1Z0-1072-26 Exam Questions and Answers

You need to restore an Oracle Base Database System to a specific point in time using incremental backups and archived redo logs. Which tool should you use at the OS level if you are managing the recovery manually?

Data Pump (impdp)

Oracle Recovery Manager (RMAN)

RMAN is the native physical backup and point-in-time recovery utility for Oracle databases.

OCI Block Storage Volume Snapshots

SQL*Loader

Why: Oracle Recovery Manager (RMAN) is the standard Oracle tool used for backup, restoration, and recovery of database files including datafiles, control files, and archived redo logs.

You are managing an Oracle Base Database System (Virtual Machine) and need to scale up the compute shape to a higher number of OCPUs to handle an upcoming month-end processing spike. Which action should you perform?

Terminate the current DB system and provision a new one with the larger shape, then restore from a manual backup.

Stop the database instance via SQL*Plus and run the 'alter system modify shape' command.

Edit the DB system configuration in the OCI Console and update the OCPU count or shape directly.

Editing the DB system shape or OCPU count directly is the supported method for vertical scaling.

Attach an additional block storage volume with higher performance tiers to absorb the extra compute load.

Why: For Oracle Base Database Systems, you can scale up the compute shape by modifying the OCPU core count or shape directly from the OCI Console without losing data.

You are configuring an Exadata Cloud Service (ExaCS) instance and need to ensure maximum isolation and security for your database infrastructure. Which architectural layer provides tenant isolation at the hypervisor level in ExaCS?

Virtual Cloud Network (VCN) security lists and network security groups

Storage Server Cell software zones

Exadata Database Vault compartment boundaries

Oracle VM or KVM guest virtualization (domU)

Virtualization using OVM or KVM isolates database server guests at the hypervisor level.

Why: In Exadata Cloud Service, Oracle manages the underlying hardware, and tenant isolation is achieved using Oracle VM (OVM) or KVM-based virtualization to isolate dom0 and guest domU virtual machines.

Which Autonomous Database deployment model runs on dedicated Exadata infrastructure residing in a customer's OCI tenancy, providing maximum isolation?

Exadata Cloud at Customer (ExaCC)

Autonomous Database on Shared Infrastructure

Oracle Base Database System

Autonomous Database on Dedicated Exadata Infrastructure

Dedicated infrastructure provides isolated Exadata resources exclusively for a single tenant.

Why: Autonomous Database on Dedicated Exadata Infrastructure (Autonomous Dedicated) provides a completely dedicated database environment within a dedicated Exadata rack.

You are managing an Oracle Base Database System and need to configure automated backups. By default, where does OCI store these automated backups?

A customer-managed File Storage Service (FSS) mount target

An Oracle-managed Object Storage bucket

Oracle-managed Object Storage is the default repository for automated DB backups.

The local root file system (/u01) of the database VM

A locally attached block volume separate from the database data disk

Why: OCI stores automated backups of database systems in an Oracle-managed Object Storage bucket specific to your tenancy.

You are setting up Oracle Data Guard between a primary Base Database System in the us-ashburn-1 region and a standby database in the us-phoenix-1 region. Which networking configuration is mandatory to enable redo transport across regions?

A Public Load Balancer fronting the standby database listener

Configuring a Dynamic Routing Gateway (DRG) and Remote VCN Peering between the regions

Remote VCN peering via DRGs is necessary for secure, private cross-region IP connectivity.

Enabling NAT gateways in both regions to route private database redo packets

Installing an IPSec VPN appliance directly on the database node operating systems

Why: Cross-region Data Guard requires Remote VCN Peering or DRG attachments with appropriate security list rules allowing traffic on listener ports (e.g., port 1521) between the primary and standby subnets.

Want more Database practice?

Domain 2: Networking

All Networking questions

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

Local Peering Gateway (LPG) access control lists

Security Lists associated with the database subnet

Network Security Groups (NSGs)

NSGs act as virtual firewalls for a set of VNICs of your choice, independent of subnet boundaries, making them ideal for tier-based isolation.

