1Z0-1072-26 Practice Test 4 — 25 Questions

Question 1

Your organization is implementing dynamic groups to manage automated deployments from OCI Functions and Compute instances. Which THREE of the following matching rule criteria are valid for constructing OCI dynamic groups? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Matching by compartment OCID (ALL {instance.compartment.id = 'ocid1...'}). Dynamic group matching rules can evaluate instance OCIDs, compartment OCIDs, resource tags (defined tags), and image OCIDs. They do not evaluate local Unix user accounts or static IAM user passwords.

Answer

Matching by local Linux operating system user accounts (e.g., /etc/passwd UID).

Answer

Matching by specific static IAM user password expiration dates.

Question 2

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Accepted Answer

ALL {tag.Department.CostCenter.value = '400'}. Dynamic group rules support defined tags using the syntax tag...value = '' or similar notation depending on the exact schema, but standard OCI grammar uses tag.namespace.tagkey.value = 'val' or tag.namespace.tagkey = 'val'. Specifically, for defined tags: tag.Department.CostCenter.value = '400'.

Answer

ANY {defined.tag.Department.CostCenter == '400'}

Answer

ALL {instance.tag.Department.CostCenter = '400'}

Answer

MATCH {tag:Department:CostCenter = '400'}

Question 3

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

Accepted Answer

Manage group memberships for the user. Administrators can deactivate user accounts, force password resets, and manage group memberships.

Answer

Modify the physical hardware serial number of the user's laptop

Answer

Configure the user's home Wi-Fi router security settings

Answer

Directly access the user's corporate email inbox

Question 4

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Accepted Answer

The group mapping rule in the OCI Identity Provider configuration does not match the incoming group claim in the SAML assertion.. Federated group mappings link external IdP group names to OCI IAM group names. If the group name in the SAML assertion does not match the mapped rule in OCI, the user cannot be authorized.

Answer

The user's password in OCI IAM has expired and must be reset.

Answer

The API signing key of the IdP metadata XML file needs to be rotated daily.

Answer

OCI requires manual creation of local user profiles for every federated login attempt.

Question 5

Your organization requires that all IAM policies created in the tenancy must be reviewed and approved. To facilitate auditing, you need to write a policy allowing the 'ComplianceTeam' group to read IAM policies and read tenancy metadata. Which policy statement correctly implements this?

Accepted Answer

Allow group ComplianceTeam to read policies, tenancy in tenancy. Reading IAM policies requires the 'policies' resource type, and tenancy metadata requires the 'tenancy' resource type.

Answer

Allow group ComplianceTeam to use security-audits in compartment root

Answer

Allow group ComplianceTeam to inspect all-resources in tenancy

Answer

Allow group ComplianceTeam to manage iam-configs in tenancy

Question 6

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Accepted Answer

Configure an Identity Provider (IdP) in OCI IAM by importing the SAML 2.0 metadata from the external IdP.. To set up external federation in OCI, you must first create an Identity Provider (IdP) record by uploading the IdP metadata XML file.

Answer

Provision local user accounts in OCI IAM for every partner employee.

Answer

Write a tenancy-wide policy allowing all external users to manage tenancy resources.

Answer

Create an API signing key pair for each partner user in OCI IAM.

Question 7

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Accepted Answer

database-family. Database resources in OCI are grouped under the 'database-family' resource type for IAM policies.

Answer

db-resources

Answer

sql-databases

Answer

databases

Question 8

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Accepted Answer

A user can belong to multiple groups.. Groups contain users, can be mapped from federated IdPs, and are used in IAM policies.

Answer

Groups can be nested inside other groups to form a hierarchy.

Answer

Groups can own compartments directly without human members.

Question 9

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rule evaluation is not always instantaneous, but more importantly, compute instances must be explicitly configured with resource principal or instance principal features depending on the SDK version, and matching rules take a short time to evaluate newly created resources.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 10

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Accepted Answer

manage. The 'manage' verb is the most powerful verb in OCI IAM policies, encompassing inspect, read, use, and full management capabilities.

Answer

use

Answer

read

Answer

inspect

Question 11

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

Accepted Answer

Compartments can be used to set granular budget limits and cost tracking.. Compartment design should reflect organizational structure, policy inheritance, and quota management.

Answer

Compartments automatically replicate resources across OCI regions for high availability.

Answer

Compartments isolate network traffic between VCNs automatically without security lists.

Question 12

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Accepted Answer

A logical wrapper operator (ALL or ANY). Dynamic group rules must start with a logical operator (ALL or ANY) followed by matching criteria enclosed in curly braces.

Answer

A user password hash

Answer

An API signing key fingerprint

Answer

A VCN security list ID

Question 13

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Accepted Answer

Scope policies to specific compartments rather than the tenancy root whenever feasible.. IAM best practices include adhering to the principle of least privilege and scoping policies to compartments rather than tenancies when possible.

Answer

Hardcode API signing keys directly into public source code repositories.

Answer

Always assign the 'manage all-resources' role to every user to simplify troubleshooting.

Answer

Use tenancy-wide administrative policies for all standard developers.

Question 14

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Accepted Answer

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.. Federated groups from IDCS must be mapped to OCI IAM groups in the OCI Console, and then a policy must be written granting that OCI IAM group access.

Answer

Assign the NetworkAdmins group directly to the tenancy root compartment via the IDCS console.

Answer

Write a policy directly referencing the IDCS group name 'NetworkAdmins' with no OCI group mapping.

Answer

Create a local user in OCI IAM for every member of the IDCS 'NetworkAdmins' group and assign them roles.

Question 15

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Accepted Answer

Dynamic Routing Gateway (DRG) attached to the VCN. OCI automatically provisions two redundant VPN tunnels for every Site-to-Site VPN connection. To use them, you configure a CPE object, a DRG, and configure both tunnels on your on-premises router.

Answer

Service Gateway

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Question 16

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Accepted Answer

Compartments nested deeper than one level from the tenancy root must be referenced using their hierarchical path (e.g., ParentComp:ChildComp).. Policy statements require the full path or correct scoping when referencing compartments. If a policy is written in the root compartment referencing a child compartment, the syntax 'compartment ChildComp' is correct only if ChildComp is a direct child; however, if syntax errors or missing family definitions exist, it fails. Wait, let's examine standard syntax: 'Allow group to

in compartment '. If ChildComp is nested deeper, the path must be specified, e.g., 'compartment ParentComp:ChildComp'.

Answer

Policies can never reference child compartments; they must always apply to the entire tenancy.

Answer

The verb 'manage' cannot be used with instances; it must be 'use'.

Answer

The group name must be prefixed with the tenancy name.

Question 17

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

Accepted Answer

Read configuration metadata of resources. The 'manage' verb encompasses all permissions: inspect, read, use, and full creation/deletion capabilities.

Answer

Modify tenancy-level IAM administrator passwords for other users

Answer

Automatically bypass all VCN security lists

Question 18

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Accepted Answer

Policies specify the subject (group or dynamic-group).. OCI IAM policy syntax follows a structured grammar: Allow to

in where .

Answer

Policies must be written in XML format.

Answer

Policies can include explicit 'Deny' statements to override allowances.

Question 19

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

Accepted Answer

Dynamic Routing Gateway (DRG). Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, and a remote peering connection established between the two DRGs.

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Answer

Internet Gateway

Question 20

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. Compartments are managed via the 'compartments' resource type in OCI IAM policies.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy