1Z0-1085-26 Governance And Administration Practice Test 4 — 15 Questions

Question 1

Which THREE components are required when writing an OCI IAM policy statement? (Choose three.)

Accepted Answer

Location (compartment name or tenancy). OCI IAM policy syntax requires a verb, a resource type (or all-resources), and a location (compartment or tenancy).

Answer

Availability domain identifier

Answer

Compute shape specification

Question 2

Which TWO types of tags are supported in Oracle Cloud Infrastructure? (Choose two.)

Accepted Answer

Defined tags. OCI supports Free-form tags and Defined tags.

Answer

Compartment-bound tags

Answer

Encrypted tags

Answer

System-enforced tags

Question 3

Which TWO methods can be used to authenticate users accessing OCI services? (Choose two.)

Accepted Answer

API signing keys for CLI and SDK access. Option C is correct because OCI uses API signing keys (RSA key pairs) to authenticate programmatic access via the CLI, SDKs, and REST APIs, where the private key signs requests and the public key fingerprint is registered on the user account in IAM. Option D is correct because interactive console access to OCI services is authenticated with a username and password, and OCI supports multi-factor authentication (MFA) via the Oracle Mobile Authenticator app or a third-party authenticator to strengthen that login. Option A is wrong because SSH key pairs are used for logging into compute instances, not for authenticating users to OCI services, and they are not stored in IAM policies. Option B is wrong because shared tenancy root certificates are not an OCI user authentication method. Option E is wrong because compartments are logical containers for organizing and isolating resources, not credentials used for authentication.

Answer

Secure Shell (SSH) key pairs stored in IAM policies

Answer

Shared tenancy root certificates

Answer

IAM compartment credentials

Question 4

Which THREE features are provided by OCI Cloud Guard to help secure a tenancy? (Choose three.)

Accepted Answer

Responder recipes to automatically remediate detected security problems. Option C is correct because Cloud Guard responder recipes define the automated actions (such as stopping an instance, deleting a public bucket, or disabling a user) that Cloud Guard takes when a detector identifies a problem, enabling automatic remediation. Option D is correct because Cloud Guard provides a security score that aggregates the number and severity of problems across the tenancy, giving a measurable view of overall security posture. Option E is correct because detector recipes specify the detector rules and conditions Cloud Guard uses to identify misconfigurations, risky activities, and threats across OCI resources. Option A is not a Cloud Guard feature; billing reports and CSV export are handled by OCI Cost Management and Billing, not by Cloud Guard. Option B is also unrelated, since Terraform template execution is a function of OCI Resource Manager, not Cloud Guard's security monitoring and remediation capabilities.

Answer

Automatic daily billing report generation and CSV export

Answer

Terraform template execution for infrastructure deployment

Question 5

Which THREE actions can be performed using OCI Audit log data? (Choose three.)

Accepted Answer

Trigger automated workflows and notifications via OCI Events based on audit log entries. Option C is correct because OCI Events service can consume Audit log entries as event types (e.g., com.oraclecloud.* resource actions) and route them to targets like OCI Functions, Notifications, or Streaming to trigger automated workflows and alerts. Option D is correct because Audit logs can be archived automatically by configuring a Service Connector Hub (or the Logging service's log archival) to move log data from the Audit log to an Object Storage bucket for long-term retention. Option E is correct because Audit log data is searchable and queryable through OCI Logging Search and the Audit service console, allowing historical API activity to be retrieved and analyzed. Option A is not correct because budget limits are managed by the Budgets service and are not adjusted by Audit log data. Option B is not correct because IAM policy syntax errors are not automatically corrected by Audit logs; IAM policies must be edited manually or via automation you build, not by the Audit service itself.

Answer

Adjust monthly budget limits dynamically

Answer

Automatically modify IAM policy syntax errors

Question 6

Which TWO statements are correct regarding OCI Budgets and spending alerts? (Choose two.)

