Oracle · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?
OCI Cloud Guard
OCI Cloud Guard aggregates security findings across tenancies and compartments into one dashboard, satisfying the consolidated monitoring constraint. It detects misconfigurations and risky activity via detectors and responder recipes, reporting centrally through the Cloud Guard console. This cross-tenancy visibility is precisely what the security officer requires.
OCI Bastion
OCI Web Application Firewall
OCI Vault
According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?
Oracle
Both Oracle and the customer jointly via shared IAM consoles
The customer
The customer configures identity controls within OCI Identity and Access Management, including user accounts, password policies and MFA enforcement. Oracle secures the underlying cloud infrastructure, but identity governance remains a tenant responsibility, satisfying the stem's requirement for account, credential and authentication management ownership.
Third-party identity auditor
Your organization has strict compliance requirements and needs to ensure that no compute instance in a specific production compartment can ever have a public IP address attached. Which OCI service should you use to enforce this rule automatically?
Security Zones
Security Zones enforce immutable, compartment-level policies that automatically deny any action violating the specified security policy, including attaching a public IP to a compute instance. Because the rule is recipe-based and cannot be overridden or disabled by users, it satisfies the compliance requirement for guaranteed, continuous enforcement in the production compartment.
Cloud Guard
Web Application Firewall
Vault Service
An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?
Guest operating system patching and configuration on the compute instances
Guest OS patching and configuration sits entirely with the customer, since OCI's shared-responsibility model places everything above the hypervisor under tenant control. Oracle secures the physical hosts, network fabric and virtualisation layer, but the operating system running inside your compute instances — its patches, hardening and settings — remains your sole obligation.
Hypervisor patching and firmware updates on the physical host
Redundancy and cooling of the physical networking hardware
Physical security of the data center hosting the compute instances
A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?
Object Storage with customer-managed keys
Key Management Service Master Keys
Vault Secrets
Vault Secrets stores credentials such as connection strings and API tokens in encrypted vaults, letting applications retrieve them programmatically at runtime. This directly satisfies the requirement to avoid hardcoding credentials, unlike plain Object Storage or config files, because secrets are centrally managed, audited and rotated without redeployment.
Identity and Access Management Dynamic Groups
An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?
Cloud Guard
Virtual Cloud Network Security Lists
Network Security Groups
OCI Web Application Firewall
OCI Web Application Firewall inspects Layer 7 HTTP traffic, filtering malicious requests and blocking SQL injection payloads before they reach the application. It directly addresses both the HTTP flood and injection constraints named in the stem, unlike network-layer defences that cannot parse application content.
Want more Security Services practice?
Practice this domainAn application administrator is configuring a high-availability database cluster across three Fault Domains in a single Availability Domain. During a scheduled infrastructure maintenance event affecting Fault Domain 1, the administrator notices that one of the database nodes becomes unreachable. What is the expected behavior of OCI Fault Domains in this scenario?
The database cluster automatically fails over its primary role to an instance in a different Availability Domain.
Only instances in Fault Domain 1 are impacted by the maintenance, while instances in Fault Domains 2 and 3 continue to run normally without disruption.
Fault Domains are isolated groups within an Availability Domain, so maintenance affecting Fault Domain 1 only impacts instances there. Nodes in Fault Domains 2 and 3 remain running, which is the isolation the cluster's spread design relies on.
The entire Availability Domain is taken offline to synchronize the maintenance state across all Fault Domains.
Instances in Fault Domain 1 are automatically migrated to Fault Domain 2, causing a brief network partition.
You are deploying a mission-critical web application that must remain available even if an entire Oracle Cloud Infrastructure availability domain experiences a major outage. The application architecture requires two compute instances. How should you provision these instances to achieve high availability?
Deploy both instances in the same Availability Domain but assign them to different Fault Domains.
Deploy both instances in separate OCI Regions using an explicit cross-region pairing gateway.
Deploy one instance in Availability Domain 1 and the other instance in Availability Domain 2.
Availability domains within a region have independent power, cooling and network infrastructure, so an outage affecting one does not affect another. Placing one compute instance in each of two availability domains satisfies the requirement that the application survive the loss of an entire availability domain.
