1Z0-1085-26 Practice Test 27 — 15 Questions

Question 1

A company is evaluating Oracle Cloud Infrastructure for a regulated workload. The compliance officer asks how OCI's distributed cloud offerings differ from standard public cloud regions so the team can decide whether an on-premises deployment is feasible. Which OCI offering lets a customer run OCI services inside their own datacenter while Oracle operates and manages the hardware and control plane?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Oracle Dedicated Region Cloud@Customer. Dedicated Region Cloud@Customer is the distributed cloud option that installs a full OCI region, including services and the control plane, on the customer's premises while Oracle manages the hardware. Free Tier and bare metal shapes live in public regions, and a VPN only extends connectivity. For strict data residency or latency requirements, the on-premises dedicated region is the relevant choice.

Answer

OCI Virtual Cloud Network with a Site-to-Site VPN

Answer

Oracle Cloud Infrastructure Compute bare metal instances

Answer

Oracle Cloud Free Tier

Question 2

A new employee joins the finance team and needs access to OCI resources that the finance group already has permissions for. The administrator wants the employee to inherit exactly the same access as the rest of the team. What is the correct action?

Accepted Answer

Add the employee to the existing finance group. In OCI, permissions are granted to groups through policies; individual users receive access by becoming members of those groups. Adding the new hire to the finance group is the simplest and most maintainable way to give exactly the same rights as the rest of the team, and it keeps access management centralized.

Answer

Create a new compartment specifically for the employee

Answer

Assign the employee the tenancy administrator role

Answer

Create a new policy that names the individual employee as the principal

Question 3

A cloud administrator is preparing to onboard a new department into an existing OCI tenancy. To follow Oracle's governance guidance, which TWO practices should the administrator apply when creating the department's compartment structure? (Choose two.)

Accepted Answer

Grant the department's group permissions only within its own compartment and its descendants, using compartment-scoped policy statements. Oracle's governance guidance favors a hierarchical compartment design where department compartments sit under shared parents, and where access is scoped narrowly to the relevant compartment and its descendants. These two practices together deliver predictable inheritance, least privilege, and manageable auditing as the tenancy scales.

Answer

Reuse a single compartment for all departments and differentiate access using resource tags alone

Answer

Create the department compartment directly under the tenancy root and attach manage all-resources policies for convenience

Answer

Attach all IAM policies directly to the tenancy root so that every new compartment automatically inherits the same broad permissions

Question 4

A company is deploying a multi-tier application on OCI. The web tier runs on compute instances in a public subnet, and the database tier runs on compute instances in a private subnet. The security team requires that database instances be accessible only from the web tier on port 1521, and that the database instances have no direct internet access. Which TWO OCI features should be configured to meet these requirements? (Choose two.)

Accepted Answer

A security list or network security group (NSG) that allows inbound TCP traffic on port 1521 only from the web tier's subnet or NSG.. To allow database access only from the web tier on port 1521, you need a security list or NSG rule that permits inbound TCP 1521 from the web tier's subnet or NSG. To ensure the database instances have no direct internet access, the private subnet's route table must not have a route to an internet gateway or NAT gateway. Together, these two configurations enforce network segmentation and least-privilege access.

Answer

A route table for the private subnet with a route to a NAT gateway for outbound internet access.

Answer

A service gateway for the private subnet to allow access to OCI Object Storage.

Answer

An internet gateway attached to the private subnet's route table.

Question 5

A DevOps engineer needs to store application configuration files and secrets for a containerized application running on OCI. The secrets must be retrievable by the application at runtime without hardcoding them in the container image. The solution must support versioning and auditing of secret access. Which OCI service should the engineer use?

Accepted Answer

OCI Vault secret management.. OCI Vault's secret management feature is purpose-built for storing and managing sensitive information like secrets and configuration files. It supports secret versioning, allowing rotation without downtime, and integrates with OCI Audit to log every access. Applications can retrieve secrets securely at runtime using IAM policies that grant least privilege. This eliminates hardcoding secrets in container images and provides the required auditing and versioning.

