1Z0-1085-26 Practice Test 13 — 15 Questions

Question 1

Which TWO OCI concepts are fundamental for organizing resources and managing access control within a tenancy? (Choose two.)

Accepted Answer

Compartments. Compartments are used to organize and isolate resources, and IAM policies control who can access those resources within compartments.

Answer

Availability Domains

Answer

Fault Domains

Answer

Internet Gateways

Question 2

Which TWO statements are true regarding the connectivity between OCI Availability Domains within a region? (Choose two.)

Accepted Answer

Traffic between Availability Domains within the same region travels over a high-bandwidth, low-latency network fabric.. ADs within a region are connected by a high-speed network fabric and do not incur standard internet egress fees.

Answer

Traffic between Availability Domains must traverse public internet gateways and is billed at standard internet egress rates.

Answer

Inter-AD communication requires the manual setup of encrypted IPsec VPN connections.

Answer

Availability domains are not connected directly; all communication must route through a secondary OCI region.

Question 3

A retail company needs to run a subset of OCI services (such as Autonomous Database and Container Engine for Kubernetes) locally within their corporate data center due to extreme latency requirements for point-of-sale terminals, while keeping data management tied to the public cloud control plane. Which OCI deployment option should they choose?

Accepted Answer

OCI Cloud@Customer. OCI Cloud@Customer brings specific OCI cloud services and managed infrastructure directly into customer data centers while managed via the public cloud control plane.

Answer

OCI Local Region

Answer

OCI Public Cloud Region

Answer

OCI Dedicated Region

Question 4

Which TWO statements are true regarding OCI Load Balancer features? (Choose two.)

Accepted Answer

OCI Load Balancers can terminate SSL/TLS certificates and perform SSL offloading.. Option A is correct because OCI Load Balancer listeners support SSL/TLS termination, meaning the load balancer decrypts incoming HTTPS traffic and can perform SSL offloading so backend servers handle plain HTTP, reducing their CPU overhead. Option C is correct because OCI Load Balancers offer flexible shapes (for example, 10 Mbps up to 8000 Mbps) that let you scale bandwidth up or down as demand changes, rather than being locked to fixed hardware shapes. Option B is wrong because OCI Load Balancers can span multiple availability domains and even multiple regions, distributing traffic across ADs for high availability. Option D is wrong because OCI Load Balancers operate at both Layer 4 (TCP) and Layer 7 (HTTP/HTTPS), not exclusively Layer 4. Option E is wrong because OCI Load Balancers are cloud-native services deployed within OCI regions, not inside on-premises data centers.

Answer

Load balancers cannot distribute traffic across multiple availability domains.

Answer

Load balancers operate exclusively at Layer 4 of the OSI model.

Answer

Load balancers must be deployed inside on-premises data centers.

Question 5

What is the primary function of an OCI Internet Gateway?

Accepted Answer

To route bidirectional traffic between the VCN and the public internet. An Internet Gateway provides a path for bidirectional network traffic between your VCN and the public internet.

Answer

To provide private access to Oracle services like Object Storage

Answer

To peer two VCNs within the same tenancy

Answer

To connect on-premises data centers via private circuits

Question 6

Which OCI compute shape type provides dedicated physical server hardware with no hypervisor overhead, ensuring maximum performance and isolation?

Accepted Answer

Bare Metal Shapes. Bare Metal shapes provide dedicated physical servers with direct hardware access and zero virtualization overhead.

Answer

Preemptible Instances

Answer

Micro-instances

Answer

Flexible Shapes

Question 7

You want to delegate the ability to create and manage sub-compartments within an existing compartment called 'AppCompartment' to a lead architect, without granting them full tenancy administration rights. How should you write this IAM policy?

Accepted Answer

Allow group ArchitectGroup to manage compartments in compartment AppCompartment. To allow managing compartments within a specific parent compartment, the policy must target the 'compartments' resource type at the parent compartment level.

Answer

Allow group ArchitectGroup to manage root-compartment in tenancy

Answer

Allow group ArchitectGroup to use compartments in tenancy

Answer

Allow group ArchitectGroup to manage tenancy in compartment AppCompartment

Question 8

Which THREE features are provided by OCI Cloud Guard to help secure a tenancy? (Choose three.)

Accepted Answer

Responder recipes to automatically remediate detected security problems. Option C is correct because Cloud Guard responder recipes define the automated actions (such as stopping an instance, deleting a public bucket, or disabling a user) that Cloud Guard takes when a detector identifies a problem, enabling automatic remediation. Option D is correct because Cloud Guard provides a security score that aggregates the number and severity of problems across the tenancy, giving a measurable view of overall security posture. Option E is correct because detector recipes specify the detector rules and conditions Cloud Guard uses to identify misconfigurations, risky activities, and threats across OCI resources. Option A is not a Cloud Guard feature; billing reports and CSV export are handled by OCI Cost Management and Billing, not by Cloud Guard. Option B is also unrelated, since Terraform template execution is a function of OCI Resource Manager, not Cloud Guard's security monitoring and remediation capabilities.

Answer

Automatic daily billing report generation and CSV export

Answer

Terraform template execution for infrastructure deployment

Question 9

Which TWO of the following networking components are required to configure a working site-to-site IPsec VPN connection to an OCI VCN? (Choose two.)

