1Z0-1072-26 Hard Questions — 25 Difficult Questions

Question 1

How can you prevent users from deleting a tag namespace?

Accepted Answer

Remove 'delete' permissions in an IAM policy. In Oracle Cloud Infrastructure (OCI), tag namespaces can be protected from deletion by managing access control through IAM policies, specifically by removing permissions such as 'tag-namespaces tier-2 delete' or similar management permissions from users.

Answer

Enable soft delete

Answer

Set the namespace to read-only

Answer

Apply a lifecycle policy

Question 2

You are designing an IAM policy hierarchy for a multi-tenant OCI environment. You write the following statement in the root compartment: 'Define tenancy TenantA as ocid1.tenancy.oc1..aaaaaaa...; Define group NetworkAdmins as ocid1.group.oc1..aaaaaaa...; Allow group NetworkAdmins to manage virtual-network-family in tenancy TenantA'. What type of policy cross-tenancy grant does this represent?

Accepted Answer

A cross-tenancy policy where the remote group is granted permissions within the defining tenancy.. In OCI cross-tenancy access, policies must be endorsed by the identity tenancy and acknowledged by the resource tenancy (or vice versa depending on the specific pattern). However, the fundamental definition of this policy statement is that a group from a remote tenancy is granted permissions.

Answer

A cross-tenancy policy where TenantA is the granting tenancy and the principal belongs to an external identity provider.

Answer

A local policy granting compartment-level administration.

Answer

An invalid policy because cross-tenancy policies cannot span virtual network families.

Question 3

You are configuring a Data Guard association for an Autonomous Database on Dedicated Infrastructure. How is the Data Guard standby database provisioned and managed?

Accepted Answer

You enable Data Guard through the OCI Console, and OCI automatically provisions and manages the standby database.. On Dedicated Exadata Infrastructure, Autonomous Data Guard is enabled via the OCI Console or API by selecting the peer region, and OCI automates the provisioning and synchronization of the standby.

Answer

You must manually configure Oracle Net listener files and run 'DGMGRL' commands from the OS command line.

Answer

You must back up the database to Object Storage and restore it manually as a standby in the target region.

Answer

Data Guard is not supported on Autonomous Database Dedicated; you must use GoldenGate instead.

Question 4

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Accepted Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy where target.tag.Project.Name = 'Analytics'. OCI IAM policy conditions are appended using the 'where' keyword followed by variable evaluations like target.tag or request.tag.

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy CONDITION tag.Project.Name = 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy IF target.tag.Project.Name == 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy WITH tag Project.Name = 'Analytics'

Question 5

You are designing a PCI-DSS compliant architecture on OCI. You need to ensure that all data stored on compute instance boot volumes and block volumes is encrypted using customer-managed encryption keys rather than Oracle-managed keys. Where should you configure these keys?

Accepted Answer

In OCI Vault (Key Management), assigning a master encryption key to the volumes during creation or update.. To use customer-managed encryption keys for boot volumes and block volumes, you configure a master encryption key in OCI Vault (Key Management) and assign it to the volumes during creation or update. This ensures that data at rest is encrypted with keys the customer controls, satisfying PCI-DSS requirements for key management. OCI Vault integrates natively with Block Volume and Boot Volume services for this purpose.

Answer

Via IAM user password policies.

Answer

Directly in the guest OS kernel encryption configuration files (`/etc/fstab`).

Answer

In the VCN Security List encryption settings.

Question 6

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rules are evaluated asynchronously. When a new resource such as a compute instance is created, it can take a few minutes for the IAM service to evaluate the rules and populate the dynamic group membership. No restart or manual intervention is required.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 7

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

Accepted Answer

Deleting a compartment requires that all resources within that compartment must first be terminated or deleted.. Compartments are global logical isolations within an OCI tenancy (making C incorrect). Users can belong to multiple groups (making A incorrect). Policies can be defined at the tenancy level or within specific compartments, and policies defined in a parent compartment automatically apply to all child compartments (making B incorrect and E correct). To delete a compartment, it must be completely empty of all resources (making D correct).

