1Z0-1072-26 Practice Test 2 — 30 Questions

Question 1

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT (Network Address Translation) Gateway allows private subnet instances to initiate outbound connections to the internet while preventing any unsolicited inbound internet traffic.

Answer

Local Peering Gateway

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Question 2

You are planning to deploy a high-performance computing (HPC) cluster on OCI requiring extremely high packet per second (PPS) and ultra-low latency between compute nodes. Which feature must you utilize?

Accepted Answer

Cluster Networks with RDMA (Remote Direct Memory Access). Cluster Networks with RDMA provide a high-bandwidth, ultra-low-latency interconnect specifically designed for HPC workloads on OCI. RDMA allows direct memory-to-memory transfers between compute nodes, bypassing the OS kernel and CPU, which drastically reduces latency and increases packet per second (PPS) throughput. This is the only OCI feature that delivers the required performance for tightly-coupled HPC applications.

Answer

NAT Gateway with bandwidth throttling disabled

Answer

Public IP addresses on all compute nodes

Answer

OCI Local Peering Gateway

Question 3

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Accepted Answer

Dynamic Routing Gateway (DRG) attached to the VCN. Option B is correct because the Dynamic Routing Gateway (DRG) is the OCI-side virtual router that must be attached to the VCN to terminate the IPSec tunnels of a Site-to-Site VPN; without a DRG there is no OCI endpoint for the VPN. Option E is correct because the Customer-Premises Equipment (CPE) object represents the public IP address of your on-premises VPN gateway, and it is a required building block referenced when creating the IPSec connection that forms the redundant tunnels. The Service Gateway (A) is only for private access to OCI services such as Object Storage, the Local Peering Gateway (C) connects VCNs within the same region, and the NAT Gateway (D) provides outbound internet access for private subnets — none of these terminate or represent an IPSec VPN endpoint, so they are not required for a Site-to-Site VPN.

Answer

Service Gateway

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Question 4

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Accepted Answer

Public subnets have route table rules pointing to an Internet Gateway, while private subnets do not.. Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.

Answer

Private subnets require IPv6 addressing.

Answer

Private subnets cannot use Security Lists.

Answer

Public subnets cannot communicate with Oracle Database services.

Question 5

Which TWO features are supported by OCI File Storage Service (FSS)? (Choose two.)

Accepted Answer

Encryption at rest using customer-managed keys in OCI KMS. OCI File Storage Service supports snapshots for data protection and encryption using customer-managed keys via OCI KMS.

Answer

Block-level multi-attach with read-write access across availability domains

Answer

Automatic tiering from file storage to Archive Storage

Answer

Native integration with Block Volume replication policies

Question 6

Which TWO of the following statements are true regarding OCI Compute Instance Maintenance and Events? (Choose two.)

Accepted Answer

OCI sends notifications when underlying infrastructure maintenance is scheduled for a compute instance.. Option D is correct because OCI publishes infrastructure maintenance events for compute instances through the OCI Notifications service and the Console, so customers receive advance notice when underlying hardware maintenance is scheduled. Option E is correct because for certain maintenance events, such as those that require a reboot, customers can proactively reboot the instance from the Console or CLI to apply the maintenance at a convenient time rather than waiting for the scheduled window. Option A is false because maintenance events do not cause permanent data loss on boot volumes; data on block and boot volumes persists across reboots and maintenance. Option B is false because maintenance events can be viewed and managed through the OCI Console, CLI, SDKs, and APIs, not only Terraform. Option C is false because customers do have visibility into hardware retirement and maintenance schedules via notifications and the Console, allowing preemptive action.

Answer

Maintenance events cause permanent data loss on attached boot volumes.

Answer

Instance maintenance events can only be managed using Terraform scripts.

Answer

Customers have zero visibility into hardware retirement schedules and cannot take preemptive action.

Question 7

You are setting up an autoscaling configuration for an instance pool. You want the pool to scale out when CPU utilization exceeds 80% and scale in when CPU utilization drops below 20%. What type of autoscaling policy should you create?

Accepted Answer

Metric-based autoscaling policy. Metric-based autoscaling policies allow you to define rules based on metrics such as CPU or memory utilization to scale out or scale in instances automatically.

Answer

Event-driven autoscaling policy

Answer

Schedule-based autoscaling policy

Answer

Manual capacity override policy

Question 8

What is the primary function of the OCI Compute Instance Oracle Cloud Agent?

Accepted Answer

To perform plugin-based management tasks like monitoring, patching, and run commands on the instance.. The Oracle Cloud Agent is a lightweight process that runs on OCI compute instances and hosts plugins for management tasks such as monitoring, patching (OS Management), running commands, and collecting metrics. It is the agent that enables services like the Monitoring plugin, Compute Instance Run Command, and Vulnerability Scanning. Its primary function is plugin-based instance management, not networking or orchestration.

Answer

To route TCP/IP packets across VCN subnets at the hypervisor level.

Answer

To provide serverless execution environments for OCI Functions.

Answer

To manage Kubernetes cluster worker node lifecycles.

Question 9

Your development team needs to access an Autonomous Transaction Processing (ATP) database instance securely over the internet. What artifact must be downloaded and distributed to clients to establish a secure, encrypted connection?

Accepted Answer

A Client Credentials Wallet (wallet.zip) file. To connect to an Autonomous Transaction Processing (ATP) database over the internet with encryption, clients must use a Client Credentials Wallet (wallet.zip). This wallet contains the credentials, connection strings (tnsnames.ora, sqlnet.ora), and the SSL/TLS certificates required for mutual TLS (mTLS) authentication. It is downloaded from the OCI Console and distributed to each client that needs secure access.

