1Z0-1072-26 Practice Test 25 — 15 Questions

Question 1

Which OCI networking component is automatically created when you provision a Virtual Cloud Network using the VCN Wizard with 'Internet Connectivity'?

Accepted Answer

Internet Gateway. The VCN Wizard with internet connectivity automatically sets up a VCN, a public subnet, a private subnet, an Internet Gateway, a NAT Gateway, and a Service Gateway.

Answer

Dynamic Routing Gateway

Answer

Local Peering Gateway

Answer

FastConnect Virtual Circuit

Question 2

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

Accepted Answer

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG. OCI DNS provides a Resolver where you can set up custom DNS forwarders to route DNS queries for specific on-premises domains to your corporate DNS servers via the DRG.

Answer

A NAT Gateway configured with DNS proxy settings

Answer

A public DNS zone for your on-premises domain

Answer

An Internet Gateway with custom host file mappings

Question 3

An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?

Accepted Answer

The DRG attachment for Vcn-B is associated with a DRG route table that lacks the import route distribution for the on-premises network.. In DRG version 2, route distribution and DRG route tables control traffic between attachments. If Vcn-B cannot reach on-premises, its DRG attachment is likely associated with a DRG route table that lacks import routes for the on-premises attachment, or vice versa.

Answer

VCN CIDRs must be identical for transit routing to function.

Answer

FastConnect only supports a single VCN attachment at a time.

Answer

Vcn-B must use an Internet Gateway instead of a DRG.

Question 4

An OCI Load Balancer has been configured with SSL termination. The backend servers require incoming traffic to also be encrypted using HTTPS. Which backend set protocol should you choose?

Accepted Answer

SSL (or HTTP with SSL enabled). If backend servers require encryption, you should configure the backend set to use SSL (HTTPS or TCP with SSL) so the load balancer encrypts traffic before forwarding it to the backend instances.

Answer

HTTP (unencrypted)

Answer

DNS

Answer

ICMP

Question 5

You are setting up OCI DNS and want to configure a zone transfer (AXFR) from your on-premises DNS server to OCI Private DNS. Which feature enables secondary DNS functionality in OCI?

Accepted Answer

OCI DNS Secondary DNS feature with TSIG key authentication. OCI DNS supports secondary DNS configurations where OCI acts as a primary or secondary DNS server for zones, supporting zone transfers.

Answer

NAT Gateway port forwarding for DNS ports

Answer

Internet Gateway DNS proxy

Answer

Service Gateway DNS resolver

Question 6

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Accepted Answer

Allow group AppSupport to read monitoring-family in tenancy. Monitoring service resources include metrics and alarms, governed by the 'monitoring-family' resource type.

Answer

Allow group AppSupport to use metrics in tenancy

Answer

Allow group AppSupport to inspect telemetry in tenancy

Answer

Allow group AppSupport to manage alarms in compartment root

Question 7

You are configuring a dynamic group matching rule that needs to include all compute instances whose OCID starts with a specific prefix or belong to a specific image. However, OCI dynamic group grammar does not support wildcard operators like asterisks (*) for prefix matching on instance IDs. Which approach should you use instead to group these instances?

Accepted Answer

Apply defined tags to the compute instances at launch and write a dynamic group rule matching those tags.. Since dynamic groups support matching by compartment ID, tags, or exact instance IDs, tagging instances at launch is the standard method to group arbitrary sets of compute instances.

Answer

Create an IAM user for each compute instance and assign them to a static group.

Answer

Manually add each instance OCID to the dynamic group membership list daily via CLI.

Answer

Use wildcard asterisks (*) directly in the instance.id matching rule.

Question 8

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Accepted Answer

The tenancy root compartment. Every new tenancy starts with the root compartment and default IAM administration constructs.

Answer

A fully configured Autonomous Data Warehouse

Answer

A 10TB Object Storage archive bucket

Answer

A pre-configured Kubernetes production cluster

Question 9

Which THREE services integrate directly with OCI IAM for access control and governance? (Choose three.)

Accepted Answer

Object Storage. OCI services such as Object Storage, Compute, and Database integrate with IAM for authorization and security.

Answer

Client web browsers

Answer

On-premise physical power generators

Question 10

Which THREE tools or methods can be used to write and apply OCI IAM policies? (Choose three.)

Accepted Answer

OCI Console (Web UI). IAM policies can be managed via the OCI Console, OCI CLI, SDKs, and Infrastructure as Code tools like Terraform (Resource Manager).

Answer

Editing local /etc/passwd files on compute instances

Answer

Direct SQL queries against the tenancy root database

Question 11

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

Accepted Answer

1. An OCI VCN can have a maximum of one Internet Gateway attached to it at any given time.

Answer

2

Answer

Unlimited

Answer

5

Question 12

You have deployed an OCI VCN with a CIDR of 192.168.0.0/16. You want to peer this VCN with another VCN that has a CIDR of 192.168.64.0/18. Will this local peering succeed?

Accepted Answer

No, because the VCN CIDR blocks overlap.. Local VCN peering requires that the peering VCNs have non-overlapping CIDR blocks. Since 192.168.64.0/18 is completely contained within 192.168.0.0/16, the CIDRs overlap, and peering will fail.

Answer

Yes, as long as both VCNs are in the same compartment.

Answer

No, because VCNs must have identical CIDR sizes to peer.

Answer

Yes, because the second VCN CIDR is a subnet of the first.

Question 13

Which TWO statements are true about OCI IAM compartments? (Choose two.)

Accepted Answer

Compartments can span multiple OCI regions globally.. Compartments are logical isolation constructs and help organize resources for billing and access control.

Answer

Compartments can only contain Virtual Cloud Networks, nothing else.

Answer

Compartments are physical data center buildings.

Answer

Compartments replace IAM policies entirely.

Question 14

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

Accepted Answer

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.. BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Answer

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Answer

The Security List on the DRG attachment blocks ICMP traffic.

Answer

The public subnet has an incorrect Internet Gateway route.

Question 15

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Accepted Answer

IPSec Connection between the CPE and the DRG. A Site-to-Site VPN requires a Customer-Premises Equipment (CPE) object representing your gateway, a Dynamic Routing Gateway (DRG) attached to your VCN, and an IPSec Connection containing tunnels configured with static or dynamic routing.

Answer

Internet Gateway attached to the private subnets

Answer

Local Peering Gateway (LPG)