1Z0-1085-26 Practice Test 12 — 15 Questions

Question 1

You are configuring security rules for an OCI Virtual Cloud Network. What is the key difference between a Security List and a Network Security Group (NSG)?

Accepted Answer

Security Lists apply to entire subnets, while NSGs apply to specific VNICs.. Security Lists are subnet-level constructs: they apply to all VNICs in a subnet and are the traditional OCI network security mechanism. Network Security Groups (NSGs) are VNIC-level constructs: they apply only to the specific VNICs to which they are attached, allowing more granular, instance-level security policy. This is the fundamental architectural difference between the two.

Answer

Security Lists only support stateless rules, while NSGs only support stateful rules.

Answer

Security Lists apply to specific VNICs, while NSGs apply to entire subnets.

Answer

Security Lists are regional, while NSGs are availability domain-specific.

Question 2

An enterprise customer requires a dedicated, private, high-speed connection between their on-premises datacenter and OCI, bypassing the public internet entirely while offering predictable network performance. Which OCI connectivity option meets this requirement?

Accepted Answer

OCI FastConnect. OCI FastConnect provides a dedicated, private physical connection between an on-premises datacenter and OCI, bypassing the public internet. It offers predictable, high-bandwidth, low-latency performance with options for private peering (to VCNs) or public peering (to OCI services). This is the only option that satisfies the requirement of a dedicated private high-speed link.

Answer

Internet Gateway

Answer

Remote Peering Connection

Answer

IPsec VPN

Question 3

An administrator wants to ensure that OCI Compute instances in an instance pool are automatically replaced if the underlying physical hardware experiences a catastrophic failure. Which OCI feature provides this capability?

Accepted Answer

Instance Pool auto-healing / health checks. Instance pools include automatic instance health monitoring that replaces unhealthy or failed instances automatically.

Answer

Manual intervention and CLI reboot scripts

Answer

Object Storage bucket replication

Answer

Block Volume differential backups

Question 4

A security administrator needs to ensure that users configure Multi-Factor Authentication (MFA) for their OCI accounts to enhance login security. Where is MFA managed in OCI?

Accepted Answer

Identity Domains. In OCI, MFA is configured and enforced through Identity Domains (the IAM identity layer that replaced the legacy tenancy-level identity). Within an Identity Domain, administrators configure MFA settings such as 'Enrolled' or 'Required' at the domain level, and individual users enroll their MFA factors (OCI Mobile App, TOTP authenticator, SMS, etc.) from their My Profile page. This is where sign-on policies and MFA enforcement rules live.

Answer

OCI Vault

Answer

Compartment Quotas

Answer

IAM Policies

Question 5

You are configuring an OCI Network Load Balancer (NLB) for a high-performance database cluster. Why would you choose NLB over a regional Layer 7 Load Balancer?

Accepted Answer

NLB operates at Layer 4 and preserves client source IP addresses. Network Load Balancer operates at Layer 4, handles high packet rates with ultra-low latency, and preserves client source IP addresses.

Answer

NLB requires fewer VCN subnets than regional load balancers

Answer

NLB terminates SSL certificates and inspects HTTP payloads

Answer

NLB supports URL path-based routing for HTTP applications

Question 6

You are configuring an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) and need to ensure that compute instances in a private subnet can initiate outbound internet connections to download software patches without allowing unsolicited inbound traffic from the internet. Which gateway must you attach to the VCN?

Accepted Answer

NAT Gateway. A NAT Gateway in OCI enables instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound traffic, because it performs source NAT and only allows return traffic for connections that originated inside the VCN. This exactly matches the requirement of downloading patches without exposing instances to inbound internet access. The NAT Gateway is attached to the VCN and referenced in the private subnet's route table.

Answer

Service Gateway

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Question 7

Your company operates a critical application in OCI. To protect against potential outages, you are reviewing your disaster recovery posture across regions. Which of the following statements regarding OCI regions is accurate?

Accepted Answer

OCI regions are completely independent of one another, sharing no common points of failure, ensuring high availability and fault isolation.. OCI regions are designed to be completely independent, meaning an outage in one region does not impact another region.

Answer

An outage in one OCI region automatically triggers a failover to the nearest secondary region.

Answer

All OCI regions must contain exactly three Availability Domains.

Answer

OCI regions share common control planes to synchronize global configurations in real-time.

Question 8

An administrator is managing an Oracle Container Engine for Kubernetes (OKE) cluster. They want to ensure that worker nodes are distributed across multiple failure domains or Availability Domains to prevent downtime if a single hardware rack fails. How should this be configured?

Accepted Answer

Configure the node pool to span multiple subnets across different Availability Domains or Fault Domains.. When creating a node pool in OKE, administrators can specify multiple subnets across different Availability Domains or Fault Domains to ensure high availability.

Answer

Use pre-emptible compute shapes for all worker nodes without subnets.

