1Z0-1072-26 Practice Test 5 — 25 Questions

Question 1

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Tag Namespace, define a Tag Key within it, apply the tag to resources, and reference the tag in an IAM policy condition.. Tag-based access control requires creating a Tag Namespace, defining Tag Keys within that namespace, applying the tags to resources or requests, and then using tag conditionals in IAM policies.

Answer

Create an IAM group, add users, assign free-form tags directly to the users, and write a policy.

Answer

Create a Dynamic Group, apply a tag namespace to the tenancy root, and assign compartment quotas.

Answer

Define a Resource Principal, attach a tag to the instance, and create a cross-region replication policy.

Question 2

Which TWO protocols are supported for health checks by OCI Load Balancer backend sets?

Accepted Answer

TCP. OCI Load Balancers support HTTP, HTTPS, and TCP health checks to monitor the availability of backend servers.

Answer

SMTP

Answer

FTP

Answer

SSH

Question 3

What is the primary function of OCI IAM federation?

Accepted Answer

To allow users authenticated by an external Identity Provider to access OCI resources using single sign-on (SSO).. Federation enables external identity providers (like Microsoft Entra ID or Okta) to authenticate users seeking access to OCI without requiring local OCI user accounts.

Answer

To replicate compute instances across multiple cloud providers.

Answer

To share VCN routing tables between different tenancies.

Answer

To synchronize Object Storage buckets across different regions.

Question 4

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Accepted Answer

The defined tag namespace and key must be created prior to launching the tagged instance.. Tag-based dynamic group rules require the tag namespace and key to exist, and the compute instance must be tagged with that exact defined tag.

Answer

The compute instance must have an API signing key uploaded to its metadata.

Answer

The dynamic group must be assigned a static user password.

Answer

The compute instance must be rebooted every 24 hours to maintain dynamic group membership.

Question 5

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

Accepted Answer

A Private Virtual Circuit allows direct access to your VCN using private IP addresses.. FastConnect virtual circuits can be public (for accessing public Oracle services without internet) or private (for extending your datacenter to your VCN). They support static routing or BGP dynamic routing.

Answer

Only static routing is supported on FastConnect public virtual circuits.

Answer

You cannot attach a FastConnect virtual circuit to a Dynamic Routing Gateway.

Answer

FastConnect virtual circuits must traverse the public internet with IPSec encryption.

Question 6

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Accepted Answer

Identity Domains support advanced features like OAuth, SAML integration, and passwordless authentication.. Identity Domains provide advanced governance features, user management, and can be configured as free or paid tiers depending on features required.

Answer

Identity Domains replace Virtual Cloud Networks entirely.

Answer

Every tenancy is restricted to having exactly one Identity Domain that cannot be changed.

Answer

Identity Domains store compute instance virtual disk images.

Question 7

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

Accepted Answer

Associate VCN-1 and VCN-2 attachments with different DRG route tables, ensuring only VCN-1's route table imports routes from the on-premises attachment.. In DRG version 2, you attach VCN-1 and VCN-2 to the DRG, and associate them with separate DRG route tables. The route table for VCN-1's attachment includes an import rule for the on-premises attachment, while VCN-2's route table does not.

Answer

Configure a NAT Gateway on VCN-2 to drop on-premises packets.

Answer

Place VCN-1 and VCN-2 in different OCI tenancies.

Answer

Attach VCN-2 to an Internet Gateway instead of the DRG.

Question 8

Which THREE components are required when configuring OCI VCN Remote Peering between two regions?

Accepted Answer

Remote Peering Connection (RPC) between the two DRGs. Remote VCN peering across regions requires a Dynamic Routing Gateway (DRG) attached to each VCN, a Remote Peering Connection (RPC) established between the two DRGs, and matching route table/security rules.

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway in both VCNs

Question 9

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Accepted Answer

Instance principals allow compute instances to make API calls to OCI services securely without storing credentials on the instance.. Instance principals allow compute instances to make API calls securely without managing credentials, authorized via dynamic groups and policies.

Answer

Instance principals only function when connected to an on-premise Active Directory domain controller.

Answer

Dynamic groups require human users to manually approve every API call made by the instance.

Answer

Compute instances must have static username and password credentials configured in their environment variables.

Question 10

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)

Accepted Answer

Download the Identity Provider metadata XML file from your IdP.. Setting up federation in OCI involves downloading/obtaining the IdP metadata XML file, uploading that metadata file to create the Identity Provider in OCI, and configuring group mappings between IdP groups and OCI groups. Local user password generation and manual IAM user creation are not part of IdP federation.

