1Z0-1085-26 Practice Test 2 — 30 Questions

Question 1

An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No IAM policy has been created that grants permissions to the dynamic group.. For a dynamic group to receive permissions, an IAM policy must be written granting access to that specific dynamic group name (e.g., 'Allow dynamic-group <group-name> to...').

Answer

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Answer

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Answer

Dynamic groups cannot be used in IAM policies; only user groups can.

Question 2

A security administrator needs to ensure that users configure Multi-Factor Authentication (MFA) for their OCI accounts to enhance login security. Where is MFA managed in OCI?

Accepted Answer

Identity Domains. MFA and user authentication policies are managed within Identity Domains in OCI.

Answer

OCI Vault

Answer

Compartment Quotas

Answer

IAM Policies

Question 3

Your development team needs to test an application's resilience against infrastructure hardware failures within a specific OCI region that contains only a single Availability Domain. Which OCI feature should you utilize to distribute your compute instances for fault tolerance?

Accepted Answer

Fault Domains. In regions with a single Availability Domain, Fault Domains provide the necessary high availability by logically isolating instances onto separate underlying hardware.

Answer

Dynamic Routing Gateways

Answer

Cross-Region Replication

Answer

Secondary Regions

Question 4

Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)

Accepted Answer

Defined tags require a Tag Namespace to be created first.. Defined tags require tag namespaces, support tag defaults, and can be evaluated in IAM policies for TBAC.

Answer

Defined tags replace IAM policies entirely for access control.

Answer

Defined tags can only be created as free-form strings without any governance.

Question 5

An organization must comply with strict data sovereignty laws requiring that their cloud environment remain physically isolated from the public internet and operated independently, yet still receive continuous updates and feature parity with OCI public cloud. Which deployment model satisfies this requirement?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region provides a fully isolated region within the customer's data center, managed by Oracle, with identical APIs and services to the public cloud.

Answer

OCI Hybrid Cloud via VPN Connect.

Answer

OCI FastConnect with a dedicated private circuit.

Answer

OCI Public Cloud with a dedicated Virtual Cloud Network (VCN).

Question 6

Which THREE components or services are part of the OCI distributed cloud strategy, providing flexibility in where and how cloud services are consumed?

Accepted Answer

OCI Cloud@Customer. The OCI distributed cloud model includes Public Cloud, Dedicated Region, and Cloud@Customer as core offerings to meet various business needs.

Answer

OCI Resource Manager

Answer

OCI Data Catalog

Question 7

An architect is evaluating OCI's distributed cloud offerings. A client in the healthcare sector requires an on-premises deployment that includes the complete portfolio of OCI cloud services, autonomous database capabilities, and exact API parity with the public cloud, all managed locally. Which OCI solution should be proposed?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region brings the complete set of OCI public cloud services into the customer's data center.

Answer

Oracle Autonomous Database on Dedicated Exadata Infrastructure in the Public Cloud

Answer

OCI Exadata Cloud@Customer

Answer

OCI Compute Cloud@Customer

Question 8

An enterprise customer wants to leverage OCI Compute Cloud@Customer to run containerized microservices on-premises while integrating seamlessly with OCI public cloud management tools. How does Compute Cloud@Customer achieve this integration?

Accepted Answer

By running an autonomous Kubernetes control plane locally that synchronizes with public cloud APIs via a secure management connection.. Compute Cloud@Customer connects back to the OCI control plane over secure, dedicated network connections to maintain consistent management APIs.

Answer

By replicating all public cloud control plane services locally onto every customer node.

Answer

By requiring manual exports of cloud templates and uploading them via Secure Shell (SSH) daily.

Answer

By converting the on-premises rack into a public OCI Region accessible via the public internet.

Question 9

An enterprise customer evaluating OCI's distributed cloud model wants to understand the advantages of OCI Dedicated Region compared to traditional public cloud. Which THREE benefits are provided by OCI Dedicated Region? (Choose three.)

Accepted Answer

Complete control and data residency within the customer's own data center facility.. Dedicated Region provides local data residency, full API/service parity with public cloud, and local control.

Answer

Elimination of all software licensing costs for third-party operating systems.

Answer

Requiring the customer's internal IT staff to manually patch the underlying hypervisors and control plane.

Question 10

Which OCI service allows you to define and run infrastructure as code (IaC) using Terraform configurations natively managed inside your tenancy?

Accepted Answer

OCI Resource Manager. OCI Resource Manager is a fully managed service that uses Terraform to provision and govern OCI resources.

Answer

OCI Audit

Answer

OCI Identity Domains

Answer

OCI Cloud Guard

Question 11

You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?

Accepted Answer

Near-real-time (typically within a few minutes). Dynamic group membership evaluations happen dynamically and near-real-time as instances change states or compartments.

Answer

Only when the instance is stopped and restarted.

Answer

Dynamic group membership is static and never updates after initial creation.

Answer

Exactly every 24 hours during the daily IAM sync cycle.

