1Z0-1085-26 Practice Exam 1 — 20 Questions

Question 1

; You need to access a private database instance in an OCI VCN that has no public IP addresses assigned, without setting up a traditional VPN or an inbound bastion host with an open SSH port. Which service should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Bastion. OCI Bastion service provides restricted and time-limited secure access to target resources that do not have public IPs, using ephemeral SSH or port forwarding sessions without maintaining a permanent bastion host.

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Answer

Site-to-Site VPN

Question 2

According to the OCI shared-responsibility model, who is responsible for managing user accounts, password policies, and multi-factor authentication (MFA) configurations?

Accepted Answer

The customer. IAM user lifecycle management, password policies, and MFA configurations are the sole responsibility of the customer.

Answer

Oracle

Answer

Both Oracle and the customer jointly via shared IAM consoles

Answer

Third-party identity auditor

Question 3

Your security team notices that Cloud Guard has generated numerous 'problems' related to overly permissive IAM policies across multiple compartments. Where do these problems originate from?

Accepted Answer

Detector recipes. Cloud Guard uses detector recipes to continuously analyze resources, including IAM policies, network configurations, and storage buckets, to identify security posture deviations.

Answer

Vault Master Encryption keys

Answer

Security Zone recipes

Answer

Responder recipes

Question 4

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

Accepted Answer

Guest operating system patching and configuration on the compute instances. In the OCI shared-responsibility model, OCI is responsible for security OF the cloud, including the underlying physical infrastructure, virtualization, and global network. The customer is responsible for security IN the cloud, which includes guest OS patching, data classification, firewall configurations, and identity and access management.

Answer

Hypervisor patching and firmware updates on the physical host

Answer

Redundancy and cooling of the physical networking hardware

Answer

Physical security of the data center hosting the compute instances

Question 5

A developer needs to store database connection strings and API tokens securely so that applications can retrieve them dynamically without hardcoding credentials. Which OCI service is designed specifically for this purpose?

Accepted Answer

Vault Secrets. OCI Vault provides secrets management capabilities that allow you to securely store, manage, and retrieve secrets such as passwords, database connection strings, and certificates.

Answer

Object Storage with customer-managed keys

Answer

Key Management Service Master Keys

Answer

Identity and Access Management Dynamic Groups

Question 6

Which of the following best describes the isolation level between OCI Availability Domains within the same region?

Accepted Answer

They are completely isolated from each other with independent power, cooling, and physical security, while being connected by a low-latency network.. Availability domains are isolated with independent power, cooling, and network infrastructure, preventing correlated failures.

Answer

They are located in different countries to ensure compliance with international tax laws.

Answer

They share physical power supplies and network switches to reduce operational costs.

Answer

They operate as independent public clouds with separate IAM user directories.

Question 7

Which OCI Console menu section should an administrator navigate to in order to create and manage user groups, compartments, and IAM policies?

Accepted Answer

Identity & Security. Identity & Security (or Governance & Administration depending on console navigation structure) contains Identity, Compartments, and Policies.

Answer

Analytics & AI

Answer

Storage

Answer

Networking

Question 8

Where in the OCI Console can an administrator view current service limits, usage, and request a service limit increase?

Accepted Answer

Limits, Quotas and Usage. The 'Limits, Quotas and Usage' section under Governance and Administration in the OCI Console is where service limits are managed.

Answer

Cloud Guard

Answer

Cost Analysis

Answer

Identity Domains

Question 9

An organization is planning a disaster recovery strategy for a Tier-1 financial application. They need a Recovery Point Objective (RPO) of near-zero and a Recovery Time Objective (RTO) of seconds. Which OCI deployment pattern best fulfills these stringent requirements?

Accepted Answer

Deploy an active-active architecture across two low-latency interconnected OCI regions using synchronous replication and automated traffic management failover.. A multi-region active-active or active-passive configuration with synchronous data replication across regions provides the lowest RPO and RTO.

Answer

Deploy instances across three Fault Domains in a single Availability Domain with automated compute health checks.

Answer

Backup daily block volumes to Object Storage and restore them in a secondary region upon disaster declaration.

Answer

Deploy an active-passive architecture across two OCI regions using asynchronous database replication and manual DNS failover.

Question 10

You are deploying a mission-critical web application that must remain available even if an entire Oracle Cloud Infrastructure availability domain experiences a major outage. The application architecture requires two compute instances. How should you provision these instances to achieve high availability?

Accepted Answer

Deploy one instance in Availability Domain 1 and the other instance in Availability Domain 2.. To protect against availability domain failures, instances must be placed in separate Availability Domains within the same OCI region.

