1Z0-1072-26 Practice Test 5 — 10 Questions

Question 1

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 2

Which TWO tasks can an administrator perform when managing database homes in Oracle Base Database Service? (Choose two.)

Accepted Answer

Apply Database Updates (Database Software Patches) to the DB home.. Option A is correct because Oracle Base Database Service allows administrators to apply database updates (database software patches) to a DB home, which patches the Oracle Database software binaries in that home. Option E is correct because a single DB home can host multiple databases as long as they all run the same Oracle Database software version, since the home provides one set of binaries. Option B is wrong because customers cannot modify the hypervisor's physical CPU hardware model in this managed service. Option C is wrong because deleting a DB home requires or removes its associated databases; they cannot all keep running unaffected. Option D is wrong because a DB home cannot be converted into an Autonomous Container Database, which is a separate Autonomous Database construct.

Answer

Modify the underlying physical CPU hardware model of the hypervisor.

Answer

Delete the DB home while keeping all associated databases running unaffected.

Answer

Convert the database home into an Autonomous Container Database.

Question 3

An autoscaling configuration is attached to your instance pool. You notice that instances are scaling out correctly based on CPU utilization, but you want to ensure that scaling events do not happen too frequently in response to brief traffic spikes. Which setting should you adjust?

Accepted Answer

The Autoscaling Cooldown Period. The Autoscaling Cooldown Period is the exact setting that prevents rapid, repeated scaling actions by enforcing a wait time after each scale event before another can trigger. This smooths out reactions to brief CPU spikes so the pool does not thrash between scale-out and scale-in. Adjusting it directly addresses the requirement to avoid frequent scaling events.

Answer

The Instance Pool capacity limits

Answer

The VCN DHCP Options timeout value

Answer

The Monitoring service metric polling interval

Question 4

You are planning to restore an Oracle Base Database Service DB system from an object storage backup. Which backup types are supported by OCI for creating a new DB system?

Accepted Answer

Automated backups or manual full backups. Oracle Base Database Service on OCI supports restoring from automated backups or manual full backups stored in Object Storage. These backup types contain the full database state needed to provision a new DB system. Incremental-only or Data Pump exports are not supported as direct sources for creating a new DB system via the OCI console or API.

Answer

OCI Block Volume snapshots

Answer

Only incremental manual backups

Answer

Only Data Pump export dump files

Question 5

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. The policy verb 'manage' on the 'compartments' resource in the tenancy grants full lifecycle control over compartments (create, update, delete, move) without conferring broader tenancy-admin rights. This is the least-privilege way to delegate compartment creation to TeamLeads. It does not grant identity administration or tenancy-level control.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 6

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Accepted Answer

Service Gateway. An OCI Service Gateway provides private access from a VCN to supported Oracle services, including OCI Logging and Logging Analytics, without traversing the public internet. Traffic from instances in a private subnet routes through the service gateway to the Oracle service's public endpoint using the service's CIDR label in a route rule. This satisfies the requirement of reaching the logging endpoint while keeping the subnet private and blocking general internet access.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 7

What is the default replication method for Object Storage buckets?

Accepted Answer

Automatic replication. Object Storage data is automatically replicated across three Fault Domains within an AD.

Answer

Manual replication

Answer

RAID 5

Answer

Not replicated

Question 8

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Accepted Answer

Provision and configure cloud infrastructure resources using Terraform configuration files.. Option D is correct because OCI Resource Manager is Oracle's managed Terraform service: a stack is built from Terraform configuration (HCL) and jobs such as plan/apply provision and configure OCI infrastructure resources declaratively. Option E is correct because Resource Manager supports importing existing OCI resources into a stack's Terraform state, typically via the "Import state" / terraform import workflow, so previously created resources become tracked and manageable by that stack. Options A, B, and C are incorrect because they describe monitoring and logging capabilities, not Resource Manager: threshold-based bucket-size email alerts are handled by OCI Monitoring alarms with Notifications, custom time-series metric alarms for CPU/memory are created in OCI Monitoring (with agent metrics), and ingesting/parsing application logs is done by the OCI Logging service (and Logging Analytics), none of which are functions of Resource Manager stacks.

Answer

Send email notifications when an object storage bucket size exceeds a threshold.

Answer

Create custom time-series metric alarms to monitor CPU and memory utilization.

Answer

Automatically ingest and parse custom application log files from compute instances.

Question 9

You are configuring an Object Storage bucket and want to ensure that if an object is accidentally overwritten or deleted, previous versions can still be retrieved. Which feature should you enable?

Accepted Answer

Object Versioning. Object Versioning preserves multiple variants of an object in the same bucket, protecting against accidental overwrites and deletions.

Answer

Cross-Region Replication

Answer

Object Storage Lifecycle Management

Answer

Bucket Retention Rules

Question 10

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Dynamic group policies in OCI are evaluated only when the request is authenticated using instance principals (or resource principals), which derive identity from the instance's metadata and certificates. When the developer script uses a user's API key or auth token, the request is authorized against that user's IAM policies, not the dynamic group's. Since the user has no matching policy granting object read/write, the request returns 403 Forbidden. The dynamic group membership is irrelevant to user-credential API calls.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.