Dynamic Routing Gateway (DRG) security policies

Why: Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

The Security List on the DRG attachment blocks ICMP traffic.

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.

Mismatched peer IPs, ASNs, or blocked TCP port 179 will keep BGP in an Idle or Active state.

The public subnet has an incorrect Internet Gateway route.

Why: BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

NAT Gateway

Dynamic Routing Gateway (DRG)

A DRG is the required router for connecting on-premises networks and enabling cross-region or multi-VCN transit routing.

Local Peering Gateway (LPG)

Internet Gateway

Why: A Dynamic Routing Gateway (DRG) version 2 acts as a virtual router that provides a single point of entry for your network traffic and supports attachments to multiple VCNs across regions, as well as on-premises connections via FastConnect or VPN.

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

A NAT Gateway configured with DNS proxy settings

A public DNS zone for your on-premises domain

An Internet Gateway with custom host file mappings

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG

VCN Resolver forwarders allow VCN instances to resolve domain names using private on-premises DNS servers.

Why: OCI DNS provides a Resolver where you can set up custom DNS forwarders to route DNS queries for specific on-premises domains to your corporate DNS servers via the DRG.

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

Dynamic Routing Gateway

Internet Gateway

NAT Gateway

Service Gateway

A Service Gateway lets your VCN privately access Oracle services such as Object Storage without exposing data to the public internet.

Why: A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

Health check policy defining protocol, port, and optional URL path

A health check policy ensures the load balancer stops routing traffic to unhealthy backend instances.

A NAT Gateway attached to the backend server subnet

A security list allowing all incoming traffic from the internet

An active Service Gateway

Why: Load balancer health checks regularly probe backend servers using specific protocols, ports, and paths to verify that instances are available and healthy.

Want more Networking practice?

All Identity And Access Management questions

Domain 3: Identity And Access Management

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Assign the NetworkAdmins group directly to the tenancy root compartment via the IDCS console.

Write a policy directly referencing the IDCS group name 'NetworkAdmins' with no OCI group mapping.

Create a local user in OCI IAM for every member of the IDCS 'NetworkAdmins' group and assign them roles.

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.

This describes the correct integration workflow: federated identity provider groups are mapped to local OCI groups, which are then used in IAM policies.

Why: Federated groups from IDCS must be mapped to OCI IAM groups in the OCI Console, and then a policy must be written granting that OCI IAM group access.

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

MATCH {instance.id == 'ocid1.instance...' OR tag.Project == 'Alpha'}

DYNAMIC {instance.id IN ('ocid1.instance...'))}

ANY {instance.id = 'ocid1.instance...', tag.Project.Value = 'Alpha'}

The ANY operator combined with matching criteria for instance.id and freeform/defined tags is the correct syntax for dynamic groups.

ALL {instance.id = 'ocid1.instance...', tag.Project.name = 'Alpha'}

Why: Dynamic group matching rules support matching conditions using ALL or ANY operators with parameters such as instance.id and tag.namespace.tagkey.

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

It applies across the entire tenancy and all compartments within it.

A policy defined in the root compartment has global tenancy scope and governs resources across all compartments.

It applies exclusively to the Identity and Access Management service.

It must be explicitly attached to each child compartment individually to take effect.

It applies only to the root compartment and cannot affect child compartments.

Why: Policies created in the root compartment (tenancy) apply globally across the entire tenancy and all child compartments unless restricted.

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Policies can only be created in the root tenancy, never in child compartments.

The policy can be created in compartment 'ProjectA' using the syntax: Allow group Auditors to inspect all-resources in compartment ProjectA

Attaching a policy to a specific compartment and scoping it to that compartment limits the group's permissions strictly to that boundary.

The policy must be created in the Identity service global container.

The policy must be created in the root compartment (tenancy).

Why: To limit access strictly to 'ProjectA', the policy can be attached either directly to 'ProjectA' or to the parent 'DepartmentX' with a specific compartment restriction.

