1Z0-1085-26 Practice Exam 2 — 20 Questions

Question 1

An enterprise has multiple child compartments under a root tenancy. A security administrator wants to ensure that a specific IAM policy written in the root tenancy cannot be overridden or weakened by child compartment policies. How does OCI handle policy evaluation across hierarchical boundaries?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policies are additive across the hierarchy; higher-level grants cannot be blocked because OCI has no explicit deny statements.. OCI IAM policies are additive. Permissions granted at higher levels (like tenancy or parent compartments) flow down and cannot be blocked or denied by child compartment policies since OCI does not have explicit DENY rules.

Answer

OCI evaluates policies alphabetically and applies the first matching statement.

Answer

Root tenancy policies are automatically disabled if any child compartment policy exists.

Answer

Child compartment policies take precedence and override parent compartment policies.

Question 2

A multinational corporation requires low-latency access for users in Frankfurt and London, with strict data isolation ensuring European data does not leave designated jurisdictions. Which OCI architectural construct should you use to organize their resources?

Accepted Answer

OCI Regions. Regions are localized geographic areas. Deploying resources into distinct OCI regions (e.g., Germany Central (Frankfurt) and UK South (London)) meets both proximity and data isolation goals.

Answer

Compartments

Answer

Availability Domains

Answer

Fault Domains

Question 3

Your organization requires a localized cloud environment that provides access to all OCI services, but data must remain strictly within a specific country due to regulatory mandates, and the infrastructure must be managed entirely on-premises. Which OCI offering is appropriate?

Accepted Answer

OCI Dedicated Region Cloud@Customer. OCI Dedicated Region Cloud@Customer provides all OCI services locally on-premises.

Answer

OCI FastConnect

Answer

OCI VPN Connect

Answer

OCI Public Cloud Region

Question 4

Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?

Accepted Answer

Compartment Quotas. Compartment quotas allow administrators to set resource limits (such as max OCPUs or counts) on specific compartments to enforce financial and capacity governance.

Answer

OCI Budgets

Answer

Service Limits

Answer

IAM Policy Statements

Question 5

Which TWO mechanisms help protect OCI workloads against single points of failure at the infrastructure level? (Choose two.)

Accepted Answer

Deploying applications across multiple Availability Domains to survive a complete facility outage.. Fault domains and availability domains are core mechanisms for infrastructure fault isolation in OCI.

Answer

Relying on a single Virtual Cloud Network (VCN) with no backup subnets.

Answer

Placing all compute instances on a single physical host to maximize internal CPU cache efficiency.

Answer

Disabling automated backups to prevent storage controller contention.

Question 6

Which OCI administrative feature allows you to organize and categorize cloud resources using user-defined key-value pairs for granular tracking and automation?

Accepted Answer

Tags. Tags provide key-value metadata attachment to OCI resources.

Answer

Compartments

Answer

Identity Domains

Answer

Service Limits

Question 7

Which THREE best practices should be followed when designing an OCI compartment hierarchy and IAM policy structure? (Choose three.)

Accepted Answer

Grant permissions to user groups rather than attaching policies directly to individual users.. Best practices include keeping compartment hierarchies shallow, using groups rather than individual users in policies, and following the principle of least privilege.

Answer

Share tenancy root administrative credentials among all team members.

Answer

Write all IAM policies at the root tenancy level to avoid managing multiple policies.

Question 8

An enterprise customer has a strict regulatory requirement that their database backups must be stored in a geographically distinct location at least 500 miles away from their primary data center, without utilizing the public internet. How can this be accomplished using OCI architecture?

Accepted Answer

Configure cross-region bucket replication from the primary OCI region to a secondary OCI region, utilizing Oracle's private network backbone.. Using OCI cross-region replication to a secondary region connected via Oracle's private backbone fulfills this requirement.

Answer

Store backups in multiple Fault Domains within the same Availability Domain.

Answer

Export backups via OCI CLI and transfer them manually using external hard drives shipped via courier.

Answer

Upload backups to a public cloud storage bucket over an encrypted IPsec VPN tunnel spanning the public internet.

Question 9

An administrator needs to organize OCI resources to manage billing and access control for different departments. Which OCI feature is designed for this purpose?

Accepted Answer

Compartment. Compartments are the primary tool for logically organizing and isolating resources, which simplifies policy management and cost tracking.

Answer

Tenancy

Answer

Fault Domain

Answer

Availability Domain

Question 10

Your organization is launching a global e-commerce platform. Users will access the platform from North America, Europe, and Asia. To minimize latency for these users, what is the best practice approach for deploying resources on OCI?

Accepted Answer

Deploy regional instances in multiple OCI regions corresponding to your user geographic distribution and use OCI Traffic Management to route users to the closest region.. Deploying workloads across multiple OCI regions close to the user base minimizes network latency.