Deploy both instances in the same Availability Domain and configure autonomous cross-AD scaling.
Your development team needs to test an application's resilience against infrastructure hardware failures within a specific OCI region that contains only a single Availability Domain. Which OCI feature should you utilize to distribute your compute instances for fault tolerance?
Dynamic Routing Gateways
Cross-Region Replication
Fault Domains
Fault domains are isolated groupings of hardware within a single Availability Domain, each with independent power and network. Distributing instances across them protects against hardware failure where only one Availability Domain exists, which availability domains alone cannot address.
Secondary Regions
An organization is planning a disaster recovery strategy for a Tier-1 financial application. They need a Recovery Point Objective (RPO) of near-zero and a Recovery Time Objective (RTO) of seconds. Which OCI deployment pattern best fulfills these stringent requirements?
Deploy instances across three Fault Domains in a single Availability Domain with automated compute health checks.
Backup daily block volumes to Object Storage and restore them in a secondary region upon disaster declaration.
Deploy an active-passive architecture across two OCI regions using asynchronous database replication and manual DNS failover.
Deploy an active-active architecture across two low-latency interconnected OCI regions using synchronous replication and automated traffic management failover.
Active-active across two low-latency OCI regions with synchronous replication keeps both sites current, giving near-zero RPO, while automated traffic management failover redirects users within seconds, meeting the seconds-level RTO. Warm standby or backup-based patterns cannot achieve both targets.
You are designing a web application hosted in OCI. You want to ensure that if a top-of-rack switch fails inside a data center, your application remains online. How are OCI Fault Domains engineered to address this specific risk?
Fault domains provide automatic geographic failover across different countries.
Fault domains automatically replicate virtual machine memory across different availability domains.
Each Fault Domain has its own dedicated external internet gateway to route traffic around broken switches.
Fault domains are isolated racks with their own power, cooling, and network hardware, ensuring anti-affinity for instance placement.
Fault domains are physically separate racks, each with independent power, cooling and network hardware. Distributing instances across fault domains ensures anti-affinity, so a single top-of-rack switch failure cannot take down every instance, satisfying the resilience requirement.
What is the primary characteristic of an Oracle Cloud Infrastructure Availability Domain?
A software-defined network boundary that connects local data centers to the OCI backbone.
A logical grouping of users and compartments for billing purposes.
One or more data centers located within a region, fault-isolated from each other with independent power and cooling.
An Availability Domain comprises one or more physically separate data centres within a region, each with independent power and cooling. This fault isolation lets you distribute resources so a single AD failure does not affect workloads in other ADs.
A hardware rack dedicated entirely to a single enterprise customer on-premises.
Want more Getting Started With Oci practice?
Practice this domainAn administrator wants to restrict inbound SSH access to a specific group of database compute instances without modifying subnet-level security rules. Which OCI feature should be used to define these fine-grained VNIC rules?
Route Tables
Security Lists
Network Security Groups
Network Security Groups apply rules at the VNIC level, so only the chosen database instances receive the restriction while the subnet's own security lists stay untouched. This satisfies the fine-grained, subnet-independent constraint that security lists cannot meet.
Dynamic Routing Gateway
A company needs to store petabytes of data that is rarely accessed but must be retained for compliance for 7 years. Retrievals can take up to several hours. Which storage tier should they use?
Standard Storage
Infrequent Access Storage
Archive Storage
Archive Storage is the only OCI tier designed for long-term retention of rarely accessed data, with retrieval times measured in hours. It satisfies the seven-year compliance retention and petabyte-scale requirements at the lowest cost per gigabyte, matching the stem's tolerance for slow retrieval.
Block Volume Backups
A cloud architect needs to deploy a cloud-native application using Docker containers without managing any underlying infrastructure, servers, or Kubernetes worker nodes. Which OCI service should they select?
OCI Functions
Oracle Container Engine for Kubernetes (OKE)
OCI Container Instances
OCI Container Instances runs Docker containers directly without managing servers or Kubernetes worker nodes, satisfying the serverless container requirement. It differs from OKE, which requires managing node pools, and from Functions, which is event-driven rather than long-running.