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

Allow group Developers to terminate instances in tenancy where client.subnet = '192.168.100.0/24'

Allow group Developers to use instance-family in tenancy where request.ip in ('192.168.100.0/24')

The 'in' operator with request.ip correctly evaluates whether the client IP falls within the specified CIDR block for policy enforcement.

Allow group Developers to inspect instances in tenancy where request.ip = '192.168.100.0/24'

Allow group Developers to manage instance-family in tenancy where request.ip = '192.168.100.0/24'

Why: OCI IAM policies support conditional access using the 'request.ip' variable in combination with logical operators like 'in'.

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

Allow dynamic-group AppInstances to read objects in compartment Production where target.tag.Operations.Environment = 'true'

Allow dynamic-group AppInstances to read objects in tenancy where target.tag.Operations.Environment = 'Production'

This policy correctly uses target.tag.<namespace>.<key> to restrict the read permission to buckets bearing the specified defined tag.

Allow dynamic-group AppInstances to read objects in tenancy where request.tag.Operations.Environment = 'Production'

Allow dynamic-group AppInstances to read buckets in tenancy where bucket.tag.Operations.Environment = 'Production'

Why: Policies can enforce tag-based access control using the target.tag variable to check if a resource possesses a specific defined tag.

Want more Identity And Access Management practice?

Domain 4: Compute

All Compute questions

A development team needs to deploy an application that requires exactly 6 OCPUs and 32 GB of memory. Which compute option best satisfies this requirement efficiently without wasting resources?

VM.Standard1.16

VM.Standard.E4.Flex configured with 6 OCPUs and 32 GB of RAM

Flexible shapes allow you to provision exact amounts of OCPUs and memory.

BM.Standard.E3.128

VM.Standard2.8

Why: Flexible shapes allow you to independently configure OCPUs and memory to match exact workload requirements.

You are migrating a legacy application to OCI. The application requires a specific network interface card (NIC) virtualization mode and custom UEFI boot parameters that are not standard. Where should you configure these custom launch options?

Inside the VCN Security List configurations

Via the compute instance's operating system kernel parameters

In the Custom Image launch options settings

Launch options are defined at the custom image level to dictate firmware, network, and boot behavior.

In the Instance Configuration template parameters

Why: Launch options can be customized when creating a custom image or by updating the launch options of an existing custom image in OCI to specify firmware, network virtualization, and boot options.

You manage an instance pool backed by an autoscaling configuration. The pool reaches its maximum limit of 10 instances due to a traffic spike. A hardware maintenance event triggers a retirement notification for one of the instances in the pool. How does OCI Instance Pools with Autoscaling handle this retired instance?

The instance is terminated, and a new instance is provisioned to replace it, temporarily exceeding the maximum limit if necessary until scaling rules scale it back down.

The instance is terminated and not replaced because the pool is already at its maximum limit.

The instance is replaced automatically by the instance pool to maintain the operational state, managing lifecycle events independently of active autoscaling metrics.

Instance pools manage the lifecycle of instances to ensure the target number of instances are operational, substituting retired instances seamlessly.

The autoscaling configuration must be manually edited to increase the max limit before the instance can be replaced.

Why: Instance pools automatically replace unhealthy or retired instances to maintain the desired capacity. If an instance is retired, the pool provisions a new instance to replace it, even if autoscaling has reached its maximum size, because minimum/desired capacity rules take precedence over instance retirement recovery.

You need to run a dedicated compute instance where no other tenant's virtual instances can share the underlying physical hardware. Which OCI service or feature should you use?

Bare Metal Instances

Dedicated Virtual Machine Hosts

Dedicated VM hosts provide physical hardware isolation for your virtual machine instances.

Instance Pools

Protected Compute Shapes

Why: Dedicated Virtual Machine Hosts provide physical servers dedicated solely to your organization, allowing you to run virtual machines on dedicated hardware.

Your serverless application built on OCI Functions needs to process events coming from OCI Object Storage when a new file is uploaded. What is the primary mechanism to trigger the function?