Answer

Deploy all database instances in North America and application servers in Europe to balance workloads.

Answer

Deploy all resources in a single central region and use a Content Delivery Network (CDN) for static assets only.

Answer

Deploy instances across multiple Fault Domains in a single Availability Domain to handle global traffic.

Question 11

An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?

Accepted Answer

No IAM policy has been created that grants permissions to the dynamic group.. For a dynamic group to receive permissions, an IAM policy must be written granting access to that specific dynamic group name (e.g., 'Allow dynamic-group <group-name> to...').

Answer

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Answer

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Answer

Dynamic groups cannot be used in IAM policies; only user groups can.

Question 12

A security administrator needs to ensure that users configure Multi-Factor Authentication (MFA) for their OCI accounts to enhance login security. Where is MFA managed in OCI?

Accepted Answer

Identity Domains. MFA and user authentication policies are managed within Identity Domains in OCI.

Answer

OCI Vault

Answer

Compartment Quotas

Answer

IAM Policies

Question 13

Your development team needs to test an application's resilience against infrastructure hardware failures within a specific OCI region that contains only a single Availability Domain. Which OCI feature should you utilize to distribute your compute instances for fault tolerance?

Accepted Answer

Fault Domains. In regions with a single Availability Domain, Fault Domains provide the necessary high availability by logically isolating instances onto separate underlying hardware.

Answer

Dynamic Routing Gateways

Answer

Cross-Region Replication

Answer

Secondary Regions

Question 14

Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)

Accepted Answer

Defined tags require a Tag Namespace to be created first.. Defined tags require tag namespaces, support tag defaults, and can be evaluated in IAM policies for TBAC.

Answer

Defined tags replace IAM policies entirely for access control.

Answer

Defined tags can only be created as free-form strings without any governance.

Question 15

An organization must comply with strict data sovereignty laws requiring that their cloud environment remain physically isolated from the public internet and operated independently, yet still receive continuous updates and feature parity with OCI public cloud. Which deployment model satisfies this requirement?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region provides a fully isolated region within the customer's data center, managed by Oracle, with identical APIs and services to the public cloud.

Answer

OCI Hybrid Cloud via VPN Connect.

Answer

OCI FastConnect with a dedicated private circuit.

Answer

OCI Public Cloud with a dedicated Virtual Cloud Network (VCN).

Question 16

Which THREE components or services are part of the OCI distributed cloud strategy, providing flexibility in where and how cloud services are consumed?

Accepted Answer

OCI Cloud@Customer. The OCI distributed cloud model includes Public Cloud, Dedicated Region, and Cloud@Customer as core offerings to meet various business needs.

Answer

OCI Resource Manager

Answer

OCI Data Catalog

Question 17

An architect is evaluating OCI's distributed cloud offerings. A client in the healthcare sector requires an on-premises deployment that includes the complete portfolio of OCI cloud services, autonomous database capabilities, and exact API parity with the public cloud, all managed locally. Which OCI solution should be proposed?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region brings the complete set of OCI public cloud services into the customer's data center.

Answer

Oracle Autonomous Database on Dedicated Exadata Infrastructure in the Public Cloud

Answer

OCI Exadata Cloud@Customer

Answer

OCI Compute Cloud@Customer

Question 18

An enterprise customer wants to leverage OCI Compute Cloud@Customer to run containerized microservices on-premises while integrating seamlessly with OCI public cloud management tools. How does Compute Cloud@Customer achieve this integration?

Accepted Answer

By running an autonomous Kubernetes control plane locally that synchronizes with public cloud APIs via a secure management connection.. Compute Cloud@Customer connects back to the OCI control plane over secure, dedicated network connections to maintain consistent management APIs.

Answer

By replicating all public cloud control plane services locally onto every customer node.

Answer

By requiring manual exports of cloud templates and uploading them via Secure Shell (SSH) daily.

Answer

By converting the on-premises rack into a public OCI Region accessible via the public internet.

Question 19

An enterprise customer evaluating OCI's distributed cloud model wants to understand the advantages of OCI Dedicated Region compared to traditional public cloud. Which THREE benefits are provided by OCI Dedicated Region? (Choose three.)

Accepted Answer

Complete control and data residency within the customer's own data center facility.. Dedicated Region provides local data residency, full API/service parity with public cloud, and local control.

Answer

Elimination of all software licensing costs for third-party operating systems.

Answer

Requiring the customer's internal IT staff to manually patch the underlying hypervisors and control plane.

Question 20

Which OCI service allows you to define and run infrastructure as code (IaC) using Terraform configurations natively managed inside your tenancy?

Accepted Answer

OCI Resource Manager. OCI Resource Manager is a fully managed service that uses Terraform to provision and govern OCI resources.

Answer

OCI Audit

Answer

OCI Identity Domains

Answer

OCI Cloud Guard