Answer

Deploy all worker nodes in a single subnet within one Fault Domain.

Answer

Attach a Local Peering Gateway to each Kubernetes worker node.

Question 9

You have an application running in OCI that needs to query Oracle Autonomous Database privately. Traffic must not traverse the public internet and must use OCI's backbone network. Which service should you configure in your VCN?

Accepted Answer

Service Gateway. A Service Gateway in OCI provides a private, one-way path from a VCN to Oracle services such as Autonomous Database, Object Storage, and other Oracle Cloud services without traversing the public internet. Traffic stays entirely on the OCI backbone network, satisfying the requirement for private connectivity. It is the only gateway type specifically designed for accessing Oracle services privately from within a VCN.

Answer

IPsec VPN Tunnel

Answer

NAT Gateway

Answer

Internet Gateway

Question 10

Which TWO of the following are valid OCI compute shape types?

Accepted Answer

Flexible. In OCI, compute shapes are categorized by their underlying hardware and provisioning model, and 'Flexible' (B) is a valid shape type because flexible shapes let you customize the number of OCPUs and amount of memory within defined limits (for example, VM.Standard.E4.Flex or VM.Standard3.Flex). 'Bare Metal' (E) is also a valid OCI compute shape type, referring to shapes such as BM.Standard.E4.128 that give you the entire physical server with no hypervisor overhead. The other options are not OCI shape types: 'Virtual Disk' (A) describes a storage resource, not a compute shape; 'Dynamic' (C) is not an OCI compute shape category; and 'Container-only' (D) is not a valid OCI compute shape designation, since containers run on compute instances rather than defining a shape type.

Answer

Virtual Disk

Answer

Dynamic

Answer

Container-only

Question 11

An organization requires a complete disaster recovery site located in a different geographic jurisdiction hundreds of miles away to comply with business continuity mandates, ensuring data replication across independent regions. Which construct forms the foundational basis for this requirement?

Accepted Answer

OCI Regions. OCI Regions are independent, geographically separated data-center groups, and replication across regions is the construct that satisfies a disaster-recovery site in a different jurisdiction. Regions are isolated from one another by design, so placing a DR site in a separate region provides the geographic and administrative separation the mandate requires. This makes OCI Regions the foundational basis for cross-jurisdiction DR.

Answer

Fault Domains

Answer

Tenancies

Answer

Availability Domains

Question 12

Which OCI service allows you to define and run infrastructure as code (IaC) using Terraform configurations natively managed inside your tenancy?

Accepted Answer

OCI Resource Manager. OCI Resource Manager is a managed service that lets you define and run Terraform configurations natively within your OCI tenancy. It provides a managed Terraform state, plan/apply workflows, and integration with OCI IAM.

Answer

OCI Audit

Answer

OCI Identity Domains

Answer

OCI Cloud Guard

Question 13

An operations team wants to ensure that a critical web application automatically scales compute capacity up during high traffic spikes and scales down when traffic subsides. Which OCI service combination provides this capability?

Accepted Answer

Instance Pools with Autoscaling Configurations. Compute autoscaling configurations work alongside Load Balancers and Instance Pools to automatically adjust the number of compute instances based on metrics like CPU utilization.

Answer

Bare Metal instances with manual resizing

Answer

OCI Functions triggered by Object Storage events

Answer

Dedicated Virtual Host resource groups

Question 14

An architect wants to distribute incoming client traffic evenly across a pool of backend OCI Compute web servers while terminating SSL/TLS connections at the load balancer layer. Which OCI service should be used?

Accepted Answer

OCI Load Balancer. OCI Load Balancer distributes incoming traffic across backend servers and supports SSL termination.

Answer

OCI Service Gateway

Answer

OCI Dynamic Routing Gateway

Answer

OCI Network Load Balancer

Question 15

Which TWO statements are correct regarding OCI Budgets and spending alerts? (Choose two.)

Accepted Answer

Budget alerts can send notifications via OCI Notifications (email, PagerDuty, etc.).. Option A is correct because OCI Budgets integrate with the OCI Notifications service, which supports delivery channels such as email and PagerDuty (via subscriptions to a topic), so budget threshold breaches can be pushed to those endpoints. Option E is correct because a budget rule can be configured with a type of either ACTUAL spend or FORECAST spend, allowing alerts to fire when the projected spend is expected to exceed the threshold, not only after the money has already been spent. Options B, C, and D are incorrect: budgets are monitoring/alerting constructs and cannot stop or terminate compute instances (that would require separate automation such as Functions or the CLI/SDK); budget spending is refreshed periodically throughout the day (roughly every few hours), not once every 30 days; and budgets can be scoped to a compartment or to a specific tag, not only to the root tenancy.

Answer

Budgets can automatically shut down compute instances when spending exceeds 100%.

Answer

Budgets update their spending calculations once every 30 days.

Answer

Budgets can only be set at the root tenancy level, never at compartment levels.