20+ practice questions focused on Security — one of the most tested topics on the Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security PracticeAn organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?
Explanation: A Virtual Private Vault in OCI is a dedicated vault backed by dedicated HSM partitions that are not shared with other tenants, and the master encryption keys are stored within those dedicated HSMs. This satisfies the regulatory requirement that keys reside outside Oracle's shared managed infrastructure and can be revoked immediately by the customer. Because the customer controls the vault and its keys, they can schedule deletion or revoke key versions at any time, rendering the encrypted database volumes inaccessible.
An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?
Explanation: OCI IAM supports identity federation with an external SAML 2.0 IdP, so developers authenticate against the enterprise IdP and receive federated sessions mapped to OCI groups. For native console administrators, an IAM authentication policy can enforce MFA at sign-in, satisfying the requirement that all admin console access use MFA while developers use SSO.
An enterprise customer wants to restrict OCI API access so that developers can only invoke management APIs from corporate office public IP addresses. Which OCI feature implements this restriction?
Explanation: OCI IAM policies support conditions that can evaluate the request's source IP against a CIDR block using the 'request.ip' variable (or 'request.remote.ip'). By writing a policy with a condition like 'where request.ip in ("203.0.113.0/24")', you restrict API calls to corporate office IP ranges. This is the native OCI mechanism for IP-based API access control.
An enterprise security architect is designing a defense-in-depth strategy for an OCI environment hosting sensitive financial data. Which TWO architectural practices should be implemented to ensure robust network and data security? (Choose two.)
Explanation: Option A is correct because storing master encryption keys in OCI Vault with customer-managed keys (CMKs) gives the organization full control over key lifecycle, enables strict rotation policies, and enforces least-privilege access through IAM policies and key-level permissions, which is essential for protecting sensitive financial data at rest. Option E is correct because defense-in-depth network security in OCI relies on layered segmentation: private subnets prevent direct internet exposure, Local VCN Peering enables controlled east-west traffic between VCNs, and Network Security Groups (NSGs) apply granular, resource-level stateful firewall rules rather than relying on broad subnet-level security lists. Option B is incorrect because default VCN security lists are permissive and subnet-scoped; NSGs provide more precise, instance-level control and are a recommended best practice. Option C is incorrect because disabling OCI Audit logging removes the immutable audit trail needed for compliance, forensics, and tamper detection, weakening rather than strengthening security. Option D is incorrect because exposing databases directly to the public internet drastically increases the attack surface; databases should reside in private subnets and be accessed via bastion hosts, VPN, or FastConnect.
Which THREE methods can be used to establish secure, private connectivity from an on-premises datacenter to an OCI VCN without traversing the public internet? (Choose three.)
Explanation: Option A is correct because an OCI FastConnect dedicated private circuit provides a private, dedicated physical connection between the on-premises datacenter and the OCI VCN that does not traverse the public internet. Option C is correct because OCI Site-to-Site IPsec VPN establishes an encrypted tunnel over the internet between the on-premises CPE and the OCI Dynamic Routing Gateway, keeping traffic private and secure. Option D is correct because OCI FastConnect via a Partner virtual circuit also delivers private connectivity through a FastConnect partner's private network rather than the public internet. Option B is incorrect because an Internet Gateway provides public internet access to a public subnet, which is the opposite of private connectivity. Option E is incorrect because assigning unencrypted public IP addresses to database instances exposes them to the public internet and provides no private path.
+15 more Security questions available
Practice all Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security questions on the 1Z0-997-26 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security is tested as part of the Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) blueprint. Practicing with targeted Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 1Z0-997-26 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security practice session with instant scoring and detailed explanations.
Start Security Practice →