Answer

A user can belong to only one IAM group within an entire OCI tenancy.

Answer

IAM policies are evaluated at the tenancy root level and cannot be defined inside a specific compartment.

Answer

Compartments are region-specific entities, meaning a compartment created in Ashburn is automatically isolated from Phoenix.

Question 8

Which TWO characteristics apply to the OCI File Storage Service (FSS)?

Accepted Answer

Data in FSS is encrypted at rest by default.. Option B is correct because OCI File Storage Service encrypts all file system data at rest by default using Oracle-managed keys, with the option to use customer-managed keys in Vault, so no extra configuration is needed to get encryption. Option E is correct because FSS file systems are elastic: they automatically expand and shrink as data is written or deleted, and you are billed only for the storage actually used rather than a pre-provisioned capacity. Option A is wrong because FSS is a shared, network-attached NFS file system, not a block storage service for single-instance HPC boot volumes (that role belongs to Block Volume). Option C is wrong because an FSS file system is mounted within its own region and availability domain via a mount target; it is not natively mounted across multiple regions simultaneously over the public internet. Option D is wrong because FSS snapshots are space-efficient and consume storage only for changed data, and they do not require pre-allocated baseline capacity.

Answer

FSS is designed exclusively for single-instance high-performance computing (HPC) boot volumes.

Answer

FSS file systems can be natively mounted across multiple OCI regions simultaneously over the public internet.

Answer

Snapshots created in FSS consume additional baseline storage that must be explicitly pre-allocated.

Question 9

You are deploying an Exadata Cloud Service instance and need to configure separate Virtual Machine clusters on the same Exadata rack. Which architectural feature enables this separation?

Accepted Answer

Exadata VM Clusters. Exadata VM Clusters are the architectural construct that lets you carve a single Exadata Cloud Service rack into multiple isolated VM clusters, each with its own compute nodes, storage access, and network configuration. This is the supported mechanism for multi-tenant separation on the same physical rack.

Answer

OCI Compartment boundaries

Answer

Oracle Multitenant container databases with PDB isolation

Answer

Dynamic Routing Gateways (DRG)

Question 10

You are setting up a File Storage mount target. What is required at the subnet level?

Accepted Answer

An IP address within the subnet. An OCI File Storage mount target is a virtual network interface (NIC) that resides in a specific subnet within a VCN, and it must be assigned an available private IP address from that subnet's CIDR block. The mount target is what NFS clients connect to over TCP/2049, so it needs a routable private IP within the VCN. Without a free IP in the subnet, the mount target cannot be created.

Answer

A NAT Gateway

Answer

A Public IP

Answer

A Service Gateway

Question 11

You are configuring Data Guard between two Exadata Cloud Service instances across different OCI regions. Which network component is mandatory to facilitate redo transport securely across regional boundaries?

Accepted Answer

Remote VCN Peering. Remote VCN Peering connects VCNs in different OCI regions, providing the private network path needed for Data Guard redo transport between Exadata Cloud Service instances in separate regions. Without it, redo traffic would have to traverse the public internet, which is neither secure nor supported for this use case.

Answer

OCI API Gateway

Answer

An Internet Gateway with public IP addresses

Answer

Local VCN Peering gateway

Question 12

You need to run an OCI Function that connects to an Oracle Autonomous Database secured within a private subnet. How should you configure the function to access the database securely without exposing it to the public internet?

Accepted Answer

Attach the function application to a private subnet within your VCN using VCN configuration.. Attaching the function application to a private subnet in your VCN lets the function's execution environment get an IP in that subnet and reach the Autonomous Database privately via the VCN's routing and security rules. This is the supported OCI Functions pattern for private resource access without public exposure.

Answer

Use an API Gateway with a public endpoint and route database queries through HTTP headers.

Answer

Configure a public IP address on the function execution environment.

Answer

Functions cannot access private subnets; you must use an internet gateway.

Question 13

Which service should you use to migrate physical data centers to OCI via physical hardware shipping?

Accepted Answer

Data Transfer Service. Data Transfer Service uses physical appliances to move data.

