1Z0-1085-26 Practice Test 10 — 10 Questions

Question 1

An administrator wants to run Docker containers in OCI quickly without managing Kubernetes clusters, node pools, or servers. Which OCI service is most appropriate?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that enables users to run containers instantly without managing underlying infrastructure or clusters.

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

Compute Instances running Docker manually

Answer

OCI Functions

Question 2

An administrator is configuring a site-to-site VPN connection between an on-premises data center and an OCI VCN. During testing, packets are being dropped because the on-premises firewall expects a specific encryption algorithm and IPsec tunnel parameters that do not match OCI defaults. How can this be resolved?

Accepted Answer

Create a custom IPsec connection specifying the exact Phase 1 and Phase 2 parameters required by the on-premises firewall.. Custom IPsec connection configurations allow administrators to specify exact Phase 1 and Phase 2 tunnel parameters (such as encryption and authentication algorithms) to match on-premises VPN device requirements.

Answer

Modify the default VCN Security List to allow IPsec encapsulation protocols.

Answer

Replace the Dynamic Routing Gateway with a NAT Gateway to bypass IPsec encryption.

Answer

Install an OCI Compute instance running a software VPN appliance to override OCI IPSec defaults.

Question 3

An administrator needs to configure custom DNS resolution for instances within a VCN so they can resolve hostnames pointing to an internal on-premises corporate directory server over a FastConnect link. Which OCI DNS feature should be configured?

Accepted Answer

VCN Private DNS Resolver forwarding rules. Private DNS resolver rules, specifically forward zones, allow VCN instances to forward DNS queries for custom domains to designated on-premises name servers.

Answer

Default Internet Gateway DNS forwarding

Answer

Public DNS Zones

Answer

OCI Internet Domain Name Registration

Question 4

What is the term used in OCI to describe a software-defined version of a traditional physical network, including subnets, route tables, and gateways?

Accepted Answer

Virtual Cloud Network (VCN). A Virtual Cloud Network (VCN) is a customizable, software-defined private network that you set up in OCI.

Answer

Subnet Gateway

Answer

Local Peering Network

Answer

Virtual Private Network (VPN)

Question 5

Which OCI storage service is best suited for sharing configuration files across multiple Linux virtual machine instances simultaneously?

Accepted Answer

OCI File Storage Service. OCI File Storage Service (FSS) provides a shared network file system that can be mounted simultaneously by multiple instances.

Answer

OCI Block Volume

Answer

Local NVMe Storage

Answer

OCI Object Storage

Question 6

Which TWO statements are true regarding OCI Load Balancer features? (Choose two.)

Accepted Answer

OCI Load Balancers can terminate SSL/TLS certificates and perform SSL offloading.. OCI Load Balancers support SSL termination and flexible bandwidth shaping.

Answer

Load balancers cannot distribute traffic across multiple availability domains.

Answer

Load balancers operate exclusively at Layer 4 of the OSI model.

Answer

Load balancers must be deployed inside on-premises data centers.

Question 7

You need to route traffic privately from your VCN to Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which components must be configured?

Accepted Answer

Service Gateway and a route table rule with service destination. A Service Gateway combined with a route table entry pointing to the service destination allows private traffic routing to regional Oracle services.

Answer

NAT Gateway and an inbound firewall rule

Answer

Dynamic Routing Gateway and IPsec VPN

Answer

Internet Gateway and a matching security list rule

Question 8

An administrator wants to restrict inbound SSH access to a specific group of database compute instances without modifying subnet-level security rules. Which OCI feature should be used to define these fine-grained VNIC rules?

Accepted Answer

Network Security Groups. Network Security Groups (NSGs) allow you to apply security rules to a specific set of VNICs of your choice, independent of subnets.

Answer

Route Tables

Answer

Security Lists

Answer

Dynamic Routing Gateway

Question 9

You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?

Accepted Answer

Missing route table entries directing traffic to the Local Peering Gateway in both VCNs. VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.

Answer

Using security lists instead of Network Security Groups

Answer

Attaching an Internet Gateway to the peering connection

Answer

Enabling Flow Logs on the subnets

Question 10

You are configuring security lists for a subnet hosting web servers. You want to allow incoming HTTP traffic on port 80 from any IP address on the internet. How should you configure the ingress rule?

Accepted Answer

Source: 0.0.0.0/0, Protocol: TCP, Destination Port: 80. An ingress security rule allowing TCP traffic on destination port 80 with source CIDR 0.0.0.0/0 permits public HTTP access.

Answer

Source: Internet Gateway, Protocol: ICMP

Answer

Source: 10.0.0.0/16, Protocol: UDP, Destination Port: 443

Answer

Source: 0.0.0.0/0, Protocol: UDP, Destination Port: 80