Compute Instances with Custom Images
An application running on OCI Compute instances requires shared file storage that can be mounted concurrently across hundreds of Linux instances via the standard NFS protocol. Which OCI storage service is best suited?
Object Storage
File Storage Service
File Storage Service exposes NFSv3 file systems mountable concurrently by many compute instances, satisfying the shared NFS requirement. Block Volume attaches to one instance at a time, and Object Storage is not a POSIX NFS file system.
Block Volume
Local NVMe Temporary Storage
Your development team needs to deploy microservices orchestrated via Kubernetes with automated worker node scaling and managed control plane upgrades. Which OCI service should you provision?
OCI Functions
OCI Container Instances
OCI Compute Instances with Docker
Oracle Container Engine for Kubernetes (OKE)
OKE provides a managed Kubernetes control plane plus node pools with automated worker scaling and managed upgrades, satisfying the orchestration, scaling and upgrade requirements. Container Instances lacks Kubernetes orchestration, and OCI Functions is event-driven rather than cluster-based.
You are configuring an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) and need to ensure that compute instances in a private subnet can initiate outbound internet connections to download software patches without allowing unsolicited inbound traffic from the internet. Which gateway must you attach to the VCN?
Service Gateway
Internet Gateway
NAT Gateway
A NAT Gateway provides one-way outbound internet access for instances in private subnets, translating their private IPs and blocking unsolicited inbound connections. This satisfies the requirement to download patches while preventing inbound internet traffic, unlike an Internet Gateway, which requires public IPs.
Dynamic Routing Gateway
Want more Core Oci Services practice?
Practice this domainYour company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?
Cost-tracking tags
Cost-tracking tags are metadata key-value pairs applied to OCI resources that appear in Cost Analysis and cost reports, enabling spend to be grouped and allocated by business unit. They satisfy the requirement to attribute operational costs across compartments, unlike free-form tags, which are not used for cost reporting.
IAM policies
Budgets
Compartment quotas
An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?
OCI Notifications
OCI Audit
OCI Audit automatically records all API calls against your tenancy, capturing the identity of the caller, timestamp, source IP and the exact action performed. Querying it filters the VCN deletion event, satisfying the auditor's need for precise who-deleted-what history from yesterday.
OCI Events
OCI Monitoring
Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?
OCI Tag Defaults
OCI Cloud Guard
OCI Budgets
Budgets allow you to set financial limits and configure automated alerts when forecasted or actual spend crosses set percentages.
OCI Cost Analysis
Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?
OCI Cloud Guard
OCI Cloud Guard continuously monitors resources against security best practices and industry benchmarks, satisfying the stem's diagnostic and compliance requirement. It detects misconfigurations and insecure activity through configurable detector recipes, then raises problems and responds automatically. Unlike posture-only tools, it also triggers corrective actions, directly meeting the continuous monitoring constraint.
OCI Audit
OCI Logging Analytics
OCI Cost Analysis
An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?
Allow group DBA-Group to manage all-resources in compartment DevCompartment
Allow compartment DevCompartment to manage autonomous-databases for group DBA-Group
Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment
Scoping the statement to autonomous-databases in compartment DevCompartment grants management of Autonomous Databases only there, excluding every other resource type in that compartment. Broadening to all-resources or tenancy-level scope would breach the least-privilege requirement in the stem.
Allow group DBA-Group to manage autonomous-databases in tenancy
You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?
2 levels
There is no limit or recommendation; you can nest indefinitely.
6 levels
OCI best practise caps compartment nesting at six levels beneath the tenancy root. A seven-level structure exceeds this limit, complicating policy inheritance and IAM management, so six levels is the recommended maximum depth for the hierarchy.
10 levels
Want more Governance And Administration practice?
Practice this domainThe vendor does not publish an exact question count for the 1Z0-1085-26. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Security Services, Getting Started With Oci, Core Oci Services, Governance And Administration. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Oracle 1Z0-1085-26 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.