1Z0-1072-26 Practice Test 23 — 15 Questions

Question 1

What is the function of the OCI IAM 'inspect' verb?

Accepted Answer

It allows users to list resources of a given type without viewing their contents or configuration details.. The 'inspect' verb allows users to list resources within a compartment or tenancy without viewing their sensitive configuration details or contents.

Answer

It allows users to inspect security vulnerabilities on compute instances.

Answer

It allows users to create, update, and delete resources.

Answer

It allows users to download object storage bucket files.

Question 2

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Accepted Answer

Nothing further; endorsement and commitment IAM policies are sufficient for cross-tenancy dynamic group authorization.. For cross-tenancy dynamic group access, the target tenancy must also trust the source tenancy as an identity provider or use resource principal federation mechanisms supported by OCI cross-tenancy architecture.

Answer

You must create a local dynamic group in Tenancy A with the exact same matching rules as Tenancy B.

Answer

You must configure an API signing key for the dynamic group in Tenancy B.

Answer

You must establish a Remote VCN Peering connection between the two tenancies.

Question 3

Which TWO actions can be performed on an OCI Autonomous Database to manage or alter its compute and storage configurations after initial provisioning? (Choose two.)

Accepted Answer

Scale up or down the number of OCPUs without downtime.. Autonomous Database allows dynamic scaling of CPU OCPUs and storage capacity on-the-fly without requiring database restarts or downtime.

Answer

Manually configure Oracle Grid Infrastructure clusterware parameters on the underlying cluster nodes.

Answer

Manually repartition tablespaces using raw OS mount points attached to the DB node.

Answer

Modify the operating system kernel parameters using root user privileges.

Question 4

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Accepted Answer

The policy can be created in compartment 'ProjectA' using the syntax: Allow group Auditors to inspect all-resources in compartment ProjectA. To limit access strictly to 'ProjectA', the policy can be attached either directly to 'ProjectA' or to the parent 'DepartmentX' with a specific compartment restriction.

Answer

Policies can only be created in the root tenancy, never in child compartments.

Answer

The policy must be created in the Identity service global container.

Answer

The policy must be created in the root compartment (tenancy).

Question 5

When configuring database backups in Oracle Base Database Service, which THREE components or options can be managed or customized? (Choose three.)

Accepted Answer

Automated backup retention period between 7 and 60 days. In Base Database Service, administrators can configure backup destinations (Object Storage), automated backup retention windows, and manual backup schedules.

Answer

Automatic deletion of backup files immediately after database shutdown

Answer

Direct replication of backup files to local customer tape drives

Question 6

You are planning a Disaster Recovery strategy for an Oracle Base Database System using Oracle Data Guard on OCI. You need the standby database to be open in read-only mode for reporting queries while simultaneously applying redo data from the primary database. Which Data Guard mode should you configure?

Accepted Answer

Active Data Guard. Active Data Guard enables physical standby databases to be open for read-only queries while performing real-time apply of redo from the primary database.

Answer

Snapshot Standby

Answer

Logical Standby in read-write mode

Answer

Traditional Physical Standby (Mount mode)

Question 7

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Accepted Answer

Allow group Developers to use instances in tenancy where request.subnet.id = 'ocid1.subnet...'. OCI IAM policies support conditions based on the source subnet OCID using the 'request.subnet.id' variable.

Answer

Configure a security list rule allowing instance deletion from the specified subnet.

Answer

Allow group Developers to delete instances in subnet 'ocid1.subnet...'

Answer

Allow group Developers to manage instances in tenancy where client.subnet.id = 'ocid1.subnet...'

Question 8

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Accepted Answer

It applies across the entire tenancy and all compartments within it.. Policies created in the root compartment (tenancy) apply globally across the entire tenancy and all child compartments unless restricted.

Answer

It applies exclusively to the Identity and Access Management service.

Answer

It must be explicitly attached to each child compartment individually to take effect.

Answer

It applies only to the root compartment and cannot affect child compartments.

Question 9

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Accepted Answer

Allow group NetworkAdmins to manage subnets, route-tables, and vcns in tenancy. OCI defines fine-grained resource types within families, such as virtual-networks, subnets, and route-tables, allowing precise policy scoping.

Answer

Allow group NetworkAdmins to manage all-resources in tenancy where target.type != 'gateway'

Answer

Allow group NetworkAdmins to use networking in tenancy

Answer

Allow group NetworkAdmins to manage virtual-network-family in tenancy

Question 10

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Accepted Answer

Enforce Multi-Factor Authentication (MFA) via security rules. Securing user accounts includes enforcing MFA, managing API signing key lifecycles, and setting strong password policies.

Answer

Disable all audit logging to hide administrative actions

Answer

Assign root compartment administrator privileges to all temporary contractors

Question 11

What is the maximum number of groups a single OCI user can be a member of?

Accepted Answer

300 groups. OCI enforces limits on group membership per user. The standard limit is 300 groups per user.

Answer

10 groups

Answer

Unlimited

Answer

50 groups

Question 12

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

Accepted Answer

5,000 compartments (default soft/hard limit). OCI imposes service limits on compartments per tenancy, which defaults to several thousand (typically 5,000 compartments per tenancy, adjustable via service limit request).

Answer

10 compartments

Answer

Unlimited with no restrictions

Answer

100 compartments

Question 13

An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?

Accepted Answer

Allow group DevViewers to read policies in tenancy. Viewing policies without modification requires the 'read' or 'inspect' verb on the 'policies' resource type.

Answer

Allow group DevViewers to manage policy-documents in compartment root

Answer

Allow group DevViewers to use iam in tenancy

Answer

Allow group DevViewers to inspect security-settings in tenancy

Question 14

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

Accepted Answer

Allow group SecurityAnalysts to read cloud-guard-family in tenancy. OCI Cloud Guard and Security Advisor resources are managed via specific resource types, primarily 'cloud-guard-family' for Cloud Guard.

Answer

Allow group SecurityAnalysts to inspect compliance-rules in tenancy

Answer

Allow group SecurityAnalysts to manage security-posture in tenancy

Answer

Allow group SecurityAnalysts to use vulnerability-scanners in compartment root

Question 15

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Accepted Answer

Define an IAM policy in Tenancy A endorsing the group from Tenancy B, and a policy in Tenancy B committing to the access.. Cross-tenancy access requires the target tenancy (Tenancy A) to define an endorsement, and the source tenancy (Tenancy B) to define a corresponding commitment.

Answer

Create local user accounts in Tenancy A for every user in Tenancy B's group.

Answer

Establish a Remote VCN Peering connection between Tenancy A and Tenancy B.

Answer

Share the Object Storage bucket directly using pre-authenticated requests.