1Z0-1072-26 Practice Test 23 — 15 Questions

Question 1

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

Accepted Answer

Compartment OCID (instance.compartment.id). Option B is correct because instance.compartment.id is a valid variable in OCI dynamic group matching rules, allowing rules to match compute instances based on the OCID of the compartment they reside in. Option C is correct because instance.id is a supported variable that matches a specific compute instance by its OCID. Option D is correct because tag.namespace.tagkey is a valid matching-rule variable, enabling rules to match instances based on defined tags applied to them. Option A is incorrect because dynamic group matching rules cannot evaluate operating system user password hashes, as these are not OCI resource metadata. Option E is incorrect because the public IP address of the user launching the instance is not a supported attribute in dynamic group matching rules.

Answer

The operating system user password hash

Answer

The public IP address of the user launching the instance

Question 2

Which TWO types of groups exist in OCI IAM? (Choose two.)

Accepted Answer

Dynamic groups. In OCI IAM, the two supported group types are dynamic groups (B) and standard user groups (C). Dynamic groups (B) are correct because they match compute instances (and other resources) using rules written against resource attributes, allowing those resources to be granted permissions as principals without individual credentials. Standard user groups (C) are correct because they are the ordinary groups that contain IAM users, and policies grant access to those users collectively by referencing the group. The remaining options are not OCI IAM group types: compartment security groups (A) and virtual network groups (D) are not constructs in OCI IAM (network security is handled via NSGs and security lists), and billing resource groups (E) do not exist as an IAM group category.

Answer

Compartment security groups

Answer

Virtual network groups

Answer

Billing resource groups

Question 3

Which THREE of the following features or actions are supported when managing OCI Custom Images? (Choose three.)

Accepted Answer

You can copy a custom image directly to another OCI region using native cross-region image copy features.. Option A is correct because OCI supports native cross-region image copy, allowing a custom image to be copied directly to another region via the Console, CLI (oci compute image copy), or API without manually exporting and importing. Option B is correct because a custom image can be specified as the boot source image when creating an instance configuration, which is then used by an instance pool to launch instances. Option D is correct because OCI lets you export a custom image to an Object Storage bucket, producing an OCI-format or QCOW2/VMDK file that can be downloaded and used elsewhere. Option C is not supported because custom images are static artifacts; they do not automatically pull OS patches from Oracle update servers, so patching must be handled by the customer. Option E is not supported because OCI provides no Console file manager to mount and edit files inside an image; you must launch an instance from the image, modify it, and create a new image.

Answer

Custom images automatically sync operating system patches from Oracle update servers daily.

Answer

You can directly mount and edit files inside a custom image using the OCI Console file manager.

Question 4

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

Accepted Answer

Users authenticate against the external Identity Provider, not OCI IAM.. Option A is correct because in OCI SAML 2.0 federation, authentication occurs at the external Identity Provider (IdP), which issues the SAML assertion that OCI IAM consumes to establish the session. Option B is correct because federated users are authenticated by the external IdP, so OCI IAM does not store or require a local password for them. Option C is correct because OCI IAM maps external IdP groups to OCI IAM groups, and those OCI IAM group memberships drive authorization via policies. Option D is incorrect because federated users can access OCI through the Console, CLI, and SDKs using token-based or browser-based federation flows. Option E is incorrect because federation avoids manually creating local user profiles for every employee; users are provisioned or mapped through the IdP integration.

Answer

Federated users cannot access OCI via the CLI or SDKs.

Answer

Federation requires manual creation of local user profiles for every employee on day one.

Question 5

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) via security rules. Option A is correct because OCI IAM lets administrators enforce Multi-Factor Authentication through security rules (sign-on policies) in an identity domain, adding a second authentication factor that protects accounts even if a password is compromised. Option B is correct because API signing keys are long-lived credentials; rotating them periodically and revoking unused or compromised keys limits the window in which a leaked private key can be abused against OCI APIs. Option D is correct because configuring password policies in OCI IAM to govern complexity, length, reuse, and expiration strengthens resistance to brute-force and credential-stuffing attacks. Option C is not appropriate because disabling audit logging removes visibility into administrative actions and weakens security and compliance rather than securing accounts. Option E is not appropriate because granting root compartment administrator privileges to temporary contractors violates least privilege and dramatically increases the risk of unauthorized or accidental changes.

