1Z0-1072-26 Practice Test 9 — 10 Questions

Question 1

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Identity Provider (IdP) in OCI IAM by importing the SAML 2.0 metadata from the external IdP.. To set up external federation in OCI, you must first create an Identity Provider (IdP) record by uploading the IdP metadata XML file.

Answer

Provision local user accounts in OCI IAM for every partner employee.

Answer

Write a tenancy-wide policy allowing all external users to manage tenancy resources.

Answer

Create an API signing key pair for each partner user in OCI IAM.

Question 2

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Accepted Answer

database-family. Database resources in OCI are grouped under the 'database-family' resource type for IAM policies.

Answer

db-resources

Answer

sql-databases

Answer

databases

Question 3

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Accepted Answer

A user can belong to multiple groups.. Groups contain users, can be mapped from federated IdPs, and are used in IAM policies.

Answer

Groups can be nested inside other groups to form a hierarchy.

Answer

Groups can own compartments directly without human members.

Question 4

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rule evaluation is not always instantaneous, but more importantly, compute instances must be explicitly configured with resource principal or instance principal features depending on the SDK version, and matching rules take a short time to evaluate newly created resources.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 5

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Accepted Answer

manage. The 'manage' verb is the most powerful verb in OCI IAM policies, encompassing inspect, read, use, and full management capabilities.

Answer

use

Answer

read

Answer

inspect

Question 6

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

Accepted Answer

Compartments can be used to set granular budget limits and cost tracking.. Compartment design should reflect organizational structure, policy inheritance, and quota management.

Answer

Compartments automatically replicate resources across OCI regions for high availability.

Answer

Compartments isolate network traffic between VCNs automatically without security lists.

Question 7

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Accepted Answer

A logical wrapper operator (ALL or ANY). Dynamic group rules must start with a logical operator (ALL or ANY) followed by matching criteria enclosed in curly braces.

Answer

A user password hash

Answer

An API signing key fingerprint

Answer

A VCN security list ID

Question 8

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Accepted Answer

Scope policies to specific compartments rather than the tenancy root whenever feasible.. IAM best practices include adhering to the principle of least privilege and scoping policies to compartments rather than tenancies when possible.

Answer

Hardcode API signing keys directly into public source code repositories.

Answer

Always assign the 'manage all-resources' role to every user to simplify troubleshooting.

Answer

Use tenancy-wide administrative policies for all standard developers.

Question 9

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Accepted Answer

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.. Federated groups from IDCS must be mapped to OCI IAM groups in the OCI Console, and then a policy must be written granting that OCI IAM group access.

Answer

Assign the NetworkAdmins group directly to the tenancy root compartment via the IDCS console.

Answer

Write a policy directly referencing the IDCS group name 'NetworkAdmins' with no OCI group mapping.

Answer

Create a local user in OCI IAM for every member of the IDCS 'NetworkAdmins' group and assign them roles.

Question 10

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Accepted Answer

Dynamic Routing Gateway (DRG) attached to the VCN. OCI automatically provisions two redundant VPN tunnels for every Site-to-Site VPN connection. To use them, you configure a CPE object, a DRG, and configure both tunnels on your on-premises router.

Answer

Service Gateway

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway