1Z0-1072-26 Hard Questions — 25 Difficult Questions

Question 1

You are managing a large OKE cluster and notice that pods are failing to schedule because the worker nodes have run out of ephemeral storage. What is the most robust architectural solution to address this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the size of the worker node boot volumes in the node pool configuration or add node pools with larger boot volumes.. Ephemeral storage on OKE nodes is tied to the boot volume or local storage. To fix ephemeral storage exhaustion, you can resize the worker node boot volumes, add node pools with larger boot volumes, or configure emptyDir volumes to use specific storage mediums.

Answer

Change the VCN MTU size from 9000 to 1500.

Answer

Attach a Block Volume to the Kubernetes control plane nodes.

Answer

Restart the Kubernetes API server.

Question 2

You are deploying a Container Engine for Kubernetes (OKE) cluster and want to ensure that worker nodes are distributed across separate physical hardware infrastructures to maximize fault tolerance. Which feature should you configure during cluster creation?

Accepted Answer

Node Pool Fault Domains. Fault domains ensure that instances are distributed across physical hardware that has independent power and top-of-rack switches. OKE supports specifying fault domains or availability domains for node pools.

Answer

VCN Route Tables

Answer

Kubernetes Horizontal Pod Autoscaler

Answer

Pod Security Policies

Question 3

You are migrating a legacy application to OCI. The application requires a specific network interface card (NIC) virtualization mode and custom UEFI boot parameters that are not standard. Where should you configure these custom launch options?

Accepted Answer

In the Custom Image launch options settings. Launch options can be customized when creating a custom image or by updating the launch options of an existing custom image in OCI to specify firmware, network virtualization, and boot options.

Answer

Inside the VCN Security List configurations

Answer

Via the compute instance's operating system kernel parameters

Answer

In the Instance Configuration template parameters

Question 4

You are running a stateful application inside an OKE cluster that requires persistent storage backed by OCI Block Volumes. When a pod is rescheduled to a different worker node due to a node failure, how does the Persistent Volume (PV) behave?

Accepted Answer

The OCI Block Volume CSI driver automatically detaches the volume from the old node and attaches it to the new worker node.. OCI Block Volume CSI (Container Storage Interface) driver dynamically detaches the block volume from the failed worker node and attaches it to the new worker node where the rescheduled pod is running, preserving data persistence.

Answer

You must manually log into the OCI Console, detach the volume, and attach it to the new worker node.

Answer

The persistent volume is converted to Object Storage automatically.

Answer

The data is permanently lost because block volumes cannot move across worker nodes.

Question 5

You are troubleshooting a performance issue on an OCI compute instance. You suspect that the instance is experiencing CPU throttling due to credits being exhausted. Which compute shape type are you most likely using?

Accepted Answer

Standard AMD Flexible Shape with baseline OCPU performance enabled. Burstable instances (such as VM.Standard.E3.Flex or VM.Standard.E4.Flex configured with baseline OCPU utilization or specific micro/standard burstable settings) use CPU credits. If credits are exhausted, performance is throttled to the baseline.

Answer

HPC (High-Performance Computing) Shape

Answer

Bare Metal Standard Shape

Answer

GPU Shape

Question 6

Which THREE security best practices should be implemented when deploying and managing OCI Functions? (Choose three.)

Accepted Answer

Using dynamic groups and IAM policies to grant functions least-privilege access to other OCI resources. Security best practices for functions include using dynamic groups and IAM policies for least-privilege resource access, storing sensitive strings in OCI Vault, and deploying functions in private subnets with VCN integration.

Answer

Hardcoding tenancy administrator credentials in environment variables for easy access

Answer

Disabling authentication on API Gateways triggering functions to allow open public access

Question 7

You are configuring an autoscaling policy for an instance pool. You choose a schedule-based policy to scale out the pool to 20 instances every Monday at 8:00 AM. What happens if an instance within the pool fails due to hardware degradation during the weekend when the pool size is set to 5?

Accepted Answer

The instance pool automatically replaces the failed instance immediately to maintain the current desired capacity of 5.. Instance pools continuously monitor the health of instances. If an instance fails or is unhealthy, the instance pool automatically terminates it and provisions a replacement instance to maintain the desired capacity of the pool at that moment.

Answer

The failed instance is left in a failed state until Monday at 8:00 AM when the scheduled scaling event runs.

Answer

The autoscaling configuration disables itself due to a health check failure.

Answer

The entire instance pool is shut down to prevent data corruption.

Question 8

Which THREE options are available when configuring health checks for an OCI Instance Pool to monitor instance health? (Choose three.)

Accepted Answer

Instance Health (monitoring infrastructure status and Oracle Cloud Agent). Instance pools support multiple health check types, including Instance Health (checking hypervisor and agent status), Custom HTTP/HTTPS health checks, and Custom VNIC-based TCP health checks.

Answer

Object Storage bucket upload speed health checks

Answer

Automatic database transaction replication health checks

Question 9

You are implementing automated disaster recovery for your OCI compute instances. You configure automated backups for boot volumes and block volumes using volume groups. What is the primary advantage of using Volume Groups for backups?

Accepted Answer

Volume groups ensure point-in-time, coordinated crash-consistent or application-consistent backups across multiple attached volumes.. Volume Groups allow you to group multiple boot and block volumes together and take crash-consistent or application-consistent point-in-time backups simultaneously across all volumes in the group.

Answer

Volume groups automatically replicate data across different cloud providers.

Answer

Volume groups convert block volumes into high-performance local NVMe storage.

Answer

Volume groups eliminate all storage costs associated with snapshots.

