1Z0-1085-26 Core Oci Services — Timed 20 Questions

Question 1

An enterprise application requires block storage with extremely high IOPS and ultra-low latency for an Oracle Database deployment. Which OCI Block Volume performance tier should you configure?

Accepted Answer

Higher Performance. Higher Performance (formerly Ultra High Performance) offers up to 300,000 IOPS and 4rd-generation NVMe performance, specifically built for demanding databases.

Answer

Lower Cost

Answer

Basic

Answer

Balanced

Question 2

You are configuring autoscaling for an instance pool. Which two metric types are natively supported by OCI Autoscaling to trigger scale-out and scale-in events?

Accepted Answer

CPU utilization and Memory utilization. OCI Autoscaling natively supports CPU utilization and Memory utilization metrics to trigger scaling actions.

Answer

HTTP request rate and database query latency

Answer

Disk I/O throughput and Network packet drops

Answer

GPU temperature and power consumption

Question 3

Which THREE components are required to successfully configure a Site-to-Site VPN connection from an on-premises data center to an OCI VCN? (Choose three.)

Accepted Answer

Customer Premise Equipment (CPE) object. A Site-to-Site VPN requires a Customer Premise Equipment (CPE) object, a Dynamic Routing Gateway (DRG), and an IPsec connection linking them.

Answer

Local Peering Gateway

Question 4

Which TWO OCI compute shapes are available when provisioning virtual machines in OCI? (Choose two.)

Accepted Answer

Standard Shapes. Standard Shapes (C) are correct because OCI offers fixed-size VM shapes such as VM.Standard2.1, VM.Standard.E4.Flex, and VM.Standard3.Flex where CPU, memory, and network resources are pre-defined per shape. Flexible Shapes (D) are correct because OCI allows flexible VM shapes (e.g., VM.Standard.E4.Flex, VM.Standard3.Flex, VM.Optimized3.Flex) where you can independently select the number of OCPUs and amount of memory within supported ranges, providing granular sizing. Object Storage Shapes (A) are not compute shapes; Object Storage is a storage service with tiers like Standard, Infrequent Access, and Archive, not VM provisioning options. Database Shapes (B) are not a valid OCI VM shape category; databases run on compute shapes (e.g., VM.Standard or BM.DenseIO) or as autonomous services, but 'Database Shapes' is not an OCI compute shape classification. Network Shapes (E) do not exist as an OCI compute shape category; networking is configured via VCNs, subnets, and gateways, not selected as a VM shape.

Answer

Object Storage Shapes

Answer

Database Shapes

Answer

Network Shapes

Question 5

An organization has multiple business units with separate VCNs in the same OCI region. They need to peer these VCNs directly to share data privately without routing traffic through an on-premises data center. Which OCI component enables this?

Accepted Answer

Service Gateway. A Local Peering Gateway (LPG) enables you to peer two VCNs in the same region so that traffic flows privately between them.

Answer

Internet Gateway with NAT

Answer

Remote Peering Connection via DRG

Question 6

You need to perform maintenance on a physical host running your OCI compute instance. How can you ensure minimal downtime when OCI is scheduled to reboot the instance for underlying host maintenance?

Accepted Answer

Manually reboot the instance before the maintenance deadline to trigger migration to a healthy host. OCI publishes host maintenance events in advance, and rebooting the instance yourself before the deadline triggers live migration to a healthy host, which typically completes with only seconds of downtime. If you let OCI perform the maintenance reboot at the scheduled time, the instance is stopped and restarted, causing longer unplanned downtime. Proactively rebooting is the documented best practice for minimizing impact.

Answer

Change the VCN route table during maintenance windows

Answer

Attach an additional Block Volume to prevent host reboots

Answer

Convert the virtual machine into a Bare Metal server

Question 7

You are designing a secure web application architecture. You want to ensure that incoming database traffic is restricted to only web servers belonging to a specific Network Security Group, without exposing database ports to the rest of the subnet. Which feature enables this?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) allow you to specify security rules referencing other NSGs as sources or destinations for fine-grained filtering.

Answer

Dynamic Routing Gateway policies

Answer

Internet Gateway rules

Answer

Security Lists

Question 8

An organization is setting up a multi-region deployment. They need to replicate Block Volume backups automatically across regions. Where is this configuration managed?

Accepted Answer

Block Volume Backup Policies. Block volume backup policies allow you to configure automated cross-region replication settings when defining backup schedules.

