1Z0-1085-26 Governance And Administration Practice Test 2 — 15 Questions

Question 1

An administrator needs a policy that grants a group the ability to manage all resources in a specific compartment named ProjectA, but must explicitly prevent them from deleting any compute instances in that same compartment. The group should retain the ability to launch and stop instances. Which approach correctly enforces this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant granular allow statements for the needed verbs, such as manage instances where the request excludes the DELETE action, by authorizing only the specific instance operations required. Because OCI IAM policies are additive and support only allow statements, the only reliable way to prevent deletion is to avoid granting the delete verb. Composing granular allow statements that cover launch, stop, and read operations on instances, without authorizing termination, delivers the required management capability while withholding deletion.

Answer

Write a broad 'manage all-resources in compartment ProjectA' policy and no deny statement, relying on instance termination protection at the instance level

Answer

Write 'Allow group ProjectAdmins to manage all-resources in compartment ProjectA' plus a statement denying use of the instance terminate verb in that compartment

Answer

Attach a tag-based access control policy that denies deletion to any instance tagged with ProjectA

Question 2

A company wants to create a compartment structure that isolates each of its three business units while still allowing a central platform team to manage shared networking resources. Which approach best satisfies both isolation and centralized management?

Accepted Answer

Create three sibling compartments under the root compartment and grant the platform team manage permissions on networking resources in each. Sibling compartments under the root preserve hard isolation between business units, and scoping the platform team's policy to networking resource types in each compartment gives it exactly the shared-management capability it needs. This design keeps policy statements narrow, supports per-unit quotas and cost tracking, and avoids tenancy-wide grants that would break isolation.

Answer

Create three compartments and grant each business unit manage all-resources in tenancy so they can self-manage

Answer

Create three compartments nested under a single business-unit compartment and give the platform team manage all-resources at the tenancy level

Answer

Create one compartment for all business units and rely on tagging to separate their resources

Question 3

Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?

Accepted Answer

Cost-tracking tags. Tags in OCI allow you to attach metadata to resources, which can then be used in Cost Analysis for tracking and allocating spend.

Answer

IAM policies

Answer

Budgets

Answer

Compartment quotas

Question 4

An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?

Accepted Answer

OCI Audit. OCI Audit automatically records all API calls made against OCI resources, including who made the call, when, from where, and what the request/response was. To find who deleted a VCN, the auditor queries Audit for the DeleteVcn API event, which retains this history for the configured retention period. This is the only OCI service that provides the exact API event history needed for forensic verification.

Answer

OCI Notifications

Answer

OCI Events

Answer

OCI Monitoring

Question 5

Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?

Accepted Answer

OCI Budgets. OCI Budgets allow you orange spending limits and trigger alerts at specified percentage thresholds via email or notifications.

Answer

OCI Tag Defaults

Answer

OCI Cloud Guard

Answer

OCI Cost Analysis

Question 6

Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard scans OCI resources for security misconfigurations and risky activities, providing actionable remediation steps.

Answer

OCI Audit

Answer

OCI Logging Analytics

Answer

OCI Cost Analysis

Question 7

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?

Accepted Answer

Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment. The IAM policy syntax is 'Allow group to

in compartment ', so 'Allow group DBA-Group to manage autonomous-databases in compartment DevCompartment' grants management of Autonomous Databases scoped to DevCompartment only. This satisfies the least-privilege requirement by limiting both the resource type and the compartment.

Answer

Allow group DBA-Group to manage all-resources in compartment DevCompartment

Answer

Allow compartment DevCompartment to manage autonomous-databases for group DBA-Group

Answer

Allow group DBA-Group to manage autonomous-databases in tenancy

Question 8

You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?

Accepted Answer

6 levels. OCI recommends keeping compartment hierarchies shallow, typically no more than 6 levels deep, to maintain manageable IAM policies and avoid complexity.

Answer

2 levels

Answer

There is no limit or recommendation; you can nest indefinitely.

Answer

10 levels

Question 9

Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?

Accepted Answer

Compartment Quotas. Compartment Quotas in OCI allow administrators to set hard limits on the quantity or capacity of resources that can be created within a compartment, independent of IAM policies. By setting a quota on the number of OCPUs for compute instances in the 'Staging' compartment, you enforce that no user, regardless of their IAM permissions, can exceed that limit. This directly addresses the requirement to prevent provisioning instances with more than 4 OCPUs.

Answer

OCI Budgets

Answer

Service Limits

Answer

IAM Policy Statements

Question 10

You created a Defined Tag namespace called 'Department' and a key called 'CostCenter'. However, developers are forgetting to add these tags when creating compute instances. How can you ensure that every new compute instance created in a specific compartment automatically receives these tags without relying on manual user input?

Accepted Answer

Configure Tag Defaults for the compartment.. Tag defaults allow administrators to specify default values for defined tags that are automatically applied to all resources created within a compartment.

Answer

Write an IAM policy with a tag enforcement condition.

Answer

Use OCI Audit to retroactively tag unlabelled resources.

Answer

Set up a compartment quota for tagging.

Question 11

Which OCI construct serves as the root container for all your cloud resources and acts as the logical boundary for managing users, groups, and compartments?

Accepted Answer

Tenancy. The Tenancy is the root compartment and overarching container for all OCI resources.

Answer

Region

Answer

Availability Domain

Answer

Compartment

Question 12

You want to delegate the ability to create and manage sub-compartments within an existing compartment called 'AppCompartment' to a lead architect, without granting them full tenancy administration rights. How should you write this IAM policy?

Accepted Answer

Allow group ArchitectGroup to manage compartments in compartment AppCompartment. To allow managing compartments within a specific parent compartment, the policy must target the 'compartments' resource type at the parent compartment level.

Answer

Allow group ArchitectGroup to manage root-compartment in tenancy

Answer

Allow group ArchitectGroup to use compartments in tenancy

Answer

Allow group ArchitectGroup to manage tenancy in compartment AppCompartment

Question 13

Which OCI tool can you use to visualize your monthly cloud spend trends, filter costs by compartments, and examine expenses broken down by specific services?

Accepted Answer

Cost Analysis. OCI Cost Analysis is the built-in dashboard for analyzing cloud spending and cost breakdowns.

Answer

Audit

Answer

Cloud Guard

Answer

Resource Manager

Question 14

An administrator wants to move a Virtual Cloud Network (VCN) from 'CompartmentA' to 'CompartmentB'. What is the primary prerequisite that must be met for this move to succeed?

Accepted Answer

You must have permissions to manage the VCN in both the source and destination compartments.. To move a resource between compartments, all dependent child or associated resources (like subnets, route tables, or security lists) must be supported, and you must have manage permissions on both source and destination compartments.

Answer

You must stop all running instances attached to the VCN before moving it.

Answer

The VCN must first be terminated and recreated in the destination compartment.

Answer

The VCN must be exported to Object Storage prior to the compartment change.

Question 15

Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?

Accepted Answer

Authentication fails immediately at the IdP, preventing access to OCI.. With OCI federated identity via SAML 2.0, authentication is delegated entirely to the external IdP — OCI never stores or validates a password for federated users. When the corporate IdP disables the account, the IdP refuses to issue a valid SAML assertion, so the OCI sign-in flow fails at the IdP before any OCI session is created. Access is therefore blocked immediately, not on a delayed schedule.

Answer

The user can still log into OCI using local OCI IAM password credentials.

Answer

OCI will prompt the user to reset their OCI password.

Answer

The user retains access until their active OCI API signing key expires.