1Z0-1085-26 Practice Exam 4 — 20 Questions

Question 1

Which TWO of the following gateways can be attached to an OCI Virtual Cloud Network (VCN)? (Choose two.)

Accepted Answer

Internet Gateway. The Internet Gateway (A) is a valid OCI VCN gateway that provides bidirectional internet connectivity for resources in a public subnet, enabling inbound and outbound traffic to and from the internet. The Dynamic Routing Gateway (E) is also a valid VCN attachment that provides a path for private traffic between the VCN and external networks such as on-premises networks via FastConnect or IPSec VPN, and between VCNs via peering (local and remote). The other options are not real OCI gateway types: there is no Compute Scaling Gateway (B), no Object Routing Gateway (C), and no Local Storage Gateway (D) in OCI VCN networking; OCI offers Internet Gateway, NAT Gateway, Service Gateway, Local Peering Gateway, Dynamic Routing Gateway, and (in some contexts) Remote Peering Connection.

Answer

Compute Scaling Gateway

Answer

Object Routing Gateway

Answer

Local Storage Gateway

Question 2

An administrator needs to create a private network inside a VCN that isolates database servers from the public internet. How should this be structured?

Accepted Answer

Create a private subnet with no route to an Internet Gateway. A private subnet with a route table that does not contain a route to an Internet Gateway ensures instances are isolated from inbound public internet traffic.

Answer

Create a public subnet and attach an Internet Gateway

Answer

Disable all security lists globally across the tenancy

Answer

Attach a NAT Gateway with an assigned public IP

Question 3

Which TWO of the following statements accurately describe OCI Availability Domains? (Choose two.)

Accepted Answer

Availability domains are connected to each other by a high-bandwidth, low-latency network.. Option A is correct because OCI Availability Domains within a region are interconnected by a dedicated high-bandwidth, low-latency network, which enables low-latency communication between resources in different ADs while still supporting high availability designs. Option C is correct because each Availability Domain is physically isolated from the others, with independent power, cooling, and network infrastructure, so a failure in one AD does not affect the others. Option B is incorrect because Availability Domains are physical data center groupings, not purely logical constructs. Option D is incorrect because a fault domain is a grouping within a single Availability Domain and cannot span multiple ADs. Option E is incorrect because Availability Domains are region-specific and are not shared across distinct OCI regions.

Answer

Availability domains are purely logical constructs with no physical representation.

Answer

A single fault domain can span across multiple availability domains.

Answer

Availability domains are shared across multiple distinct OCI regions.

Question 4

An OCI tenant requires a dedicated, high-speed, private network connection from their on-premises data center to OCI that bypasses the public internet entirely. Which OCI service should be provisioned?

Accepted Answer

FastConnect. OCI FastConnect provides dedicated, private, high-bandwidth connections between an on-premises network and OCI.

Answer

Service Gateway

Answer

IPsec VPN

Answer

Internet Gateway

Question 5

Which OCI compute shape is best suited for workloads requiring dedicated physical servers with no virtualization layer or hypervisor overhead?

Accepted Answer

Bare Metal Shapes. Bare Metal shapes provide physical servers dedicated solely to your tenancy with zero virtualization overhead.

Answer

Flexible Virtual Machine Shapes

Answer

Preemptible Instance Shapes

Answer

OCI Container Instances

Question 6

A database administrator needs to share a multi-gigabyte Oracle Database backup file stored in an OCI Object Storage bucket with an external auditor who does not have an OCI account. How can this be achieved securely without granting IAM console access?

Accepted Answer

Generate a Pre-authenticated Request (PAR) for the specific backup object with an expiration date.. A Pre-authenticated Request (PAR) in OCI Object Storage generates a unique URL that grants time-limited access to a specific object or bucket without requiring the recipient to have an OCI account or IAM credentials. Because the auditor only needs to download a single backup file, creating a PAR scoped to that object with an expiration date provides the least-privilege, secure sharing mechanism. The PAR can also be configured as read-only, ensuring the auditor cannot modify or delete the backup.

Answer

Configure a Service Gateway to allow external IP ranges to access the bucket.

Answer

Make the entire bucket public by modifying the bucket access policy.

Answer

Create a temporary IAM user account with Object Storage Reader permissions.

Question 7

You are troubleshooting a connectivity issue where an on-premises server cannot reach an OCI compute instance over an IPsec VPN tunnel. The security list and NSG rules are verified as correct. What is another common OCI networking configuration that must be checked?