Accepted Answer

Budget alerts can send notifications via OCI Notifications (email, PagerDuty, etc.).. Option A is correct because OCI Budgets integrate with the OCI Notifications service, which supports delivery channels such as email and PagerDuty (via subscriptions to a topic), so budget threshold breaches can be pushed to those endpoints. Option E is correct because a budget rule can be configured with a type of either ACTUAL spend or FORECAST spend, allowing alerts to fire when the projected spend is expected to exceed the threshold, not only after the money has already been spent. Options B, C, and D are incorrect: budgets are monitoring/alerting constructs and cannot stop or terminate compute instances (that would require separate automation such as Functions or the CLI/SDK); budget spending is refreshed periodically throughout the day (roughly every few hours), not once every 30 days; and budgets can be scoped to a compartment or to a specific tag, not only to the root tenancy.

Answer

Budgets can automatically shut down compute instances when spending exceeds 100%.

Answer

Budgets update their spending calculations once every 30 days.

Answer

Budgets can only be set at the root tenancy level, never at compartment levels.

Question 7

Which THREE best practices should be followed when designing an OCI compartment hierarchy and IAM policy structure? (Choose three.)

Accepted Answer

Grant permissions to user groups rather than attaching policies directly to individual users.. Option A is correct because OCI IAM best practice is to grant permissions to groups and then assign users to those groups, which centralizes access management and avoids the sprawl and audit difficulty of per-user policies. Option B is correct because least privilege means granting only the specific verbs and resource-types a group needs in a given compartment, reducing blast radius and satisfying security and compliance requirements. Option C is correct because OCI recommends keeping compartment hierarchies relatively shallow (commonly no more than about six levels) to keep policies, quotas, and troubleshooting manageable and to avoid overly complex inheritance. Option D is wrong because sharing root tenancy administrator credentials destroys accountability and violates the principle of unique, individually attributable identities. Option E is wrong because writing all policies at the root tenancy level creates broad, hard-to-audit permissions and ignores compartment-scoped policy inheritance, which is the mechanism OCI provides for delegated, least-privilege administration.

Answer

Share tenancy root administrative credentials among all team members.

Answer

Write all IAM policies at the root tenancy level to avoid managing multiple policies.

Question 8

Which TWO options are valid methods for organizing and managing infrastructure configuration in OCI? (Choose two.)

Accepted Answer

Using OCI Resource Manager to provision and manage Terraform configurations.. Option D is correct because OCI Resource Manager is the managed Terraform service that lets you create, plan, apply, and manage infrastructure-as-code stacks, so it is a valid way to organize and manage infrastructure configuration. Option E is correct because compartments are the fundamental logical containers in OCI used to segment resources and scope IAM policies, making them a core mechanism for organizing and controlling infrastructure. The remaining options are incorrect because Cloud Guard is a security posture service, not a compute deployment tool; Cost Analysis is a billing and usage reporting feature, not an IAM policy authoring tool; and Audit records API activity for compliance, it does not create VCNs.

Answer

Using OCI Cloud Guard to deploy compute instances.

Answer

Using OCI Cost Analysis to write IAM policies.

Answer

Using OCI Audit to create virtual cloud networks.

Question 9

Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)

Accepted Answer

Defined tags require a Tag Namespace to be created first.. Option C is correct because OCI Defined Tags must live inside a Tag Namespace, which is created first in a tenancy (or compartment) and acts as the container that scopes the tag keys and their value types. Option D is correct because Tag Defaults are a feature of defined tags that automatically apply a specified tag key/value to resources created in a given compartment, enforcing consistent tagging without manual effort. Option E is correct because Tag-Based Access Control works by writing IAM policies that reference tag values through variables such as target.tag.. (for example, request.permission or target.tag.Project.Environment), allowing conditions like 'where target.tag.Project.Environment = "Prod"'. Option A is wrong because defined tags and TBAC augment IAM policies rather than replace them; policies are still required to grant or deny permissions. Option B is wrong because free-form tags are the ungoverned string-based tags, whereas defined tags are governed by a namespace with a predefined schema and value constraints.

