1Z0-1085-26 Practice Test 17 — 15 Questions

Question 1

An architect is designing a highly resilient web application on OCI. Which TWO components are essential for distributing incoming HTTP/HTTPS traffic across multiple backend compute instances across different availability domains? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Load Balancer configured as regional. A regional OCI Load Balancer combined with a backend set containing instances across multiple Availability Domains ensures high availability and load distribution.

Answer

Internet Gateway attached to the backend compute instances directly

Answer

Service Gateway for internal telemetry

Answer

Dynamic Routing Gateway (DRG) attached to the subnet

Question 2

A company needs to store unstructured data such as log files, images, and backups in OCI for long-term retention at the lowest possible cost, and data retrieval times of several hours are acceptable. Which OCI Object Storage tier should be chosen?

Accepted Answer

Archive Storage Tier. Archive Storage is designed for data that is rarely accessed and requires long-term retention, offering the lowest storage cost with a retrieval time of up to 4 hours.

Answer

Block Volume Backup Tier

Answer

Infrequent Access Tier

Answer

Standard Tier

Question 3

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?

Accepted Answer

Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment. The IAM policy syntax is 'Allow group to

in compartment ', so 'Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment' grants management of Autonomous Databases scoped to DevCompartment only. This satisfies the least-privilege requirement by limiting both the resource type and the compartment.

Answer

Allow group DBA-Group to manage all-resources in compartment DevCompartment

Answer

Allow compartment DevCompartment to manage autonomous-databases for group DBA-Group

Answer

Allow group DBA-Group to manage autonomous-databases in tenancy

Question 4

Which THREE OCI deployment models are part of the OCI distributed cloud strategy? (Choose three.)

Accepted Answer

OCI Dedicated Region. OCI's distributed cloud model includes Public Cloud, Dedicated Region, and Cloud@Customer offerings.

Answer

OCI Regional Edge Node

Answer

OCI Standalone Local Zone

Question 5

In an OCI region with a single availability domain, how does OCI achieve high availability and fault isolation for compute workloads?

Accepted Answer

By utilizing multiple fault domains within that single availability domain.. In regions with a single availability domain, OCI relies on multiple fault domains to distribute workloads across isolated physical hardware.

Answer

By provisioning multiple availability domains dynamically behind the scenes.

Answer

By requiring users to manually peer across international regions.

Answer

High availability is not possible in single-AD regions.

Question 6

You need to copy an existing Block Volume backup from your home region to another OCI region for disaster recovery purposes. What feature should you use?

Accepted Answer

Cross-Region Replication for Block Volume Backups. Block Volume Cross-Region Replication allows you to automatically or manually copy volume backups to another OCI region.

Answer

Compute instance live migration

Answer

Local Peering Gateway transfer

Answer

Object Storage Lifecycle rules

Question 7

Which TWO OCI features are associated with OCI Object Storage? (Choose two.)

Accepted Answer

Pre-authenticated Requests (PARs). Option B, Pre-authenticated Requests (PARs), is correct because OCI Object Storage lets you create PARs that grant time-limited, URL-based access to a bucket or object without requiring an OCI IAM identity or credentials, which is a native Object Storage capability. Option E, Lifecycle Management Rules, is correct because Object Storage supports lifecycle policies that automatically transition objects between storage tiers (Standard, Infrequent Access, Archive) or delete them based on age or prefix rules. The other options do not belong: iSCSI Block Volume Attachments (A) apply to OCI Block Volume service, NFSv3 File System Mounts (C) apply to the OCI File Storage service, and VCN Security Lists (D) are networking constructs within a Virtual Cloud Network, not Object Storage features.

Answer

iSCSI Block Volume Attachments

Answer

NFSv3 File System Mounts

Answer

VCN Security Lists

Question 8

An administrator is configuring a site-to-site VPN connection between an on-premises data center and an OCI VCN. During testing, packets are being dropped because the on-premises firewall expects a specific encryption algorithm and IPsec tunnel parameters that do not match OCI defaults. How can this be resolved?