Accepted Answer

Ensure the VCN route table has a rule pointing on-premises CIDR to the DRG. The VCN route table must have a rule pointing traffic destined for the on-premises subnet to the Dynamic Routing Gateway (DRG).

Answer

Confirm that the subnet has a Service Gateway attached

Answer

Check that the compute instance has a public IP address assigned

Answer

Verify that an Internet Gateway is attached to the VCN

Question 8

Which TWO options are valid methods for organizing and managing infrastructure configuration in OCI? (Choose two.)

Accepted Answer

Using OCI Resource Manager to provision and manage Terraform configurations.. Option D is correct because OCI Resource Manager is the managed Terraform service that lets you create, plan, apply, and manage infrastructure-as-code stacks, so it is a valid way to organize and manage infrastructure configuration. Option E is correct because compartments are the fundamental logical containers in OCI used to segment resources and scope IAM policies, making them a core mechanism for organizing and controlling infrastructure. The remaining options are incorrect because Cloud Guard is a security posture service, not a compute deployment tool; Cost Analysis is a billing and usage reporting feature, not an IAM policy authoring tool; and Audit records API activity for compliance, it does not create VCNs.

Answer

Using OCI Cloud Guard to deploy compute instances.

Answer

Using OCI Cost Analysis to write IAM policies.

Answer

Using OCI Audit to create virtual cloud networks.

Question 9

An enterprise customer has a strict regulatory requirement that their database backups must be stored in a geographically distinct location at least 500 miles away from their primary data center, without utilizing the public internet. How can this be accomplished using OCI architecture?

Accepted Answer

Configure cross-region bucket replication from the primary OCI region to a secondary OCI region, utilizing Oracle's private network backbone.. OCI cross-region bucket replication copies objects between buckets in different OCI regions over Oracle's private backbone, never traversing the public internet. Because OCI regions are geographically separated (typically hundreds of miles apart), this satisfies both the distance and the no-public-internet requirements. It's the only option that meets both constraints simultaneously.

Answer

Store backups in multiple Fault Domains within the same Availability Domain.

Answer

Export backups via OCI CLI and transfer them manually using external hard drives shipped via courier.

Answer

Upload backups to a public cloud storage bucket over an encrypted IPsec VPN tunnel spanning the public internet.

Question 10

When designing a disaster recovery and high availability architecture across OCI, which TWO strategies help achieve high availability and fault tolerance? (Choose two.)

Accepted Answer

Distributing critical application instances across multiple fault domains within an availability domain.. Option D is correct because distributing critical application instances across multiple fault domains within an availability domain provides fault tolerance against hardware failures, since each fault domain has independent power and network infrastructure, so a failure in one fault domain does not affect instances in others. Option E is correct because replicating data and workloads across multiple OCI regions provides disaster recovery and geographic redundancy, protecting against region-wide outages and enabling business continuity through services like OCI Full Stack Disaster Recovery, remote replication, and cross-region backups. Option A is incorrect because a single availability domain with no redundancy creates a single point of failure, offering neither high availability nor fault tolerance. Option B is incorrect because placing all instances in a single fault domain concentrates risk, so a fault domain failure would take down the entire workload despite any local communication benefit. Option C is incorrect because creating resources in the root tenancy without compartments is an organizational and access-control anti-pattern that has no bearing on high availability or fault tolerance.

Answer

Relying solely on a single availability domain with no redundancy.

Answer

Placing all database and application instances in a single fault domain for faster local communication.

Answer

Creating all resources in the root tenancy without compartments.

Question 11

A web application deployed across multiple compute instances experiences fluctuating traffic loads throughout the day. The infrastructure needs to automatically add or remove compute instances based on CPU utilization metrics. Which OCI service combination provides this capability?

Accepted Answer

Instance Pools combined with Compute Autoscaling. Compute Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics such as CPU utilization.

Answer

Container Instances combined with Object Storage lifecycle rules

Answer

Virtual Cloud Network with Dynamic Routing Gateway autoscaling

Answer

Load Balancer combined with Block Volume backups

Question 12

An administrator needs to route internet-bound traffic from private compute instances through a NAT Gateway. What route table configuration is required in the private subnet?

Accepted Answer

Destination: 0.0.0.0/0, Target: NAT Gateway. A private subnet route table must have a rule directing destination CIDR 0.0.0.0/0 to the NAT Gateway target.

