1Z0-1085-26 Practice Test 26 — 15 Questions

Question 1

A startup has just created a new Oracle Cloud Infrastructure tenancy and needs to add its first group of engineers as identities that will sign in to the Console. The administrator must create the user accounts before any policies can be written for them. Which OCI Identity and Access Management entity must the administrator create to represent each individual person who will sign in?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IAM user, optionally federated to an external identity provider. Users are the fundamental identity objects in OCI Identity and Access Management that represent human beings who need to authenticate. Each engineer needs an individual user so that access can be granted through group membership and policies, and so that actions are attributable to a specific person in audit logs. Compartments structure resources and dynamic groups target workloads, so neither satisfies the need to onboard people.

Answer

An identity domain policy granting the Console login permission

Answer

A compartment named after the engineering team

Answer

A dynamic group scoped to the tenancy's root compartment

Question 2

A security administrator in a large tenancy must determine which principal performed a specific DeleteBucket operation on an Object Storage bucket three weeks ago. The tenancy has Audit retention set to 90 days and no external SIEM integration. Where should the administrator look to find this information?

Accepted Answer

OCI Audit service, filtering events by the Object Storage bucket's compartment and the DeleteBucket event type. The OCI Audit service is the authoritative, always-on record of API activity across a tenancy and retains events for 90 days by default. Because it captures the principal, action, resource, and time, filtering by compartment and the DeleteBucket event type lets the administrator identify exactly who deleted the bucket without any prior configuration.

Answer

OCI Events service, reviewing the rule history for Object Storage delete event types

Answer

OCI Monitoring service, querying the oci_objectstorage metric namespace for delete operations

Answer

OCI Logging service, enabling a service log on the bucket and searching historical log entries from three weeks ago

Question 3

A media company stores millions of video files in an OCI Object Storage bucket. The compliance team requires that all objects be encrypted with a customer-managed key stored in OCI Vault, and that the encryption key be rotated automatically every 90 days. Which OCI feature should the administrator configure to meet these requirements?

Accepted Answer

Enable Object Storage bucket encryption using a Vault master encryption key and set a key rotation policy on the key.. OCI Object Storage integrates with OCI Vault to support customer-managed encryption keys. When you configure a bucket to use a Vault master encryption key, all objects in that bucket are encrypted with that key. Vault allows you to define a rotation schedule for the key, such as every 90 days, which automatically generates a new key version while retaining older versions for decrypting existing data. This satisfies both the customer-managed key and automatic rotation requirements.

Answer

Use OCI Block Volume encryption with a customer-managed key and mount the volume to all compute instances that access the bucket.

Answer

Apply an OCI Identity and Access Management policy that enforces encryption on all objects in the bucket.

Answer

Configure a lifecycle policy on the bucket to archive objects after 90 days and rely on default Oracle-managed encryption.

Question 4

A research team runs a long-running simulation on an OCI Compute instance in the Frankfurt region. They need a shared, POSIX-compliant file system that can be mounted by multiple Linux instances simultaneously and that can automatically scale capacity up to 8 EB without provisioning. Which OCI service should they use?

Accepted Answer

OCI File Storage Service (FSS). OCI File Storage Service is the only option that delivers a shared, POSIX-compliant NFS file system that multiple compute instances can mount at the same time. It automatically scales capacity up to 8 EB, eliminating provisioning. Block Volume, Object Storage, and Local NVMe SSD each lack either shared simultaneous access, POSIX compliance, or automatic exabyte-scale elasticity.

Answer

OCI Block Volume

Answer

OCI Object Storage

Answer

OCI Local NVMe SSD

Question 5

A solutions architect is preparing to provision compute instances in a new OCI region. Before creating anything, the architect must confirm which availability domain and fault domain will host the instances. Which statement correctly describes the relationship between regions, availability domains, and fault domains in Oracle Cloud Infrastructure?

Accepted Answer

A region contains one or more availability domains, and each availability domain contains one or more fault domains. Understanding the containment order matters for placement decisions. A region is the geographic boundary, availability domains are isolated datacenter groupings within it, and fault domains are hardware groupings inside each availability domain. Spreading instances across fault domains protects against localized hardware failures, while spreading across availability domains protects against larger datacenter-level events.

