1Z0-1085-26 Practice Test 2 — 25 Questions

Question 1

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Web Application Firewall. OCI Web Application Firewall (WAF) is a cloud-based, PCI-compliant security service that protects applications from malicious internet traffic, including cross-site scripting (XSS), SQL injection, and HTTP floods.

Answer

Cloud Guard

Answer

Virtual Cloud Network Security Lists

Answer

Network Security Groups

Question 2

What is an OCI Region?

Accepted Answer

A localized geographic area that contains one or more availability domains.. An OCI region is a localized geographic area containing one or more availability domains.

Answer

A security boundary used to manage user permissions and access control.

Answer

A virtual machine image template used to launch compute instances.

Answer

A physical server rack installed in a customer's private office.

Question 3

A company needs to register and manage public DNS records (such as A, CNAME, and TXT records) for their domain name hosted on OCI. Which OCI service should they use?

Accepted Answer

OCI DNS (Public Zones). OCI DNS provides scalable, highly available public and private Domain Name System services.

Answer

OCI Load Balancer DNS Manager

Answer

OCI Private DNS

Answer

OCI Compute Hostname service

Question 4

An administrator wants to restrict inbound SSH access to a specific group of database compute instances without modifying subnet-level security rules. Which OCI feature should be used to define these fine-grained VNIC rules?

Accepted Answer

Network Security Groups. Network Security Groups (NSGs) allow you to apply security rules to a specific set of VNICs of your choice, independent of subnets.

Answer

Route Tables

Answer

Security Lists

Answer

Dynamic Routing Gateway

Question 5

An architect is designing an application that requires data replication between two OCI regions. The primary region is Ashburn and the secondary region is Phoenix. What is the foundational nature of OCI's multi-region architecture regarding inter-region traffic?

Accepted Answer

OCI regions are independent geographic areas connected by Oracle's high-speed private network backbone, allowing secure cross-region replication.. OCI regions are completely independent and connected by secure, high-speed global network backbones, allowing safe cross-region data transfer.

Answer

All inter-region traffic must traverse the public internet via encrypted IPsec VPN tunnels.

Answer

OCI regions are isolated from each other; cross-region data transfer requires third-party WAN optimizers.

Answer

Inter-region communication is restricted to metadata only; user data cannot be moved between regions.

Question 6

Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?

Accepted Answer

OCI Budgets. OCI Budgets allow you orange spending limits and trigger alerts at specified percentage thresholds via email or notifications.

Answer

OCI Tag Defaults

Answer

OCI Cloud Guard

Answer

OCI Cost Analysis

Question 7

You are deploying a mission-critical web application that must remain available even if an entire Oracle Cloud Infrastructure availability domain experiences a major outage. The application architecture requires two compute instances. How should you provision these instances to achieve high availability?

Accepted Answer

Deploy one instance in Availability Domain 1 and the other instance in Availability Domain 2.. To survive the loss of an entire Availability Domain, the two instances must be placed in different Availability Domains, because each AD is an isolated fault domain with independent power, cooling, and network. Spreading instances across AD 1 and AD 2 ensures that an AD-level outage leaves at least one instance running. Fault domains only protect against failures within a single AD and cannot survive an AD outage.

Answer

Deploy both instances in the same Availability Domain but assign them to different Fault Domains.

Answer

Deploy both instances in separate OCI Regions using an explicit cross-region pairing gateway.

Answer

Deploy both instances in the same Availability Domain and configure autonomous cross-AD scaling.

Question 8

A database administrator needs to take an instantaneous, point-in-time, space-efficient copy of a large block volume without waiting for full data copying to complete. Which Block Volume feature should they use?

Accepted Answer

Block Volume Clone. Volume Clones provide an immediate, point-in-time copy of a block volume using metadata pointers, allowing immediate access without waiting for a full physical copy.

Answer

Boot volume attachment

Answer

Standard Block Volume Backup

Answer

Cross-region replication policy

Question 9

Which TWO of the following are OCI storage services?

Accepted Answer

Block Volume. Object Storage and Block Volume are primary OCI storage services.

Answer

DNS Service

Answer

Load Balancer

Answer

Functions

Question 10

An administrator wants to configure automated backup policies for OCI Block Volumes attached to production databases. They need a policy that takes daily backups and retains them for 30 days, as well as weekly backups retained for 1 year. How can this be accomplished?

Accepted Answer

Create a user-defined Volume Backup Policy specifying multiple schedules with distinct retention periods.. OCI Block Volume backups support user-defined backup policies that allow combining multiple schedules (e.g., daily and weekly) with custom retention periods.

Answer

Enable Object Storage lifecycle management rules on the attached volume.

Answer

Configure a Compute Autoscaling policy with custom volume snapshot triggers.

Answer

Manually run scripts using the OCI CLI every day and week.

Question 11

You want to host a static HTML website with images and JavaScript files entirely on OCI without provisioning any virtual machine web servers. Where should you store and serve these website files?