Answer

Disable all audit logging to hide administrative actions

Answer

Assign root compartment administrator privileges to all temporary contractors

Question 6

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Accepted Answer

manage. In OCI IAM policy statements, the verb defines the level of access granted on a resource-type, and the valid verbs are inspect, read, use, manage. Option A (manage) is correct because it is the highest-level verb, granting full control including create, read, update, and delete on the specified resources. Option E (inspect) is correct because it is the lowest-level verb, allowing a user to list resources without accessing their contents or metadata beyond basic listing. Option B (write) is not a valid OCI IAM policy verb; write-style permissions are covered by manage or use depending on the resource. Option C (delete) is not a standalone verb in OCI policies; deletion is included within manage. Option D (execute) is not a valid OCI IAM policy verb; execution of functions or instances is granted via use or manage.

Answer

write

Answer

delete

Answer

execute

Question 7

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Accepted Answer

IPSec Connection between the CPE and the DRG. Option B is correct because the IPSec Connection is the actual tunnel resource in OCI that links the on-premises CPE to the DRG, carrying encrypted traffic over the internet using IKE/IPSec. Option D is correct because a Dynamic Routing Gateway (DRG) must be attached to the VCN to serve as the OCI-side termination point for the Site-to-Site VPN and to route traffic to and from the on-premises network. Option E is correct because the Customer-Premises Equipment (CPE) object is an OCI representation of the on-premises VPN device (its public IP and routing/BGP details) and is a mandatory input when creating the IPSec connection. Option A is incorrect because an Internet Gateway is used for public subnet internet access, not for Site-to-Site VPN termination, and the VPN attaches to the DRG instead. Option C is incorrect because a Local Peering Gateway connects VCNs within the same region and has no role in connecting an on-premises datacenter to OCI.

Answer

Internet Gateway attached to the private subnets

Answer

Local Peering Gateway (LPG)

Question 8

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Accepted Answer

There are no explicit 'Deny' rules in OCI IAM policy grammar.. Option A is correct because OCI IAM policy grammar only supports 'Allow' statements (e.g., 'Allow group X to manage instance in compartment Y'); there is no 'Deny' verb in the policy syntax, so access is never explicitly denied by a policy statement. Option E is correct because OCI IAM evaluates all applicable policies and the resulting permissions are additive — if any policy grants a permission, the user has it, and multiple grants simply accumulate rather than one overriding another. Option B is wrong because tenancy root policies do not cancel compartment-level policies; policies at any level are combined additively, and a root-level policy can grant access that compartment policies also grant. Option C is wrong because there are no explicit deny statements in OCI IAM, so nothing can take precedence over allows in that manner. Option D is wrong because OCI does not stop at the first matching statement; it evaluates all policies that apply to the request and unions the allowed permissions.

Answer

Tenancy root policies always override and cancel compartment-level policies.

Answer

Explicit deny statements take precedence over all allow statements.

Answer

Policy evaluation stops immediately upon encountering the first matching statement.

Question 9

Which TWO types of traffic can be routed through an OCI Service Gateway?

Accepted Answer

Traffic to OCI Object Storage in the same region. Option D is correct because an OCI Service Gateway provides private access from a VCN to Oracle Services Network (OSN) services such as Object Storage in the same region, without requiring an Internet Gateway or NAT Gateway. Option E is correct because Autonomous Database is also an Oracle Services Network service reachable through the Service Gateway in the same region, keeping traffic on the Oracle network. Options A, B, and C are incorrect: general web browsing requires an Internet Gateway (or NAT Gateway for private subnets), on-premises connectivity via FastConnect uses a Dynamic Routing Gateway (DRG) with a FastConnect virtual circuit, and cross-region VCN peering uses Remote Peering Connections (RPCs) over a DRG, not a Service Gateway.

