1Z0-1072-26 Practice Test 10 — 10 Questions

Question 1

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compartments nested deeper than one level from the tenancy root must be referenced using their hierarchical path (e.g., ParentComp:ChildComp).. Policy statements require the full path or correct scoping when referencing compartments. If a policy is written in the root compartment referencing a child compartment, the syntax 'compartment ChildComp' is correct only if ChildComp is a direct child; however, if syntax errors or missing family definitions exist, it fails. Wait, let's examine standard syntax: 'Allow group to

in compartment '. If ChildComp is nested deeper, the path must be specified, e.g., 'compartment ParentComp:ChildComp'.

Answer

Policies can never reference child compartments; they must always apply to the entire tenancy.

Answer

The verb 'manage' cannot be used with instances; it must be 'use'.

Answer

The group name must be prefixed with the tenancy name.

Question 2

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

Accepted Answer

Read configuration metadata of resources. The 'manage' verb encompasses all permissions: inspect, read, use, and full creation/deletion capabilities.

Answer

Modify tenancy-level IAM administrator passwords for other users

Answer

Automatically bypass all VCN security lists

Question 3

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Accepted Answer

Policies specify the subject (group or dynamic-group).. OCI IAM policy syntax follows a structured grammar: Allow to

in where .

Answer

Policies must be written in XML format.

Answer

Policies can include explicit 'Deny' statements to override allowances.

Question 4

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

Accepted Answer

Dynamic Routing Gateway (DRG). Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, and a remote peering connection established between the two DRGs.

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Answer

Internet Gateway

Question 5

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. Compartments are managed via the 'compartments' resource type in OCI IAM policies.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 6

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

Accepted Answer

The policy must allow the dynamic group to read secrets and keys in the vault compartment, and the vault key must be accessible.. Vault secrets are encrypted using master encryption keys (master encryption keys managed in OCI Vault). For a dynamic group to read a secret, the policy must grant access to secrets and keys, and the key policy must allow decryption.

Answer

The vault must be placed in the exact same subnet as the compute instance.

Answer

The compute instance must have its root password stored as plain text in the instance metadata.

Answer

You must attach an API signing key directly to the compute instance metadata service.

Question 7

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Accepted Answer

ALL {instance.compartment.id = 'ocid1.compartment..oc1..aaaa...'}. Dynamic groups match compute instances in a compartment using the parameter 'instance.compartment.id'.

Answer

DYNAMIC {compartment.id IN ('ocid1.compartment..oc1..aaaa...')}

Answer

ANY {resource.compartment = 'ocid1.compartment..oc1..aaaa...'}

Answer

MATCH {compartment.ocid == 'ocid1.compartment..oc1..aaaa...'}

Question 8

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

Accepted Answer

Policies defined in a child compartment cannot grant permissions on resources in parent compartments.. Policies must specify a valid scope (compartment or tenancy) and correctly reference subjects and resources.

Answer

Compartment names in policy statements are case-insensitive and can be replaced by user OCIDs.

Answer

Policies are attached directly to individual users rather than groups.

Answer

Policies can grant permissions across completely unrelated tenancies without any endorsement or commitment.

Question 9

You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?

Accepted Answer

Provide the Oracle Industry Partner token to your FastConnect provider so they can complete the provisioning from their network.. When using the FastConnect Provider model, you must provide the Oracle Industry Partner token (OCID) to your telecommunication or network provider so they can provision the circuit from their end.

Answer

Configure the token as the BGP ASN on your on-premises router.

Answer

Attach the token directly to the instance security list.

Answer

Paste the token into the OCI VCN route table settings.

Question 10

Which TWO statements are true regarding OCI IP addresses and VNICs?

Accepted Answer

Every VNIC is assigned at least one primary private IP address.. Every VNIC has a primary private IP address assigned from its subnet CIDR block, and can optionally have secondary private IP addresses and public IP addresses (ephemeral or reserved).

Answer

Private IP addresses are permanent and can never be unassigned from a VNIC.

Answer

A VNIC can only belong to one subnet at a time, but can span multiple VCNs.

Answer

VNICs in private subnets can be assigned public IP addresses directly.