1Z0-1085-26 Core Oci Services Practice Test 12 — 15 Questions

Question 1

An administrator is managing an Oracle Container Engine for Kubernetes (OKE) cluster. They want to ensure that worker nodes are distributed across multiple failure domains or Availability Domains to prevent downtime if a single hardware rack fails. How should this be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the node pool to span multiple subnets across different Availability Domains or Fault Domains.. When creating a node pool in OKE, administrators can specify multiple subnets across different Availability Domains or Fault Domains to ensure high availability.

Answer

Use pre-emptible compute shapes for all worker nodes without subnets.

Answer

Deploy all worker nodes in a single subnet within one Fault Domain.

Answer

Attach a Local Peering Gateway to each Kubernetes worker node.

Question 2

An administrator is troubleshooting a VCN where instances in a private subnet cannot reach the public internet via a NAT Gateway. The NAT Gateway is attached to the VCN, and the security list allows all outbound traffic. What is the most likely cause of the failure?

Accepted Answer

The subnet route table lacks a route rule with destination 0.0.0.0/0 pointing to the NAT Gateway.. Even with a NAT Gateway attached and security lists open, the private subnet's route table must have a route rule with destination 0.0.0.0/0 pointing to the NAT Gateway.

Answer

The NAT Gateway requires an incoming security list rule from 0.0.0.0/0.

Answer

The local OS firewall on the NAT Gateway is blocking packets.

Answer

The VCN lacks an Internet Gateway attached to the public subnets.

Question 3

An architect wants to distribute incoming client traffic evenly across a pool of backend OCI Compute web servers while terminating SSL/TLS connections at the load balancer layer. Which OCI service should be used?

Accepted Answer

OCI Load Balancer. OCI Load Balancer distributes incoming traffic across backend servers and supports SSL termination.

Answer

OCI Service Gateway

Answer

OCI Dynamic Routing Gateway

Answer

OCI Network Load Balancer

Question 4

Which TWO of the following are valid OCI Object Storage storage tiers? (Choose two.)

Accepted Answer

Archive Storage Tier. Option B (Archive Storage Tier) is correct because OCI Object Storage offers an Archive tier designed for long-term retention of rarely accessed data, with the lowest storage cost and a restore/retrieval latency measured in hours. Option C (Standard Tier) is correct because the Standard tier is OCI Object Storage's default hot tier for frequently accessed data, providing immediate, millisecond-latency access with high durability. The other options are not OCI Object Storage tiers: Ephemeral SSD (A) and High-Performance Flash (D) are not Object Storage classes, and Magnetic Tape (E) is a physical archival medium, not an OCI Object Storage tier.

Answer

Ephemeral SSD Tier

Answer

High-Performance Flash Tier

Answer

Magnetic Tape Tier

Question 5

An organization has strict compliance requirements to ensure that all data stored in OCI Object Storage buckets is encrypted using a custom encryption key managed entirely by the customer, rather than Oracle-managed keys. How can this be achieved?

Accepted Answer

Use OCI Vault to create and manage Customer-Managed Keys (CMK) for encrypting the Object Storage bucket.. OCI Vault is the dedicated key management service that lets customers create, rotate, and manage Customer-Managed Keys (CMKs) in HSMs, and Object Storage buckets can be configured to use a Vault CMK instead of the default Oracle-managed encryption key. This satisfies compliance requirements because the customer retains full control over the key lifecycle, including the ability to revoke access by disabling or deleting the key. Selecting a Vault key at bucket creation (or via the encryption tab afterward) is the supported, native mechanism.

Answer

Enable bucket versioning and assign an IAM administrator password.

Answer

Attach an Internet Gateway configured with SSL certificates.

Answer

Encrypt the data manually using local scripts before uploading to Object Storage.

Question 6

Which THREE of the following statements are true regarding OCI Block Volume backups and performance? (Choose three.)

Accepted Answer

Block volume performance can be scaled independently of storage capacity by adjusting Volume Performance Units (VPUs).. Option A is correct because OCI Block Volume performance is governed by Volume Performance Units (VPUs), which let you raise or lower IOPS/throughput independently of the volume's size in GB, so performance and capacity scale separately. Option D is correct because OCI Block Volume backups can be copied from one region to another, enabling cross-region backup retention and disaster-recovery strategies. Option E is correct because OCI supports online resizing of a block volume, meaning you can increase its size while it remains attached to the compute instance without detaching or rebooting. Option B is not correct because a block volume attaches to a single instance within one availability domain at a time, not to one instance across multiple regions simultaneously. Option C is not correct because OCI Block Volume backups support incremental backups, with the first backup being full and subsequent backups capturing only changes.

Answer

Block volumes can only be attached to a single compute instance across multiple regions simultaneously.

