1Z0-1072-26 Practice Exam 3 — 20 Questions

Question 1

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 2

Which TWO tasks can an administrator perform when managing database homes in Oracle Base Database Service? (Choose two.)

Accepted Answer

Apply Database Updates (Database Software Patches) to the DB home.. Option A is correct because Oracle Base Database Service allows administrators to apply database updates (database software patches) to a DB home, which patches the Oracle Database software binaries in that home. Option E is correct because a single DB home can host multiple databases as long as they all run the same Oracle Database software version, since the home provides one set of binaries. Option B is wrong because customers cannot modify the hypervisor's physical CPU hardware model in this managed service. Option C is wrong because deleting a DB home requires or removes its associated databases; they cannot all keep running unaffected. Option D is wrong because a DB home cannot be converted into an Autonomous Container Database, which is a separate Autonomous Database construct.

Answer

Modify the underlying physical CPU hardware model of the hypervisor.

Answer

Delete the DB home while keeping all associated databases running unaffected.

Answer

Convert the database home into an Autonomous Container Database.

Question 3

An autoscaling configuration is attached to your instance pool. You notice that instances are scaling out correctly based on CPU utilization, but you want to ensure that scaling events do not happen too frequently in response to brief traffic spikes. Which setting should you adjust?

Accepted Answer

The Autoscaling Cooldown Period. The Autoscaling Cooldown Period is the exact setting that prevents rapid, repeated scaling actions by enforcing a wait time after each scale event before another can trigger. This smooths out reactions to brief CPU spikes so the pool does not thrash between scale-out and scale-in. Adjusting it directly addresses the requirement to avoid frequent scaling events.

Answer

The Instance Pool capacity limits

Answer

The VCN DHCP Options timeout value

Answer

The Monitoring service metric polling interval

Question 4

You are planning to restore an Oracle Base Database Service DB system from an object storage backup. Which backup types are supported by OCI for creating a new DB system?

Accepted Answer

Automated backups or manual full backups. Oracle Base Database Service on OCI supports restoring from automated backups or manual full backups stored in Object Storage. These backup types contain the full database state needed to provision a new DB system. Incremental-only or Data Pump exports are not supported as direct sources for creating a new DB system via the OCI console or API.

Answer

OCI Block Volume snapshots

Answer

Only incremental manual backups

Answer

Only Data Pump export dump files

Question 5

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. The policy verb 'manage' on the 'compartments' resource in the tenancy grants full lifecycle control over compartments (create, update, delete, move) without conferring broader tenancy-admin rights. This is the least-privilege way to delegate compartment creation to TeamLeads. It does not grant identity administration or tenancy-level control.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 6

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Accepted Answer

Service Gateway. An OCI Service Gateway provides private access from a VCN to supported Oracle services, including OCI Logging and Logging Analytics, without traversing the public internet. Traffic from instances in a private subnet routes through the service gateway to the Oracle service's public endpoint using the service's CIDR label in a route rule. This satisfies the requirement of reaching the logging endpoint while keeping the subnet private and blocking general internet access.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 7

What is the default replication method for Object Storage buckets?

Accepted Answer

Automatic replication. Object Storage data is automatically replicated across three Fault Domains within an AD.

Answer

Manual replication

Answer

RAID 5

Answer

Not replicated

Question 8

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Accepted Answer

Provision and configure cloud infrastructure resources using Terraform configuration files.. Option D is correct because OCI Resource Manager is Oracle's managed Terraform service: a stack is built from Terraform configuration (HCL) and jobs such as plan/apply provision and configure OCI infrastructure resources declaratively. Option E is correct because Resource Manager supports importing existing OCI resources into a stack's Terraform state, typically via the "Import state" / terraform import workflow, so previously created resources become tracked and manageable by that stack. Options A, B, and C are incorrect because they describe monitoring and logging capabilities, not Resource Manager: threshold-based bucket-size email alerts are handled by OCI Monitoring alarms with Notifications, custom time-series metric alarms for CPU/memory are created in OCI Monitoring (with agent metrics), and ingesting/parsing application logs is done by the OCI Logging service (and Logging Analytics), none of which are functions of Resource Manager stacks.

Answer

Send email notifications when an object storage bucket size exceeds a threshold.

Answer

Create custom time-series metric alarms to monitor CPU and memory utilization.

Answer

Automatically ingest and parse custom application log files from compute instances.

Question 9

You are configuring an Object Storage bucket and want to ensure that if an object is accidentally overwritten or deleted, previous versions can still be retrieved. Which feature should you enable?

Accepted Answer

Object Versioning. Object Versioning preserves multiple variants of an object in the same bucket, protecting against accidental overwrites and deletions.

Answer

Cross-Region Replication

Answer

Object Storage Lifecycle Management

Answer

Bucket Retention Rules

Question 10

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Dynamic group policies in OCI are evaluated only when the request is authenticated using instance principals (or resource principals), which derive identity from the instance's metadata and certificates. When the developer script uses a user's API key or auth token, the request is authorized against that user's IAM policies, not the dynamic group's. Since the user has no matching policy granting object read/write, the request returns 403 Forbidden. The dynamic group membership is irrelevant to user-credential API calls.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.

