1Z0-1072-26 Practice Exam 2 — 20 Questions

Question 1

You are configuring Data Guard between two Exadata Cloud Service instances across different OCI regions. Which network component is mandatory to facilitate redo transport securely across regional boundaries?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote VCN Peering. Remote VCN Peering connects VCNs in different OCI regions, providing the private network path needed for Data Guard redo transport between Exadata Cloud Service instances in separate regions. Without it, redo traffic would have to traverse the public internet, which is neither secure nor supported for this use case.

Answer

OCI API Gateway

Answer

An Internet Gateway with public IP addresses

Answer

Local VCN Peering gateway

Question 2

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Accepted Answer

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.. When OCI is federated with IDCS, IDCS groups must be mapped to OCI IAM groups before OCI policies can reference them. The correct workflow is to map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy granting that OCI IAM group permission to manage virtual-network-family in the desired compartment. This ensures proper authorization and follows OCI's federation model.

Answer

Assign the NetworkAdmins group directly to the tenancy root compartment via the IDCS console.

Answer

Write a policy directly referencing the IDCS group name 'NetworkAdmins' with no OCI group mapping.

Answer

Create a local user in OCI IAM for every member of the IDCS 'NetworkAdmins' group and assign them roles.

Question 3

You need to run an OCI Function that connects to an Oracle Autonomous Database secured within a private subnet. How should you configure the function to access the database securely without exposing it to the public internet?

Accepted Answer

Attach the function application to a private subnet within your VCN using VCN configuration.. Attaching the function application to a private subnet in your VCN lets the function's execution environment get an IP in that subnet and reach the Autonomous Database privately via the VCN's routing and security rules. This is the supported OCI Functions pattern for private resource access without public exposure.

Answer

Use an API Gateway with a public endpoint and route database queries through HTTP headers.

Answer

Configure a public IP address on the function execution environment.

Answer

Functions cannot access private subnets; you must use an internet gateway.

Question 4

When configuring an alarm, what does the 'suppression' feature do?

Accepted Answer

Temporarily stops notifications for the alarm. Suppression allows you to temporarily disable notifications for an alarm without deleting or disabling the alarm itself.

Answer

Deletes all historical logs

Answer

Prevents the resource from scaling

Answer

Disables all metrics for the resource

Question 5

What is the primary function of an OCI NAT Gateway?

Accepted Answer

To allow private subnet instances to initiate outbound connections to the internet while blocking inbound connections.. A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software patches) without accepting inbound connections from the internet.

Answer

To peer two VCNs in the same region.

Answer

To allow inbound internet traffic to reach private database instances securely.

Answer

To connect on-premises datacenters to OCI VCNs.

Question 6

Which service should you use to migrate physical data centers to OCI via physical hardware shipping?

Accepted Answer

Data Transfer Service. Data Transfer Service uses physical appliances to move data.

Answer

Storage Gateway

Answer

FastConnect

Answer

Object Storage replication

Question 7

You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?

Accepted Answer

Backend servers are taking longer to process requests than the load balancer idle timeout threshold.. A 504 Gateway Timeout from an OCI Public Load Balancer almost always means the backend did not respond within the listener's configured idle/response timeout window. When the LB's idle timeout (default 60 seconds for HTTP listeners) expires before the backend finishes processing, the LB closes the connection and returns 504 to the client. The fix is to raise the idle timeout or optimize backend response time.

Answer

The Internet Gateway has exceeded its bandwidth limit.

Answer

The NAT Gateway is blocking incoming HTTP traffic.

Answer

The VCN route table is missing a default route.

Question 8

You are planning a Disaster Recovery strategy for an Oracle Base Database System using Oracle Data Guard on OCI. You need the standby database to be open in read-only mode for reporting queries while simultaneously applying redo data from the primary database. Which Data Guard mode should you configure?

Accepted Answer

Active Data Guard. Active Data Guard enables physical standby databases to be open for read-only queries while performing real-time apply of redo from the primary database.

Answer

Snapshot Standby

Answer

Logical Standby in read-write mode

Answer

Traditional Physical Standby (Mount mode)

Question 9

Which THREE of the following are valid lifecycle policy actions?

Accepted Answer

Delete. Delete, Archive, and aborting multipart uploads are valid.

Answer

Compress

Answer

Encrypt

Question 10

You are running a stateful application inside an OKE cluster that requires persistent storage backed by OCI Block Volumes. When a pod is rescheduled to a different worker node due to a node failure, how does the Persistent Volume (PV) behave?

Accepted Answer

The OCI Block Volume CSI driver automatically detaches the volume from the old node and attaches it to the new worker node.. The OCI Block Volume CSI driver integrates with OKE to manage the lifecycle of PersistentVolumes backed by Block Volumes. When a pod is rescheduled to a new node, the CSI driver automatically detaches the volume from the failed node and attaches it to the new node, then mounts it to the pod. This is a core feature of the CSI driver and requires no manual intervention.

Answer

You must manually log into the OCI Console, detach the volume, and attach it to the new worker node.

Answer

The persistent volume is converted to Object Storage automatically.

Answer

The data is permanently lost because block volumes cannot move across worker nodes.

Question 11

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

Accepted Answer

NAT Gateway. A NAT (Network Address Translation) Gateway allows private subnet instances to initiate outbound connections to the internet while preventing any unsolicited inbound internet traffic.

Answer

Local Peering Gateway

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Question 12

You are planning to deploy a high-performance computing (HPC) cluster on OCI requiring extremely high packet per second (PPS) and ultra-low latency between compute nodes. Which feature must you utilize?

