because Oracle’s associated learning path lists foundational OCI understanding and basic cloud-computing and security knowledge as prerequisites.
Start with the official MyLearn exam entry to confirm that the exam code and certification title match the attempt you intend to purchase. Then compare your experience with the five-domain learning path before deciding whether to study through the full path or use targeted preparation.
Who should prepare for this certification?
Security professionals, solution architects, IT administrators, cloud engineers, and other practitioners responsible for OCI security are the primary audience identified by Oracle. Your job role matters less than whether you make or review security decisions across OCI services.
A security specialist may use the certification to structure knowledge of IAM, network controls, data protection, and posture management. A solution architect can use it to test whether security requirements are reflected in OCI design choices. An administrator or cloud engineer may benefit most from connecting policies, services, and operational troubleshooting to real resource configurations.
Candidates coming from on-premises security should avoid assuming that familiar control names map directly to OCI implementation. Candidates with OCI infrastructure experience should avoid treating security as a list of isolated services. Build an understanding of how identity, network exposure, workload protection, data protection, and monitoring or posture maintenance interact.
Use the prerequisite decision this way: if terms such as compartments, policies, networking, and core OCI resource management are unfamiliar, begin with OCI foundations before attempting advanced security study. If those concepts are familiar but security services are not, proceed through the security learning path while using labs to close configuration gaps.
Which skills and domains are measured?
Oracle states that the 2025 course is structured around five key domains: IAM, network security, OS and workload protection, data protection, and maintaining security posture. These domains provide the clearest official framework for organizing preparation, although the supplied sources do not provide percentage weights for individual domains.
IAM covers the identity and access decisions that determine who or what can reach OCI resources and what actions are permitted. Study the relationship between identities, policies, compartments, and service access. Pay particular attention to least-privilege reasoning and to the difference between granting access and proving that access is appropriate.
Network security concerns the controls that reduce unwanted exposure and regulate traffic. Oracle’s 2025 updates specifically include Zero Trust Packet Routing. Prepare by tracing traffic paths and asking which control applies at each boundary, rather than memorizing service descriptions without a security scenario.
OS and workload protection addresses the security of systems and applications running in OCI. Oracle lists OS Management Hub among the 2025 course updates and also highlights troubleshooting OCI security issues. Study the operational consequences of configuration choices, including how protection is maintained after deployment.
Data protection focuses on safeguarding sensitive information and the mechanisms used to control or protect it. The preparation course includes OCI Certificates and Vault Secret walkthroughs, which are useful anchors for studying credentials, secrets, certificates, and secure application access.
Maintaining security posture is the continuous side of the certification. It involves identifying weaknesses, applying appropriate controls, and troubleshooting security conditions over time. Treat this domain as an operating discipline: define the intended state, inspect the environment, investigate deviations, and apply a corrective action.
Oracle also names IAM Optimization and Object IAM in its 2025 course updates. Include these topics in your notes, and record the security problem each feature solves, the resources it affects, and the conditions under which one approach is preferable to another.
How should you sequence the official learning path?
Study the five domains as a connected security workflow: establish identity controls, restrict network paths, protect operating systems and workloads, secure data and credentials, then verify and maintain the resulting posture. This sequence gives each service a place in an architecture and reduces the risk of learning disconnected product labels.
Oracle lists 22+ hours of expert training, 18 skill checks, and an Oracle University lab in the 2025 learning path. Use the path as a baseline, not as a reason to skip active recall. After each module, close the material and explain the control, its purpose, the configuration inputs, and a likely failure condition in your own words.
First, take an inventory of your existing knowledge. Mark each domain as familiar, partially understood, or new. Begin with the least familiar prerequisite concepts, then work through IAM and networking before moving to workload and data protection. Finish with posture maintenance and troubleshooting because those topics require you to connect several controls.
The preparation course is described as a 59-minute course with HPE preparation, walkthroughs for Network Source, Network Firewall, OCI Certificates, Bastion, Vault Secret, WAF, and Custom Security Zone, plus sample questions. Use it as an orientation and environment-readiness resource; do not mistake a short preparation course for a substitute for domain practice.
For every service, create a four-column note: security objective, relevant OCI configuration, evidence that the control is working, and common misconfiguration. This format turns passive viewing into a troubleshooting reference and makes it easier to identify gaps before taking the practice exam.
How can hands-on labs improve readiness?
Use an Oracle University lab to perform the actions you have studied, then deliberately inspect what changed. Hands-on work is most useful when you can explain why a configuration improves security, what access it grants or blocks, and how you would diagnose an unexpected result.
The lab instructions say you must schedule the lab to obtain lab time. They also direct learners to test and configure the system through ouconnect.oracle.com and to use the lab support process if a technical issue occurs. Schedule early enough to resolve access problems before the study session on which you depend.
Oracle’s lab guidance says to check back 12 hours before the lab starts for the username and password; another lab instruction says to check at 9:00am local time on the scheduled day. Follow the instructions displayed for your specific lab reservation rather than relying on an old message or a saved credential.