Answer

Block volume backups are always full backups and incremental backups are not supported.

Question 7

Which THREE of the following features are supported by OCI Network Load Balancer (NLB)? (Choose three.)

Accepted Answer

Layer 4 (TCP, UDP, ICMP) traffic distribution. Option A is correct because OCI Network Load Balancer operates at Layer 4 of the OSI model, distributing TCP, UDP, and ICMP traffic based on connection-level information rather than inspecting application payloads. Option B is correct because the NLB is designed for extreme throughput, handling millions of requests per second, and it provides a static VIP that does not change as the service scales, which is essential for high-volume, latency-sensitive workloads. Option D is correct because the NLB preserves the original client source IP address when forwarding traffic to backend servers, allowing backends to see and log the true client address for security and auditing purposes. Option C is not correct because SSL/TLS termination and certificate management are features of the OCI Load Balancer (Layer 7), not the Network Load Balancer, which passes encrypted traffic through without terminating it. Option E is not correct because URL path-based routing requires Layer 7 inspection of HTTP/HTTPS requests, which is a capability of the OCI Load Balancer rather than the Layer 4 Network Load Balancer.

Answer

SSL/TLS termination and certificate management

Answer

URL path-based routing for HTTP/HTTPS requests

Question 8

Which TWO of the following gateways can be attached to an OCI Virtual Cloud Network (VCN)? (Choose two.)

Accepted Answer

Internet Gateway. The Internet Gateway (A) is a valid OCI VCN gateway that provides bidirectional internet connectivity for resources in a public subnet, enabling inbound and outbound traffic to and from the internet. The Dynamic Routing Gateway (E) is also a valid VCN attachment that provides a path for private traffic between the VCN and external networks such as on-premises networks via FastConnect or IPSec VPN, and between VCNs via peering (local and remote). The other options are not real OCI gateway types: there is no Compute Scaling Gateway (B), no Object Routing Gateway (C), and no Local Storage Gateway (D) in OCI VCN networking; OCI offers Internet Gateway, NAT Gateway, Service Gateway, Local Peering Gateway, Dynamic Routing Gateway, and (in some contexts) Remote Peering Connection.

Answer

Compute Scaling Gateway

Answer

Object Routing Gateway

Answer

Local Storage Gateway

Question 9

Which THREE of the following actions can be performed using OCI File Storage Service (FSS)? (Choose three.)

Accepted Answer

Encrypt file system data using Oracle-managed or customer-managed encryption keys in OCI Vault.. Option A is correct because OCI File Storage Service encrypts all file system data at rest by default with Oracle-managed keys and also supports customer-managed keys stored in OCI Vault, which can be selected when creating or updating a file system. Option C is correct because FSS supports point-in-time snapshots of a file system, which can be used for backup, recovery, and cloning file systems. Option D is correct because FSS exposes file systems over the NFS v3 protocol and is designed for concurrent access from many compute instances, scaling to thousands of clients. Option B is not correct because attaching a file system as a block device via iSCSI is characteristic of OCI Block Volume, not File Storage Service, which is a shared NFS file system. Option E is not correct because FSS file systems grow and shrink automatically as data is added or removed, and they are not resized manually or in fixed 32 TB increments.

Answer

Attach the file system to compute instances as a block device using iSCSI commands.

Answer

Resize the file system storage capacity manually or configure it to require fixed 32 TB increments.

Question 10

Which TWO of the following statements about OCI FastConnect are correct? (Choose two.)

Accepted Answer

FastConnect supports multiple connectivity models, including FastConnect via Provider and FastConnect Colocation.. Option A is correct because OCI FastConnect offers multiple connectivity models, including FastConnect via a third-party Provider (where the provider handles the cross-connect) and FastConnect Colocation (where the customer's equipment connects directly to Oracle at a colocation facility). Option D is correct because FastConnect is a dedicated, private physical connection between an on-premises datacenter and OCI, bypassing the public internet entirely. Option B is incorrect because FastConnect does not route traffic over the public internet; IPsec VPN over the internet is a separate OCI connectivity option. Option C is incorrect because FastConnect supports far higher bandwidths (e.g., 1 Gbps, 10 Gbps, and up to 100 Gbps per connection), not a 10 Mbps global cap. Option E is incorrect because FastConnect is attached to a VCN via a Dynamic Routing Gateway (DRG), not an Internet Gateway.

Answer

FastConnect routes all traffic over the public internet using encrypted IPsec tunnels.

Answer

FastConnect has a maximum bandwidth limit of 10 Mbps globally.

Answer

FastConnect is configured exclusively by attaching an Internet Gateway to the VCN.

Question 11

Which THREE of the following are characteristics of OCI Container Instances? (Choose three.)

