1Z0-1072-26 Practice Test 25 — 15 Questions

Question 1

Which THREE statements regarding OCI Network Security Groups (NSGs) vs Security Lists are correct?

Accepted Answer

NSGs apply to a specific set of VNICs of your choice, whereas Security Lists apply to all VNICs in a subnet.. Option B is correct because an NSG is a virtual firewall attached to a chosen set of VNICs (you explicitly add VNICs to the NSG), while a Security List is applied at the subnet level and therefore governs every VNIC in that subnet. Option D is correct because NSG security rules can use other NSGs as the source or destination, which lets you write rules based on group membership rather than CIDR blocks. Option E is correct because both Security Lists and NSGs support stateful rules (return traffic automatically allowed) and stateless rules (return traffic must be explicitly allowed). Option A is wrong because NSGs are optional and Security Lists are the default mechanism automatically associated with a subnet. Option C is wrong because Security Lists are scoped to a single VCN and cannot span multiple VCNs, just as NSGs are VCN-scoped.

Answer

NSGs are mandatory for every subnet, while Security Lists are optional.

Answer

Security Lists can span across multiple VCNs, while NSGs cannot.

Question 2

Which OCI service feature enables you to run software containers without provisioning virtual machines or managing Kubernetes clusters, offering simple container execution?

Accepted Answer

Container Instances. OCI Container Instances is a serverless compute service that runs containers directly without requiring you to provision VMs or manage a Kubernetes control plane. You supply a container image and OCI handles the underlying infrastructure, making it the simplest container execution option. This matches the question's requirement exactly.

Answer

Bare Metal Compute

Answer

Dedicated VM Hosts

Answer

Instance Pools

Question 3

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Accepted Answer

Define an IAM policy in Tenancy A endorsing the group from Tenancy B, and a policy in Tenancy B committing to the access.. Cross-tenancy access in OCI requires a two-sided policy arrangement: Tenancy A defines a policy that endorses (names) the group from Tenancy B, and Tenancy B defines a policy that commits its group to the access. Both policies must exist for the cross-tenancy authorization to take effect.

Answer

Create local user accounts in Tenancy A for every user in Tenancy B's group.

Answer

Establish a Remote VCN Peering connection between Tenancy A and Tenancy B.

Answer

Share the Object Storage bucket directly using pre-authenticated requests.

Question 4

Which TWO deployment options are available when provisioning an Oracle Autonomous Database? (Choose two.)

Accepted Answer

Shared Exadata Infrastructure. Option A (Shared Exadata Infrastructure) is correct because Oracle Autonomous Database can be provisioned on shared Exadata infrastructure, where the underlying Exadata hardware and Exadata Storage Server software are managed by Oracle and shared across multiple tenants while each database remains isolated. Option D (Dedicated Exadata Infrastructure) is also correct because Autonomous Database supports a dedicated deployment model in which the Exadata infrastructure is single-tenant and provisioned exclusively for one customer, typically via Oracle Exadata Cloud@Customer or dedicated region capacity. Option B is incorrect because Autonomous Database is an Oracle-managed cloud service and is not deployed on customer local on-premises hypervisor virtual machines. Option C is incorrect because OCI Block Volume multi-attach storage clusters are not a supported deployment substrate for Autonomous Database; the service runs on Exadata infrastructure. Option E is incorrect because Autonomous Database is built on Exadata infrastructure, so a bare metal single-tenant instance without Exadata infrastructure is not an available deployment option.

Answer

Local on-premises hypervisor virtual machines

Answer

Standard OCI Block Volume multi-attach storage clusters

Answer

Bare metal single-tenant instances without Exadata infrastructure

Question 5

An OCI customer has a VCN with CIDR 10.0.0.0/16. They have deployed a Kubernetes cluster (OKE) where worker nodes are placed in a private subnet. The cluster requires internal service discovery and pod-to-pod communication across different worker subnets. What is required in the subnet route table to support standard OKE cluster networking?

Accepted Answer

A default 'local' route covering the VCN CIDR (10.0.0.0/16) pointing to 'local' target. Standard OKE subnets require intra-VCN routing, which is automatically handled by the default local route (10.0.0.0/16 pointing to 'local'), ensuring all subnets within the VCN can communicate freely.

Answer

A route pointing to a NAT Gateway for every pod CIDR

Answer

A Service Gateway for container image downloads

Answer

A route pointing 0.0.0.0/0 to an Internet Gateway

Question 6

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

Accepted Answer

DRG route tables and import/export route distribution maps. DRG route tables allow you to customize how traffic flows between attachments. By using DRG attachments and custom route tables on the DRG, you can route traffic from Spoke1 to the Hub VCN attachment, and then from the Hub back out to Spoke2.

Answer

Local Peering Gateways with cross-region peering attachments

Answer

Virtual Circuit FastConnect multipath routing

Answer

Internet Gateway route translation rules

Question 7

You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?

Accepted Answer

OCI VCNs do not support IP multicast; the application must be redesigned to use unicast.. OCI Virtual Cloud Networks (VCNs) operate at Layer 3 and do not support IP multicast traffic. Application architectures must be redesigned to use unicast or alternative synchronization mechanisms.