Answer

Identity and Access Management (IAM) dynamic groups

Answer

Virtual Cloud Network Route Tables

Answer

OCI Object Storage Lifecycle Rules

Question 9

Which TWO OCI compute offerings allow you to run workloads without managing physical server hardware or underlying hypervisors? (Choose two.)

Accepted Answer

Bare Metal Compute Instances. OCI Container Instances and OCI Functions are serverless compute options requiring no infrastructure management.

Answer

Standard Flexible Virtual Machines

Answer

Standard Dedicated Virtual Machine Hosts

Question 10

Which TWO statements are correct regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs)? (Choose two.)

Accepted Answer

Security Lists apply to all VNICs contained within a specific subnet.. Option B is correct because a Security List is a subnet-level, stateful virtual firewall whose rules apply to every VNIC in the subnet(s) it is associated with, so all instances in that subnet inherit the same rule set. Option D is correct because an NSG is a VNIC-level construct: you add specific VNICs to the NSG, and those VNICs can reside in different subnets (even across multiple VCNs in the same region when using NSG references), giving granular, per-instance control. Option A is wrong because Security List rules can reference CIDR blocks, services, or other Security Lists only in the sense of NSG-style references—OCI Security Lists do not support referencing another Security List as a source; NSGs are the construct that supports source/destination NSG references. Option C is wrong because NSGs work in both public and private subnets; subnet type does not restrict NSG usage. Option E is wrong because Security Lists are stateful—return traffic for allowed connections is automatically permitted—so they do support stateful firewall rules.

Answer

Security Lists can reference another Security List as a rule source.

Answer

Network Security Groups can only be used in public subnets.

Answer

Security Lists do not support stateful firewall rules.

Question 11

Which THREE storage options can be attached or mounted to an OCI Compute virtual machine instance? (Choose three.)

Accepted Answer

OCI File Storage Service (via NFS). Option B (OCI File Storage Service via NFS) is correct because File Storage file systems are mounted to Compute instances over NFSv3 using a mount target, making them a supported attachable/mountable storage option. Option D (OCI Block Volume) is correct because Block Volumes are attached to an instance via iSCSI or paravirtualized attachment and then mounted as a block device. Option E (OCI Boot Volume) is correct because every instance has a boot volume attached, and additional boot volumes can be attached to an instance as block devices. Option A is not correct because Object Storage buckets are accessed via the Object Storage API/SDK/CLI or mounted through tools like s3fs/rclone, not natively mounted as a block device. Option C is not correct because Container Instance storage is local ephemeral storage tied to a container instance, not a storage option attached or mounted to a Compute VM instance.

Answer

OCI Object Storage bucket (mounted as block device)

Answer

OCI Container Instance storage

Question 12

Which THREE OCI networking components are regional constructs rather than availability domain-specific? (Choose three.)

Accepted Answer

Service Gateway. Option A, the Service Gateway, is a regional construct because it is created in a VCN and provides access to Oracle Services Network from any subnet in the region, not tied to a single availability domain. Option B, the Virtual Cloud Network (VCN), is regional by design, spanning all availability domains within a region and containing subnets that may be AD-specific or regional. Option E, the Internet Gateway, is also a regional construct attached to a VCN, enabling internet access for resources across the region regardless of AD. Option C is not fully correct because subnets can be either regional or AD-specific, so they are not exclusively regional constructs. Option D is incorrect because compute instances are launched into a specific availability domain or fault domain, making them AD-specific resources.

Answer

Subnets (can be regional or AD-specific)

Answer

Compute Instances

Question 13

Which TWO storage services in OCI provide encryption at rest by default? (Choose two.)

Accepted Answer

OCI Block Volume. OCI Block Volume (D) is correct because Oracle Cloud Infrastructure automatically encrypts all block volumes at rest by default using AES-256 encryption, with keys managed by OCI or by the customer via the Vault service, and no action is required to enable it. OCI Object Storage (E) is also correct because every object written to a bucket is encrypted at rest by default with AES-256, again using either Oracle-managed or customer-managed keys. The remaining options are not OCI storage services with default encryption: a Public Internet Cache (A) is not a storage service and provides no encryption-at-rest guarantee, an Unencrypted On-Premises NAS (B) is by definition not encrypted and is outside OCI, and Local unmanaged scratch disks (C) are ephemeral instance storage that is not encrypted at rest by default.

