1Z0-1072-26 Practice Test 24 — 15 Questions

Question 1

Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?

Accepted Answer

OCI FastConnect. OCI offers FastConnect for dedicated private connections and Site-to-Site VPN for encrypted IPSec connections over the public internet.

Answer

Internet Gateway

Answer

Service Gateway

Answer

Local Peering Gateway

Question 2

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

Accepted Answer

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.. BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Answer

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Answer

The Security List on the DRG attachment blocks ICMP traffic.

Answer

The public subnet has an incorrect Internet Gateway route.

Question 3

Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?

Accepted Answer

An individual IAM user account created for each compute instance to authenticate API calls.. Instance Principals use dynamic groups to match instances based on tags or compartment OCIDs, and policies to grant permissions. Individual IAM users are never required or created for instance principals.

Answer

Compute instances launched within OCI that support instance metadata services.

Answer

An IAM Policy that grants the Dynamic Group permission to access the Object Storage bucket.

Answer

A Dynamic Group that includes the target Compute instances based on matching rules.

Question 4

Which TWO statements are true regarding OCI IP addresses and VNICs?

Accepted Answer

Every VNIC is assigned at least one primary private IP address.. Every VNIC has a primary private IP address assigned from its subnet CIDR block, and can optionally have secondary private IP addresses and public IP addresses (ephemeral or reserved).

Answer

Private IP addresses are permanent and can never be unassigned from a VNIC.

Answer

A VNIC can only belong to one subnet at a time, but can span multiple VCNs.

Answer

VNICs in private subnets can be assigned public IP addresses directly.

Question 5

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

Accepted Answer

Compartments. Option B (Compartments) is correct because compartments are the fundamental logical construct in OCI for organizing and isolating resources, forming a hierarchy under a tenancy that supports policy-based access control and quota management. Option E (Tags, both Freeform and Defined) is correct because OCI tagging lets you attach metadata key-value pairs to resources for organization, cost tracking, and automation, with Defined tags governed by tag namespaces and Freeform tags being simpler user-applied labels. The unmarked options do not belong: Windows Registry hives (A) are an OS-level configuration store unrelated to OCI resource organization, Active Directory organizational units synced directly to resource folders (C) is not an OCI feature since OCI IAM does not map AD OUs to resource folders, and physical server chassis slots (D) describe hardware placement, not a logical OCI resource-organization mechanism.

Answer

Windows Registry hives

Answer

Active Directory organizational units synced directly to resource folders

Answer

Physical server chassis slots

Question 6

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

Accepted Answer

Read includes all inspect permissions plus the ability to get resource metadata and configuration details.. The 'read' verb includes all permissions of 'inspect' plus the ability to get full configuration metadata and details of resources.

Answer

Read allows users to modify resources, whereas inspect only allows viewing.

Answer

Read allows downloading data from Object Storage, whereas inspect allows uploading.

Answer

Read is more restrictive than inspect.

Question 7

Which TWO are true about cloning a block volume?

Accepted Answer

Clones are independent. Clones are independent volumes and can be resized.

Answer

Clones must be same size

Answer

Clones are read-only

Answer

Clones are linked to source

Question 8

You need to store infrequently accessed data in Oracle Cloud Infrastructure (OCI) with the lowest possible cost while maintaining data retrieval times within a few hours. Which storage tier should you choose?

Accepted Answer

Archive Storage. Archive Storage is designed for long-term data retention at the lowest cost, with a retrieval time of up to 4 hours.

Answer

Block Volume

Answer

Standard Object Storage

Answer

Infrequent Access Object Storage

Question 9

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

Accepted Answer

To provide a customizable, isolated virtual network in OCI for your cloud resources.. A VCN is a customizable, private software-defined network that you set up in OCI, resembling a traditional physical network.

Answer

To store backup files and unstructured object data.

Answer

To host public DNS domain names on the internet.

Answer

To execute serverless container functions.