Answer

Storage Gateway

Answer

FastConnect

Answer

Object Storage replication

Question 14

You are planning a Disaster Recovery strategy for an Oracle Base Database System using Oracle Data Guard on OCI. You need the standby database to be open in read-only mode for reporting queries while simultaneously applying redo data from the primary database. Which Data Guard mode should you configure?

Accepted Answer

Active Data Guard. Active Data Guard enables physical standby databases to be open for read-only queries while performing real-time apply of redo from the primary database.

Answer

Snapshot Standby

Answer

Logical Standby in read-write mode

Answer

Traditional Physical Standby (Mount mode)

Question 15

Which THREE of the following are valid lifecycle policy actions?

Accepted Answer

Delete. Delete, Archive, and aborting multipart uploads are valid.

Answer

Compress

Answer

Encrypt

Question 16

You are running a stateful application inside an OKE cluster that requires persistent storage backed by OCI Block Volumes. When a pod is rescheduled to a different worker node due to a node failure, how does the Persistent Volume (PV) behave?

Accepted Answer

The OCI Block Volume CSI driver automatically detaches the volume from the old node and attaches it to the new worker node.. The OCI Block Volume CSI driver integrates with OKE to manage the lifecycle of PersistentVolumes backed by Block Volumes. When a pod is rescheduled to a new node, the CSI driver automatically detaches the volume from the failed node and attaches it to the new node, then mounts it to the pod. This is a core feature of the CSI driver and requires no manual intervention.

Answer

You must manually log into the OCI Console, detach the volume, and attach it to the new worker node.

Answer

The persistent volume is converted to Object Storage automatically.

Answer

The data is permanently lost because block volumes cannot move across worker nodes.

Question 17

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 18

Which TWO actions can be performed using OCI Resource Manager stacks? (Choose two.)

Accepted Answer

Provision and configure cloud infrastructure resources using Terraform configuration files.. Option D is correct because OCI Resource Manager is Oracle's managed Terraform service: a stack is built from Terraform configuration (HCL) and jobs such as plan/apply provision and configure OCI infrastructure resources declaratively. Option E is correct because Resource Manager supports importing existing OCI resources into a stack's Terraform state, typically via the "Import state" / terraform import workflow, so previously created resources become tracked and manageable by that stack. Options A, B, and C are incorrect because they describe monitoring and logging capabilities, not Resource Manager: threshold-based bucket-size email alerts are handled by OCI Monitoring alarms with Notifications, custom time-series metric alarms for CPU/memory are created in OCI Monitoring (with agent metrics), and ingesting/parsing application logs is done by the OCI Logging service (and Logging Analytics), none of which are functions of Resource Manager stacks.

Answer

Send email notifications when an object storage bucket size exceeds a threshold.

Answer

Create custom time-series metric alarms to monitor CPU and memory utilization.

Answer

Automatically ingest and parse custom application log files from compute instances.

Question 19

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Dynamic group policies in OCI are evaluated only when the request is authenticated using instance principals (or resource principals), which derive identity from the instance's metadata and certificates. When the developer script uses a user's API key or auth token, the request is authorized against that user's IAM policies, not the dynamic group's. Since the user has no matching policy granting object read/write, the request returns 403 Forbidden. The dynamic group membership is irrelevant to user-credential API calls.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.

Question 20

You are deploying a microservices application on OKE and want to implement zero-downtime rolling deployments for your pods. Which Kubernetes deployment strategy and configuration parameter should you utilize?

Accepted Answer

RollingUpdate strategy with maxSurge and maxUnavailable configured. The RollingUpdate strategy is Kubernetes' native mechanism for replacing pods incrementally so that some old replicas remain available while new ones come up, enabling zero-downtime deployments. The maxSurge parameter controls how many extra pods above the desired count can be created during the rollout, and maxUnavailable controls how many pods below the desired count can be temporarily unavailable. Tuning both ensures capacity is maintained throughout the update.

Answer

Horizontal Pod Autoscaler with metric-based CPU triggers

Answer

Static Pod assignment via node selectors

Answer

Recreate strategy with immediate termination of all old pods