Answer

Defined tags replace IAM policies entirely for access control.

Answer

Defined tags can only be created as free-form strings without any governance.

Question 10

Which TWO statements describe OCI Service Limits? (Choose two.)

Accepted Answer

Service limits restrict the maximum amount of a resource you can consume in a tenancy or region.. Service limits are thresholds set on resource consumption per tenancy/region, and administrators can request increases via the console.

Answer

Service limits cannot be increased under any circumstances.

Answer

Service limits are managed entirely by writing IAM policy statements.

Answer

Service limits apply only to Object Storage and cannot restrict compute or networking.

Question 11

You want to ensure that any compute instance launched by the data science team is automatically tagged with a specific project code, without requiring manual tagging by the users. Which OCI governance mechanism is best suited for this?

Accepted Answer

Tag Defaults. Tag defaults allow you to set default values for defined tags at the compartment level, automatically applying them upon resource creation.

Answer

OCI Vault

Answer

Compartment Quotas

Answer

Cloud Guard Detector Recipes

Question 12

Which OCI Console menu section should an administrator navigate to in order to create and manage user groups, compartments, and IAM policies?

Accepted Answer

Identity & Security. In the OCI Console, user groups, compartments, and IAM policies are all managed under the 'Identity & Security' section. This is where administrators create groups, define compartments, write policies, and manage federation and identity domains.

Answer

Analytics & AI

Answer

Storage

Answer

Networking

Question 13

An enterprise has multiple child compartments under a root tenancy. A security administrator wants to ensure that a specific IAM policy written in the root tenancy cannot be overridden or weakened by child compartment policies. How does OCI handle policy evaluation across hierarchical boundaries?

Accepted Answer

Policies are additive across the hierarchy; higher-level grants cannot be blocked because OCI has no explicit deny statements.. OCI IAM policies are additive across the tenancy hierarchy. Policies written at the root or compartment level grant permissions, and there are no explicit deny statements in OCI. Therefore, a policy in a child compartment cannot override or weaken a grant from a parent compartment; it can only add more permissions. This means higher-level grants cannot be blocked by lower-level policies.

Answer

OCI evaluates policies alphabetically and applies the first matching statement.

Answer

Root tenancy policies are automatically disabled if any child compartment policy exists.

Answer

Child compartment policies take precedence and override parent compartment policies.

Question 14

A security administrator in a large tenancy must determine which principal performed a specific DeleteBucket operation on an Object Storage bucket three weeks ago. The tenancy has Audit retention set to 90 days and no external SIEM integration. Where should the administrator look to find this information?

Accepted Answer

OCI Audit service, filtering events by the Object Storage bucket's compartment and the DeleteBucket event type. The OCI Audit service is the authoritative, always-on record of API activity across a tenancy and retains events for 90 days by default. Because it captures the principal, action, resource, and time, filtering by compartment and the DeleteBucket event type lets the administrator identify exactly who deleted the bucket without any prior configuration.

Answer

OCI Events service, reviewing the rule history for Object Storage delete event types

Answer

OCI Monitoring service, querying the oci_objectstorage metric namespace for delete operations

Answer

OCI Logging service, enabling a service log on the bucket and searching historical log entries from three weeks ago

Question 15

A junior cloud engineer has just joined a tenancy and needs to sign in to the OCI Console. The identity administrator wants to grant the engineer access without creating a separate local OCI password. Which identity type should the administrator federate with OCI Identity and Access Management to achieve this?

Accepted Answer

An identity provider that supports SAML 2.0, such as Microsoft Entra ID or Okta. OCI IAM supports federation with SAML 2.0 identity providers, so mapping an external directory to OCI lets users authenticate with existing corporate credentials. This removes the need to issue and manage a local OCI Console password for the new engineer while still granting Console access through group-to-policy mappings.

Answer

A customer secret key associated with the engineer's user account

Answer

An OCI API key pair generated for the engineer's user account

Answer

An OCI auth token generated for the engineer's user account