Question 10

How can you prevent users from deleting a tag namespace?

Accepted Answer

Remove 'delete' permissions in an IAM policy. IAM policies are required to restrict deletion permissions on tag namespaces.

Answer

Enable soft delete

Answer

Set the namespace to read-only

Answer

Apply a lifecycle policy

Question 11

You are running an application on an OKE cluster. You want to ensure that specific pods belonging to a high-priority database caching tier are never scheduled onto the same worker node as each other to avoid a single node failure taking down the entire cache tier. What Kubernetes feature should you configure?

Accepted Answer

Pod Anti-Affinity. Kubernetes pod anti-affinity allows you to specify rules that prevent pods with matching labels from being scheduled on the same node, availability domain, or fault domain.

Answer

Persistent Volume Claims

Answer

Kubernetes Network Policies

Answer

Horizontal Pod Autoscaler

Question 12

A company uses OCI Resource Manager to manage its cloud infrastructure using Terraform. A developer has modified a Terraform configuration file locally and needs to preview the changes that Resource Manager will make to the cloud environment before actually applying them. Which Resource Manager job type should be executed?

Accepted Answer

Plan Job. A 'Plan' job in OCI Resource Manager generates an execution plan, showing what actions Terraform will take when applied against the current state.

Answer

Apply Job

Answer

Import Job

Answer

Destroy Job

Question 13

You need to run an OCI Function that connects to an Oracle Autonomous Database secured within a private subnet. How should you configure the function to access the database securely without exposing it to the public internet?

Accepted Answer

Attach the function application to a private subnet within your VCN using VCN configuration.. OCI Functions support VCN configuration, allowing you to attach a function application to a specific subnet within a VCN so that functions can access private resources like databases via private IP addresses.

Answer

Use an API Gateway with a public endpoint and route database queries through HTTP headers.

Answer

Configure a public IP address on the function execution environment.

Answer

Functions cannot access private subnets; you must use an internet gateway.

Question 14

You are designing a disaster recovery strategy for an OCI compute instance. You need to replicate boot volume backups to a secondary region. How should you accomplish this?

Accepted Answer

Use the OCI Console or CLI to copy the boot volume backup to the destination region.. Boot volume backups can be copied across regions using the cross-region copy feature in the OCI Console or CLI, allowing you to restore them as boot volumes in another region.

Answer

Configure a local peering gateway between the two regions' boot storage endpoints.

Answer

Boot volume backups cannot be copied across regions; you must recreate the instance manually.

Answer

Attach the boot volume backup as an Object Storage bucket and sync via FTP.

Question 15

Which THREE features are associated with OCI Dedicated Virtual Machine Hosts? (Choose three.)

Accepted Answer

Visibility into host-level resource capacity and placement control. Dedicated VM hosts provide physical hardware isolation, allow you to run multiple virtual machine instances on a single dedicated server, and give you visibility into host resource capacity.

Answer

Automatic multi-cloud replication across AWS and Azure physical datacenters

Answer

The ability to convert the dedicated host directly into a Kubernetes master node without OS reinstallation

Question 16

You are troubleshooting a custom OCI compute image that fails to boot properly after launching an instance. The instance gets stuck in a pre-boot state. Where can you view serial console logs to diagnose the low-level boot sequence and kernel panic messages?

Accepted Answer

OCI Compute Instance Serial Console connection. OCI provides access to the serial console for compute instances, allowing administrators to view low-level kernel boot messages, GRUB menus, and interactive login prompts even if network access is down.

Answer

Object Storage boot bucket logs

Answer

OCI Logging service via custom log agents

Answer

OCI Monitoring service under instance metrics

Question 17

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Accepted Answer

ANY {instance.id = 'ocid1.instance...', tag.Project.Value = 'Alpha'}. Dynamic group matching rules support matching conditions using ALL or ANY operators with parameters such as instance.id and tag.namespace.tagkey.

Answer

MATCH {instance.id == 'ocid1.instance...' OR tag.Project == 'Alpha'}

Answer

DYNAMIC {instance.id IN ('ocid1.instance...'))}

Answer

ALL {instance.id = 'ocid1.instance...', tag.Project.name = 'Alpha'}

Question 18

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Accepted Answer

No IAM policies have been created granting permissions to the mapped OCI IAM groups.. Successful authentication via federation only proves who the user is; authorization requires IAM policies to be written that grant the mapped OCI IAM groups permissions to resources.

Answer

The SAML assertion signature certificate has expired in the external IdP.

Answer

Federated users cannot access OCI without first creating local user accounts.

Answer

The user's browser blocked the OCI redirection cookies.

Question 19

You are configuring an Exadata Cloud Service (ExaCS) instance and need to ensure maximum isolation and security for your database infrastructure. Which architectural layer provides tenant isolation at the hypervisor level in ExaCS?

Accepted Answer

Oracle VM or KVM guest virtualization (domU). In Exadata Cloud Service, Oracle manages the underlying hardware, and tenant isolation is achieved using Oracle VM (OVM) or KVM-based virtualization to isolate dom0 and guest domU virtual machines.

Answer

Virtual Cloud Network (VCN) security lists and network security groups

Answer

Storage Server Cell software zones

Answer

Exadata Database Vault compartment boundaries

Question 20

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Accepted Answer

Provision and configure cloud infrastructure resources using Terraform configuration files.. OCI Resource Manager uses Terraform to provision, update, import, and destroy infrastructure stacks.

Answer

Send email notifications when an object storage bucket size exceeds a threshold.

Answer

Create custom time-series metric alarms to monitor CPU and memory utilization.

Answer

Automatically ingest and parse custom application log files from compute instances.