1Z0-1085-26 Core Oci Services Practice Test 11 — 15 Questions

Question 1

A web application deployed across multiple compute instances experiences fluctuating traffic loads throughout the day. The infrastructure needs to automatically add or remove compute instances based on CPU utilization metrics. Which OCI service combination provides this capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Instance Pools combined with Compute Autoscaling. Compute Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics such as CPU utilization.

Answer

Container Instances combined with Object Storage lifecycle rules

Answer

Virtual Cloud Network with Dynamic Routing Gateway autoscaling

Answer

Load Balancer combined with Block Volume backups

Question 2

An administrator wants to run Docker containers in OCI quickly without managing Kubernetes clusters, node pools, or servers. Which OCI service is most appropriate?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that lets you run containers directly without provisioning or managing servers, clusters, or node pools. It is designed for quick, simple container execution, making it the most appropriate choice when the goal is to avoid Kubernetes complexity. It provides a fast path to running Docker containers in OCI.

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

Compute Instances running Docker manually

Answer

OCI Functions

Question 3

An enterprise has two VCNs in the same OCI region. VCN-A needs to communicate with VCN-B. The VCN CIDR blocks do not overlap. The administrator configures a Local Peering Gateway (LPG) on VCN-A and another on VCN-B, and establishes the peer connection. However, instances in VCN-A still cannot reach instances in VCN-B. What additional step is required?

Accepted Answer

Add route rules in the respective subnet route tables pointing the peer VCN's CIDR block to the LPG target.. After establishing an LPG peer between two VCNs, each VCN's subnet route tables must have a route rule pointing the peer VCN's CIDR to the local LPG OCID as the target. Without these route rules, traffic has no path even though the peering relationship exists. This is the missing step that explains why instances still cannot communicate.

Answer

Modify the default Security List to allow inbound traffic from the same VCN CIDR.

Answer

Attach an Internet Gateway to both VCNs to route traffic between them.

Answer

Create a Dynamic Routing Gateway (DRG) and attach both VCNs to it.

Question 4

A security administrator wants to implement stateful packet filtering at the individual instance level within a VCN subnet, allowing different rules to apply to different groups of instances in the same subnet. Which OCI feature should be used?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) in OCI are stateful, instance-level virtual firewalls that let you apply different rule sets to different groups of instances even within the same subnet. You attach an NSG to specific VNICs, and rules reference the NSG rather than CIDR blocks, enabling granular per-instance filtering. Security Lists, by contrast, apply at the subnet level and affect every instance in the subnet uniformly.

Answer

Dynamic Routing Gateway firewall rules

Answer

Security Lists

Answer

Internet Gateway security policies

Question 5

An administrator needs to create a point-in-time, read-only copy of a Block Volume data disk for backup and disaster recovery purposes. What OCI feature should be created?

Accepted Answer

Block Volume Backup. Block Volume backups are point-in-time snapshots of a block volume that can be used to restore data or create new volumes.

Answer

File Storage clone

Answer

Compute instance custom image

Answer

Object Storage archive snapshot

Question 6

An administrator is configuring a site-to-site VPN connection between an on-premises data center and an OCI VCN. During testing, packets are being dropped because the on-premises firewall expects a specific encryption algorithm and IPsec tunnel parameters that do not match OCI defaults. How can this be resolved?

Accepted Answer

Create a custom IPsec connection specifying the exact Phase 1 and Phase 2 parameters required by the on-premises firewall.. OCI's site-to-site VPN uses IPsec, and when the on-premises firewall requires specific Phase 1 (IKE) and Phase 2 (ESP) parameters that differ from OCI defaults, you must create a custom IPsec connection in which you explicitly specify the matching encryption, authentication, DH group, and lifetime values. This aligns both ends of the tunnel so packets are no longer dropped due to parameter mismatch.

Answer

Modify the default VCN Security List to allow IPsec encapsulation protocols.

Answer

Replace the Dynamic Routing Gateway with a NAT Gateway to bypass IPsec encryption.

Answer

Install an OCI Compute instance running a software VPN appliance to override OCI IPSec defaults.

Question 7

An OCI tenant requires a dedicated, high-speed, private network connection from their on-premises data center to OCI that bypasses the public internet entirely. Which OCI service should be provisioned?

Accepted Answer

FastConnect. OCI FastConnect provides dedicated, private, high-bandwidth connections between an on-premises network and OCI.

Answer

Service Gateway

Answer

IPsec VPN

Answer

Internet Gateway

Question 8

A developer has deployed a Node.js web application on an OCI Compute instance, but external users cannot access the application on port 3000. The instance's VCN has a security list allowing TCP traffic on port 3000. What additional OS-level configuration is likely blocking the traffic?