Answer

Enable multi-factor authentication (MFA) exclusively by modifying local OCI user security settings.

Answer

Manually create individual IAM users in OCI and assign them local passwords matching their enterprise credentials.

Question 11

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

Accepted Answer

Virtual Cloud Networks (VCNs). DRG version 2 supports attachments to VCNs, Site-to-Site VPN IPSec connections, FastConnect virtual circuits, and remote peer DRGs for cross-region peering.

Answer

Internet Gateways

Answer

Local Peering Gateways (LPGs)

Question 12

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

Accepted Answer

Manually create individual IAM user accounts for each auditor in the Oracle Cloud Infrastructure Console.. To federate an IdP, you must configure the IdP, create an IdP group, map that IdP group to an OCI group, and write a policy granting the OCI group access. You do not manually create local IAM users for the federated users.

Answer

Map the Identity Provider's user group to an Oracle Cloud Infrastructure IAM group.

Answer

Create an IAM policy granting the mapped OCI group read access to the FinanceAudits compartment.

Answer

Configure the Identity Provider (IdP) metadata XML file in the OCI IAM identity provider console.

Question 13

Which THREE administrative tasks require membership in the tenancy Administrators group or equivalent high-level IAM privileges? (Choose three.)

Accepted Answer

Writing and modifying policies in the tenancy root compartment. High-level administrative tasks include creating identity providers, managing root-level policies, and setting tenancy limits.

Answer

Uploading a personal SSH public key to a standard user profile

Answer

Launching a basic compute instance in a developer compartment

Question 14

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Accepted Answer

Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.. Backend instances must allow incoming traffic from the load balancer's subnet or security list on the application ports. Updating the backend instance security lists or NSGs resolves the timeout.

Answer

Configure a NAT Gateway on the load balancer subnet.

Answer

Change the load balancer shape from Flexible to 100 Mbps.

Answer

Attach an Internet Gateway to the backend subnet route table.

Question 15

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

Accepted Answer

Identity & Security -> Compartments. Compartments can only be created within the root tenancy or inside an existing parent compartment. You navigate to Identity & Security, select Compartments, and choose the parent compartment.

Answer

Billing & Cost Management -> Compartment Management

Answer

Networking -> Virtual Cloud Networks -> Compartment Association

Answer

Governance & Administration -> Tenancy Explorer

Question 16

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

Accepted Answer

Deleting a compartment requires that all resources within that compartment must first be terminated or deleted.. Compartments are logical isolations across regions and are completely global within a tenancy. IAM policies are inherited from parent compartments down to child compartments. Options B and D accurately describe compartment and policy behavior.

Answer

A user can belong to only one IAM group within an entire OCI tenancy.

Answer

IAM policies are evaluated at the tenancy root level and cannot be defined inside a specific compartment.

Answer

Compartments are region-specific entities, meaning a compartment created in Ashburn is automatically isolated from Phoenix.

Question 17

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Accepted Answer

Service Gateway. A Service Gateway enables private access to regional OCI services (such as Object Storage, Logging, and Database) without requiring internet access.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 18

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

Accepted Answer

Mismatched IKE security parameters (Phase 1 or Phase 2) or blocked UDP ports 500/4500 on the firewall.. VPN tunnel down status is commonly caused by mismatched IKE security parameters (Phase 1/Phase 2 pre-shared key, encryption/authentication algorithms, Diffie-Hellman groups) or blocked UDP ports 500/4500 on local firewalls.

Answer

The NAT Gateway is misconfigured.

Answer

The FastConnect virtual circuit is disabled.

Answer

The VCN subnet route table is missing a route to 0.0.0.0/0.

Question 19

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

Accepted Answer

VCN Resolver custom forwarders. The VCN Resolver handles DNS resolution for instances. You can configure custom DNS forwarders in the VCN Resolver to forward queries for specific private domains to internal DNS servers while resolving internet queries normally.

Answer

Internet Gateway DNS proxy

Answer

Service Gateway name server

Answer

NAT Gateway DNS translation

Question 20

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

Accepted Answer

A Private DNS Zone associated with the VCN via a VCN view. To resolve records in a private domain within a VCN, you must create a Private DNS Zone and associate it with your VCN using a VCN view.

Answer

A Public DNS Zone with an Internet Gateway

Answer

A Service Gateway pointing to the DNS service

Answer

A NAT Gateway with DNS forwarding rules