OCI Events Service

OCI Events captures changes in Object Storage and invokes the target OCI Function.

Direct polling of Object Storage buckets by the function container

Scheduled Cron Jobs in Compute

API Gateway direct integration

Why: OCI Events service listens to resource state changes and can trigger an OCI Function when an object is created in Object Storage.

You are deploying a Container Engine for Kubernetes (OKE) cluster and want to ensure that worker nodes are distributed across separate physical hardware infrastructures to maximize fault tolerance. Which feature should you configure during cluster creation?

Node Pool Fault Domains

Configuring node pools across multiple fault domains ensures node distribution on separate physical hardware.

VCN Route Tables

Kubernetes Horizontal Pod Autoscaler

Pod Security Policies

Why: Fault domains ensure that instances are distributed across physical hardware that has independent power and top-of-rack switches. OKE supports specifying fault domains or availability domains for node pools.

Want more Compute practice?

Domain 5: Storage

All Storage questions

Which OCI storage service is best suited for hosting shared configuration files and home directories for hundreds of Linux compute instances simultaneously using the NFSv3 protocol?

OCI Object Storage

OCI File Storage Service

File Storage Service supports NFSv3 for shared concurrent access across multiple instances.

OCI Archive Storage

OCI Block Volume

Why: File Storage Service (FSS) provides a distributed, scalable, enterprise-grade network file system that supports the NFSv3 protocol for concurrent access from multiple instances.

An administrator wants to create a point-in-time, space-efficient replica of an existing Block Volume within the same availability domain. Which feature should be used to achieve this instantly?

Block Volume Clone

Cloning provides an immediate, space-efficient, point-in-time copy of a volume within the same availability domain.

Block Volume Backup

Cross-Region Replication

Volume Group Backup

Why: Block Volume clones allow you to create an instant, point-in-time, replica of a block volume within the same availability domain without needing to create a full backup first.

A company is running an enterprise application on OCI that requires high IOPS and low latency for its database files. The administrator needs to attach a block volume that can dynamically scale performance beyond its default capacity limits without having to detach the volume. Which Block Volume performance level should be selected?

Higher Performance

Higher Performance delivers the highest IOPS/throughput and supports demanding enterprise database workloads.

Lower Cost

Ultra High Performance

Balanced

Why: Higher Performance provides the highest IOPS and throughput per GB, and volumes can be dynamically scaled up to higher performance tiers or resized without downtime.

An administrator has created a File Storage Service (FSS) file system in a private subnet. Developers need to mount this file system on compute instances across three different availability domains within the same region. What is the correct way to configure network access for FSS?

Attach the Block Volume to multiple instances simultaneously across availability domains.

Deploy a mount target in one subnet and configure security lists to allow NFS traffic from instances in all required subnets.

A mount target provides the IP address and network endpoint, allowing NFS traffic from any authorized subnet in the region.

Create a separate FSS file system in each availability domain and peer them.

Use an OCI FastConnect circuit to route NFS traffic between availability domains.

Why: FSS is regional and can be mounted across availability domains in the same region, provided that mount targets are accessible via appropriate security lists and subnet routes.

An organization requires that all data uploaded to an Object Storage bucket must be automatically encrypted using a master encryption key managed by them in OCI Key Management (KMS), rather than Oracle-managed keys. How can this be enforced?

Apply an IAM policy stating that all PutObject API calls must pass customer secret keys in the header.

Configure the bucket during creation to use a Customer-Managed Key from OCI KMS.

Customer-managed keys in OCI KMS can be assigned at the bucket level to encrypt all stored data.

Enable SSE-C (Server-Side Encryption with Customer-Provided Keys) on every individual file upload via CLI.

Write a custom OCI Functions script triggered by Object Storage events to re-encrypt objects using KMS.

Why: When creating a bucket, you can select 'Use Customer-Managed Keys' and choose your vault and master encryption key from OCI KMS.