Answer

OCI Block Volume with encryption using customer-managed keys.

Answer

OCI Object Storage with pre-authenticated requests.

Answer

OCI Config Management with Git repositories.

Question 6

An administrator must ensure that members of a development group can create and delete compute instances in the 'Dev' compartment but must not be able to change the security rules of the VCN that those instances use. The group already has no policies. Which combination of policy statements achieves this?

Accepted Answer

Allow group Developers to manage instances in compartment Dev, and Allow group Developers to read virtual-network-family in compartment Dev. The correct design pairs manage on instances, which covers create and delete, with read on virtual-network-family, which allows inspection without modification. This separation of verbs by resource family enforces least privilege: developers get the compute lifecycle they need while security rules remain under the network team's control.

Answer

Allow group Developers to manage instances in compartment Dev, and Allow group Developers to manage virtual-network-family in compartment Dev

Answer

Allow group Developers to use instances in compartment Dev, and Allow group Developers to read virtual-network-family in compartment Dev

Answer

Allow group Developers to manage all-resources in compartment Dev

Question 7

A security administrator is configuring a bastion host in OCI to provide secure SSH access to private compute instances. The administrator wants to use OCI Bastion service to minimize exposure. Which statement accurately describes the OCI Bastion service?

Accepted Answer

It supports SSH and RDP sessions, and sessions are created with a specified time-to-live (TTL) after which they are automatically terminated.. OCI Bastion service is a managed, serverless service that provides secure SSH and RDP access to private instances without public IPs. Sessions have a configurable TTL and are automatically terminated. It does not require deploying a bastion host, and it can be used across compartments with proper policies. This makes it an ideal solution for secure administrative access.

Answer

It requires a public IP address on the target private instances to establish the session.

Answer

It is a managed service that requires deploying a bastion host compute instance in a public subnet.

Answer

It can only be used to access resources within the same compartment as the bastion.

Question 8

A system administrator needs to grant a new employee access to manage compute instances in a specific compartment. The employee should not have access to any other resources. Which OCI IAM policy statement should the administrator use?

Accepted Answer

Allow group ComputeAdmins to manage instances in compartment Production. The policy that grants manage rights on instances within the Production compartment is correct because it provides the necessary permissions while scoping access to only that compartment. The other options either grant excessive permissions across the tenancy or insufficient read-only access. This follows the principle of least privilege.

Answer

Allow group ComputeAdmins to read instances in compartment Production

Answer

Allow group ComputeAdmins to manage instances in tenancy

Answer

Allow group ComputeAdmins to manage all-resources in tenancy

Question 9

A developer is building an application on a Compute instance that must read objects from an Object Storage bucket. The security policy forbids storing API keys or auth tokens on the instance. The instance runs in a compartment called app-prod, and the bucket lives in a different compartment called data-prod. Which approach allows the instance to access the bucket without embedding credentials?

Accepted Answer

Create a dynamic group with a matching rule for the instance, and write a policy allowing that dynamic group to read objects in the data-prod compartment. Instance principals let a Compute instance authenticate to OCI APIs using certificates delivered through the instance metadata service, with no secret stored by the developer. A dynamic group with a matching rule identifies the instance as a principal, and a policy grants that dynamic group read access to objects in the target compartment. This satisfies least privilege and the prohibition on embedded credentials.

Answer

Add the instance to a group in the default identity domain and grant that group read access to the bucket

Answer

Generate a customer secret key for a service user and store it in the instance metadata as a custom tag

Answer

Create an auth token for a local user and reference it from an environment variable set in the instance startup script

Question 10

A company wants to centrally manage and audit access to their OCI tenancy. They need to ensure that all user actions are logged and that they can detect suspicious activities. Which OCI service should they use?

