1Z0-1072-26 Practice Test 11 — 15 Questions

Question 1

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Tag Namespace, define a Tag Key within it, apply the tag to resources, and reference the tag in an IAM policy condition.. Tag-based access control requires creating a Tag Namespace, defining Tag Keys within that namespace, applying the tags to resources or requests, and then using tag conditionals in IAM policies.

Answer

Create an IAM group, add users, assign free-form tags directly to the users, and write a policy.

Answer

Create a Dynamic Group, apply a tag namespace to the tenancy root, and assign compartment quotas.

Answer

Define a Resource Principal, attach a tag to the instance, and create a cross-region replication policy.

Question 2

Which TWO protocols are supported for health checks by OCI Load Balancer backend sets?

Accepted Answer

TCP. OCI Load Balancers support HTTP, HTTPS, and TCP health checks to monitor the availability of backend servers.

Answer

SMTP

Answer

FTP

Answer

SSH

Question 3

What is the primary function of OCI IAM federation?

Accepted Answer

To allow users authenticated by an external Identity Provider to access OCI resources using single sign-on (SSO).. Federation enables external identity providers (like Microsoft Entra ID or Okta) to authenticate users seeking access to OCI without requiring local OCI user accounts.

Answer

To replicate compute instances across multiple cloud providers.

Answer

To share VCN routing tables between different tenancies.

Answer

To synchronize Object Storage buckets across different regions.

Question 4

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Accepted Answer

The defined tag namespace and key must be created prior to launching the tagged instance.. Tag-based dynamic group rules require the tag namespace and key to exist, and the compute instance must be tagged with that exact defined tag.

Answer

The compute instance must have an API signing key uploaded to its metadata.

Answer

The dynamic group must be assigned a static user password.

Answer

The compute instance must be rebooted every 24 hours to maintain dynamic group membership.

Question 5

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

Accepted Answer

A Private Virtual Circuit allows direct access to your VCN using private IP addresses.. FastConnect virtual circuits can be public (for accessing public Oracle services without internet) or private (for extending your datacenter to your VCN). They support static routing or BGP dynamic routing.

Answer

Only static routing is supported on FastConnect public virtual circuits.

Answer

You cannot attach a FastConnect virtual circuit to a Dynamic Routing Gateway.

Answer

FastConnect virtual circuits must traverse the public internet with IPSec encryption.

Question 6

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Accepted Answer

Identity Domains support advanced features like OAuth, SAML integration, and passwordless authentication.. Identity Domains provide advanced governance features, user management, and can be configured as free or paid tiers depending on features required.

Answer

Identity Domains replace Virtual Cloud Networks entirely.

Answer

Every tenancy is restricted to having exactly one Identity Domain that cannot be changed.

Answer

Identity Domains store compute instance virtual disk images.

Question 7

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

Accepted Answer

Associate VCN-1 and VCN-2 attachments with different DRG route tables, ensuring only VCN-1's route table imports routes from the on-premises attachment.. In DRG version 2, you attach VCN-1 and VCN-2 to the DRG, and associate them with separate DRG route tables. The route table for VCN-1's attachment includes an import rule for the on-premises attachment, while VCN-2's route table does not.

Answer

Configure a NAT Gateway on VCN-2 to drop on-premises packets.

Answer

Place VCN-1 and VCN-2 in different OCI tenancies.

Answer

Attach VCN-2 to an Internet Gateway instead of the DRG.

Question 8

Which THREE components are required when configuring OCI VCN Remote Peering between two regions?

Accepted Answer

Remote Peering Connection (RPC) between the two DRGs. Remote VCN peering across regions requires a Dynamic Routing Gateway (DRG) attached to each VCN, a Remote Peering Connection (RPC) established between the two DRGs, and matching route table/security rules.

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway in both VCNs

Question 9

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Accepted Answer

Instance principals allow compute instances to make API calls to OCI services securely without storing credentials on the instance.. Instance principals allow compute instances to make API calls securely without managing credentials, authorized via dynamic groups and policies.

Answer

Instance principals only function when connected to an on-premise Active Directory domain controller.

Answer

Dynamic groups require human users to manually approve every API call made by the instance.

Answer

Compute instances must have static username and password credentials configured in their environment variables.

Question 10

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)

Accepted Answer

Download the Identity Provider metadata XML file from your IdP.. Setting up federation in OCI involves downloading/obtaining the IdP metadata XML file, uploading that metadata file to create the Identity Provider in OCI, and configuring group mappings between IdP groups and OCI groups. Local user password generation and manual IAM user creation are not part of IdP federation.

Answer

Enable multi-factor authentication (MFA) exclusively by modifying local OCI user security settings.

Answer

Manually create individual IAM users in OCI and assign them local passwords matching their enterprise credentials.

Question 11

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

Accepted Answer

Virtual Cloud Networks (VCNs). DRG version 2 supports attachments to VCNs, Site-to-Site VPN IPSec connections, FastConnect virtual circuits, and remote peer DRGs for cross-region peering.

Answer

Internet Gateways

Answer

Local Peering Gateways (LPGs)

Question 12

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

Accepted Answer

Manually create individual IAM user accounts for each auditor in the Oracle Cloud Infrastructure Console.. To federate an IdP, you must configure the IdP, create an IdP group, map that IdP group to an OCI group, and write a policy granting the OCI group access. You do not manually create local IAM users for the federated users.

Answer

Map the Identity Provider's user group to an Oracle Cloud Infrastructure IAM group.

Answer

Create an IAM policy granting the mapped OCI group read access to the FinanceAudits compartment.

Answer

Configure the Identity Provider (IdP) metadata XML file in the OCI IAM identity provider console.

Question 13

Which THREE administrative tasks require membership in the tenancy Administrators group or equivalent high-level IAM privileges? (Choose three.)

Accepted Answer

Writing and modifying policies in the tenancy root compartment. High-level administrative tasks include creating identity providers, managing root-level policies, and setting tenancy limits.

Answer

Uploading a personal SSH public key to a standard user profile

Answer

Launching a basic compute instance in a developer compartment

Question 14

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Accepted Answer

Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.. Backend instances must allow incoming traffic from the load balancer's subnet or security list on the application ports. Updating the backend instance security lists or NSGs resolves the timeout.

Answer

Configure a NAT Gateway on the load balancer subnet.

Answer

Change the load balancer shape from Flexible to 100 Mbps.

Answer

Attach an Internet Gateway to the backend subnet route table.

Question 15

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

Accepted Answer

Identity & Security -> Compartments. Compartments can only be created within the root tenancy or inside an existing parent compartment. You navigate to Identity & Security, select Compartments, and choose the parent compartment.

Answer

Billing & Cost Management -> Compartment Management

Answer

Networking -> Virtual Cloud Networks -> Compartment Association

Answer

Governance & Administration -> Tenancy Explorer