Question 12

An application administrator is configuring a high-availability database cluster across three Fault Domains in a single Availability Domain. During a scheduled infrastructure maintenance event affecting Fault Domain 1, the administrator notices that one of the database nodes becomes unreachable. What is the expected behavior of OCI Fault Domains in this scenario?

Accepted Answer

Only instances in Fault Domain 1 are impacted by the maintenance, while instances in Fault Domains 2 and 3 continue to run normally without disruption.. Fault domains are isolated hardware and power groupings. Maintenance events or hardware failures impact only the specific Fault Domain being maintained, leaving other Fault Domains unaffected.

Answer

The database cluster automatically fails over its primary role to an instance in a different Availability Domain.

Answer

The entire Availability Domain is taken offline to synchronize the maintenance state across all Fault Domains.

Answer

Instances in Fault Domain 1 are automatically migrated to Fault Domain 2, causing a brief network partition.

Question 13

You are deploying a distributed database cluster that requires three nodes to be isolated from one another regarding underlying infrastructure failures. The chosen OCI region has only one Availability Domain. How should you provision the database instances?

Accepted Answer

Deploy each node in a separate Fault Domain (FD-1, FD-2, and FD-3) within the single Availability Domain.. When an OCI region has only one Availability Domain, you achieve high availability by placing instances across three distinct Fault Domains within that AD.

Answer

Deploy the nodes in the same Fault Domain and configure OCI Compute Auto-Scaling.

Answer

Deploy the nodes across three different OCI regions using asynchronous database links.

Answer

Deploy all three nodes in the same Fault Domain to maximize internal rack-level network performance.

Question 14

An architect is planning a multi-region disaster recovery deployment in OCI. Which THREE design considerations are essential for ensuring successful data synchronization and failover? (Choose three.)

Accepted Answer

Selecting secondary regions that offer the necessary service availability and capacity to run the production workload.. DR planning requires considering replication RPO, inter-region latency limits, and failover automation.

Answer

Routing all database replication logs through the public internet for maximum transparency.

Answer

Assuming that all OCI regions have identical network latency to all global internet service providers.

Question 15

An enterprise customer is reviewing their high availability architecture in OCI. They want to ensure their database and application tiers are protected against both localized hardware failures and major facility disruptions. Which THREE architectural practices should they follow? (Choose three.)

Accepted Answer

Distribute database nodes across distinct Fault Domains within an Availability Domain to protect against rack-level failures.. High availability across hardware and facility levels requires multi-AD deployment, multi-FD placement, and regular failover testing.

Answer

Rely solely on manual administrator intervention for all failover scenarios without automated health checks.

Answer

Consolidate all application and database nodes onto a single physical server in Availability Domain 1.

Question 16

Which TWO configuration steps are necessary when setting up private access from a VCN to OCI Object Storage using a Service Gateway? (Choose two.)

Accepted Answer

Add a route table rule with the service destination pointing to the Service Gateway.. Setting up a Service Gateway requires creating the Service Gateway resource itself and adding a route table rule pointing traffic destined for the Object Storage service destination to the Service Gateway.

Answer

Assign a public IP address to every compute instance in the private subnet.

Answer

Attach an Internet Gateway to the VCN to route service traffic.

Answer

Configure a NAT Gateway as a next-hop in the subnet route table.

Question 17

Which OCI compute feature allows you to run virtual machines on dedicated physical servers allocated exclusively to your organization?

Accepted Answer

Dedicated Virtual Machine Hosts. Dedicated Virtual Machine Hosts provide physical servers dedicated solely to your tenancy for compliance and isolation requirements.

Answer

OCI Container Instances

Answer

Preemptible Instances

Answer

Standard Flexible VM Shapes

Question 18

Which TWO OCI compute shapes are available when provisioning virtual machines in OCI? (Choose two.)

Accepted Answer

Standard Shapes. OCI offers both Standard virtual machine shapes and Flexible virtual machine shapes where OCPUs and memory can be customized.

Answer

Object Storage Shapes

Answer

Database Shapes

Answer

Network Shapes

Question 19

You are designing an architecture requiring a resilient, fault-tolerant entry point that distributes incoming HTTP/HTTPS traffic across multiple backend compute instances across different availability domains. Which load balancing service should you deploy?

Accepted Answer

Public Load Balancer. A Public Load Balancer provides automated traffic distribution across multiple backend servers and availability domains with a public IP address.

Answer

Local Peering Gateway

Answer

Network Load Balancer

Answer

Dynamic Routing Gateway

Question 20

Which THREE OCI networking components are required to connect an on-premises data center to a VCN via an IPsec VPN? (Choose three.)

Accepted Answer

IPsec Connection. Site-to-Site VPN requires a Dynamic Routing Gateway (DRG), a Customer Premise Equipment (CPE) object, and an IPsec connection.

Answer

Internet Gateway

Answer

Local Peering Gateway