1Z0-1085-26 Practice Test 19 — 15 Questions

Question 1

An organization with strict data residency requirements is evaluating OCI's hybrid and dedicated offerings. Which THREE options represent OCI deployment models designed to bring cloud services into customer-controlled environments? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Compute Cloud@Customer. Dedicated Region, Exadata Cloud@Customer, and Compute Cloud@Customer bring OCI capabilities to on-premises data centers.

Answer

OCI Local Peering Gateway

Answer

OCI Public Cloud Region

Question 2

An organization has strict compliance requirements to ensure that all data stored in OCI Object Storage buckets is encrypted using a custom encryption key managed entirely by the customer, rather than Oracle-managed keys. How can this be achieved?

Accepted Answer

Use OCI Vault to create and manage Customer-Managed Keys (CMK) for encrypting the Object Storage bucket.. OCI Vault is the dedicated key management service that lets customers create, rotate, and manage Customer-Managed Keys (CMKs) in HSMs, and Object Storage buckets can be configured to use a Vault CMK instead of the default Oracle-managed encryption key. This satisfies compliance requirements because the customer retains full control over the key lifecycle, including the ability to revoke access by disabling or deleting the key. Selecting a Vault key at bucket creation (or via the encryption tab afterward) is the supported, native mechanism.

Answer

Enable bucket versioning and assign an IAM administrator password.

Answer

Attach an Internet Gateway configured with SSL certificates.

Answer

Encrypt the data manually using local scripts before uploading to Object Storage.

Question 3

You need to deploy a batch processing job that can tolerate sudden termination by OCI if compute capacity is reclaimed, significantly reducing your compute costs. Which instance type should you choose?

Accepted Answer

Preemptible Instance. Preemptible Instances in OCI are designed for workloads that can tolerate sudden termination. They are significantly cheaper than standard instances but can be reclaimed by OCI when capacity is needed, with a 30-second warning. This makes them ideal for batch processing jobs that can be checkpointed or restarted, reducing compute costs.

Answer

Standard Bare Metal Shape

Answer

Standard Flexible VM Shape

Answer

Dedicated Virtual Machine Host

Question 4

How does OCI ensure that high-availability requirements are met within a single region?

Accepted Answer

Availability Domains. Availability Domains (ADs) and Fault Domains (FDs) provide physical isolation.

Answer

Multiple VCNs

Answer

Multiple Load Balancers

Answer

Global clusters

Question 5

An enterprise customer evaluating OCI's distributed cloud model wants to understand the advantages of OCI Dedicated Region compared to traditional public cloud. Which THREE benefits are provided by OCI Dedicated Region? (Choose three.)

Accepted Answer

Complete control and data residency within the customer's own data center facility.. OCI Dedicated Region is a fully managed cloud region deployed inside the customer's own data center, so option C is correct because it gives the customer complete control over the physical environment and keeps all data resident on-premises for sovereignty and compliance. Option D is correct because OCI Dedicated Region runs the same OCI public cloud services with exact API parity, letting workloads move between the dedicated region and public OCI without code changes. Option E is correct because Oracle operates and manages the dedicated region, applying continuous updates and adding new OCI services automatically, just as in a public region. Option A is wrong because OCI Dedicated Region does not eliminate third-party OS licensing costs, which remain the customer's responsibility. Option B is wrong because Oracle, not the customer's IT staff, handles patching of the hypervisors and control plane in this fully managed offering.

Answer

Elimination of all software licensing costs for third-party operating systems.

Answer

Requiring the customer's internal IT staff to manually patch the underlying hypervisors and control plane.

Question 6

Which TWO mechanisms help protect OCI workloads against single points of failure at the infrastructure level? (Choose two.)

