1Z0-1085-26 Practice Test 14 — 15 Questions

Question 1

Which THREE of the following actions can be performed using OCI File Storage Service (FSS)? (Choose three.)

Accepted Answer

Encrypt file system data using Oracle-managed or customer-managed encryption keys in OCI Vault.. Option A is correct because OCI File Storage Service encrypts all file system data at rest by default with Oracle-managed keys and also supports customer-managed keys stored in OCI Vault, which can be selected when creating or updating a file system. Option C is correct because FSS supports point-in-time snapshots of a file system, which can be used for backup, recovery, and cloning file systems. Option D is correct because FSS exposes file systems over the NFS v3 protocol and is designed for concurrent access from many compute instances, scaling to thousands of clients. Option B is not correct because attaching a file system as a block device via iSCSI is characteristic of OCI Block Volume, not File Storage Service, which is a shared NFS file system. Option E is not correct because FSS file systems grow and shrink automatically as data is added or removed, and they are not resized manually or in fixed 32 TB increments.

Answer

Attach the file system to compute instances as a block device using iSCSI commands.

Answer

Resize the file system storage capacity manually or configure it to require fixed 32 TB increments.

Question 2

Which OCI service is used to host containerized applications and manage clusters?

Accepted Answer

Container Engine for Kubernetes. Oracle Container Engine for Kubernetes (OKE) is the service for container orchestration.

Answer

Compute Instances

Answer

Database Service

Answer

Functions

Question 3

A DevOps engineer is provisioning compute instances in a region that has a single availability domain. To protect the application from unexpected physical hardware failures and power supply outages within that single availability domain, how should the engineer distribute the instances?

Accepted Answer

Across different Fault Domains. Fault domains provide anti-affinity and isolate instances across different physical hardware, power, and network infrastructure within a single availability domain.

Answer

Across multiple OCI Regions

Answer

Inside the same Fault Domain

Answer

Across multiple Availability Domains

Question 4

You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?

Accepted Answer

6 levels. OCI recommends keeping compartment hierarchies shallow, typically no more than 6 levels deep, to maintain manageable IAM policies and avoid complexity.

Answer

2 levels

Answer

There is no limit or recommendation; you can nest indefinitely.

Answer

10 levels

Question 5

Which TWO OCI networking components are required to successfully enable private communication between two separate VCNs residing in the same OCI region? (Choose two.)

Accepted Answer

Route table rules pointing traffic to the LPG. Local Peering connects two VCNs in the same region, requiring a Local Peering Gateway (LPG) in each VCN and corresponding routing rule updates in the VCN route tables.

Answer

Dynamic Routing Gateway (DRG) with remote peering

Answer

NAT Gateway configured on the source VCN

Answer

Internet Gateway attached to both VCNs

Question 6

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?

Accepted Answer

Detector recipes. Cloud Guard problems are generated by detector recipes, which define the categories of misconfigurations and security issues that Cloud Guard monitors, such as overly permissive IAM policies. Detector recipes evaluate resources against rules and emit problems when violations are found. Responder recipes only define the automated remediation actions taken after a problem is detected, so they are not the source of the problems themselves.

Answer

Vault Master Encryption keys

Answer

Security Zone recipes

Answer

Responder recipes

Question 7

An administrator needs to ensure that data in an OCI Object Storage bucket is automatically transitioned from Standard storage to Infrequent Access storage after 30 days, and then deleted after 365 days. Which Object Storage feature should be used?

Accepted Answer

Object Storage Lifecycle Rules. Object Storage Object Lifecycle Management rules allow automating the transition and deletion of objects based on age.

Answer

Block Volume Auto-Backup Policies

Answer

VCN Security Lists

Answer

IAM Policy Statements

Question 8

Which THREE entities can be attached to an OCI Dynamic Routing Gateway (DRG) to facilitate network connectivity? (Choose three.)

Accepted Answer

Site-to-Site VPN static or dynamic connections. Option A is correct because a DRG is the OCI endpoint for Site-to-Site VPN, supporting both static (policy-based) and dynamic (BGP-based) IPSec connections that terminate on the DRG. Option B is correct because FastConnect virtual circuits attach to a DRG to provide private dedicated connectivity between on-premises networks and OCI VCNs. Option D is correct because VCNs are attached to a DRG through VCN attachments, which is the mechanism that lets the DRG route traffic between the VCN and external networks. Option C is incorrect because an Internet Gateway attaches to a VCN (not a DRG) to enable public internet routing for resources in public subnets. Option E is incorrect because IPSec VPN tunnels are part of a Site-to-Site VPN connection (covered by option A), and there is no OCI entity called an 'RPC attachment' to a DRG.

Answer

Internet Gateways for public routing

Answer

IPSec VPN tunnels via RPC attachments

Question 9

Which TWO mechanisms can be used to secure data in transit within OCI networking? (Choose two.)

