1Z0-1085-26 Practice Test 24 — 15 Questions

Question 1

An enterprise application running on OCI requires high availability across two Availability Domains within a single region. The database backend needs to be securely isolated from public internet traffic while maintaining high-speed, low-latency communication with the application servers. How should the Virtual Cloud Network (VCN) be structured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create public subnets in each Availability Domain for the application servers and private subnets in each Availability Domain for the database instances.. To achieve high availability across two Availability Domains while isolating the database from the internet, you need public subnets in each AD for the application servers (so they can receive external traffic) and private subnets in each AD for the database instances (so they have no public IP and are isolated). This design provides both HA and security.

Answer

Create a single VCN with only private subnets and use a NAT Gateway to allow inbound traffic to the database.

Answer

Deploy all resources in a single Availability Domain using Network Security Groups to isolate traffic.

Answer

Place both application and database instances in a single public subnet spanning both Availability Domains.

Question 2

An administrator is setting up an OCI File Storage (FSS) mount target in a specific subnet. When attempting to mount the file system from a compute instance in a different subnet within the same VCN, the mount command hangs. What must be configured to allow this connection?

Accepted Answer

Configure security rules (Security Lists or NSGs) allowing NFS traffic (ports 111, 2048, 2049, 2050) to the mount target.. Access to File Storage requires security rules allowing TCP and UDP ports 111, 2048, 2049, and 2050 for NFS traffic between the compute instance and the FSS mount target.

Answer

Add a NAT Gateway to translate NFS packets across subnets.

Answer

Attach the File Storage volume directly to the compute instance via iSCSI.

Answer

Create a Local Peering Gateway between the two subnets.

Question 3

Which TWO metrics can be monitored using OCI Monitoring service for compute instances? (Choose two.)

Accepted Answer

Memory Utilization. OCI Monitoring ingests metrics published through the OCI Monitoring service, and compute instances emit the agent-based metric Memory Utilization (option B) when the Compute Instance Monitoring plugin is enabled, making it a valid monitorable metric. CPU Utilization (option E) is a default hypervisor-level metric emitted for every compute instance without any agent, so it is also directly monitorable in OCI Monitoring. Options A, C, and D are not compute instance metrics: VCN Route Table Rule Count and Subnet CIDR block utilization are networking/VCN constructs, and Object Storage Bucket Count is an Object Storage service metric, none of which are published as compute instance metrics in OCI Monitoring.

Answer

VCN Route Table Rule Count

Answer

Object Storage Bucket Count

Answer

Subnet CIDR block utilization

Question 4

An administrator has configured a Dynamic Routing Gateway (DRG) to connect an on-premises datacenter to an OCI VCN using an IPsec VPN. However, on-premises servers cannot communicate with instances in the VCN. Which VCN routing configuration is missing?

Accepted Answer

A route rule in the subnet route table with the on-premises CIDR as the destination and the DRG as the target.. Traffic coming from the DRG needs a route rule in the VCN route table pointing to the DRG as the target for the on-premises CIDR block.

Answer

A security list rule allowing ingress TCP traffic from the local VCN CIDR.

Answer

A NAT Gateway attached to the DRG to translate internal IP addresses.

Answer

A route rule in the subnet route table with a destination of 0.0.0.0/0 and target as the Internet Gateway.

Question 5

When evaluating OCI regions for deploying a new application, you notice that some regions are designated as having multiple availability domains while others have only one. What is a key design implication when deploying to a single-AD region?

Accepted Answer

You must rely on fault domains for hardware isolation and another region for disaster recovery.. Single-AD regions lack multiple physical data center facilities, so high availability must rely on fault domains for hardware isolation.

Answer

Compute instances are automatically spread across other global regions.

Answer

Storage services are automatically replicated across public clouds.

Answer

You cannot deploy fault domains in a single-AD region.

Question 6

Where in the OCI Console can an administrator view current service limits, usage, and request a service limit increase?

Accepted Answer

Limits, Quotas and Usage. The 'Limits, Quotas and Usage' page in the OCI Console is the central place to view current service limits, monitor usage against those limits, and submit service limit increase requests. Administrators navigate here to manage capacity and request adjustments.

Answer

Cloud Guard

Answer

Cost Analysis

Answer

Identity Domains

Question 7

A company requires a dedicated, private connection between their on-premises data center and OCI that provides consistent bandwidth. Which service is recommended?

Accepted Answer

FastConnect. FastConnect provides private, dedicated connectivity between on-premises and OCI.

Answer

NAT Gateway

Answer

Site-to-Site VPN

Answer

Local Peering Gateway

Question 8

An administrator is configuring autoscaling on an OCI Instance Pool. They notice that the autoscaling configuration is not triggering scale-out actions despite high CPU utilization. What is a likely cause?