When connected, the lab material directs you to find the username and password under the Cloud Host Name Details section, open the webtop, choose My Training Environments, and select the system assigned to the event. Keep lab credentials private; Oracle’s course guidance specifically warns against posting them in a visible community discussion.
The lab material states that the environment is available until 18:00hrs and that an Extend Lab button may be available. These displayed lab times are session-specific, so check the active reservation rather than assuming that every environment has the same end time. If resources are unavailable or a schedule request is rejected, use Oracle University support instead of repeatedly submitting requests without checking status.
Practice three kinds of activity: build a control from a stated requirement, inspect an existing configuration for a weakness, and troubleshoot a failed or over-permissive result. These activities are more valuable than clicking through a successful walkthrough because they require you to choose the control and verify the outcome.
What is a practical study roadmap?
A workable roadmap has four stages: baseline assessment, domain construction, integrated practice, and administrative readiness. Move forward when you can explain and apply a control, not merely when you have completed a video or accumulated notes.
Stage one is a baseline assessment. Read the official domain descriptions, review the learning-path prerequisites, and attempt the available Oracle practice activity without consulting notes. Classify every error as a terminology gap, service-selection error, configuration error, or reasoning error. The classification tells you what to repair.
Stage two is domain construction. Study IAM and network security first because identity and traffic decisions influence access to applications and resources. Then cover OS and workload protection, followed by data protection. Keep maintaining-security-posture notes throughout rather than leaving operational security until the final day.
Stage three is integrated practice. Build scenarios that cross domains: an application needs a secret, a workload must be reachable only through approved paths, an administrator needs limited access, or a security control is producing an unexpected result. For each scenario, state the requirement, select the service or control, identify the least-privilege configuration, and define how you would verify it.
Stage four is readiness. Repeat the practice assessment, revisit only the weak areas, and perform one final lab or configuration review. Confirm the exam delivery type, registration identity, equipment, connection, and appointment policies from the current Oracle page. Do not schedule an attempt merely because you have finished the learning path.
A compact weekly rhythm can combine one domain lesson, one hands-on task, one closed-book explanation, and one error review. Adjust the pace to your background. The important measure is whether you can reason from a security requirement to an OCI control and then validate the result.
How should you use Oracle’s practice exam?
Use the practice exam as a diagnostic checkpoint, not as a source of recalled exam content. Oracle’s associated practice exam requires a score of 80% or higher to pass and includes three sample hands-on performance challenges: Security Zone, Certificates, and Network Firewall.
Take the practice exam after an initial pass through the domains. Record why each answer was selected and why the alternatives were rejected. A correct guess is still a study gap; mark it for review rather than treating the score as proof of readiness.
Use the three named challenges to test different capabilities. Security Zone can prompt you to review policy-driven protection, Certificates can expose gaps in certificate handling, and Network Firewall can reveal whether you understand traffic-control decisions. The supplied source identifies the challenge names but does not establish that they reproduce the live exam, so do not treat them as a question bank.
After the assessment, return to official learning content and your lab notes. Recreate the relevant configuration where possible, explain the security objective, and document the verification step. This process repairs understanding more effectively than memorizing an answer pattern.
Do not use dumps, leaked questions, or claims that memorization guarantees a pass. Oracle’s certification guidelines state that fraudulent activity can result in forfeited fees and further consequences. Prepare with authorized learning content, practice activities, and your own reasoning.
What exam delivery requirements should you verify?
The supplied Oracle University preparation page applies to Oracle University-delivered exams and explicitly says its details are not valid for exams scheduled and delivered by Pearson VUE. Confirm the delivery provider in your registration and follow the requirements for that provider before making equipment or scheduling decisions.
For an Oracle University-delivered proctored exam, Oracle requires government-issued identification whose first and last name exactly match the exam registration name. Check the document’s validity, condition, photo, and name before appointment day. Resolve a mismatch before check-in rather than assuming an examiner can correct it.
Oracle’s listed technical requirements include Windows 11, Windows 10, or Mac OS X 13 or later with a supported current Chrome or Edge setup, administrator rights, at least 8 GB RAM, a single display, and a webcam with a minimum resolution of 640x490 at 10 fps. iOS, Windows CE, Windows RT, Android, Chrome OS, and Linux are not supported for that delivery arrangement.
The connection should be consistent and reliable, with at least 3 mb/sec upload and download and a ping of less than 100 ms. Oracle advises against mobile hotspots and requires proxy and VPN connections to be disabled. Test the actual computer and network you expect to use, not only a different device.
Oracle also lists an English QWERTY keyboard, working webcam, audio, and microphone. Close other applications and browsers before starting, leave only the MyLearn Exam page tab open, and turn off incognito and browser developer modes. Pen and paper are not allowed; Oracle says a digital whiteboard is available in the exam delivery platform.
For proctored exams, check in at least 30 minutes before the exam start time. Candidates who try to check in after the scheduled exam time may not be admitted. Treat the readiness check as a technical test and a chance to identify unsupported settings, not as an optional formality.
What scheduling, cost, and credential policies matter?
