1Z0-1085-26 Practice Test 1 — 10 Questions

Question 1

An enterprise architect is designing a highly available and resilient web application in OCI. Which THREE strategies should be implemented to ensure maximum uptime and fault isolation? (Choose three.)

Accepted Answer

Configure OCI Traffic Management to automatically route client requests away from an impaired region.. High resilience involves multi-AD/FD placement, cross-region disaster recovery, and automated traffic management.

Answer

Rely solely on single-instance virtual machines with automatic daily backups instead of multi-node clustering.

Answer

Deploy all database and application instances in a single Fault Domain to optimize network latency.

Question 2

You need to restrict access to a specific compute instance based on the application it is running, without affecting other instances in the same subnet. Which security feature should you use?

Accepted Answer

Network Security Groups. Network Security Groups (NSG) allow fine-grained security at the VNIC level.

Answer

Dynamic Routing Gateway

Answer

Route Tables

Answer

Security Lists

Question 3

Which THREE types of gateways can be attached to an OCI Virtual Cloud Network (VCN)? (Choose three.)

Accepted Answer

NAT Gateway. In OCI, a VCN can have a NAT Gateway (B), which lets instances in a private subnet initiate outbound internet connections without exposing them to inbound traffic, and an Internet Gateway (D), which provides bidirectional internet connectivity for instances in public subnets. A Service Gateway (E) is also attachable to a VCN and enables private access to Oracle services such as Object Storage or Autonomous Database without traversing the internet. By contrast, a Storage Gateway (A) is not an OCI VCN gateway type — OCI offers a Storage Gateway appliance for hybrid on-premises access to Object Storage, but it is not attached to a VCN as a gateway. A Database Gateway (C) is likewise not a VCN-attachable gateway in OCI; database connectivity is handled through other constructs such as private endpoints or the service gateway.

Answer

Storage Gateway

Answer

Database Gateway

Question 4

An organization is setting up a hybrid network architecture using OCI FastConnect with a Partner/Provider model. They need to ensure that their on-premises network can communicate with multiple VCNs across different regions using private IP addresses without traversing the public internet. Which OCI component is mandatory to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG). A Dynamic Routing Gateway (DRG) version 2 supports attaching to FastConnect and can peer across regions or connect multiple VCNs to a single on-premises connection.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 5

You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?

Accepted Answer

Missing route table entries directing traffic to the Local Peering Gateway in both VCNs. VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.

Answer

Using security lists instead of Network Security Groups

Answer

Attaching an Internet Gateway to the peering connection

Answer

Enabling Flow Logs on the subnets

Question 6

A multinational corporation has strict data residency regulations that prohibit their core financial data from leaving their physical corporate headquarters, yet they want to use OCI managed services and the exact same control plane API. Which OCI deployment model satisfies these requirements?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region or OCI Cloud@Customer allows organizations to run OCI services on-premises, maintaining data residency while using the public cloud control plane and APIs.

Answer

OCI Multi-Cloud Interconnect

Answer

OCI Public Cloud Region

Answer

OCI Global Edge Services

Question 7

A developer has deployed a Node.js web application on an OCI Compute instance, but external users cannot access the application on port 3000. The instance's VCN has a security list allowing TCP traffic on port 3000. What additional OS-level configuration is likely blocking the traffic?

Accepted Answer

The local OS firewall (such as firewalld or iptables) running on the compute instance.. Even when the VCN security list allows TCP port 3000, the instance's local OS firewall (firewalld, iptables, or nftables) can independently block inbound traffic. OCI security lists and NSGs operate at the VCN level, not inside the guest OS, so both layers must permit the traffic. This is the most likely OS-level cause of the connectivity failure.

Answer

The OCI Object Storage bucket policy restricting HTTP ports.

Answer

The VCN Service Gateway intercepting local port requests.

Answer

The Dynamic Routing Gateway dropping layer 4 packets.

Question 8

Which TWO of the following are core tenets of the OCI distributed cloud model? (Choose two.)

Accepted Answer

Offering flexible deployment options including public cloud, dedicated regions, and hybrid cloud solutions.. Option B is correct because the OCI distributed cloud model is defined by flexible deployment choices, spanning public multi-tenant regions, dedicated regions (such as OCI Dedicated Region and Oracle Alloy), and hybrid offerings like Exadata Cloud@Customer and Compute Cloud@Customer. Option D is correct because a core promise of OCI's distributed cloud is delivering the same cloud services, OCI Console/management tooling, and API parity consistently across those deployment models, so workloads and automation remain portable. Option A is wrong because OCI explicitly does not limit its services to Oracle-operated public multi-tenant data centers; the distributed cloud model extends services to customer and partner sites. Option C is wrong because database services such as Autonomous Database and Base Database Service run in OCI public regions, dedicated regions, and on-premises, not exclusively on-premises. Option E is wrong because in OCI public regions Oracle owns and manages the physical hardware, while customers manage only their own resources and configurations.

Answer

Providing cloud services exclusively through public multi-tenant data centers operated solely by Oracle.

Answer

Restricting all database services to run exclusively on-premises.

Answer

Requiring customers to manage their own underlying physical hardware in OCI public regions.

Question 9

An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?

Accepted Answer

No IAM policy has been created that grants permissions to the dynamic group.. A dynamic group only defines membership based on matching rules; it grants no permissions by itself. Permissions are granted exclusively through IAM policies that reference the dynamic group as the principal. If no such policy exists, instances in the group receive nothing, which is the most likely cause described.

Answer

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Answer

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Answer

Dynamic groups cannot be used in IAM policies; only user groups can.

Question 10

You have a parent compartment named 'ParentComp' and a child compartment named 'ChildComp'. If you write an IAM policy at the root tenancy level granting a group access to 'ParentComp', what is the inheritance rule regarding 'ChildComp'?

Accepted Answer

The policy automatically applies to ChildComp because permissions inherit downward in compartment hierarchies.. Policies defined at a parent compartment or tenancy level automatically inherit down to all nested child compartments.

Answer

ChildComp never inherits permissions; a separate policy must always be written for every child compartment.

Answer

Parent compartment policies are blocked if child compartments exist.

Answer

Permissions inherit upward from ChildComp to ParentComp.