1Z0-1072-26 Practice Test 28 — 15 Questions

Question 1

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

Accepted Answer

Configure a Listener Rule Set with an HTTP-to-HTTPS redirect rule.. OCI Load Balancers support rule sets, including HTTP redirect rules, allowing you to create a rule that redirects incoming HTTP traffic to HTTPS.

Answer

Change the security list egress rules.

Answer

Use a Service Gateway to forward port 80 to 443.

Answer

Attach a NAT Gateway to port 80.

Question 2

Which THREE components are required when configuring an OCI FastConnect direct peering connection?

Accepted Answer

Physical cross-connect or partner provider connection. A FastConnect direct peering connection requires a Dynamic Routing Gateway (DRG) attached to your VCN, a FastConnect virtual circuit, and a physical cross-connect or partner connection setup.

Answer

Internet Gateway

Answer

Local Peering Gateway (LPG)

Question 3

You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?

Accepted Answer

Enable 'Preserve Client IP' in the backend set configuration.. To preserve client source IP addresses, you should enable 'Backend Set - SSL/TCP' or configure proxy protocol / appropriate backend header settings depending on the listener type, but specifically in OCI Load Balancer, backend sets support preserving client IP headers.

Answer

Attach a NAT Gateway to the Load Balancer subnet.

Answer

Switch the load balancer shape to asymmetric routing mode.

Answer

Configure an Internet Gateway route on the backend servers.

Question 4

What is the primary function of an OCI NAT Gateway?

Accepted Answer

To allow private subnet instances to initiate outbound connections to the internet while blocking inbound connections.. A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software patches) without accepting inbound connections from the internet.

Answer

To peer two VCNs in the same region.

Answer

To allow inbound internet traffic to reach private database instances securely.

Answer

To connect on-premises datacenters to OCI VCNs.

Question 5

Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?

Accepted Answer

Failover routing. OCI Traffic Management steering policies support multiple traffic steering strategies including Failover, Load Balancer, Geolocation, ASN-based, and Compute-based routing.

Answer

OCI Compartment quota limits

Answer

SQL query performance metrics

Question 6

You need to trigger a serverless function whenever an object is uploaded to an Object Storage bucket. Which service should you configure?

Accepted Answer

Events service. The Events service allows you to create rules that respond to changes in resources, such as an Object-Create event in Object Storage.

Answer

Resource Manager

Answer

Notifications service

Answer

Monitoring service

Question 7

An OCI administrator creates a subnet and associates a security list with it. An instance in this subnet cannot connect to an external API on HTTPS (port 443). The security list has an ingress rule for port 443, but no egress rules defined. Why is the connection failing?

Accepted Answer

The security list lacks an egress rule allowing outbound traffic to port 443 (or all ports), or the default egress rule was removed.. By default, OCI Security Lists are stateful, meaning return traffic for ingress is automatically allowed. However, outbound (egress) traffic initiated by the instance requires an explicit egress rule (or a default egress rule allowing all traffic out) if egress rules are modified or restricted.

Answer

Ingress rules apply to outbound connections.

Answer

The instance needs a public IP address to make outbound API calls.

Answer

Port 443 is blocked globally across all OCI regions.

Question 8

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

Accepted Answer

Check the subnet security lists or NSGs for a matching egress rule allowing outbound traffic to the internet.. Security lists or NSGs associated with the private subnet must have an egress rule allowing outbound traffic to 0.0.0.0/0 (all ports or specific ports like 80/443). Without matching egress rules, traffic hitting the NAT gateway will be dropped.

Answer

Check if the instances have public IP addresses assigned.

Answer

Check if an Internet Gateway is also attached to the VCN.

Answer

Check if a Service Gateway is attached to the VCN.

Question 9

Which TWO components are involved when routing traffic from an OCI private subnet to an on-premises datacenter via FastConnect?

Accepted Answer

Dynamic Routing Gateway (DRG). Traffic from a private subnet to on-premises via FastConnect requires a route table rule pointing to the Dynamic Routing Gateway (DRG), and the FastConnect virtual circuit terminating on that DRG.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 10

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

Accepted Answer

It distributes traffic across multiple endpoints according to assigned weights and health checks.. Load Balancer steering distributes traffic across a pool of endpoints based on specified weights and health status, similar to load balancing algorithms.

Answer

It routes all traffic to a single primary datacenter until manual failover occurs.

Answer

It routes users based strictly on their geographic location.

Answer

It routes traffic based on client ASN numbers.

Question 11

Which TWO networking components are required when establishing an OCI Site-to-Site VPN connection using dynamic routing (BGP)?

Accepted Answer

Dynamic Routing Gateway (DRG) configured with BGP ASN. Site-to-Site VPN with dynamic routing requires a CPE object, a DRG attached to the VCN, an IPSec connection with tunnels configured, and BGP ASN configuration on both the OCI side and CPE side.

Answer

Internet Gateway attached to private subnets

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway for BGP packet translation

Question 12

Your company requires a dedicated, highly reliable, encrypted connection from your on-premises datacenter to your OCI Virtual Cloud Network, bypassing the public internet entirely. The link must support speeds up to 10 Gbps and provide failover redundancy. Which OCI service meets this requirement?

Accepted Answer

FastConnect with MACsec or layered IPsec VPN. FastConnect provides a dedicated, private connection between your datacenter and OCI. For encryption across FastConnect, you can layer an IPsec VPN over the FastConnect circuit.

Answer

Oracle Cloud Infrastructure Public Load Balancer with SSL termination

Answer

Site-to-Site VPN over Public Internet

Answer

Remote Peering Connection (RPC)

Question 13

Which feature in the Monitoring service allows you to aggregate metrics from different compartments into a single dashboard?

Accepted Answer

Metric Query Language (MQL). Cross-compartment queries are supported by the Monitoring service to view resources globally or across specific compartments.

Answer

Compartment Explorer

Answer

Dynamic Groups

Answer

Logging Analytics

Question 14

Which Terraform file extension does Resource Manager support?

Accepted Answer

.tf. Resource Manager supports standard .tf files for configuration.

Answer

.yaml

Answer

.json

Answer

.conf

Question 15

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

Accepted Answer

HTTP/HTTPS listener. To inspect HTTP headers and perform layer 7 load balancing (such as path-based routing or SSL termination with HTTP inspection), you must configure an HTTP/HTTPS listener.

Answer

ICMP listener

Answer

TCP listener

Answer

UDP listener