Accepted Answer

Audit. The Audit service is the correct choice because it automatically logs all API calls and user actions in the tenancy, providing a centralized audit trail. Cloud Guard, Logging, and IAM serve different purposes: Cloud Guard detects security issues, Logging aggregates logs, and IAM manages access. Only Audit provides the comprehensive record needed for auditing and detecting suspicious activities.

Answer

Identity and Access Management (IAM)

Answer

Logging

Answer

Cloud Guard

Question 11

A solutions architect is designing a VCN with public and private subnets. Instances in the private subnet need to download security patches from the internet but must not be directly accessible from the internet. Which configuration should the architect implement?

Accepted Answer

Attach a NAT Gateway to the VCN and configure a route in the private subnet's route table to the NAT Gateway.. A NAT Gateway enables instances in a private subnet to initiate outbound internet connections while blocking inbound traffic, which is exactly what is needed for patch downloads without direct accessibility. Internet Gateway would expose instances, while Service Gateway and Dynamic Routing Gateway serve other connectivity purposes.

Answer

Attach an Internet Gateway to the VCN and configure a route in the private subnet's route table to the Internet Gateway.

Answer

Attach a Dynamic Routing Gateway to the VCN and configure a route in the private subnet's route table to the Dynamic Routing Gateway.

Answer

Attach a Service Gateway to the VCN and configure a route in the private subnet's route table to the Service Gateway.

Question 12

A database administrator needs to deploy a highly available Oracle Database on OCI. The database must automatically fail over to a standby database in another Availability Domain within the same region in case of a primary failure, with minimal data loss. Which OCI service should be used?

Accepted Answer

Oracle Data Guard with a standby in another Availability Domain within the same region. Oracle Data Guard is the Oracle-recommended solution for high availability and disaster recovery. Configuring a standby database in a different Availability Domain within the same region enables automatic failover with minimal data loss, meeting the requirement for intra-region resilience. It supports both synchronous and asynchronous replication modes to balance performance and data protection.

Answer

Oracle Data Guard with a remote standby in another region

Answer

Oracle Real Application Clusters (RAC) on a single Availability Domain

Answer

Oracle Autonomous Database with auto-scaling enabled

Question 13

A company is deploying a web application on OCI and needs to distribute incoming traffic across multiple compute instances for high availability. Which OCI service should they use?

Accepted Answer

Load Balancer. The OCI Load Balancer is designed to distribute incoming traffic across multiple compute instances, providing high availability and fault tolerance. It supports health checks and can scale automatically. Other services like Internet Gateway, NAT Gateway, and DRG serve different networking purposes and cannot perform load balancing.

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Question 14

A company is setting up their OCI tenancy and needs to understand the shared security model. Which TWO responsibilities fall under Oracle's scope in the shared security model? (Choose two.)

Accepted Answer

Managing the physical security of data centers. In the OCI shared security model, Oracle is responsible for security 'of' the cloud, which includes physical data center security and the hypervisor infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security lists, patching guest OS, and encrypting data. This division ensures both parties contribute to overall security.

Answer

Encrypting data at rest in Object Storage

Answer

Configuring security lists and network security groups

Answer

Patching the guest operating system on compute instances

Question 15

A cloud administrator is configuring a new tenancy and wants each business unit to have its own isolated set of users and groups while still being centrally billed and governed. The administrator also wants to give a specific group permission to manage only the networking resources inside one of those units. Which OCI IAM construct should be used to create that isolated container of users and groups?

Accepted Answer

Identity domains. Identity domains provide the isolated user and group namespace inside a tenancy, which is what allows separate business units to have their own identities while sharing tenancy-level billing and governance. Policies authored at the tenancy level can then reference groups from a specific domain and scope their permissions to chosen compartments or resources, satisfying both isolation and least privilege.

Answer

Dynamic groups

Answer

Federation with an external identity provider

Answer

Compartments