Answer

Fault domains are logical constructs assigned by policy and are unrelated to physical hardware

Answer

An availability domain contains one or more regions, each divided into fault domains

Answer

A fault domain can span multiple availability domains within the same region

Question 6

A startup wants to run a containerized web application on OCI without managing any worker nodes or control plane infrastructure. They need automatic scaling and pay only for the compute resources their pods consume. Which OCI service should they use?

Accepted Answer

OCI Container Engine for Kubernetes (OKE) with virtual nodes. OKE with virtual nodes abstracts away worker nodes, letting you run Kubernetes pods without managing any infrastructure. It automatically scales and bills based on pod resource requests, aligning with the startup's requirements. Container Instances lack orchestration, OKE with managed nodes still requires node management, and Functions is for event-driven functions, not containerized web apps.

Answer

OCI Functions

Answer

OCI Container Instances

Answer

OCI Container Engine for Kubernetes (OKE) with managed nodes

Question 7

A junior cloud engineer has just joined a tenancy and needs to sign in to the OCI Console. The identity administrator wants to grant the engineer access without creating a separate local OCI password. Which identity type should the administrator federate with OCI Identity and Access Management to achieve this?

Accepted Answer

An identity provider that supports SAML 2.0, such as Microsoft Entra ID or Okta. OCI IAM supports federation with SAML 2.0 identity providers, so mapping an external directory to OCI lets users authenticate with existing corporate credentials. This removes the need to issue and manage a local OCI Console password for the new engineer while still granting Console access through group-to-policy mappings.

Answer

A customer secret key associated with the engineer's user account

Answer

An OCI API key pair generated for the engineer's user account

Answer

An OCI auth token generated for the engineer's user account

Question 8

A solutions architect is planning the resource hierarchy for a multi-department OCI tenancy. The security team requires that each department's resources be logically separated for cost tracking and policy scoping, while still residing in the same tenancy. Which OCI construct should the architect use to achieve this separation?

Accepted Answer

Compartments, because they provide a logical grouping for resources that supports policy scoping and cost tracking.. Compartments are OCI's logical containers for resources, enabling administrators to group resources by department, project, or environment. IAM policies can be scoped to a compartment, and cost reports can be filtered by compartment, satisfying both access separation and chargeback needs. Availability domains, regions, and fault domains serve fault-isolation and geographic purposes, not organizational hierarchy or policy scoping.

Answer

Fault domains, because they isolate resources at the hardware level for each department's workloads.

Answer

Availability domains, because each department can be assigned to a distinct availability domain for isolation.

Answer

Regions, because each department should be placed in a separate region for complete logical isolation.

Question 9

A startup is evaluating Oracle Cloud Infrastructure for the first time. The team wants to create a new tenancy and needs to understand which entity is created automatically when the tenancy is provisioned. Which statement correctly describes what is created by default?

Accepted Answer

A root compartment that holds all resources, plus an initial administrator user and a default identity domain for managing users and groups.. A new OCI tenancy is provisioned with a root compartment that forms the top of the resource hierarchy, an initial administrator user for first-time access, and a default identity domain for managing identities. Networking, policies for other users, budgets, and Object Storage buckets are not created automatically. Understanding this baseline prevents incorrect assumptions about what is immediately usable after signup.

Answer

A default compartment, a preconfigured Identity and Access Management policy granting full access to all users, and a shared Object Storage bucket for tenant backups.

Answer

A default compartment named after the tenancy's root compartment, plus an administrator user and a default Virtual Cloud Network in each region.

Answer

A default compartment, an initial administrator user, and a preconfigured budget alert that monitors tenancy spending across all regions.

Question 10

A financial services company needs to run a high-performance computing (HPC) workload on OCI that requires extremely low latency and high bandwidth between compute instances. They want to minimize network overhead and jitter. Which OCI feature should they enable?

Accepted Answer

Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) v2. RDMA over Converged Ethernet (RoCE) v2 is the OCI feature that enables low-latency, high-bandwidth, and low-CPU-overhead communication between compute instances, which is essential for tightly coupled HPC workloads. FastConnect, VCN peering, and Load Balancer address connectivity, routing, or distribution but do not provide the direct memory access performance required.