Answer

Deploy both instances in the same Availability Domain but assign them to different Fault Domains.

Answer

Deploy both instances in separate OCI Regions using an explicit cross-region pairing gateway.

Answer

Deploy both instances in the same Availability Domain and configure autonomous cross-AD scaling.

Question 11

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?

Accepted Answer

Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment. To scope access to a specific resource type within a specific compartment, the policy must use the target resource type (autonomous-databases) and be defined at the appropriate compartment level.

Answer

Allow group DBA-Group to manage all-resources in compartment DevCompartment

Answer

Allow compartment DevCompartment to manage autonomous-databases for group DBA-Group

Answer

Allow group DBA-Group to manage autonomous-databases in tenancy

Question 12

You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?

Accepted Answer

Use the condition 'where request.region = <home-region>'. OCI IAM policy conditions support checking contextual variables such as request.region, enabling regional scoping.

Answer

IAM policies cannot be restricted by region; they always apply globally.

Answer

Use the condition 'where target.region.home = true'

Answer

Use the condition 'where principal.region = home'

Question 13

Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?

Accepted Answer

Authentication fails immediately at the IdP, preventing access to OCI.. Federated authentication relies on the corporate IdP; once disabled there, the user cannot successfully authenticate or generate security assertions for OCI.

Answer

The user can still log into OCI using local OCI IAM password credentials.

Answer

OCI will prompt the user to reset their OCI password.

Answer

The user retains access until their active OCI API signing key expires.

Question 14

An organization requires a complete disaster recovery site located in a different geographic jurisdiction hundreds of miles away to comply with business continuity mandates, ensuring data replication across independent regions. Which construct forms the foundational basis for this requirement?

Accepted Answer

OCI Regions. OCI Regions are localized geographic areas that are completely independent of one another, separated by hundreds of miles, making them ideal for disaster recovery.

Answer

Fault Domains

Answer

Tenancies

Answer

Availability Domains

Question 15

You are reviewing the network architecture of an OCI region and need to understand the connectivity between availability domains. Which statement is accurate regarding availability domain inter-connectivity?

Accepted Answer

Availability domains are connected by a high-bandwidth, low-latency network.. Availability domains are connected to each other by a low-latency, high-bandwidth network, enabling synchronous replication and distributed architectures.

Answer

Availability domains are isolated from each other and cannot communicate directly over the network.

Answer

Communication between availability domains must route through the public internet.

Answer

Availability domains share the same physical power infrastructure to ensure identical latency.

Question 16

What is the primary purpose of OCI Fault Domains within an Availability Domain?

Accepted Answer

To provide fault tolerance against hardware and power failures within an Availability Domain.. Fault domains group physical hardware (servers, storage, switches) to provide anti-affinity and fault isolation.

Answer

To isolate network traffic between different virtual cloud networks (VCNs).

Answer

To segregate billing and cost-management data across different departments.

Answer

To define geographic boundaries for global data residency compliance.

Question 17

An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?

Accepted Answer

OCI Audit. The OCI Audit service automatically records all API calls made to supported OCI services, including identity, user actions, and resource deletions.

Answer

OCI Notifications

Answer

OCI Events

Answer

OCI Monitoring

Question 18

Your company operates workloads in an OCI region that suffers a rare regional-wide network partition. Your architecture remains online because you implemented a multi-region deployment. Which OCI feature enables this level of business continuity?

Accepted Answer

OCI Regions. Independent OCI regions allow organizations to deploy active-active or active-passive architectures across geographies.

Answer

Fault Domains

Answer

Availability Domains

Answer

Dynamic Routing Gateway

Question 19

When designing a highly available architecture in OCI, why is it recommended to deploy application tiers across multiple Availability Domains or Fault Domains?

Accepted Answer

To prevent a single hardware or facility failure from disrupting the entire application workload.. Distributing workloads across ADs or FDs ensures that no single point of failure takes down the application.

Answer

To increase the processing speed of CPU instructions.

Answer

To reduce data transfer costs between cloud regions.

Answer

To satisfy legal requirements for cross-border data transfer.

Question 20

You are designing a web application hosted in OCI. You want to ensure that if a top-of-rack switch fails inside a data center, your application remains online. How are OCI Fault Domains engineered to address this specific risk?

Accepted Answer

Fault domains are isolated racks with their own power, cooling, and network hardware, ensuring anti-affinity for instance placement.. Fault domains isolate hardware, power supplies, and top-of-rack network switches within an availability domain.

Answer

Fault domains provide automatic geographic failover across different countries.

Answer

Fault domains automatically replicate virtual machine memory across different availability domains.

Answer

Each Fault Domain has its own dedicated external internet gateway to route traffic around broken switches.