1Z0-1072-26 Practice Test 8 — 10 Questions

Question 1

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Accepted Answer

Identity Domains support advanced features like OAuth, SAML integration, and passwordless authentication.. Option B is correct because OCI Identity Domains are built on Oracle Identity Cloud Service (IDCS) technology and natively support advanced identity features such as OAuth 2.0, OpenID Connect, SAML 2.0 federation, and passwordless authentication (e.g., FIDO2/WebAuthn). Option E is correct because an Identity Domain is fundamentally a container that holds and manages identity resources — users, groups, dynamic groups, app roles, policies, and security settings — for a tenancy or a specific set of resources. Option A is wrong because Identity Domains are an IAM construct and have nothing to do with networking; Virtual Cloud Networks are separate networking resources and are not replaced by Identity Domains. Option C is wrong because a tenancy can have multiple Identity Domains (the default domain plus additional domains, subject to limits), and they can be created, modified, or deleted. Option D is wrong because storing compute instance virtual disk images is the role of OCI Block Volume and Object Storage services, not Identity Domains.

Answer

Identity Domains replace Virtual Cloud Networks entirely.

Answer

Every tenancy is restricted to having exactly one Identity Domain that cannot be changed.

Answer

Identity Domains store compute instance virtual disk images.

Question 2

Which service is best used to monitor a public-facing website endpoint for availability?

Accepted Answer

Health Checks. Health Checks monitor endpoints from various global locations.

Answer

Events service

Answer

Notifications service

Answer

Monitoring service

Question 3

An administrator configured a Network Security Group (NSG) and a Security List for a compute instance in a subnet. The Security List denies port 443 inbound, but the NSG associated with the instance's primary VNIC explicitly allows port 443 inbound from any source. What will happen when external traffic attempts to access the instance on port 443?

Accepted Answer

Traffic will be allowed because Security List and NSG rules are additive.. OCI security rules are evaluated additively. If either the Security List or the applicable NSG allows the traffic, the traffic is permitted. Therefore, port 443 traffic will be allowed.

Answer

Traffic will be blocked due to the default stateless nature of NSGs.

Answer

Traffic will be dropped because both components must explicitly allow the traffic for it to pass.

Answer

Traffic will be dropped because Security Lists take precedence over Network Security Groups.

Question 4

Which TWO statements are true regarding OCI VCN Flow Logs?

Accepted Answer

Flow logs capture information about traffic flowing through VNICs in your VCN.. Option A is correct because OCI VCN Flow Logs capture metadata about IP traffic traversing the VNICs (VNIC-level flow data) within a VCN, including source/destination IPs, ports, protocol, and action. Option E is correct because when creating a flow log you can set the capture filter to log accepted traffic, rejected traffic, or all traffic, giving you flexibility in what security-relevant events are recorded. The unmarked options are incorrect: flow logs are not limited to public subnets (they work with any subnet/VNIC), they do not encrypt database data at rest (that is handled by OCI Block Volume/Bucket encryption and TDE for databases), and they do not require an Internet Gateway to export logs since flow logs are delivered to OCI Object Storage or OCI Streaming via the service's internal path.

Answer

Flow logs are only supported on public subnets.

Answer

Flow logs automatically encrypt your database data at rest.

Answer

Flow logs require an Internet Gateway to export logs out of the VCN.

Question 5

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Accepted Answer

Tenancy root (or the root compartment). When an OCI tenancy is created, Oracle automatically creates a top-level compartment known as the tenancy root or root compartment. It shares the tenancy's name and serves as the default container for all resources until administrators create additional compartments.

Answer

MasterCompartment

Answer

RootComp

Answer

Default-Tenant

Question 6

Your OCI environment requires secure hybrid connectivity using an IPsec VPN over a Dynamic Routing Gateway (DRG). Which THREE parameters or components must be correctly configured to ensure successful IPsec VPN tunnel establishment?

Accepted Answer

IPsec connection tunnels configured with appropriate pre-shared keys (PSK) and cryptographic parameters. Establishing an IPsec VPN tunnel requires a Customer-Premises Equipment (CPE) object representing your on-premises router public IP, a DRG attached to your VCN, and IPsec connection tunnels configured with correct static or BGP routing and pre-shared keys.

Answer

A Local Peering Gateway (LPG) bridging the VPN tunnel to the database subnet

Answer

An Internet Gateway attached to the private subnets handling the VPN traffic

Question 7

Which type of compute shape provides the lowest cost per core for general-purpose workloads by utilizing ARM-based Ampere processors?

Accepted Answer

VM.Standard.A1.Flex. VM.Standard.A1.Flex is OCI's Arm-based Ampere Altra compute shape, offering the lowest cost per core for general-purpose workloads. It provides flexible OCPU and memory configurations and is significantly cheaper than x86 equivalents, making it the correct answer for cost-sensitive ARM workloads.

Answer

VM.Standard.E4.Flex

Answer

BM.DenseIO2.52

Answer

VM.Standard3.Flex

Question 8

Which TWO storage options are available when provisioning an Oracle Base Database System?

Accepted Answer

OCI Block Volume storage managed via Automatic Storage Management (ASM). Option D is correct because Oracle Base Database System on OCI can be provisioned with OCI Block Volume storage that is presented to the database host and managed by Automatic Storage Management (ASM), which is the standard Oracle storage management layer for database files. Option E is correct because certain Bare Metal shapes for Base Database System offer local NVMe storage, which can be used as high-performance direct-attached storage for the database. Options A, B, and C are not valid provisioning choices for Oracle Base Database System: Google Cloud Persistent Disk and Amazon S3 are other cloud providers' services, and local floppy disk drives are obsolete and far too small for database storage.

Answer

Google Cloud Persistent Disk

Answer

Local floppy disk drives

Answer

Amazon S3 object storage buckets

Question 9

What is the primary benefit of using Oracle Autonomous Database's autoscaling feature for CPU and storage?

Accepted Answer

It automatically increases OCPU or storage capacity when workload spikes, and scales down when demand drops.. Autoscaling in Autonomous Database automatically increases OCPU count (up to 3x the base) when CPU utilization is high and scales back down when demand drops, without manual intervention. This provides performance elasticity for variable workloads while controlling cost.

Answer

It automatically pauses billing when the database is idle for more than one hour.

Answer

It automatically converts your database from Transaction Processing to Data Warehouse workloads.

Answer

It automatically migrates the database to a different cloud region during high load.

Question 10

Which THREE features are supported by OCI Load Balancer?

Accepted Answer

TCP layer 4 load balancing. OCI Load Balancer supports TCP layer 4 load balancing (option A) because it can distribute raw TCP traffic based on IP address and port without inspecting application-layer content, which is the defining behavior of a Layer 4 load balancer. It also supports HTTP/HTTPS layer 7 load balancing (option C), allowing it to route requests based on HTTP headers, paths, hostnames, and cookies, and to perform health checks at the application layer. SSL termination (option D) is supported because the load balancer can decrypt incoming TLS/SSL traffic at the listener and forward plaintext or re-encrypted traffic to backend servers, offloading certificate processing from the backends. Option B is incorrect because OCI Load Balancer is not a Next-Gen Firewall and does not perform automatic packet filtering or deep packet inspection like a security appliance. Option E is incorrect because OCI Load Balancer distributes traffic to backend compute instances (or backend sets), not directly to database query engines, and it has no native database query routing capability.

Answer

Automatic packet filtering like a Next-Gen Firewall

Answer

Direct database query routing without backend compute instances