A team is using OCI File Storage Service and needs to protect against accidental deletion of files by end users. Which feature should be implemented?

FSS Snapshots

Snapshots provide instant, read-only point-in-time copies of file systems for data recovery.

Object Storage Lifecycle Policies

FSS Object Versioning

Block Volume Volume Groups

Why: File Storage Service supports snapshots, which are read-only, point-in-time versions of a file system that allow users to recover accidental deletions.

Want more Storage practice?

All Observability And Management questions

Domain 6: Observability And Management

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Send email notifications when an object storage bucket size exceeds a threshold.

Create custom time-series metric alarms to monitor CPU and memory utilization.

Automatically ingest and parse custom application log files from compute instances.

Provision and configure cloud infrastructure resources using Terraform configuration files.

Correct. Resource Manager manages infrastructure using Terraform configurations.

Import existing OCI cloud resources into a Terraform state file managed by the stack.

Correct. Resource Manager supports importing existing resources into stack states.

Why: OCI Resource Manager uses Terraform to provision, update, import, and destroy infrastructure stacks.

A company uses OCI Resource Manager to manage its cloud infrastructure using Terraform. A developer has modified a Terraform configuration file locally and needs to preview the changes that Resource Manager will make to the cloud environment before actually applying them. Which Resource Manager job type should be executed?

Plan Job

Correct. A Plan job creates a preview of the infrastructure changes without modifying actual resources.

Apply Job

Import Job

Destroy Job

Why: A 'Plan' job in OCI Resource Manager generates an execution plan, showing what actions Terraform will take when applied against the current state.

You are configuring a custom log in OCI Logging. You want to parse and extract specific fields from unstructured application log lines using search queries. Which log feature allows you to query, analyze, and create visualizations from these ingested logs?

OCI Monitoring Metrics Explorer

OCI Events Rule Builder

OCI Logging Analytics Log Explorer

Correct. Log Explorer allows you to search, parse, and visualize logs using structured queries.

OCI Resource Manager Jobs

Why: OCI Logging Search allows users to query ingested log data using a powerful query language, and Log Analytics offers advanced log analysis features.

Your development team wants to automatically trigger a serverless function whenever a new object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the foundational router to capture this object upload event and invoke the function?

OCI Monitoring Service

OCI Logging Service

OCI Events Service

Correct. Events service detects changes to OCI resources and routes them to targets like OCI Functions.

OCI Resource Manager

Why: The OCI Events service enables you to create automation based on the lifecycle changes of resources in OCI, such as Object Storage creations.

You need to ingest custom application logs from multiple compute instances into OCI Logging. What is the correct sequence of components you must configure within OCI?

Create a Notification Topic, add HTTP endpoints, and enable Audit logs.

Create a Log Group, install and configure the OCI Logging Unified Agent on the instances, and create a custom Log pointing to the agent configuration.

Correct. Custom logs require a Log Group, a properly configured Unified Agent on the instances, and a Log resource.

Create a Resource Manager stack, deploy a Terraform template, and configure an email subscription.

Create a Monitoring Alarm, configure OCI Events, and link them to an Object Storage bucket.

Why: To ship custom logs from compute instances, you install the Unified Agent, configure a log group, and create a log resource associated with a unified agent configuration.

An OCI administrator needs to be notified via email whenever CPU utilization on a critical production compute instance exceeds 90% for a sustained period of 5 minutes. Which combination of services should the administrator configure to achieve this?

OCI Logging Analytics and OCI Notifications service.

OCI Resource Manager and OCI Monitoring service.

OCI Monitoring service (to create an alarm on the CpuUtilization metric) and OCI Notifications service (to send the email).

Correct. An alarm is configured in Monitoring for CpuUtilization, and it publishes messages to a topic in Notifications.

OCI Events service (to listen for CPU threshold events) and OCI Email Delivery service (to dispatch the email).

Why: OCI Monitoring service is used to collect metrics, create alarms based on thresholds, and integrate with the OCI Notifications service to dispatch emails.

Want more Observability And Management practice?