Accepted Answer

The local OS firewall (such as firewalld or iptables) running on the compute instance.. Even when the VCN security list allows TCP port 3000, the instance's local OS firewall (firewalld, iptables, or nftables) can independently block inbound traffic. OCI security lists and NSGs operate at the VCN level, not inside the guest OS, so both layers must permit the traffic. This is the most likely OS-level cause of the connectivity failure.

Answer

The OCI Object Storage bucket policy restricting HTTP ports.

Answer

The VCN Service Gateway intercepting local port requests.

Answer

The Dynamic Routing Gateway dropping layer 4 packets.

Question 9

An administrator wants to configure automated backup policies for OCI Block Volumes attached to production databases. They need a policy that takes daily backups and retains them for 30 days, as well as weekly backups retained for 1 year. How can this be accomplished?

Accepted Answer

Create a user-defined Volume Backup Policy specifying multiple schedules with distinct retention periods.. OCI Block Volume backups support user-defined backup policies that allow combining multiple schedules (e.g., daily and weekly) with custom retention periods.

Answer

Enable Object Storage lifecycle management rules on the attached volume.

Answer

Configure a Compute Autoscaling policy with custom volume snapshot triggers.

Answer

Manually run scripts using the OCI CLI every day and week.

Question 10

A company needs to register and manage public DNS records (such as A, CNAME, and TXT records) for their domain name hosted on OCI. Which OCI service should they use?

Accepted Answer

OCI DNS (Public Zones). OCI DNS provides scalable, highly available public and private Domain Name System services.

Answer

OCI Load Balancer DNS Manager

Answer

OCI Private DNS

Answer

OCI Compute Hostname service

Question 11

An administrator wants to ensure that OCI Compute instances in an instance pool are automatically replaced if the underlying physical hardware experiences a catastrophic failure. Which OCI feature provides this capability?

Accepted Answer

Instance Pool auto-healing / health checks. Instance pools include automatic instance health monitoring that replaces unhealthy or failed instances automatically.

Answer

Manual intervention and CLI reboot scripts

Answer

Object Storage bucket replication

Answer

Block Volume differential backups

Question 12

An administrator is setting up an OCI File Storage (FSS) mount target in a specific subnet. When attempting to mount the file system from a compute instance in a different subnet within the same VCN, the mount command hangs. What must be configured to allow this connection?

Accepted Answer

Configure security rules (Security Lists or NSGs) allowing NFS traffic (ports 111, 2048, 2049, 2050) to the mount target.. Access to File Storage requires security rules allowing TCP and UDP ports 111, 2048, 2049, and 2050 for NFS traffic between the compute instance and the FSS mount target.

Answer

Add a NAT Gateway to translate NFS packets across subnets.

Answer

Attach the File Storage volume directly to the compute instance via iSCSI.

Answer

Create a Local Peering Gateway between the two subnets.

Question 13

An application running in an OCI VCN needs to access OCI Object Storage and Oracle Autonomous Database privately. Both services must be accessed without traffic leaving Oracle's network backbone and without using public IPs. Which combination of OCI gateway features accomplishes this?

Accepted Answer

Service Gateway with appropriate VCN route table rules and security policies. A Service Gateway in OCI provides private access from a VCN to supported Oracle services such as Object Storage and Autonomous Database without traversing the internet or using public IPs, keeping traffic on Oracle's backbone. Combined with appropriate route table rules and security policies, it satisfies both the private-access and no-public-IP requirements. This is exactly the combination option D describes.

Answer

Internet Gateway and NAT Gateway

Answer

Dynamic Routing Gateway paired with an external DNS resolver

Answer

Local Peering Gateway attached to the Object Storage tenancy

Question 14

A company is running multiple web servers behind an OCI Public Load Balancer. They notice that client IP addresses are appearing in web server logs as the internal private IP address of the load balancer rather than the actual client's public IP address. How can this be resolved?

Accepted Answer

Configure the web servers to read the X-Forwarded-For HTTP header inserted by the load balancer.. OCI Load Balancer adds standard HTTP headers such as 'X-Forwarded-For' to pass the original client IP address to backend web servers.

Answer

Switch the load balancer from TCP load balancing to a NAT Gateway.

Answer

Change the load balancer shape from Flexible to a fixed 100 Mbps shape.

Answer

Enable SSL client certificate forwarding in the VCN routing table.

Question 15

An administrator needs to temporarily grant read access to a specific file in an OCI Object Storage bucket to a colleague without managing IAM user credentials. What feature should be used?

Accepted Answer

Pre-authenticated Request (PAR). Pre-authenticated requests (PARs) provide a convenient way to grant secure, time-limited download or upload access to individual objects.

Answer

Bucket public access toggle

Answer

VCN Security List rule modification

Answer

IAM Group policy update