Accepted Answer

Deploying applications across multiple Availability Domains to survive a complete facility outage.. Option A is correct because OCI Availability Domains (ADs) are isolated, physically separate data centers within a region, each with independent power, cooling, and networking, so deploying applications across multiple ADs lets workloads survive a complete facility outage and eliminates a single-AD point of failure. Option E is correct because Fault Domains (FDs) are logical groupings of hardware within an AD that do not share a single rack or power distribution unit, so distributing instances across multiple FDs protects against rack-level hardware and power failures. Option B is not correct because a single VCN with no backup subnets concentrates network resources and provides no redundancy, which increases rather than mitigates single points of failure. Option C is not correct because co-locating all compute instances on one physical host creates a host-level single point of failure and offers no meaningful availability benefit. Option D is not correct because disabling automated backups removes a data-recovery safeguard and does nothing to protect against infrastructure-level single points of failure.

Answer

Relying on a single Virtual Cloud Network (VCN) with no backup subnets.

Answer

Placing all compute instances on a single physical host to maximize internal CPU cache efficiency.

Answer

Disabling automated backups to prevent storage controller contention.

Question 7

Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)

Accepted Answer

Defined tags require a Tag Namespace to be created first.. Option C is correct because OCI Defined Tags must live inside a Tag Namespace, which is created first in a tenancy (or compartment) and acts as the container that scopes the tag keys and their value types. Option D is correct because Tag Defaults are a feature of defined tags that automatically apply a specified tag key/value to resources created in a given compartment, enforcing consistent tagging without manual effort. Option E is correct because Tag-Based Access Control works by writing IAM policies that reference tag values through variables such as target.tag.. (for example, request.permission or target.tag.Project.Environment), allowing conditions like 'where target.tag.Project.Environment = "Prod"'. Option A is wrong because defined tags and TBAC augment IAM policies rather than replace them; policies are still required to grant or deny permissions. Option B is wrong because free-form tags are the ungoverned string-based tags, whereas defined tags are governed by a namespace with a predefined schema and value constraints.

Answer

Defined tags replace IAM policies entirely for access control.

Answer

Defined tags can only be created as free-form strings without any governance.

Question 8

Which THREE best practices should be followed when designing an OCI compartment hierarchy and IAM policy structure? (Choose three.)

Accepted Answer

Grant permissions to user groups rather than attaching policies directly to individual users.. Option A is correct because OCI IAM best practice is to grant permissions to groups and then assign users to those groups, which centralizes access management and avoids the sprawl and audit difficulty of per-user policies. Option B is correct because least privilege means granting only the specific verbs and resource-types a group needs in a given compartment, reducing blast radius and satisfying security and compliance requirements. Option C is correct because OCI recommends keeping compartment hierarchies relatively shallow (commonly no more than about six levels) to keep policies, quotas, and troubleshooting manageable and to avoid overly complex inheritance. Option D is wrong because sharing root tenancy administrator credentials destroys accountability and violates the principle of unique, individually attributable identities. Option E is wrong because writing all policies at the root tenancy level creates broad, hard-to-audit permissions and ignores compartment-scoped policy inheritance, which is the mechanism OCI provides for delegated, least-privilege administration.

Answer

Share tenancy root administrative credentials among all team members.

Answer

Write all IAM policies at the root tenancy level to avoid managing multiple policies.

Question 9

An enterprise customer is reviewing their high availability architecture in OCI. They want to ensure their database and application tiers are protected against both localized hardware failures and major facility disruptions. Which THREE architectural practices should they follow? (Choose three.)

Accepted Answer

Distribute database nodes across distinct Fault Domains within an Availability Domain to protect against rack-level failures.. Option A is correct because distributing database nodes across distinct Fault Domains within an Availability Domain protects against localized rack-level or hardware failures, since each Fault Domain has independent power and network infrastructure. Option D is correct because deploying application servers across multiple Availability Domains ensures the application tier survives a complete AD outage, as Availability Domains are physically isolated from one another within a region. Option E is correct because regularly testing disaster recovery and failover procedures validates that Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are actually achievable, which is essential for a credible high availability architecture. Option B is incorrect because relying solely on manual intervention without automated health checks increases recovery time and human error, undermining high availability. Option C is incorrect because consolidating all nodes onto a single physical server creates a single point of failure and provides no protection against hardware or facility disruptions.

Answer

Rely solely on manual administrator intervention for all failover scenarios without automated health checks.