Answer

OCI Virtual Cloud Network (VCN) peering

Answer

OCI FastConnect

Answer

OCI Load Balancer

Question 11

A developer needs to launch a compute instance in Oracle Cloud Infrastructure but has never used the platform. The developer wants to avoid the complexity of manually configuring networking and security rules for a quick test. Which OCI feature is designed to simplify this initial setup?

Accepted Answer

The Compute Instance Wizard, which automatically creates a VCN, subnet, internet gateway, and security list when you choose the default networking option.. The Compute Instance Wizard includes a default networking option that automatically creates a VCN, public subnet, internet gateway, and security list rules, allowing a developer to launch a functional instance without manually building networking. This directly addresses the need for a fast, low-complexity test. Other services like FastConnect or Security Zones serve entirely different purposes and do not simplify basic instance provisioning.

Answer

The Virtual Cloud Network Wizard, which must be run separately before any instance can be created and cannot be triggered from the instance launch flow.

Answer

The Security Zone policy, which enforces a set of security rules and automatically builds all required network resources for new instances.

Answer

The FastConnect Wizard, which provisions a dedicated private connection and automatically configures all routing for new instances.

Question 12

A finance team needs a consolidated, near-real-time view of all OCI costs broken down by the compartment that incurred them, and they want to save and share this view with other team members without exporting spreadsheets. Which OCI service should they use?

Accepted Answer

OCI Cost Analysis. Cost Analysis is the native OCI tool for exploring actual and forecast costs across dimensions like compartment, service, and tags. Its saved-report feature allows finance staff to define a compartment breakdown once and share it, providing near-real-time visibility without CSV exports. Budgets and Usage Reports serve alerting and archival purposes rather than interactive reporting.

Answer

OCI Usage Reports

Answer

OCI Cloud Advisor

Answer

OCI Budgets

Question 13

A healthcare organization stores sensitive patient data in an OCI Object Storage bucket. Compliance requires that all data be encrypted at rest with a key that the organization manages and rotates every 90 days. The organization already uses OCI Vault. Which encryption approach should they implement?

Accepted Answer

Use customer-managed keys stored in OCI Vault and configure a rotation schedule.. Customer-managed keys in OCI Vault are the correct solution because they give the organization full control over the encryption keys, including the ability to define and enforce a 90-day rotation schedule. Object Storage integrates with Vault to use these keys for server-side encryption. Oracle-managed keys and client-side keys stored on instances do not provide the required control and rotation capabilities.

Answer

Use client-side encryption with a key stored on a compute instance's boot volume.

Answer

Use Oracle-managed encryption keys and enable automatic rotation.

Answer

Use HTTPS for data in transit and rely on default server-side encryption for data at rest.

Question 14

A financial services company runs a web application on OCI behind a public load balancer. Auditors require that all inbound traffic be inspected for common web exploits such as cross-site scripting and that malicious source IPs be blocked automatically for a period of time. The security team also wants to keep management overhead low by using managed rule sets. Which OCI service should be deployed in front of the application?

Accepted Answer

OCI Web Application Firewall. The scenario requires inline inspection of HTTP traffic with managed application-layer rule sets and automatic temporary blocking of malicious clients. OCI Web Application Firewall is purpose-built for that: it attaches to a load balancer or edge endpoint, evaluates requests against Oracle-managed and custom rules, and can add offending IPs to a block list for a set duration. Network-layer and posture services cannot perform those application-layer actions.

Answer

OCI Cloud Guard

Answer

OCI Bastion

Answer

OCI Network Firewall

Question 15

An administrator is preparing to use OCI Tag Defaults so that resources created by the application team are automatically tagged with the correct cost center and environment values. Which TWO statements about how Tag Defaults behave are correct? (Choose two.)

Accepted Answer

Tag Defaults can be defined using a defined tag key that exists in the tenancy's tag namespace. Tag Defaults are attached to a compartment and reference an existing defined tag key in a tag namespace, applying the value to resources created afterward. Marking the default as locked enforces the value so users cannot alter it, which is essential for trustworthy cost center and environment data. They are not retroactive and cannot create namespaces.

Answer

Tag Defaults can automatically create a new tag namespace if the specified namespace does not exist

Answer

Tag Defaults require a pre-authenticated request to be generated for each compartment before they take effect

Answer

Tag Defaults only apply to resources that already existed before the default was configured