Verify the current price, currency, delivery provider, and appointment rules at the point of purchase. Oracle stated on August 6, 2025 that attempts for its non-foundational core OCI certifications, including OCI Security Professional, cost US$245, while the learning path and practice tests were free; currency and purchasing arrangements can change.
Oracle’s pricing policy says that when Oracle University and Pearson VUE accept different currencies in a country, the exam price is provided in the currency offered by Oracle University. Oracle also advises candidates to check Pearson VUE for the currency accepted by the vendor for the selected exam. Use the official purchase flow for the final amount rather than relying on a third-party listing.
If you need to cancel or reschedule, Oracle’s exam-preparation information says to do so at least 24 hours before the appointment. Missing that cancellation window can risk forfeiting the attempt. Make the appointment only after your technical setup, identification, and preparation plan are ready.
Oracle states that OCI certifications are valid for 24 months from the date the credential is earned. Check the credential record after completion; Oracle says the certification page confirms the credential, date earned, expiration date if applicable, and skills acquired.
Oracle’s retake policy allows a failed exam to be scheduled for an earliest appointment date from the failed exam appointment date, while a passed exam cannot be retaken. Do not plan a retake around an assumed waiting period; confirm the permitted appointment date in the current certification account and policy.
Before payment, write down the exact exam title and code, the provider, the registration name, the identification document you will use, and the cancellation deadline. This small checklist prevents an avoidable administrative error from consuming an attempt.
Which preparation mistakes should you avoid?
The most damaging mistakes are studying service names without security reasoning, ignoring prerequisites, postponing labs, treating practice scores as guarantees, and failing to verify delivery requirements. Correct them by linking every topic to a requirement, a configuration decision, and a verification method.
Do not read the five domains as five independent chapters. IAM affects who can use a service; network security affects where traffic can flow; workload and data protection affect what is exposed; posture maintenance checks whether those controls remain effective. Use cross-domain scenarios to expose gaps that isolated flashcards conceal.
Do not overfocus on the newest named updates while neglecting fundamentals. Oracle highlights Zero Trust Packet Routing, OS Management Hub, IAM Optimization, Object IAM, and troubleshooting OCI security issues, but these updates still need to be understood in relation to identity, network, workload, data, and posture objectives.
Do not schedule a lab and then wait passively for credentials. Check the reservation instructions at the stated time, test the connection, locate the assigned environment, and report technical problems through the course support process. A lab reservation is not the same as demonstrated readiness.
Do not confuse an official practice assessment with the live exam. Use its result to select revision topics, and use the hands-on challenges to rehearse configuration and troubleshooting. Avoid any source that claims to provide guaranteed live questions or a shortcut through memorization.
Do not rely on old policy screenshots. Oracle publishes new exam versions and policies can depend on delivery provider, country, appointment, and account conditions. Recheck the official exam-preparation and certification-guidelines pages immediately before registration and again before the appointment.
What should you do next?
Begin by opening the official MyLearn entry for 1Z0-1104-25 and confirming the exam identity. Next, compare your experience with the five domains, choose the learning-path modules that address your gaps, and reserve hands-on time only when you can use it for deliberate practice.
Use this action sequence:
1. Confirm that 1Z0-1104-25 is the intended Oracle Cloud Infrastructure 2025 Security Professional exam.
2. Check the learning-path prerequisites and rate your IAM, network security, workload protection, data protection, and security-posture knowledge.
3. Complete the relevant official learning content and build notes around objectives, configurations, evidence, and failure modes.
4. Schedule and use the Oracle University lab when available, checking the lab-specific access and end-time instructions.
5. Take the official practice assessment, investigate every missed or guessed item, and repeat weak configurations in the lab or learning environment.
6. Run the Oracle readiness check and verify the provider-specific identity, equipment, connection, and check-in requirements.
7. Purchase and schedule only after your preparation and administrative checklist are complete.
The learning path is stated by Oracle to be archived on September 30, 2026. That makes it sensible to confirm its availability and any replacement learning experience before building a long study plan around it. Always use the current Oracle pages for final preparation decisions.
Conclusion
A strong 1Z0-1104-25 plan is based on applied security reasoning: identify the requirement, choose the OCI control, configure it with appropriate access boundaries, and verify the result. Use Oracle’s five-domain structure to organize study, the learning path and labs to build practical skill, and the practice exam to diagnose weak areas. Before booking, confirm the live exam provider, current purchase terms, identity requirements, technical setup, and appointment policies on Oracle’s official pages.
Related exams
- 1z0-1067-24 exam — Oracle Cloud Infrastructure 2024 Cloud Operations Professional
- 1z0-1067-25 exam — Oracle Cloud Infrastructure 2026 Cloud Ops Professional
- 1z0-1084-25 exam — Oracle Cloud Infrastructure 2026 Developer Professional
- 1z0-1085-24 exam — Oracle Cloud Infrastructure 2024 Foundations Associate
- 1z0-1085-25 exam — Oracle Cloud Infrastructure 2026 Foundations Associate
- 1z0-1105-23 exam — Oracle Cloud Data Management 2023 Foundations Associate
