1Z0-1072-26 Exam Questions and Answers

Network Security Groups (NSGs)

NSGs apply security rules to a set of VNICs you choose, independent of subnet CIDR, so database instances accept traffic only from the named application instances wherever they reside. Security lists cannot express this, as they act at subnet level.

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.

Misconfigured BGP peering IPs or ASNs prevent the TCP session from establishing, leaving BGP in Idle rather than Active or Established. Since the Provider model already delivers Layer 2 connectivity, the fault lies at Layer 3 peering configuration between the Oracle and on-premises routers, matching the stem's Idle status.

Dynamic Routing Gateway (DRG)

A Dynamic Routing Gateway acts as the regional transit hub, terminating the FastConnect virtual circuit and routing traffic to attached VCNs. Critically, DRG route tables support inter-region routing via remote peering or DRG attachments, satisfying the requirement to reach multiple VCNs across different OCI regions through one dedicated connection.

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG

Configuring custom DNS forwarders in the VCN Resolver, pointing to the on-premises DNS servers reachable through the DRG, lets instances resolve on-premises hostnames. The VCN Resolver forwards queries it cannot answer internally to those specified servers.

Service Gateway

A service gateway provides private access to Oracle services such as Object Storage without leaving the OCI network, satisfying the no-public-internet constraint. It is regional, so resources in the private subnet reach Object Storage in the same region over the Oracle backbone, with route table and security rules permitting the traffic.

Health check policy defining protocol, port, and optional URL path

The load balancer needs a health check policy on the backend set to probe each instance; it defines the protocol, port and optional URL path used to determine whether a backend is healthy and eligible to receive traffic.

Oracle Recovery Manager (RMAN)

Oracle Recovery Manager (RMAN) provides the precise OS-level toolset required to coordinate incremental backups with archived redo logs for manual point-in-time recovery. It directly satisfies the operational constraint of restoring an Oracle Base Database System through native database channels, intelligently sequencing the application of base incremental images and subsequent redo streams without manual file-matching overhead.

Edit the DB system configuration in the OCI Console and update the OCPU count or shape directly.

Oracle Base Database System on Virtual Machine shapes are scaled by editing the DB system and changing the OCPU count or shape, which resizes the underlying compute without redeployment. This satisfies the month-end spike requirement.

Oracle VM or KVM guest virtualization (domU)

Oracle VM or KVM guest virtualisation (domU) delivers hypervisor-level tenant isolation, satisfying the stem's requirement for maximum isolation in ExaCS. Each guest domain runs its own kernel, separated by the hypervisor from other tenants, unlike shared-database or schema-level approaches. This hard boundary prevents cross-tenant access at the virtualisation layer.

Autonomous Database on Dedicated Exadata Infrastructure

Autonomous Database on Dedicated Exadata Infrastructure satisfies the requirement for maximum isolation by provisioning the database engine directly on single-tenant Exadata hardware residing within your specific Oracle Cloud Infrastructure tenancy. This deployment model removes resource sharing with other tenants at the compute, memory, network, and storage layers, thereby delivering the stringent security boundaries and dedicated performance needed for enterprise workloads requiring physical segregation.

An Oracle-managed Object Storage bucket

Oracle Base Database Systems utilise an Oracle-managed Object Storage bucket to satisfy the requirement for automated backups. When you enable this feature, the service automatically provisions and manages a hidden, internal bucket within your tenancy. This mechanism offloads the operational overhead of backup lifecycle management and storage configuration, ensuring that data is durably persisted outside the database host. By abstracting the underlying infrastructure, OCI provides a seamless, scalable repository that integrates directly with the database control plane for automated recovery operations.

Autonomous Database Clone (Thin Clone)

An Autonomous Database Clone configured as a Thin Clone satisfies the requirement for a space-efficient, point-in-time copy by leveraging metadata-only inheritance. Instead of duplicating all underlying data blocks, a Thin Clone shares the base database storage blocks and only allocates new storage for subsequent writes. This architectural mechanism allows developers to instantly provision multiple independent writable copies of the production Autonomous Transaction Processing database without incurring the heavy storage costs or latency associated with traditional full physical clones, making it ideal for automated regression testing.

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.

Federated IDCS groups cannot hold OCI policies directly; they must be mapped to an OCI IAM group, which then receives the policy granting manage virtual-network-family. This satisfies the stem's requirement to assign NetworkAdmins management of Virtual Cloud Networks.

It applies across the entire tenancy and all compartments within it.