Accepted Answer

Cluster Networks with RDMA (Remote Direct Memory Access). Cluster Networks with RDMA provide a high-bandwidth, ultra-low-latency interconnect specifically designed for HPC workloads on OCI. RDMA allows direct memory-to-memory transfers between compute nodes, bypassing the OS kernel and CPU, which drastically reduces latency and increases packet per second (PPS) throughput. This is the only OCI feature that delivers the required performance for tightly-coupled HPC applications.

Answer

NAT Gateway with bandwidth throttling disabled

Answer

Public IP addresses on all compute nodes

Answer

OCI Local Peering Gateway

Question 13

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Accepted Answer

Dynamic Routing Gateway (DRG) attached to the VCN. Option B is correct because the Dynamic Routing Gateway (DRG) is the OCI-side virtual router that must be attached to the VCN to terminate the IPSec tunnels of a Site-to-Site VPN; without a DRG there is no OCI endpoint for the VPN. Option E is correct because the Customer-Premises Equipment (CPE) object represents the public IP address of your on-premises VPN gateway, and it is a required building block referenced when creating the IPSec connection that forms the redundant tunnels. The Service Gateway (A) is only for private access to OCI services such as Object Storage, the Local Peering Gateway (C) connects VCNs within the same region, and the NAT Gateway (D) provides outbound internet access for private subnets — none of these terminate or represent an IPSec VPN endpoint, so they are not required for a Site-to-Site VPN.

Answer

Service Gateway

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Question 14

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Accepted Answer

Public subnets have route table rules pointing to an Internet Gateway, while private subnets do not.. Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.

Answer

Private subnets require IPv6 addressing.

Answer

Private subnets cannot use Security Lists.

Answer

Public subnets cannot communicate with Oracle Database services.

Question 15

Which TWO features are supported by OCI File Storage Service (FSS)? (Choose two.)

Accepted Answer

Encryption at rest using customer-managed keys in OCI KMS. OCI File Storage Service supports snapshots for data protection and encryption using customer-managed keys via OCI KMS.

Answer

Block-level multi-attach with read-write access across availability domains

Answer

Automatic tiering from file storage to Archive Storage

Answer

Native integration with Block Volume replication policies

Question 16

Which TWO of the following statements are true regarding OCI Compute Instance Maintenance and Events? (Choose two.)

Accepted Answer

OCI sends notifications when underlying infrastructure maintenance is scheduled for a compute instance.. Option D is correct because OCI publishes infrastructure maintenance events for compute instances through the OCI Notifications service and the Console, so customers receive advance notice when underlying hardware maintenance is scheduled. Option E is correct because for certain maintenance events, such as those that require a reboot, customers can proactively reboot the instance from the Console or CLI to apply the maintenance at a convenient time rather than waiting for the scheduled window. Option A is false because maintenance events do not cause permanent data loss on boot volumes; data on block and boot volumes persists across reboots and maintenance. Option B is false because maintenance events can be viewed and managed through the OCI Console, CLI, SDKs, and APIs, not only Terraform. Option C is false because customers do have visibility into hardware retirement and maintenance schedules via notifications and the Console, allowing preemptive action.

Answer

Maintenance events cause permanent data loss on attached boot volumes.

Answer

Instance maintenance events can only be managed using Terraform scripts.

Answer

Customers have zero visibility into hardware retirement schedules and cannot take preemptive action.

Question 17

You are setting up an autoscaling configuration for an instance pool. You want the pool to scale out when CPU utilization exceeds 80% and scale in when CPU utilization drops below 20%. What type of autoscaling policy should you create?

Accepted Answer

Metric-based autoscaling policy. Metric-based autoscaling policies allow you to define rules based on metrics such as CPU or memory utilization to scale out or scale in instances automatically.

Answer

Event-driven autoscaling policy

Answer

Schedule-based autoscaling policy

Answer

Manual capacity override policy

Question 18

What is the primary function of the OCI Compute Instance Oracle Cloud Agent?

Accepted Answer

To perform plugin-based management tasks like monitoring, patching, and run commands on the instance.. The Oracle Cloud Agent is a lightweight process that runs on OCI compute instances and hosts plugins for management tasks such as monitoring, patching (OS Management), running commands, and collecting metrics. It is the agent that enables services like the Monitoring plugin, Compute Instance Run Command, and Vulnerability Scanning. Its primary function is plugin-based instance management, not networking or orchestration.

Answer

To route TCP/IP packets across VCN subnets at the hypervisor level.

Answer

To provide serverless execution environments for OCI Functions.

Answer

To manage Kubernetes cluster worker node lifecycles.

Question 19

Your development team needs to access an Autonomous Transaction Processing (ATP) database instance securely over the internet. What artifact must be downloaded and distributed to clients to establish a secure, encrypted connection?

Accepted Answer

A Client Credentials Wallet (wallet.zip) file. To connect to an Autonomous Transaction Processing (ATP) database over the internet with encryption, clients must use a Client Credentials Wallet (wallet.zip). This wallet contains the credentials, connection strings (tnsnames.ora, sqlnet.ora), and the SSL/TLS certificates required for mutual TLS (mTLS) authentication. It is downloaded from the OCI Console and distributed to each client that needs secure access.

Answer

An Identity and Access Management (IAM) API signing key

Answer

An SSH Private Key (.ppk) file

Answer

A Transparent Data Encryption (TDE) master key file

Question 20

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Accepted Answer

Add a route in the private subnet route table with a destination of 0.0.0.0/0 and the target as the NAT Gateway.. A NAT Gateway allows instances in a private subnet to initiate connections to the internet, but prevents inbound connections from the internet. The route table associated with the private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Answer

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Answer

Configure a Service Gateway with a route to 0.0.0.0/0.

Answer

Assign a public IP address to the instances within the private subnet.