Accepted Answer

Create a custom IPsec connection specifying the exact Phase 1 and Phase 2 parameters required by the on-premises firewall.. OCI's site-to-site VPN uses IPsec, and when the on-premises firewall requires specific Phase 1 (IKE) and Phase 2 (ESP) parameters that differ from OCI defaults, you must create a custom IPsec connection in which you explicitly specify the matching encryption, authentication, DH group, and lifetime values. This aligns both ends of the tunnel so packets are no longer dropped due to parameter mismatch.

Answer

Modify the default VCN Security List to allow IPsec encapsulation protocols.

Answer

Replace the Dynamic Routing Gateway with a NAT Gateway to bypass IPsec encryption.

Answer

Install an OCI Compute instance running a software VPN appliance to override OCI IPSec defaults.

Question 9

A cloud architect needs to deploy a cloud-native application using Docker containers without managing any underlying infrastructure, servers, or Kubernetes worker nodes. Which OCI service should they select?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that runs Docker containers directly without requiring you to manage servers, clusters, or Kubernetes worker nodes. It is designed for teams that want to deploy containerized workloads quickly with no infrastructure overhead, making it the correct choice for a cloud-native app that must avoid node management. It supports bringing your own container image and handles the underlying compute lifecycle.

Answer

OCI Functions

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

Compute Instances with Custom Images

Question 10

Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard scans OCI resources for security misconfigurations and risky activities, providing actionable remediation steps.

Answer

OCI Audit

Answer

OCI Logging Analytics

Answer

OCI Cost Analysis

Question 11

; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?

Accepted Answer

OCI Bastion. OCI Bastion is a fully managed service that provides secure, time-limited SSH access to private resources in a VCN without requiring a public IP, VPN, or an always-on bastion host with an open SSH port. You create a bastion in a public subnet and use it to create sessions to targets in private subnets.

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Answer

Site-to-Site VPN

Question 12

You are designing an architecture requiring a resilient, fault-tolerant entry point that distributes incoming HTTP/HTTPS traffic across multiple backend compute instances across different availability domains. Which load balancing service should you deploy?

Accepted Answer

Public Load Balancer. The Public Load Balancer in OCI is a regional, Layer 7 service that distributes HTTP/HTTPS traffic across backend instances in multiple availability domains, providing fault tolerance and high availability. It supports advanced features like SSL termination, session persistence, and health checks, making it ideal for resilient web architectures. The other options are networking gateways, not load balancers.

Answer

Local Peering Gateway

Answer

Network Load Balancer

Answer

Dynamic Routing Gateway

Question 13

Which THREE of the following are characteristics of OCI Container Instances? (Choose three.)

Accepted Answer

They support attaching OCI File Storage as volume mounts to containers.. Option A is correct because OCI Container Instances natively support attaching OCI File Storage file systems as volume mounts, letting containers persist and share data without managing block volumes or host paths. Option B is correct because Container Instances use a container-instance shape where you explicitly set the number of OCPUs and the amount of memory (in GB) for the container group, giving precise resource allocation. Option D is correct because Container Instances are a serverless compute service that runs containers immediately without requiring you to provision, patch, or manage VMs or a Kubernetes control plane. Option C is wrong because Container Instances are fully managed and abstract away Kubernetes entirely; there are no control plane nodes to install or configure. Option E is wrong because Container Instances target simple, typically short-lived or single-group workloads, not large-scale stateful multi-node orchestration across dozens of worker nodes, which is the domain of OKE.

Answer

They require the manual installation and configuration of Kubernetes control plane nodes.

Answer

They are designed for long-running stateful multi-node container orchestration across 50 worker nodes.

Question 14

You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the ingress rule in the database NSG?

Accepted Answer

Specify the web server Network Security Group as the source. OCI NSGs allow you to reference another NSG as the source in security rules, enabling tight access control between tiers without managing IP addresses.

Answer

Configure a Dynamic Routing Gateway rule

Answer

Use an Internet Gateway source identifier

Answer

Specify the CIDR block of the entire VCN as the source

Question 15

An administrator needs to temporarily grant read access to a specific file in an OCI Object Storage bucket to a colleague without managing IAM user credentials. What feature should be used?

Accepted Answer

Pre-authenticated Request (PAR). Pre-authenticated requests (PARs) provide a convenient way to grant secure, time-limited download or upload access to individual objects.

Answer

Bucket public access toggle

Answer

VCN Security List rule modification

Answer

IAM Group policy update