Accepted Answer

OCI Object Storage Public Bucket. OCI Object Storage supports hosting public static websites by configuring public buckets to serve web content directly via HTTP/HTTPS.

Answer

OCI File Storage Service

Answer

Block Volume Storage

Answer

OCI Container Instances

Question 12

You need to deploy a web application on OCI that requires a flexible compute shape to adjust CPU and memory independently. Which OCI compute feature should you select?

Accepted Answer

Flexible Shapes. Flexible shapes allow independent scaling of CPU and memory, optimizing costs for workload requirements.

Answer

Preemptible Instances

Answer

Dedicated Host

Answer

Bare Metal Instances

Question 13

You need to deploy a scalable containerized web application where Oracle manages the Kubernetes control plane and you manage the underlying compute worker nodes. Which service should you choose?

Accepted Answer

Oracle Container Engine for Kubernetes (OKE). Oracle Container Engine for Kubernetes (OKE) is OCI's managed Kubernetes service where Oracle operates the control plane (API server, etcd, scheduler) and the customer manages the worker nodes. This matches the requirement exactly: a scalable containerized web app with Oracle-managed control plane and self-managed compute worker nodes.

Answer

Compute VM instance pools without Docker

Answer

OCI Container Instances

Answer

OCI Functions

Question 14

Which OCI service provides native tools to monitor resource metrics (such as CPU utilization) and trigger alarms when thresholds are breached?

Accepted Answer

OCI Monitoring. OCI Monitoring collects metrics and enables alarms based on telemetry data.

Answer

OCI Identity Domains

Answer

OCI Vault

Answer

OCI Cost Analysis

Question 15

A security engineer is designing a zero-trust architecture for a microservices environment in OCI. Traffic between compute instances in different subnets must be restricted based on individual workload roles rather than entire subnet CIDR blocks. Which OCI networking feature should be implemented?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) provide virtual firewall rules for a set of VNICs of your choice, allowing fine-grained security rules independent of subnet architecture.

Answer

Security Lists

Answer

Local Peering Gateways

Answer

Stateful Route Tables

Question 16

A developer wants to run event-driven data processing tasks in OCI without provisioning or managing any underlying servers. The execution duration is short (under 5 minutes). Which OCI service should the developer use?

Accepted Answer

OCI Functions. OCI Functions is a serverless, highly scalable platform based on the Fn Project open source engine that allows developers to run code without managing servers.

Answer

Container Instances

Answer

Compute Instances with Autoscaling

Answer

Oracle Container Engine for Kubernetes (OKE)

Question 17

Which THREE OCI networking components are required to connect an on-premises data center to a VCN via an IPsec VPN? (Choose three.)

Accepted Answer

IPsec Connection. The three required OCI components for an IPsec VPN connection to a VCN are the IPsec Connection (A), the Customer Premise Equipment (CPE) object (C), and the Dynamic Routing Gateway (DRG) (D). The IPsec Connection (A) is the actual tunnel resource that defines the shared secret, routing type (static or BGP), and links the CPE to the DRG. The CPE object (C) is a logical representation of the on-premises VPN device, holding its public IP address and identifying the remote endpoint of the tunnel. The DRG (D) is the virtual router attached to the VCN that terminates the IPsec tunnels and provides the path into the VCN's subnets. An Internet Gateway (B) is not required because IPsec VPN traffic traverses the public internet to reach the DRG's public IP; an IGW only enables inbound/outbound internet access for VCN resources. A Local Peering Gateway (E) is used to connect two VCNs within the same region and plays no role in on-premises connectivity.

Answer

Internet Gateway

Answer

Local Peering Gateway

Question 18

Which THREE components are required when writing an OCI IAM policy statement? (Choose three.)

Accepted Answer

Location (compartment name or tenancy). OCI IAM policy syntax requires a verb, a resource type (or all-resources), and a location (compartment or tenancy).

Answer

Availability domain identifier

Answer

Compute shape specification

Question 19

You need to grant an external auditing firm read-only access to view all resources across your entire OCI tenancy without allowing them to make any changes. What is the most efficient way to achieve this?

Accepted Answer

Create an IAM policy: 'Allow group Auditors to inspect all-resources in tenancy'. Using the 'inspect' or 'read' verb across 'all-resources' at the tenancy level grants read-only visibility to auditors.

Answer

Export all resource configurations to a CSV file and email them weekly.

Answer

Create an IAM policy: 'Allow group Auditors to manage all-resources in tenancy'

Answer

Manually add the auditor accounts as co-administrators of the root tenancy.

Question 20

An administrator needs to deploy a critical production database across multiple data centers in the same OCI region to protect against unexpected hardware failure while ensuring lowest possible network latency for synchronous replication. Which component should the administrator leverage?

Accepted Answer

Availability Domains. Availability Domains (ADs) are isolated, independent data centers within a region, connected with high-performance, low-latency networks, making them ideal for high availability within the same region.

Answer

OCI Dedicated Regions

Answer

OCI Regions

Answer

Fault Domains