A policy created in the root compartment is tenancy-scoped: its statements apply across the entire tenancy and every compartment inside it, unless the statement itself names a narrower compartment. Placement in root therefore grants the broadest default reach.

manage

The manage verb in OCI IAM policies encompasses the full permission set — inspect, read, use, and manage — on a resource type. It therefore grants the most comprehensive access, including the ability to create, update, and delete resources.

Allow group DBA-Group to manage autonomous-database in compartment DevComp

Granting `manage autonomous-database` scoped to the DevComp compartment limits the DBA-Group to full lifecycle control of Autonomous Databases there, without touching other compartments or resource types. This directly satisfies the least-privilege constraint, since broader verbs like `manage all-resources` or tenancy-wide scope would over-grant.

Allow group Auditors to read policies in tenancy

The statement 'Allow group Auditors to read policies in tenancy' grants read access to policy objects tenancy-wide, letting the Auditors group inspect every IAM policy for compliance. The 'in tenancy' scope is what extends visibility beyond a single compartment.

To allow OCI resources, such as compute instances, to be authenticated and authorized as principals in IAM policies.

A dynamic group matches OCI resources by defined rules, letting compute instances and other resources act as principals authenticated and authorised in IAM policies. This enables instance principals to call OCI APIs without storing credentials, satisfying the requirement for resource-level identity.

VM.Standard.E4.Flex configured with 6 OCPUs and 32 GB of RAM

Flexible shapes allow administrators to independently customise the number of OCPUs and the amount of memory allocated to a virtual machine. By selecting the VM.Standard.E4.Flex shape, the team can precisely provision exactly 6 OCPUs and 32 GB of RAM. This granular control directly satisfies the resource constraint specified in the stem, ensuring that the deployment remains cost-efficient by avoiding the over-provisioning typically associated with fixed-shape instances that force users to accept pre-defined hardware ratios.

In the Custom Image launch options settings

Custom image launch options let you specify the NIC virtualisation mode and UEFI boot parameters, such as secure boot and firmware settings, when instances launch from that image. This satisfies the non-standard hardware requirements, since these settings cannot be altered on a running instance after launch.

The instance is replaced automatically by the instance pool to maintain the operational state, managing lifecycle events independently of active autoscaling metrics.

Instance pools manage the lifecycle of instances to ensure the target number of instances are operational, substituting retired instances seamlessly.

OCI Events Service

OCI Events Service is the correct mechanism because it captures the Object Storage lifecycle state change—specifically the `Object Create` lifecycle event—when a new file is uploaded. This directly satisfies the requirement to trigger a serverless function asynchronously based on resource creation, without needing polling or custom daemon architectures, by routing the emitted cloud event payload straight to the function endpoint as an invocation trigger.

Custom Image

A custom image captures the boot volume of a configured Linux instance, preserving security hardening and pre-installed agents, then lets you launch new instances from that exact baseline. This satisfies the requirement for a reusable gold image rather than reconfiguring each instance manually.

BM.DenseIO2.52

DenseIO shapes provide locally attached NVMe storage, which satisfies the requirement for raw, low-latency performance necessary for high-frequency transaction logging. Unlike standard virtual machine shapes that rely on network-attached block storage, the BM.DenseIO2.52 instance exposes the physical NVMe drives directly to the operating system. This architecture eliminates the overhead of the network stack, ensuring the minimal I/O latency required for high-performance database workloads. By utilising bare metal hardware, you ensure dedicated access to these high-speed storage resources without contention from other tenants.

OCI File Storage Service

OCI File Storage satisfies the requirement for a shared file system accessible by hundreds of Linux compute instances simultaneously because it implements the Network File System version 3 (NFSv3) protocol. This fully managed service provides a distributed file system that can be mounted concurrently across multiple Oracle Cloud Infrastructure compute nodes, making it the ideal architecture for sharing common configuration files and user home directories without file-locking conflicts or protocol mismatches.

Block Volume Clone

A Block Volume Clone creates an instant, point-in-time copy that is space-efficient because it initially shares blocks with the source volume, diverging only as data changes. This satisfies the same-availability-domain and instant replica constraints without a full data copy.

Configure the bucket during creation to use a Customer-Managed Key from OCI KMS.

Configuring the bucket with a Customer-Managed Key from OCI KMS ensures every uploaded object is encrypted with the organisation's own master encryption key, satisfying the requirement for customer-managed rather than Oracle-managed keys. The key is assigned at bucket creation, so encryption applies automatically to all objects without per-object configuration.