Answer

Public Internet Cache

Answer

Unencrypted On-Premises NAS

Answer

Local unmanaged scratch disks

Question 14

An administrator needs to configure DNS resolution so that an on-premises server connected via FastConnect can resolve private hostnames within an OCI VCN. Which OCI DNS component must be configured?

Accepted Answer

Private DNS Resolver with Listener Endpoints. To allow on-premises servers connected via FastConnect to resolve private hostnames within an OCI VCN, you must configure a Private DNS Resolver with Listener Endpoints. The listener endpoint receives DNS queries from on-premises, and the resolver forwards them to OCI's private DNS. This enables hybrid DNS resolution.

Answer

Internet Gateway DNS Forwarder

Answer

Public DNS Zone

Answer

Traffic Management Steering Policies

Question 15

An enterprise application running on OCI Compute instances requires shared block storage that can be attached in read/write mode across multiple virtual machines simultaneously. What is the recommended OCI solution?

Accepted Answer

Use OCI File Storage Service (FSS) for concurrent shared access. Standard block volumes cannot be attached read/write to multiple instances. Clustered databases or specialized clustered file systems using shared block volumes with clustered device mapping or File Storage Service are required. (File Storage Service provides standard concurrent shared file storage).

Answer

Use Object Storage mounted as a block device

Answer

Attach a single Block Volume in read/write mode to multiple instances simultaneously

Answer

Configure Local NVMe drives as a shared cluster disk

Question 16

You need to create a secure connection between two VCNs in the same region, ensuring that traffic remains private and does not traverse the public internet. Which component should you configure?

Accepted Answer

Local Peering Gateway (LPG). A Local Peering Gateway (LPG) enables private peering between two VCNs within the same region.

Answer

Dynamic Routing Gateway with IPsec VPN

Answer

Internet Gateway with NAT

Question 17

You need to deploy a batch processing job that can tolerate sudden termination by OCI if compute capacity is reclaimed, significantly reducing your compute costs. Which instance type should you choose?

Accepted Answer

Preemptible Instance. Preemptible Instances in OCI are spare compute capacity offered at a significant discount, but OCI can reclaim them with a short notice when capacity is needed elsewhere. They are explicitly designed for fault-tolerant, interruption-tolerant workloads like batch processing, rendering, or stateless jobs, which matches the scenario's requirement to tolerate sudden termination in exchange for lower cost. Choosing a preemptible instance is the correct cost-optimization strategy here.

Answer

Standard Flexible VM Shape

Answer

Dedicated Virtual Machine Host

Answer

Standard Bare Metal Shape

Question 18

An enterprise application deployed across multiple OCI subnets requires a Layer 4 load balancer that can handle millions of packets per second with ultra-low latency and preserve client source IP addresses. Which service should you deploy?

Accepted Answer

Network Load Balancer. OCI Network Load Balancer is a Layer 4 (TCP/UDP) load balancer designed for extreme throughput (millions of packets per second) and ultra-low latency, and it preserves the client source IP by default. It is the correct choice when the requirement is high-performance, connection-oriented load balancing across subnets without Layer 7 inspection.

Answer

OCI API Gateway

Answer

Dynamic Routing Gateway

Answer

Public Load Balancer (Layer 7)

Question 19

Which OCI Object Storage tier is recommended for storing data that is accessed infrequently, but requires rapid access when needed with lower retrieval costs than Archive?

Accepted Answer

Infrequent Access Storage. OCI Object Storage Infrequent Access tier is designed for data accessed less often but requiring rapid retrieval when needed, with lower storage cost than Standard and lower retrieval cost than Archive. It is ideal for backups, disaster recovery, and long-term data that must remain immediately available. Standard is for frequently accessed data, and Archive is for rarely accessed data with hours-long retrieval.

Answer

Standard Storage

Answer

Archive Storage

Answer

Boot Volume storage

Question 20

You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the ingress rule in the database NSG?

Accepted Answer

Specify the web server Network Security Group as the source. OCI Network Security Groups (NSGs) allow security rules to reference other NSGs as sources or destinations, enabling dynamic, identity-based security policies. By specifying the web server NSG as the source in the database NSG's ingress rule, only instances in that NSG can reach the database, regardless of their IP addresses. This is the recommended approach for multi-tier applications because it decouples security policy from IP addressing.

Answer

Specify the CIDR block of the entire VCN as the source

Answer

Use an Internet Gateway source identifier

Answer

Configure a Dynamic Routing Gateway rule