Accepted Answer

The autoscaling policy threshold or cooldown period is misconfigured. Autoscaling requires a co-configured scaling policy with defined thresholds and cooldown periods linked to the instance pool. If the cooldown period is active or thresholds are improperly configured, scaling won't occur.

Answer

The VCN Security List lacks an inbound rule for autoscaling metrics

Answer

The instance pool is attached to an Internet Gateway instead of a NAT Gateway

Answer

The compute instances are using Flexible shapes instead of Bare Metal

Question 9

A security administrator wants to implement stateful packet filtering at the individual instance level within a VCN subnet, allowing different rules to apply to different groups of instances in the same subnet. Which OCI feature should be used?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) in OCI are stateful, instance-level virtual firewalls that let you apply different rule sets to different groups of instances even within the same subnet. You attach an NSG to specific VNICs, and rules reference the NSG rather than CIDR blocks, enabling granular per-instance filtering. Security Lists, by contrast, apply at the subnet level and affect every instance in the subnet uniformly.

Answer

Dynamic Routing Gateway firewall rules

Answer

Security Lists

Answer

Internet Gateway security policies

Question 10

When architecting a solution for high availability in OCI, which TWO factors should be considered to ensure that your application remains resilient?

Accepted Answer

Distributing compute resources across multiple Fault Domains. Option B is correct because Fault Domains are isolated groups of hardware within an Availability Domain, so distributing compute resources across multiple Fault Domains prevents a single hardware failure from taking down the entire application, which is a core HA design principle in OCI. Option E is correct because using multiple Availability Domains (each with independent power, cooling, and network) or multiple Regions provides geographic redundancy, allowing the application to survive a full AD or regional outage. Option A is wrong because concentrating all instances in one Fault Domain creates a single point of failure and actually reduces resilience. Option C is wrong because compartments are logical IAM/organizational containers, not a high-availability mechanism, and grouping services in one compartment has no bearing on fault tolerance. Option D is wrong because a load balancer with no backends cannot route traffic to any application servers, so it provides no availability at all.

Answer

Placing all compute instances in a single Fault Domain for performance

Answer

Configuring all services to exist in the same compartment for simplified access

Answer

Using a single load balancer with no backends

Question 11

An application running on an Oracle Cloud Infrastructure (OCI) compute instance needs secure, private access to Object Storage in the same region without traversing the public internet. Which architecture should you implement?

Accepted Answer

Configure a Service Gateway in your VCN and add a route rule with the destination set to the Object Storage service CIDR.. To securely access OCI Object Storage privately from a VCN without public internet, you should configure a Service Gateway and a corresponding route table rule targeting the Object Storage service.

Answer

Attach a NAT Gateway to your VCN and route traffic destined for Object Storage through it.

Answer

Deploy an Internet Gateway and use security lists to block all inbound traffic except Object Storage traffic.

Answer

Set up a Local Peering Gateway and peer your VCN directly to the Object Storage public namespace.

Question 12

An administrator needs to organize OCI resources to manage billing and access control for different departments. Which OCI feature is designed for this purpose?

Accepted Answer

Compartment. Compartments are OCI's fundamental logical grouping mechanism for isolating and organizing resources. They are used to separate resources by department, environment, or project, and IAM policies and budgets can be scoped to individual compartments. This makes them the correct answer for managing both billing and access control across departments.

Answer

Tenancy

Answer

Fault Domain

Answer

Availability Domain

Question 13

An enterprise application deployed across multiple OCI subnets requires a Layer 4 load balancer that can handle millions of packets per second with ultra-low latency and preserve client source IP addresses. Which service should you deploy?

Accepted Answer

Network Load Balancer. Network Load Balancer (NLB) operates at Layer 4, handles high throughput and packet rates with low latency, and preserves source IPs.

Answer

OCI API Gateway

Answer

Dynamic Routing Gateway

Answer

Public Load Balancer (Layer 7)

Question 14

You need to allow your OKE cluster to access a private database. Where should the database be placed for the best security practice?

Accepted Answer

Private subnet. Placing the database in a private subnet and using NSGs to allow traffic from the OKE nodes is best practice.

Answer

The same public subnet as OKE

Answer

Management subnet

Answer

Public subnet

Question 15

An engineer needs to deploy flexible compute instances on OCI. Which TWO parameters can be independently adjusted when configuring a flexible compute shape? (Choose two.)

Accepted Answer

Amount of Memory (RAM). Flexible shapes allow users to customize the number of OCPUs and the amount of memory independently to fit workload requirements.

Answer

GPU manufacturer and core architecture

Answer

Hypervisor version and vendor

Answer

Physical motherboard serial number