Answer

General web browsing traffic to external websites like google.com

Answer

Traffic destined for an on-premises datacenter via FastConnect

Answer

Peer traffic to another VCN in a different region

Question 10

Which THREE network components must be correctly configured in a VCN to allow an application instance in a private subnet to connect to an Autonomous Database with a private endpoint?

Accepted Answer

Security lists or network security groups allowing traffic on port 1522. Option A is correct because the Autonomous Database private endpoint listener accepts connections on TCP port 1522, so the security list or NSG applied to the application subnet (and the ADB endpoint subnet) must permit ingress/egress on port 1522 between the application instance and the database endpoint. Option B is correct because the application must resolve the private endpoint's hostname to its private IP; this requires proper DNS configuration, typically via the VCN resolver and, for private endpoints, the private DNS zone/record associated with the ADB endpoint. Option E is correct because a private endpoint for Autonomous Database must reside in a subnet within the VCN (often a dedicated subnet), and that subnet must be properly designated and configured so the endpoint is reachable from the application's private subnet. Option C is incorrect because an Internet Gateway is only for public internet traffic and is not required for private subnet-to-private endpoint communication. Option D is incorrect because a Public Load Balancer is not needed and would not provide the private connectivity path to the ADB private endpoint.

Answer

An Internet Gateway attached to the private subnet

Answer

A Public Load Balancer fronting the private IP address

Question 11

Which THREE features are automatically managed by Oracle Autonomous Database without requiring manual DBA intervention?

Accepted Answer

Performance tuning and indexing. Option B (Performance tuning and indexing) is correct because Oracle Autonomous Database uses automatic indexing and built-in performance tuning features such as Automatic SQL Tuning and SQL plan management to optimize workloads without DBA intervention. Option C (Automated backups) is correct because Autonomous Database automatically configures and performs backups, including retention and recovery capabilities, without manual scheduling. Option D (Database patching and upgrades) is correct because Autonomous Database automatically applies patches and performs upgrades during maintenance windows, minimizing manual DBA effort. Option A is not correct because defining business requirements and designing data models are human design activities, not database self-management features. Option E is not correct because developing custom corporate application code is performed by developers and is outside the scope of Autonomous Database automation.

Answer

Business requirement definition and data modeling

Answer

Custom corporate application code development

Question 12

You need to ingest custom application logs from multiple compute instances into OCI Logging. What is the correct sequence of components you must configure within OCI?

Accepted Answer

Create a Log Group, install and configure the OCI Logging Unified Agent on the instances, and create a custom Log pointing to the agent configuration.. To ship custom logs from compute instances, you install the Unified Agent, configure a log group, and create a log resource associated with a unified agent configuration.

Answer

Create a Notification Topic, add HTTP endpoints, and enable Audit logs.

Answer

Create a Resource Manager stack, deploy a Terraform template, and configure an email subscription.

Answer

Create a Monitoring Alarm, configure OCI Events, and link them to an Object Storage bucket.

Question 13

What is the default retention period for audit logs in OCI?

Accepted Answer

365 days. Audit logs are retained for 365 days by default.

Answer

90 days

Answer

Unlimited

Answer

30 days

Question 14

You are configuring an OCI Load Balancer and need to distribute incoming requests across backend servers based on the client's source IP address so that requests from the same client always go to the same backend server. Which load balancing policy should you choose?

Accepted Answer

IP Hash. The IP Hash load balancing policy hashes the client's source IP address to route requests from the same client to the same backend server, ensuring session persistence.

Answer

Least Connections

Answer

Random

Answer

Weighted Round Robin

Question 15

Which OCI service is most appropriate for storing static website content?

Accepted Answer

Object Storage. Object Storage is frequently used to host static website assets.

Answer

File Storage

Answer

Block Volume

Answer

Archive Storage