Accepted Answer

They support attaching OCI File Storage as volume mounts to containers.. Option A is correct because OCI Container Instances natively support attaching OCI File Storage file systems as volume mounts, letting containers persist and share data without managing block volumes or host paths. Option B is correct because Container Instances use a container-instance shape where you explicitly set the number of OCPUs and the amount of memory (in GB) for the container group, giving precise resource allocation. Option D is correct because Container Instances are a serverless compute service that runs containers immediately without requiring you to provision, patch, or manage VMs or a Kubernetes control plane. Option C is wrong because Container Instances are fully managed and abstract away Kubernetes entirely; there are no control plane nodes to install or configure. Option E is wrong because Container Instances target simple, typically short-lived or single-group workloads, not large-scale stateful multi-node orchestration across dozens of worker nodes, which is the domain of OKE.

Answer

They require the manual installation and configuration of Kubernetes control plane nodes.

Answer

They are designed for long-running stateful multi-node container orchestration across 50 worker nodes.

Question 12

Which TWO of the following networking components are required to configure a working site-to-site IPsec VPN connection to an OCI VCN? (Choose two.)

Accepted Answer

Customer Premises Equipment (CPE) object. Option B, the Customer Premises Equipment (CPE) object, is correct because OCI requires a CPE object to represent the on-premises VPN endpoint (its public IP address) before you can create the IPSec connection. Option E, the Dynamic Routing Gateway (DRG), is correct because the DRG is the OCI-side VPN endpoint that must be attached to the VCN and paired with the CPE via an IPSec connection to establish the site-to-site tunnel. Option A is wrong because an Internet Gateway is for general internet access from a subnet, not for terminating the VPN tunnel, and it need not be attached to the database subnet. Option C is wrong because a Local Peering Gateway connects two VCNs within the same region, which is unrelated to connecting to on-premises equipment. Option D is wrong because a NAT Gateway provides outbound internet access for private subnets and is not used for IP translation of VPN packets.

Answer

Internet Gateway attached to the database subnet

Answer

Local Peering Gateway peered with another VCN

Answer

NAT Gateway for IP translation of VPN packets

Question 13

Which THREE of the following statements regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs) are correct? (Choose three.)

Accepted Answer

Security Lists apply to all VNICs in a specific subnet, whereas NSGs apply to a specific set of VNICs chosen by the user.. Option A is correct because Security Lists are subnet-scoped: every VNIC in a subnet inherits the Security List rules attached to that subnet, while NSGs are VNIC-scoped and apply only to the specific VNICs the user adds to the NSG. Option C is correct because both Security Lists and NSGs let you define rules as either stateful (connection tracking is automatic) or stateless (you must write rules for both directions of traffic). Option D is correct because a VNIC can be a member of multiple NSGs simultaneously (up to the service limit), and the union of all their rules is evaluated for that VNIC. Option B is wrong because Security Lists are stateful by default in OCI, not stateless, so no manual stateful tracking configuration is needed. Option E is wrong because NSG rules can reference other NSGs (or CIDR blocks) as the source/destination, which is one of the main advantages of NSGs over Security Lists.

Answer

Security Lists are stateless by default and require manual configuration for stateful tracking.

Answer

Network Security Groups require rules to reference subnet CIDR blocks rather than other NSGs.

Question 14

Which TWO of the following features are provided by OCI DNS? (Choose two.)

Accepted Answer

Public DNS zones for managing globally resolvable internet domains. Option A is correct because OCI DNS provides public DNS zones that host authoritative records for globally resolvable internet domains, allowing you to manage A, AAAA, CNAME, MX, and other record types for public name resolution. Option C is correct because OCI DNS also supports private DNS zones that are resolvable only within specified VCNs, enabling internal hostname resolution for instances and services without exposing those names to the internet. Option B is not a DNS feature; SSL/TLS certificate provisioning is handled by OCI Certificates or a load balancer's certificate management, not by the DNS service. Option D is incorrect because DDoS mitigation is provided by OCI's edge/network security services, not by DNS, and it is not tied to the absence of DNS zones. Option E is incorrect because layer 4 TCP load balancing is a function of the OCI Load Balancer service, not OCI DNS.

Answer

Automatic SSL certificate provisioning for backend web servers

Answer

Automated DDoS mitigation for compute instances without DNS zones

Answer

Direct layer 4 TCP packet load balancing

Question 15

Which TWO of the following are valid methods for deploying applications on OCI without managing underlying operating systems or virtual machine hypervisors? (Choose two.)

Accepted Answer

OCI Functions. OCI Functions and OCI Container Instances are serverless compute options that eliminate OS and hypervisor management.

Answer

DenseIO Compute Instances

Answer

Bare Metal Compute Instances

Answer

Standard Virtual Machine Compute Instances