Question 11

You are deploying a microservices application on OKE and want to implement zero-downtime rolling deployments for your pods. Which Kubernetes deployment strategy and configuration parameter should you utilize?

Accepted Answer

RollingUpdate strategy with maxSurge and maxUnavailable configured. The RollingUpdate strategy is Kubernetes' native mechanism for replacing pods incrementally so that some old replicas remain available while new ones come up, enabling zero-downtime deployments. The maxSurge parameter controls how many extra pods above the desired count can be created during the rollout, and maxUnavailable controls how many pods below the desired count can be temporarily unavailable. Tuning both ensures capacity is maintained throughout the update.

Answer

Horizontal Pod Autoscaler with metric-based CPU triggers

Answer

Static Pod assignment via node selectors

Answer

Recreate strategy with immediate termination of all old pods

Question 12

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

Accepted Answer

Add a route rule with destination service cidr (e.g. All Services in Oracle Services Network) and target as the Service Gateway.. To direct traffic to the Service Gateway, the subnet route table must have a route rule where the destination is the Oracle Services Network (or a specific service region prefix) and the target is the Service Gateway.

Answer

No route table changes are required once the Service Gateway is attached to the VCN.

Answer

Add a route rule pointing to the Dynamic Routing Gateway.

Answer

Add a route rule with destination 0.0.0.0/0 and target as the Service Gateway.

Question 13

Which TWO components are involved when routing traffic from an OCI private subnet to an on-premises datacenter via FastConnect?

Accepted Answer

Dynamic Routing Gateway (DRG). Traffic from a private subnet to on-premises via FastConnect requires a route table rule pointing to the Dynamic Routing Gateway (DRG), and the FastConnect virtual circuit terminating on that DRG.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 14

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Accepted Answer

The tenancy root compartment. Option C is correct because every new OCI tenancy is created with a single root compartment that serves as the top-level container for all resources and cannot be deleted. Option D is correct because OCI automatically provisions a default group named Administrators and an initial tenancy administrator user during tenancy creation, and this user is the first identity that can manage the tenancy. Option A is incorrect because Autonomous Data Warehouse instances are not created by default and must be provisioned by the customer. Option B is incorrect because Object Storage buckets, including archive-tier buckets, are not pre-created in a new tenancy. Option E is incorrect because Kubernetes clusters, including production clusters, are not pre-configured and must be created by the user.

Answer

A fully configured Autonomous Data Warehouse

Answer

A 10TB Object Storage archive bucket

Answer

A pre-configured Kubernetes production cluster

Question 15

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Accepted Answer

In the IPSec Connection details page under the DRG. When you create an IPSec connection under the DRG details, OCI automatically provisions two redundant VPN tunnels, displaying their respective public IP addresses in the IPSec Connection details page.

Answer

In the NAT Gateway configuration settings

Answer

In the FastConnect Virtual Circuit overview

Answer

In the VCN Details page under Internet Gateway

Question 16

An OCI administrator needs to store large amounts of unstructured data that is accessed infrequently, but must be retained for compliance purposes for at least 5 years. Data retrieval times of up to 4 hours are acceptable. Which OCI Object Storage tier should be used?

Accepted Answer

Archive Storage Tier. OCI Archive Storage is designed for data that is infrequently accessed and requires long retention periods, offering the lowest storage cost with a time-to-first-byte retrieval time of up to 4 hours.

Answer

Object Storage Standard Tier

Answer

Object Storage Infrequent Access Tier

Answer

File Storage Service

Question 17

Which OCI Object Storage feature enables users without an OCI account to securely download or upload a specific object via a generated URL with a defined expiration time?

Accepted Answer

Pre-Authenticated Requests (PAR). Pre-authenticated requests (PAR) provide a way to let users securely access or upload a specific object or bucket without requiring credentials, using a unique URL with an expiration time.

Answer

OCI IAM Federation

Answer

API Signing Keys

Answer

Object Storage Public Access Buckets

Question 18

Which TWO of the following are valid Object Storage tiers in OCI?

Accepted Answer

Archive. Standard and Archive are the primary tiers in OCI Object Storage.

Answer

Fast Storage

Answer

Temporary Storage

Answer

Cold Storage

Question 19

You have an existing compute instance with a standard boot volume size of 47 GB. Your application requires 200 GB. You successfully increase the boot volume size to 200 GB in the OCI Console. However, when you run `df -h` inside the guest OS, it still shows 47 GB. What is the cause?

Accepted Answer

The guest OS partition and file system have not yet been resized to claim the expanded storage.. While OCI resizes the physical storage block device at the hypervisor level, the guest operating system partition and file system must be manually or automatically extended to utilize the new space.

Answer

OCI does not support expanding boot volumes online; you must reboot the instance.

Answer

You must detach the boot volume and reattach it for the OS to notice the change.

Answer

Boot volumes have a hard cap of 50 GB unless converted to Block Volumes.

Question 20

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

Accepted Answer

object-family. OCI IAM policies govern access to virtually all OCI resources, including compute and object storage.

Answer

employee-badge-readers

Answer

corporate-laptop-hardware

Answer

office-wifi-routers