1Z0-1085-26 Governance And Administration — 25 Questions

Question 1

A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow group UserAdmins to manage identity-domains in tenancy. To manage identity resources like users and groups without granting infrastructure access, the domain resource type is 'tenancy' with the verb 'inspect' or 'manage' scoped to identity services.

Answer

Allow user UserAdmins to inspect compartments in tenancy

Answer

Allow group UserAdmins to manage all-resources in tenancy

Answer

Allow group UserAdmins to manage users in tenancy

Question 2

Your organization has a strict requirement that no IAM policy can be written without a specified description and that all policies must be reviewed. When creating an IAM policy in OCI, is providing a description mandatory?

Accepted Answer

Yes, providing a description is mandatory when creating an IAM policy.. In OCI IAM, a description is a mandatory field when creating a policy to help administrators document the business justification.

Answer

Descriptions are only mandatory when using the CLI, but optional in the Console.

Answer

Only if the policy is created at the tenancy root level.

Answer

No, the description is entirely optional and can be left blank.

Question 3

Which OCI feature allows you to group multiple independent policies together or organize permissions logically, although IAM policies themselves are written as statements within compartments or the tenancy?

Accepted Answer

Tags. While OCI IAM doesn't have a separate 'policy folder' construct, policies are organized by where they are attached (compartment/tenancy). Free-form and defined tags can also be applied to policies for organization.

Answer

Identity Domains

Answer

Service Gateways

Answer

Dynamic Groups

Question 4

An enterprise is auditing their OCI IAM setup and discovers that a policy statement was written with a syntax error. Which OCI mechanism validates IAM policy syntax before it is saved or applied?

Accepted Answer

The built-in OCI IAM policy validator and syntax checker in the Console/API.. The OCI IAM policy editor in the console and API provides real-time syntax checking and validation as you type policy statements.

Answer

OCI Resource Manager Terraform syntax checker.

Answer

OCI Audit log analysis.

Answer

OCI Cloud Guard policy rules.

Question 5

Which THREE of the following are valid OCI IAM policy verbs, listed in order from least permissive to most permissive? (Choose three.)

Accepted Answer

use. The OCI IAM verb hierarchy from least to most permissive is: inspect -> read -> use -> manage.

Answer

modify

Answer

administer

Question 6

Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?

Accepted Answer

Cost-tracking tags. Tags in OCI allow you to attach metadata to resources, which can then be used in Cost Analysis for tracking and allocating spend.

Answer

IAM policies

Answer

Budgets

Answer

Compartment quotas

Question 7

You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?

Accepted Answer

Use the condition 'where request.region = <home-region>'. OCI IAM policy conditions support checking contextual variables such as request.region, enabling regional scoping.

Answer

IAM policies cannot be restricted by region; they always apply globally.

Answer

Use the condition 'where target.region.home = true'

Answer

Use the condition 'where principal.region = home'

Question 8

An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?

Accepted Answer

OCI Audit. The OCI Audit service automatically records all API calls made to supported OCI services, including identity, user actions, and resource deletions.

Answer

OCI Notifications

Answer

OCI Events

Answer

OCI Monitoring

Question 9

Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?

Accepted Answer

OCI Budgets. OCI Budgets allow you orange spending limits and trigger alerts at specified percentage thresholds via email or notifications.

Answer

OCI Tag Defaults

Answer

OCI Cloud Guard

Answer

OCI Cost Analysis

Question 10

Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard scans OCI resources for security misconfigurations and risky activities, providing actionable remediation steps.

Answer

OCI Audit

Answer

OCI Logging Analytics

Answer

OCI Cost Analysis

Question 11

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?

Accepted Answer

Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment. To scope access to a specific resource type within a specific compartment, the policy must use the target resource type (autonomous-databases) and be defined at the appropriate compartment level.

Answer

Allow group DBA-Group to manage all-resources in compartment DevCompartment

Answer

Allow compartment DevCompartment to manage autonomous-databases for group DBA-Group

Answer

Allow group DBA-Group to manage autonomous-databases in tenancy

Question 12

You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?