Answer

Destination: 0.0.0.0/0, Target: Service Gateway

Answer

Destination: 10.0.0.0/16, Target: Internet Gateway

Answer

Destination: VCN CIDR, Target: NAT Gateway

Question 13

Which TWO statements accurately describe the characteristics of OCI Availability Domains and Fault Domains? (Choose two.)

Accepted Answer

A region can contain one or more Availability Domains.. Option C is correct because an OCI region is composed of one or more Availability Domains (ADs), which are isolated, fault-tolerant data center groupings within that region; some regions have a single AD while others have three. Option D is correct because Fault Domains (FDs) are isolated hardware and power groupings within a single Availability Domain, and OCI provides three FDs per AD to enable anti-affinity placement of instances. Option A is incorrect because Availability Domains do not span multiple global regions; they are contained within a single region, and it is regions that are geographically distributed. Option B is incorrect because Availability Domains are deliberately isolated from one another with independent power, cooling, and network infrastructure to maximize fault tolerance, not to share physical power infrastructure. Option E is incorrect because Fault Domains are physical hardware and power isolation groupings confined within one Availability Domain, not software-defined constructs that span across different ADs.

Answer

Availability domains span across multiple global regions to provide high availability.

Answer

Availability domains share physical power infrastructure to minimize data center costs.

Answer

Fault domains are software-defined constructs that exist across different availability domains.

Question 14

You are configuring an OCI Load Balancer. Which component defines the backend servers that receive traffic?

Accepted Answer

Backend Sets. Backend sets define the group of backend servers and their load balancing policy.

Answer

Certificates

Answer

Route tables

Answer

Listeners

Question 15

Which OCI service allows you to back up your on-premises data to the cloud for long-term storage?

Accepted Answer

Object Storage. Object Storage with lifecycle policies is commonly used for backup storage.

Answer

Block Volume

Answer

FastConnect

Answer

Compute Instance

Question 16

An administrator is troubleshooting a VCN where instances in a private subnet cannot reach the public internet via a NAT Gateway. The NAT Gateway is attached to the VCN, and the security list allows all outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The subnet route table lacks a route rule with destination 0.0.0.0/0 pointing to the NAT Gateway.. Even with a NAT Gateway attached and security lists open, the private subnet's route table must have a route rule with destination 0.0.0.0/0 pointing to the NAT Gateway.

Answer

The NAT Gateway requires an incoming security list rule from 0.0.0.0/0.

Answer

The local OS firewall on the NAT Gateway is blocking packets.

Answer

The VCN lacks an Internet Gateway attached to the public subnets.

Question 17

Which statement best describes the geographical relationship between OCI Regions and Availability Domains?

Accepted Answer

A region is a localized geographic area that contains one or more availability domains.. Regions contain one or more availability domains, and multiple regions make up the OCI global footprint.

Answer

Regions and availability domains are completely independent and interchangeable concepts.

Answer

Each availability domain represents a separate public cloud region in a different country.

Answer

An availability domain spans across multiple global regions to provide high availability.

Question 18

What is the primary function of a Dynamic Routing Gateway (DRG) in OCI?

Accepted Answer

To provide a path for private traffic between a VCN and on-premises networks or remote VCNs. A DRG acts as a virtual router that provides a path for private traffic between your VCN and locations outside your VCN, such as on-premises networks or other VCNs.

Answer

To route public internet traffic to virtual machines

Answer

To balance HTTP traffic across backend web servers

Answer

To provide private access to regional Oracle Cloud services

Question 19

An administrator needs to configure autoscaling for a compute instance pool so that instances scale out when CPU usage exceeds 80% and scale in when CPU usage drops below 20%. Where is this autoscaling configuration applied?

Accepted Answer

On an Instance Pool. Autoscaling configurations in OCI are linked directly to an Instance Pool to automatically manage the number of instances.

Answer

On the OCI Load Balancer backend set

Answer

Directly on the VCN Route Table

Answer

Inside an individual Compute VM's operating system configuration

Question 20

You want to automate object lifecycle management in an OCI Object Storage bucket so that files older than 90 days are automatically transitioned to Archive storage. What should you configure?

Accepted Answer

Object Storage Lifecycle Rules. Object Storage Lifecycle Rules allow you to define automated actions to transition objects to different storage tiers or delete them after a specified time period.

Answer

Pre-authenticated requests

Answer

A scheduled OCI Function with a custom script

Answer

Object Versioning policies