Accepted Answer

Customer Premises Equipment (CPE) object. Option B, the Customer Premises Equipment (CPE) object, is correct because OCI requires a CPE object to represent the on-premises VPN endpoint (its public IP address) before you can create the IPSec connection. Option E, the Dynamic Routing Gateway (DRG), is correct because the DRG is the OCI-side VPN endpoint that must be attached to the VCN and paired with the CPE via an IPSec connection to establish the site-to-site tunnel. Option A is wrong because an Internet Gateway is for general internet access from a subnet, not for terminating the VPN tunnel, and it need not be attached to the database subnet. Option C is wrong because a Local Peering Gateway connects two VCNs within the same region, which is unrelated to connecting to on-premises equipment. Option D is wrong because a NAT Gateway provides outbound internet access for private subnets and is not used for IP translation of VPN packets.

Answer

Internet Gateway attached to the database subnet

Answer

Local Peering Gateway peered with another VCN

Answer

NAT Gateway for IP translation of VPN packets

Question 10

An administrator must configure DNS resolution so that instances within a VCN can resolve custom internal domain names managed by an on-premises DNS server connected via FastConnect. Which OCI DNS feature should be used?

Accepted Answer

Private DNS Resolver with Forwarding Rules. OCI Private DNS resolver allows conditional forwarding rules to forward queries for specific domains to designated on-premises DNS servers.

Answer

Default Internet DNS Resolver

Answer

Public Zones

Answer

Traffic Management Steering Policies

Question 11

An application deployed on OCI Compute instances requires custom DNS records that resolve only within a specific VCN and are not exposed to the public internet. Which OCI DNS feature should you configure?

Accepted Answer

Private DNS Zone. Private DNS zones allow you to manage internal domain names that are resolved exclusively within your VCNs.

Answer

Internet Resolver Forwarding

Answer

Traffic Management Steering Policies

Answer

Public DNS Zone

Question 12

Which THREE of the following statements regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs) are correct? (Choose three.)

Accepted Answer

Security Lists apply to all VNICs in a specific subnet, whereas NSGs apply to a specific set of VNICs chosen by the user.. Option A is correct because Security Lists are subnet-scoped: every VNIC in a subnet inherits the Security List rules attached to that subnet, while NSGs are VNIC-scoped and apply only to the specific VNICs the user adds to the NSG. Option C is correct because both Security Lists and NSGs let you define rules as either stateful (connection tracking is automatic) or stateless (you must write rules for both directions of traffic). Option D is correct because a VNIC can be a member of multiple NSGs simultaneously (up to the service limit), and the union of all their rules is evaluated for that VNIC. Option B is wrong because Security Lists are stateful by default in OCI, not stateless, so no manual stateful tracking configuration is needed. Option E is wrong because NSG rules can reference other NSGs (or CIDR blocks) as the source/destination, which is one of the main advantages of NSGs over Security Lists.

Answer

Security Lists are stateless by default and require manual configuration for stateful tracking.

Answer

Network Security Groups require rules to reference subnet CIDR blocks rather than other NSGs.

Question 13

A company is running multiple web servers behind an OCI Public Load Balancer. They notice that client IP addresses are appearing in web server logs as the internal private IP address of the load balancer rather than the actual client's public IP address. How can this be resolved?

Accepted Answer

Configure the web servers to read the X-Forwarded-For HTTP header inserted by the load balancer.. OCI Load Balancer adds standard HTTP headers such as 'X-Forwarded-For' to pass the original client IP address to backend web servers.

Answer

Switch the load balancer from TCP load balancing to a NAT Gateway.

Answer

Change the load balancer shape from Flexible to a fixed 100 Mbps shape.

Answer

Enable SSL client certificate forwarding in the VCN routing table.

Question 14

Which THREE storage performance tiers are available for OCI Block Volumes? (Choose three.)

Accepted Answer

Lower Cost. OCI Block Volumes offer exactly three performance tiers: Lower Cost (option A), Balanced (option D), and Higher Performance (option C). Lower Cost is the cheapest tier, delivering a minimum of 2 VPUs per GB with the lowest IOPS/throughput, suitable for cost-sensitive, less demanding workloads. Balanced is the default mid-range tier providing 10 VPUs per GB, while Higher Performance delivers 20 VPUs per GB for the most latency-sensitive, high-IOPS workloads. Archive Tier (option B) and Infrequent Access Tier (option E) are Object Storage storage-class options, not Block Volume performance tiers, so they do not apply here.

Answer

Archive Tier

Answer

Infrequent Access Tier

Question 15

Which TWO networking services or gateways in OCI can be used to route traffic from a VCN to the public internet? (Choose two.)

Accepted Answer

Internet Gateway. The Internet Gateway (A) is correct because it provides a bidirectional path for traffic between a VCN's public subnets and the public internet, allowing resources with public IPs to both initiate and receive internet traffic. The NAT Gateway (E) is correct because it allows instances in private subnets to initiate outbound connections to the public internet while blocking inbound connections, using the gateway's public IP for translation. The Dynamic Routing Gateway (B) is incorrect because it connects a VCN to on-premises networks via IPSec VPN or FastConnect, not directly to the public internet. The Service Gateway (C) is incorrect because it provides private access to OCI public services such as Object Storage, not general internet routing. The Local Peering Gateway (D) is incorrect because it connects two VCNs within the same region, not a VCN to the internet.

Answer

Dynamic Routing Gateway

Answer

Service Gateway

Answer

Local Peering Gateway