Question 10

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Accepted Answer

Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.. The best practice is to add a security rule in the backend subnet's security list (or network security group) to allow traffic from the load balancer subnet's CIDR on the application port. This ensures that the load balancer can forward traffic to the backend instances. The load balancer's security list allowing port 443 is necessary but not sufficient; the backend must also permit traffic from the load balancer.

Answer

Configure a NAT Gateway on the load balancer subnet.

Answer

Change the load balancer shape from Flexible to 100 Mbps.

Answer

Attach an Internet Gateway to the backend subnet route table.

Question 11

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Accepted Answer

Scope policies to specific compartments rather than the tenancy root whenever feasible.. Option A is correct because scoping policies to specific compartments rather than the tenancy root follows the OCI best practice of limiting a policy's blast radius; policies written at the tenancy level apply to all compartments and resources, so granting access only where needed reduces unintended exposure. Option C is correct because the Principle of Least Privilege dictates granting only the minimum permissions required for a user's job, which in OCI means using narrowly defined verbs (inspect, read, use, manage) and specific resource types instead of broad grants. Option B is not correct because hardcoding API signing keys into public repositories exposes credentials and violates OCI security guidance to protect and rotate keys. Option D is not correct because assigning 'manage all-resources' to every user grants excessive, tenancy-wide privileges and directly contradicts least privilege. Option E is not correct because tenancy-wide administrative policies for all standard developers over-privileges them; developer access should be scoped to the compartments and resources they actually need.

Answer

Hardcode API signing keys directly into public source code repositories.

Answer

Always assign the 'manage all-resources' role to every user to simplify troubleshooting.

Answer

Use tenancy-wide administrative policies for all standard developers.

Question 12

You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?

Accepted Answer

It automatically routes all DNS queries to the secondary endpoint in Phoenix.. A Failover steering policy routes all traffic to the highest-priority healthy endpoint (Ashburn). If Ashburn fails health checks, it automatically fails over to the secondary endpoint (Phoenix).

Answer

It drops all DNS queries until Ashburn recovers.

Answer

It returns an NXDOMAIN error to the client.

Answer

It round-robins queries between both endpoints equally.

Question 13

Which THREE statements are true regarding Exadata Cloud Service architecture and capabilities? (Choose three.)

Accepted Answer

It combines Oracle Database software with Exadata database servers and storage servers in OCI.. Option A is correct because Exadata Cloud Service (ExaCS) in OCI is precisely the combination of Oracle Database software running on dedicated Exadata database servers and Exadata storage servers within Oracle Cloud Infrastructure. Option B is correct because Exadata storage is presented to the database through Oracle Automatic Storage Management (ASM), which stripes and mirrors data across the Exadata Smart Flash Cache and high-performance disk storage to deliver the platform's characteristic performance and redundancy. Option C is correct because a single Exadata infrastructure rack in OCI can host multiple VM clusters, each running its own Grid Infrastructure and databases, allowing consolidation and isolation on shared Exadata hardware. Option D is not correct because ExaCS fully supports Oracle Real Application Clusters (RAC) for high availability and scalability. Option E is not correct because ExaCS supports both RAC and single-instance databases, and high availability is a core capability rather than something absent.

Answer

It does not support Oracle Real Application Clusters (RAC).

Answer

It only supports single-instance databases with no option for high availability.

Question 14

Which THREE storage options can be used with OCI Compute instances?

Accepted Answer

File Storage. Block Volume, File Storage, and Object Storage are standard.

Answer

Local SSD only

Answer

Tape drive

Question 15

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

Accepted Answer

Local Peering Gateway (or DRG) and route table rules pointing to the peer VCN CIDR, with no NAT or Internet Gateway.. To allow peering without internet access, you need a peering connection (LPG or DRG) and proper route table rules pointing to the peer. You should omit any Internet Gateway or NAT Gateway to prevent internet access.

Answer

NAT Gateway and a route table pointing 0.0.0.0/0 to the peer VCN.

Answer

Service Gateway pointing to the peered VCN CIDR.

Answer

Internet Gateway attached to the private subnet route table.