Accepted Answer

6 levels. OCI recommends keeping compartment hierarchies shallow, typically no more than 6 levels deep, to maintain manageable IAM policies and avoid complexity.

Answer

2 levels

Answer

There is no limit or recommendation; you can nest indefinitely.

Answer

10 levels

Question 13

Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?

Accepted Answer

Compartment Quotas. Compartment quotas allow administrators to set resource limits (such as max OCPUs or counts) on specific compartments to enforce financial and capacity governance.

Answer

OCI Budgets

Answer

Service Limits

Answer

IAM Policy Statements

Question 14

You created a Defined Tag namespace called 'Department' and a key called 'CostCenter'. However, developers are forgetting to add these tags when creating compute instances. How can you ensure that every new compute instance created in a specific compartment automatically receives these tags without relying on manual user input?

Accepted Answer

Configure Tag Defaults for the compartment.. Tag defaults allow administrators to specify default values for defined tags that are automatically applied to all resources created within a compartment.

Answer

Write an IAM policy with a tag enforcement condition.

Answer

Use OCI Audit to retroactively tag unlabelled resources.

Answer

Set up a compartment quota for tagging.

Question 15

Which OCI construct serves as the root container for all your cloud resources and acts as the logical boundary for managing users, groups, and compartments?

Accepted Answer

Tenancy. The Tenancy is the root compartment and overarching container for all OCI resources.

Answer

Region

Answer

Availability Domain

Answer

Compartment

Question 16

You want to delegate the ability to create and manage sub-compartments within an existing compartment called 'AppCompartment' to a lead architect, without granting them full tenancy administration rights. How should you write this IAM policy?

Accepted Answer

Allow group ArchitectGroup to manage compartments in compartment AppCompartment. To allow managing compartments within a specific parent compartment, the policy must target the 'compartments' resource type at the parent compartment level.

Answer

Allow group ArchitectGroup to manage root-compartment in tenancy

Answer

Allow group ArchitectGroup to use compartments in tenancy

Answer

Allow group ArchitectGroup to manage tenancy in compartment AppCompartment

Question 17

Which OCI tool can you use to visualize your monthly cloud spend trends, filter costs by compartments, and examine expenses broken down by specific services?

Accepted Answer

Cost Analysis. OCI Cost Analysis is the built-in dashboard for analyzing cloud spending and cost breakdowns.

Answer

Audit

Answer

Cloud Guard

Answer

Resource Manager

Question 18

An administrator wants to move a Virtual Cloud Network (VCN) from 'CompartmentA' to 'CompartmentB'. What is the primary prerequisite that must be met for this move to succeed?

Accepted Answer

You must have permissions to manage the VCN in both the source and destination compartments.. To move a resource between compartments, all dependent child or associated resources (like subnets, route tables, or security lists) must be supported, and you must have manage permissions on both source and destination compartments.

Answer

You must stop all running instances attached to the VCN before moving it.

Answer

The VCN must first be terminated and recreated in the destination compartment.

Answer

The VCN must be exported to Object Storage prior to the compartment change.

Question 19

Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?

Accepted Answer

Authentication fails immediately at the IdP, preventing access to OCI.. Federated authentication relies on the corporate IdP; once disabled there, the user cannot successfully authenticate or generate security assertions for OCI.

Answer

The user can still log into OCI using local OCI IAM password credentials.

Answer

OCI will prompt the user to reset their OCI password.

Answer

The user retains access until their active OCI API signing key expires.

Question 20

You are setting up OCI Budgets for multiple departments. You want a budget to evaluate spending based on the actual costs incurred plus estimated charges for resources that have been running during the month. Which budget calculation rule should you select?

Accepted Answer

Forecasted spend. OCI Budgets support both 'ACTUAL' and 'FORECASTED' spend tracking types. To include both incurred spend and projected end-of-month spend, you use forecasted spend alerts.

Answer

Actual spend only

Answer

Static historical spend

Answer

Compartment quota calculation