FSS Snapshots

File Storage Service (FSS) snapshots provide a read-only, point-in-time view of a file system that can be scheduled or created manually to satisfy the requirement of protecting against accidental end-user deletion. Because snapshots are immutable and stored independently of the active file system data, users cannot modify or delete the snapshot contents even if they inadvertently remove the original files from the mount target. This mechanism allows administrators to effortlessly restore the exact state of the data as it existed prior to the user error.

Archive Storage Tier

Archive Storage retains infrequently accessed data for long-term compliance at the lowest cost, and its retrieval latency of up to four hours satisfies the stem's stated tolerance. Unlike Standard or Infrequent Access tiers, Archive is purpose-built for data held for years without frequent reads, matching the five-year retention requirement precisely.

OCI Volume Groups

OCI Volume Groups directly satisfy the requirement to back up multiple block volumes simultaneously by allowing administrators to group multiple volumes and create crash-consistent point-in-time backups across all attached disks concurrently. This feature ensures data integrity for multi-volume databases without requiring manual scripting or downtime to coordinate individual volume snapshots.

Provision and configure cloud infrastructure resources using Terraform configuration files.

OCI Resource Manager stacks utilise Terraform as their underlying engine to automate the deployment and lifecycle management of cloud environments. By processing Terraform configuration files, the service enables users to define, provision, and configure complex resource topologies declaratively. This capability directly satisfies the requirement to perform infrastructure provisioning, as the stack acts as a managed execution environment that orchestrates the provider-specific API calls necessary to realise the infrastructure state defined within the code, ensuring consistent and repeatable deployments across OCI tenancies.

Import existing OCI cloud resources into a Terraform state file managed by the stack.

Resource Manager facilitates the importation of pre-existing OCI infrastructure by mapping current cloud components to a Terraform state file. This process enables users to bring unmanaged resources under the lifecycle control of a stack, satisfying the requirement to manage existing infrastructure as code. By executing an import operation, the service synchronises the actual state of deployed resources with the Terraform configuration, allowing for subsequent updates or deletions to be managed directly through the Resource Manager interface rather than manual console adjustments.

Plan Job

A Plan Job runs terraform plan against the configuration and state, producing an execution plan that previews the changes Resource Manager would make without modifying any cloud resources. Apply Jobs perform the actual changes, so they cannot serve as a preview.

OCI Events Service

OCI Events Service captures Object Storage create-object events via rules and routes them to targets such as Functions, acting as the event router. It satisfies the requirement to trigger a serverless function on upload automatically.

Create a Log Group, install and configure the OCI Logging Unified Agent on the instances, and create a custom Log pointing to the agent configuration.

The Log Group organises storage, the Unified Agent collects and forwards instance logs, and a custom Log binds that agent configuration to the group. This sequence satisfies ingesting application logs from multiple compute instances into OCI Logging.

OCI Monitoring service (to create an alarm on the CpuUtilization metric) and OCI Notifications service (to send the email).

OCI Monitoring evaluates the CpuUtilization metric against a 90% threshold sustained for 5 minutes, firing the alarm; OCI Notifications then delivers the email via a topic subscription. Together they satisfy both the metric condition and the email delivery requirement.

Use IAM policies to control which user groups are permitted to update specific defined tag values.

Applying IAM policies to restrict tag updates satisfies the governance constraint by ensuring that only authorised personnel can modify defined tag values. By leveraging OCI’s identity-based access control, administrators prevent unauthorised users from tampering with metadata, which is essential for maintaining accurate cost-tracking and resource lifecycle management. This granular control mechanism effectively enforces organisational standards, ensuring that cost allocation remains reliable across the tenancy and preventing the data corruption that often occurs when tagging schemas are not strictly governed.

Use Defined Tags to organize and enforce a controlled namespace and key-value structure.

Defined tags live in a tenancy-wide namespace with a controlled key-value schema, so administrators can enforce consistent tagging and restrict who applies values. This satisfies the governance and cost-management requirement by preventing ad-hoc, inconsistent freeform tags across compartments.

Implement Tag Defaults to automatically apply specific tags to all resources created in a compartment.

Tag Defaults enforce consistency by automatically injecting predefined tag key-value pairs into resources at the moment of creation within a specified compartment. This mechanism directly satisfies the requirement for comprehensive governance, as it eliminates human error and ensures mandatory metadata for cost tracking is never omitted. By centralising the application of these tags, administrators maintain strict oversight across the tenancy, preventing untagged resources from bypassing financial reporting and lifecycle management policies.