Accepted Answer

TLS/SSL encryption for application and load balancer traffic. TLS/SSL encryption (Option A) is correct because it secures data in transit at the application layer by encrypting traffic between clients, load balancers, and backend services, protecting against eavesdropping and tampering on the wire. IPsec VPN tunnels (Option B) are correct because they encrypt and authenticate traffic in transit between on-premises networks and OCI over the internet, using protocols such as ESP and IKE to provide confidentiality and integrity for the connection. In contrast, Object Storage Lifecycle rules (Option C) only automate tiering or deletion of stored objects and do not encrypt network traffic. Subnet Security Lists (Option D) are stateful by default and act as virtual firewalls controlling allowed IP/port traffic, but they filter rather than encrypt data in transit. VCN Route Tables (Option E) only direct traffic to gateways or targets and provide no encryption or security for data in transit.

Answer

Object Storage Lifecycle rules

Answer

Subnet Security Lists (without stateful tracking)

Answer

VCN Route Tables

Question 10

What is the primary relationship between an OCI region and its availability domains?

Accepted Answer

A region contains one or more availability domains.. An OCI region is composed of one or more availability domains, which are isolated data centers with independent power, cooling, and networking.

Answer

An availability domain spans across multiple global regions.

Answer

Regions and availability domains are identical constructs with different names.

Answer

An availability domain contains multiple regions.

Question 11

When designing a highly available architecture in OCI, why is it recommended to deploy application tiers across multiple Availability Domains or Fault Domains?

Accepted Answer

To prevent a single hardware or facility failure from disrupting the entire application workload.. Spreading application tiers across multiple availability domains or fault domains ensures that a failure at the hardware, rack, or data-center level only impacts a subset of instances, keeping the application available. This is the fundamental principle of fault-tolerant design in OCI: eliminate single points of failure by distributing workloads across independent failure domains. The other options describe benefits unrelated to HA — CPU speed, data transfer cost, and legal compliance are not what multi-AD/FD placement achieves.

Answer

To increase the processing speed of CPU instructions.

Answer

To reduce data transfer costs between cloud regions.

Answer

To satisfy legal requirements for cross-border data transfer.

Question 12

An enterprise cloud architect is evaluating OCI's distributed cloud model and wants to understand how resource management, IAM policies, and API endpoints are handled across a customer's OCI Dedicated Region compared to standard public regions. Which statement accurately describes the control plane architecture?

Accepted Answer

Dedicated regions share the same public cloud control plane, APIs, and management tools, ensuring identical operational experiences.. OCI Dedicated Regions are managed remotely by the same control plane and APIs used in OCI public regions, ensuring uniform management while data remains local.

Answer

Dedicated regions cannot access native OCI services like Object Storage or Autonomous Database.

Answer

Dedicated regions do not support Identity and Access Management (IAM) because they are entirely disconnected from Oracle.

Answer

Dedicated regions require a completely isolated, on-premises local control plane managed independently by local administrators.

Question 13

You are designing a disaster recovery strategy for an OCI database. The primary requirement is to replicate data to a completely different geographic area with minimal latency impact. Which OCI architectural component should you utilize for the DR site?

Accepted Answer

A different OCI Region. Disaster recovery across geographic regions requires deploying resources in a secondary OCI region.

Answer

A different Fault Domain within the same Availability Domain

Answer

A different Availability Domain in the same region

Answer

A separate Compartment within the same region

Question 14

Which THREE configuration items are specified when creating an OCI Virtual Cloud Network (VCN)? (Choose three.)

Accepted Answer

CIDR Block (IPv4). When creating an OCI VCN, you must specify the CIDR Block (IPv4) (option B), which defines the VCN's IPv4 address range (e.g., 10.0.0.0/16) and is a required parameter. You must also provide the VCN Name (option C), a friendly display name that identifies the VCN within the compartment. The DNS Label (option D) is also specified at creation; it enables DNS hostnames for instances in the VCN (e.g., <dns-label>.oraclevcn.com) and is a configurable field in the Create VCN dialog. Availability Domain assignment (option A) is not a VCN-level setting—ADs apply to subnets and compute instances, not the VCN itself. GPU count specification (option E) is unrelated to VCN creation and pertains to compute instance shapes, not networking.

Answer

Availability Domain assignment

Answer

GPU count specification

Question 15

An administrator wants to ensure that critical files stored in an OCI Object Storage bucket are automatically deleted after 90 days to comply with data retention policies. What feature should be used?

Accepted Answer

Object Lifecycle Management rules. OCI Object Lifecycle Management rules let administrators define policies that automatically transition or delete objects based on age (e.g., delete after 90 days) or other criteria. This is the native, declarative mechanism for enforcing retention and cleanup without custom scripts. It directly satisfies the requirement to auto-delete critical files after 90 days.

Answer

Cross-Region Replication

Answer

Bucket Versioning

Answer

Pre-authenticated Requests