Answer

Attach a NAT Gateway configured for multicast translation.

Answer

Configure an Internet Gateway with multicast proxy enabled.

Answer

Enable multicast routing on the Dynamic Routing Gateway (DRG).

Question 8

Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)

Accepted Answer

The SAML 2.0 metadata XML file provided by the external Identity Provider. Configuring a SAML 2.0 IdP requires the IdP metadata XML file (or metadata URL) and a name for the IdP in OCI.

Answer

The physical rack serial number in the data center

Answer

The root compartment database sysadmin password

Answer

The local VCN CIDR block

Question 9

Which THREE actions should you take when preparing a custom Linux VM image for export and import across OCI tenancies or regions? (Choose three.)

Accepted Answer

Remove persistent network interface rules (such as udev network interface mapping rules).. Option B is correct because persistent udev network interface mapping rules (e.g., /etc/udev/rules.d/70-persistent-net.rules) bind NIC names to MAC addresses of the source environment; removing them lets the imported VM re-enumerate interfaces and get the correct names in the new tenancy or region. Option D is correct because cloud-init performs first-boot initialization such as setting hostname, injecting SSH keys, configuring networking, and running user-data, which is essential for the instance to be reachable and properly configured after import. Option E is correct because OCI accepts custom images in QCOW2 or RAW format when exporting to or importing from Object Storage, so the image must be in one of these supported formats. Option A is wrong because embedding tenancy administrator API signing keys in plaintext in /etc/passwd is a severe security violation and is never a valid preparation step. Option C is wrong because Linux root partitions use native Linux filesystems such as ext4, XFS, or Btrfs, not the proprietary Windows NTFS format.

Answer

Embed tenancy administrator API signing keys in plaintext within `/etc/passwd`.

Answer

Format all root partitions using proprietary Windows NTFS file systems.

Question 10

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Accepted Answer

Instance principals allow compute instances to make API calls to OCI services securely without storing credentials on the instance.. Instance principals allow compute instances to make API calls securely without managing credentials, authorized via dynamic groups and policies.

Answer

Instance principals only function when connected to an on-premise Active Directory domain controller.

Answer

Dynamic groups require human users to manually approve every API call made by the instance.

Answer

Compute instances must have static username and password credentials configured in their environment variables.

Question 11

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

Accepted Answer

Security Lists. Security Lists (at the subnet level) and Network Security Groups (at the VNIC level) are the two primary virtual firewall features used in OCI to control ingress and egress traffic.

Answer

Service Gateway

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Question 12

You are troubleshooting a custom OCI compute image that fails to boot properly after launching an instance. The instance gets stuck in a pre-boot state. Where can you view serial console logs to diagnose the low-level boot sequence and kernel panic messages?

Accepted Answer

OCI Compute Instance Serial Console connection. The OCI Compute Instance Serial Console connection provides access to the instance's serial console, which captures low-level boot messages, GRUB output, and kernel panic messages before the OS networking stack is up. This is the correct place to diagnose a custom image that fails in a pre-boot state. It works even when the instance has no network connectivity or SSH access.

Answer

Object Storage boot bucket logs

Answer

OCI Logging service via custom log agents

Answer

OCI Monitoring service under instance metrics

Question 13

Which THREE things must be configured to use Logging Analytics?

Accepted Answer

Log Source. Logging Analytics requires a log group, a log source, and an entity.

Answer

Load Balancer

Answer

Database instance

Question 14

You manage an instance pool backed by an autoscaling configuration. The pool reaches its maximum limit of 10 instances due to a traffic spike. A hardware maintenance event triggers a retirement notification for one of the instances in the pool. How does OCI Instance Pools with Autoscaling handle this retired instance?

Accepted Answer

The instance is replaced automatically by the instance pool to maintain the operational state, managing lifecycle events independently of active autoscaling metrics.. Instance pools automatically replace unhealthy or retired instances to maintain the desired capacity. If an instance is retired, the pool provisions a new instance to replace it, even if autoscaling has reached its maximum size, because minimum/desired capacity rules take precedence over instance retirement recovery.

Answer

The instance is terminated, and a new instance is provisioned to replace it, temporarily exceeding the maximum limit if necessary until scaling rules scale it back down.

Answer

The instance is terminated and not replaced because the pool is already at its maximum limit.

Answer

The autoscaling configuration must be manually edited to increase the max limit before the instance can be replaced.

Question 15

An OCI administrator needs to ensure that infrequently accessed data stored in an Object Storage bucket automatically transitions to Archive Storage after 90 days to reduce costs. Which feature should the administrator configure?

Accepted Answer

Object Storage Lifecycle Policy. Object Storage Lifecycle Policy rules can be created to automatically transition objects from Standard storage to Infrequent Access or Archive Storage based on a specified number of days since creation or modification.

Answer

Object Storage Replication Policy

Answer

OCI Data Transfer Service

Answer

Block Volume Backup Policy