Answer

Consolidate all application and database nodes onto a single physical server in Availability Domain 1.

Question 10

Which THREE components or services are part of the OCI distributed cloud strategy, providing flexibility in where and how cloud services are consumed?

Accepted Answer

OCI Cloud@Customer. OCI's distributed cloud strategy is built around delivering the same OCI services across multiple deployment locations, and three of the listed options are core to that model. Option B, OCI Cloud@Customer, is correct because it places OCI infrastructure and services inside a customer's own data center while Oracle operates and manages it, extending the cloud to on-premises environments. Option C, OCI Public Cloud, is correct because it is the standard multi-tenant public cloud region offering that anchors the distributed cloud portfolio. Option E, OCI Dedicated Region, is correct because it delivers a full OCI region within a customer's premises or chosen location with the same services and SLAs as the public cloud, giving dedicated capacity and isolation. The remaining options do not belong: OCI Resource Manager (A) is an infrastructure-as-code orchestration service for provisioning OCI resources via Terraform, and OCI Data Catalog (D) is a metadata management and data discovery service—both are individual platform services, not distributed cloud deployment models.

Answer

OCI Resource Manager

Answer

OCI Data Catalog

Question 11

Which TWO configuration steps are necessary when setting up private access from a VCN to OCI Object Storage using a Service Gateway? (Choose two.)

Accepted Answer

Add a route table rule with the service destination pointing to the Service Gateway.. Option B is correct because a Service Gateway must first be created and attached to the VCN; this gateway is the OCI construct that provides private access to Object Storage (and other OCI services) without traversing the internet. Option A is correct because, once the Service Gateway exists, the subnet's route table must include a route whose destination is the Object Storage service CIDR (the Oracle Services Network service destination, e.g., all-region services in the oracle-services network) with the Service Gateway as the next-hop target, so traffic to Object Storage is directed through it. Option C is incorrect because private access via a Service Gateway is specifically designed to avoid public IPs; instances in the private subnet do not need public addresses. Option D is incorrect because an Internet Gateway routes traffic to/from the public internet and is not used for private service access through a Service Gateway. Option E is incorrect because a NAT Gateway provides outbound internet access for private instances and is not the next-hop for Object Storage service traffic when a Service Gateway is used.

Answer

Assign a public IP address to every compute instance in the private subnet.

Answer

Attach an Internet Gateway to the VCN to route service traffic.

Answer

Configure a NAT Gateway as a next-hop in the subnet route table.

Question 12

An application deployment requires traffic from an OCI Virtual Cloud Network (VCN) to securely access Oracle Autonomous Database instances in the region without traversing the public internet. Which gateway must be configured in the VCN?

Accepted Answer

Service Gateway. A Service Gateway allows VCN resources to privately access supported OCI public services, such as Oracle Services Network, without using the public internet.

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Question 13

Which OCI administrative feature allows you to organize and categorize cloud resources using user-defined key-value pairs for granular tracking and automation?

Accepted Answer

Tags. Tags in OCI are user-defined key-value pairs that can be applied to resources for organization, tracking, and automation. They allow granular categorization beyond compartments, enabling cost tracking, access control, and automation based on tag values. This matches the requirement for user-defined key-value pairs for granular tracking and automation.

Answer

Compartments

Answer

Identity Domains

Answer

Service Limits

Question 14

Your application team needs to store millions of small files that are rarely accessed but must be available immediately when requested. Which storage tier is most cost-effective?

Accepted Answer

Infrequent Access Storage. Infrequent Access tier in Object Storage is optimized for infrequently accessed data that requires immediate retrieval.

Answer

Archive Storage

Answer

Block Volume High Performance

Answer

Standard Storage

Question 15

Your organization wants to ensure that all resources tagged with `Environment: Production` cannot be deleted accidentally by any user, including administrators. Which OCI feature can help achieve protection against accidental deletion?

Accepted Answer

Resource Locks. OCI provides resource locks (full or delete locks) that can be applied to resources to prevent accidental modification or deletion.

Answer

Tag Defaults

Answer

Compartment Quotas

Answer

IAM Deny Policies