1Z0-1072-26 Quick Quiz — 10 Questions

Question 1

You are using the Events service to trigger a Function. What is a required step before this can work?

Accepted Answer

Grant 'use' permissions on the function to the Events service. Before the OCI Events service can trigger a Function, you must grant the Events service permission to invoke the function. This is done by creating a policy that allows the Events service principal to use the function. Without this authorization, the Events service cannot call the function, and the rule will fail.

Answer

Attach a load balancer

Answer

Enable HTTP access on the function

Answer

Create a Service Connector

Question 2

You are creating an instance configuration from an existing compute instance that has two secondary data block volumes attached in addition to its boot volume. What happens to the data block volumes when you use this instance configuration to create an instance pool?

Accepted Answer

Secondary block volumes are excluded from the instance pool configuration template; instance pools manage compute instances and boot volumes.. An instance configuration captures the compute instance's shape, image, metadata, and boot volume, but secondary (data) block volumes are not included in the template. When an instance pool is created from that configuration, each new instance is provisioned with only the boot volume; the attached data volumes are excluded. This is by design because block volumes cannot be safely cloned and attached to multiple instances simultaneously.

Answer

The instance pool creation fails because secondary block volumes are prohibited in instance pools.

Answer

The block volumes become shared network file systems across all pool members simultaneously in read-write mode.

Answer

Identical copies of the block volumes are automatically created and attached to every new instance in the pool.

Question 3

You have a fleet of compute instances running in a private subnet. You want to patch their operating systems regularly using OCI OS Management service without exposing them to the public internet. What must be configured in your VCN?

Accepted Answer

A Service Gateway and a route table rule pointing traffic destined for Oracle Services to the Service Gateway. To allow private instances to access Oracle services like OS Management or Object Storage without public internet access, you must configure a Service Gateway and a corresponding route table entry.

Answer

A NAT Gateway with public IP attachment

Answer

An Internet Gateway with security list ingress rules

Answer

A Local Peering Gateway connected to Oracle's internal network

Question 4

You are designing a PCI-DSS compliant architecture on OCI. You need to ensure that all data stored on compute instance boot volumes and block volumes is encrypted using customer-managed encryption keys rather than Oracle-managed keys. Where should you configure these keys?

Accepted Answer

In OCI Vault (Key Management), assigning a master encryption key to the volumes during creation or update.. To use customer-managed encryption keys for boot volumes and block volumes, you configure a master encryption key in OCI Vault (Key Management) and assign it to the volumes during creation or update. This ensures that data at rest is encrypted with keys the customer controls, satisfying PCI-DSS requirements for key management. OCI Vault integrates natively with Block Volume and Boot Volume services for this purpose.

Answer

Via IAM user password policies.

Answer

Directly in the guest OS kernel encryption configuration files (`/etc/fstab`).

Answer

In the VCN Security List encryption settings.

Question 5

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Accepted Answer

Allow group DataReaders to read object-family in compartment DataLake. The policy statement 'Allow group DataReaders to read object-family in compartment DataLake' grants read-only access to Object Storage buckets and objects within the DataLake compartment. The 'read' verb includes the ability to list and get objects, while 'object-family' covers buckets and objects. This precisely matches the requirement for read-only access to all buckets in that compartment.

Answer

Allow group DataReaders to use buckets in compartment DataLake

Answer

Allow group DataReaders to inspect storage in tenancy

Answer

Allow group DataReaders to manage files in compartment DataLake

Question 6

What is the primary function of OCI Identity Domains?

Accepted Answer

To provide comprehensive identity and access management capabilities such as user lifecycle management, MFA, and OAuth/SAML integration.. OCI Identity Domains provide comprehensive IAM capabilities, including user lifecycle management, MFA, OAuth, SAML federation, and SCIM provisioning. They are the next-generation IAM model in OCI, replacing the legacy IAM service while maintaining compatibility. This matches option B.

Answer

To manage DNS zones and DNS resolution records.

Answer

To manage physical server racks in Oracle Cloud regions.

Answer

To isolate database traffic across virtual cloud networks.

Question 7

Which encryption method is used by default for all Object Storage buckets?

Accepted Answer

AES-256 server-side encryption. OCI Object Storage automatically encrypts all data at rest using AES-256.

Answer

RSA-4096 client-side encryption

Answer

No encryption by default

Answer

TLS 1.3 only

Question 8

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

Accepted Answer

Web: 172.16.1.0/24, App: 172.16.2.0/24, DB: 172.16.3.0/26. Option B is the only combination where all three subnets fall inside the VCN CIDR 172.16.0.0/16 and do not overlap. Web (172.16.1.0/24) provides 256 addresses for 100 hosts, App (172.16.2.0/24) provides 256 addresses for 200 hosts, and DB (172.16.3.0/26) provides 64 addresses for 50 hosts — all within the /16 and mutually exclusive.

Answer

Web: 10.0.1.0/24, App: 10.0.2.0/24, DB: 10.0.3.0/24

Answer

Web: 172.16.0.0/15, App: 172.16.0.0/16, DB: 172.16.1.0/24

Answer

Web: 172.16.1.0/24, App: 172.16.1.0/24, DB: 172.16.3.0/24

Question 9

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?

Accepted Answer

Service Gateway. Service Gateway provides private access to Oracle services like Object Storage across the Oracle network backbone.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

Local Peering Gateway

Question 10

Which TWO characteristics apply to the OCI File Storage Service (FSS)?

Accepted Answer

Data in FSS is encrypted at rest by default.. Option B is correct because OCI File Storage Service encrypts all file system data at rest by default using Oracle-managed keys, with the option to use customer-managed keys in Vault, so no extra configuration is needed to get encryption. Option E is correct because FSS file systems are elastic: they automatically expand and shrink as data is written or deleted, and you are billed only for the storage actually used rather than a pre-provisioned capacity. Option A is wrong because FSS is a shared, network-attached NFS file system, not a block storage service for single-instance HPC boot volumes (that role belongs to Block Volume). Option C is wrong because an FSS file system is mounted within its own region and availability domain via a mount target; it is not natively mounted across multiple regions simultaneously over the public internet. Option D is wrong because FSS snapshots are space-efficient and consume storage only for changed data, and they do not require pre-allocated baseline capacity.

Answer

FSS is designed exclusively for single-instance high-performance computing (HPC) boot volumes.

Answer

FSS file systems can be natively mounted across multiple OCI regions simultaneously over the public internet.

Answer

Snapshots created in FSS consume additional baseline storage that must be explicitly pre-allocated.