1Z0-1072-26 Practice Test 12 — 15 Questions

Question 1

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

Accepted Answer

Deleting a compartment requires that all resources within that compartment must first be terminated or deleted.. Compartments are logical isolations across regions and are completely global within a tenancy. IAM policies are inherited from parent compartments down to child compartments. Options B and D accurately describe compartment and policy behavior.

Answer

A user can belong to only one IAM group within an entire OCI tenancy.

Answer

IAM policies are evaluated at the tenancy root level and cannot be defined inside a specific compartment.

Answer

Compartments are region-specific entities, meaning a compartment created in Ashburn is automatically isolated from Phoenix.

Question 2

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Accepted Answer

Service Gateway. A Service Gateway enables private access to regional OCI services (such as Object Storage, Logging, and Database) without requiring internet access.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 3

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

Accepted Answer

Mismatched IKE security parameters (Phase 1 or Phase 2) or blocked UDP ports 500/4500 on the firewall.. VPN tunnel down status is commonly caused by mismatched IKE security parameters (Phase 1/Phase 2 pre-shared key, encryption/authentication algorithms, Diffie-Hellman groups) or blocked UDP ports 500/4500 on local firewalls.

Answer

The NAT Gateway is misconfigured.

Answer

The FastConnect virtual circuit is disabled.

Answer

The VCN subnet route table is missing a route to 0.0.0.0/0.

Question 4

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

Accepted Answer

VCN Resolver custom forwarders. The VCN Resolver handles DNS resolution for instances. You can configure custom DNS forwarders in the VCN Resolver to forward queries for specific private domains to internal DNS servers while resolving internet queries normally.

Answer

Internet Gateway DNS proxy

Answer

Service Gateway name server

Answer

NAT Gateway DNS translation

Question 5

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

Accepted Answer

A Private DNS Zone associated with the VCN via a VCN view. To resolve records in a private domain within a VCN, you must create a Private DNS Zone and associate it with your VCN using a VCN view.

Answer

A Public DNS Zone with an Internet Gateway

Answer

A Service Gateway pointing to the DNS service

Answer

A NAT Gateway with DNS forwarding rules

Question 6

What is the primary function of an OCI Dynamic Routing Gateway (DRG)?

Accepted Answer

To provide a private connection between your VCN and on-premises networks or other VCNs.. A DRG is a virtual router that provides a path for private traffic between your VCN and on-premises networks (via FastConnect or Site-to-Site VPN) or other VCNs.

Answer

To provide public internet access for public subnets.

Answer

To load balance web requests across backend servers.

Answer

To provide access to regional Object Storage.

Question 7

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

Accepted Answer

OCI DNS. OCI DNS is the managed Domain Name System service that enables customers to create and manage public and private DNS zones.

Answer

OCI Load Balancer

Answer

OCI VCN Resolver

Answer

OCI Traffic Management

Question 8

What is the maximum MTU (Maximum Transmission Unit) supported on standard OCI VCN virtual network interfaces (VNICs)?

Accepted Answer

9000 bytes (Jumbo Frames). Standard OCI VNICs support an MTU of 9000 bytes (Jumbo Frames), as well as the standard 1500 bytes.

Answer

576 bytes

Answer

1500 bytes

Answer

65535 bytes

Question 9

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

Accepted Answer

DRG route tables and import/export route distribution maps. DRG route tables allow you to customize how traffic flows between attachments. By using DRG attachments and custom route tables on the DRG, you can route traffic from Spoke1 to the Hub VCN attachment, and then from the Hub back out to Spoke2.

Answer

Local Peering Gateways with cross-region peering attachments

Answer

Virtual Circuit FastConnect multipath routing

Answer

Internet Gateway route translation rules

Question 10

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

Accepted Answer

Web: 172.16.1.0/24, App: 172.16.2.0/24, DB: 172.16.3.0/26. Subnet CIDRs must be non-overlapping and sized appropriately. For example, 172.16.1.0/24 (256 addresses), 172.16.2.0/24 (256 addresses), and 172.16.3.0/26 (64 addresses) fit within 172.16.0.0/16 without overlapping.

Answer

Web: 10.0.1.0/24, App: 10.0.2.0/24, DB: 10.0.3.0/24

Answer

Web: 172.16.0.0/15, App: 172.16.0.0/16, DB: 172.16.1.0/24

Answer

Web: 172.16.1.0/24, App: 172.16.1.0/24, DB: 172.16.3.0/24

Question 11

When designing network security in OCI, you can use Security Lists and Network Security Groups (NSGs). Which TWO statements accurately compare or contrast them?

Accepted Answer

Security Lists apply to all VNICs in a given subnet, while NSGs apply to a specifically selected set of VNICs.. Security Lists apply to all VNICs in a subnet, whereas NSGs are applied to a specific set of VNICs chosen by you. Both support stateful and stateless rules.

Answer

You cannot use Security Lists and Network Security Groups together for the same VNIC.

Answer

Security Lists can reference other Security Lists by OCID across different VCNs.

Answer

Network Security Groups can only contain stateless rules, whereas Security Lists only contain stateful rules.

Question 12

A database administrator requires a Block Volume attached to an Oracle Linux compute instance to deliver ultra-high IOPS and throughput with minimal latency for a high-transaction workload. Which volume performance level should be selected?

Accepted Answer

Ultra High Performance. Higher VPU (Volume Performance Units) settings such as Higher Performance or Ultra High Performance provide the necessary IOPS and throughput required for mission-critical, low-latency databases.

Answer