Answer

An Identity and Access Management (IAM) API signing key

Answer

An SSH Private Key (.ppk) file

Answer

A Transparent Data Encryption (TDE) master key file

Question 10

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Accepted Answer

Add a route in the private subnet route table with a destination of 0.0.0.0/0 and the target as the NAT Gateway.. A NAT Gateway allows instances in a private subnet to initiate connections to the internet, but prevents inbound connections from the internet. The route table associated with the private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Answer

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Answer

Configure a Service Gateway with a route to 0.0.0.0/0.

Answer

Assign a public IP address to the instances within the private subnet.

Question 11

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 12

Which TWO tasks can an administrator perform when managing database homes in Oracle Base Database Service? (Choose two.)

Accepted Answer

Apply Database Updates (Database Software Patches) to the DB home.. Option A is correct because Oracle Base Database Service allows administrators to apply database updates (database software patches) to a DB home, which patches the Oracle Database software binaries in that home. Option E is correct because a single DB home can host multiple databases as long as they all run the same Oracle Database software version, since the home provides one set of binaries. Option B is wrong because customers cannot modify the hypervisor's physical CPU hardware model in this managed service. Option C is wrong because deleting a DB home requires or removes its associated databases; they cannot all keep running unaffected. Option D is wrong because a DB home cannot be converted into an Autonomous Container Database, which is a separate Autonomous Database construct.

Answer

Modify the underlying physical CPU hardware model of the hypervisor.

Answer

Delete the DB home while keeping all associated databases running unaffected.

Answer

Convert the database home into an Autonomous Container Database.

Question 13

An autoscaling configuration is attached to your instance pool. You notice that instances are scaling out correctly based on CPU utilization, but you want to ensure that scaling events do not happen too frequently in response to brief traffic spikes. Which setting should you adjust?

Accepted Answer

The Autoscaling Cooldown Period. The Autoscaling Cooldown Period is the exact setting that prevents rapid, repeated scaling actions by enforcing a wait time after each scale event before another can trigger. This smooths out reactions to brief CPU spikes so the pool does not thrash between scale-out and scale-in. Adjusting it directly addresses the requirement to avoid frequent scaling events.

Answer

The Instance Pool capacity limits

Answer

The VCN DHCP Options timeout value

Answer

The Monitoring service metric polling interval

Question 14

You are planning to restore an Oracle Base Database Service DB system from an object storage backup. Which backup types are supported by OCI for creating a new DB system?

Accepted Answer

Automated backups or manual full backups. Oracle Base Database Service on OCI supports restoring from automated backups or manual full backups stored in Object Storage. These backup types contain the full database state needed to provision a new DB system. Incremental-only or Data Pump exports are not supported as direct sources for creating a new DB system via the OCI console or API.

Answer

OCI Block Volume snapshots

Answer

Only incremental manual backups

Answer

Only Data Pump export dump files

Question 15

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. The policy verb 'manage' on the 'compartments' resource in the tenancy grants full lifecycle control over compartments (create, update, delete, move) without conferring broader tenancy-admin rights. This is the least-privilege way to delegate compartment creation to TeamLeads. It does not grant identity administration or tenancy-level control.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 16

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Accepted Answer

Service Gateway. An OCI Service Gateway provides private access from a VCN to supported Oracle services, including OCI Logging and Logging Analytics, without traversing the public internet. Traffic from instances in a private subnet routes through the service gateway to the Oracle service's public endpoint using the service's CIDR label in a route rule. This satisfies the requirement of reaching the logging endpoint while keeping the subnet private and blocking general internet access.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 17

What is the default replication method for Object Storage buckets?

Accepted Answer

Automatic replication. Object Storage data is automatically replicated across three Fault Domains within an AD.

Answer

Manual replication

Answer

RAID 5

Answer

Not replicated

Question 18

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Accepted Answer

Provision and configure cloud infrastructure resources using Terraform configuration files.. Option D is correct because OCI Resource Manager is Oracle's managed Terraform service: a stack is built from Terraform configuration (HCL) and jobs such as plan/apply provision and configure OCI infrastructure resources declaratively. Option E is correct because Resource Manager supports importing existing OCI resources into a stack's Terraform state, typically via the "Import state" / terraform import workflow, so previously created resources become tracked and manageable by that stack. Options A, B, and C are incorrect because they describe monitoring and logging capabilities, not Resource Manager: threshold-based bucket-size email alerts are handled by OCI Monitoring alarms with Notifications, custom time-series metric alarms for CPU/memory are created in OCI Monitoring (with agent metrics), and ingesting/parsing application logs is done by the OCI Logging service (and Logging Analytics), none of which are functions of Resource Manager stacks.

Answer

Send email notifications when an object storage bucket size exceeds a threshold.

Answer

Create custom time-series metric alarms to monitor CPU and memory utilization.

Answer

Automatically ingest and parse custom application log files from compute instances.

Question 19

You are configuring an Object Storage bucket and want to ensure that if an object is accidentally overwritten or deleted, previous versions can still be retrieved. Which feature should you enable?

Accepted Answer

Object Versioning. Object Versioning preserves multiple variants of an object in the same bucket, protecting against accidental overwrites and deletions.

Answer

Cross-Region Replication

Answer

Object Storage Lifecycle Management

Answer

Bucket Retention Rules

Question 20

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Dynamic group policies in OCI are evaluated only when the request is authenticated using instance principals (or resource principals), which derive identity from the instance's metadata and certificates. When the developer script uses a user's API key or auth token, the request is authorized against that user's IAM policies, not the dynamic group's. Since the user has no matching policy granting object read/write, the request returns 403 Forbidden. The dynamic group membership is irrelevant to user-credential API calls.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.