1Z0-1085-26 Hard Questions — 25 Difficult Questions

Question 1

An enterprise is auditing their OCI IAM setup and discovers that a policy statement was written with a syntax error. Which OCI mechanism validates IAM policy syntax before it is saved or applied?

Accepted Answer

The built-in OCI IAM policy validator and syntax checker in the Console/API.. The OCI IAM policy editor in the console and API provides real-time syntax checking and validation as you type policy statements.

Answer

OCI Resource Manager Terraform syntax checker.

Answer

OCI Audit log analysis.

Answer

OCI Cloud Guard policy rules.

Question 2

Your organization has a strict requirement that no IAM policy can be written without a specified description and that all policies must be reviewed. When creating an IAM policy in OCI, is providing a description mandatory?

Accepted Answer

Yes, providing a description is mandatory when creating an IAM policy.. In OCI IAM, a description is a mandatory field when creating a policy to help administrators document the business justification.

Answer

Descriptions are only mandatory when using the CLI, but optional in the Console.

Answer

Only if the policy is created at the tenancy root level.

Answer

No, the description is entirely optional and can be left blank.

Question 3

A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?

Accepted Answer

Allow group UserAdmins to manage identity-domains in tenancy. To manage identity resources like users and groups without granting infrastructure access, the domain resource type is 'tenancy' with the verb 'inspect' or 'manage' scoped to identity services.

Answer

Allow user UserAdmins to inspect compartments in tenancy

Answer

Allow group UserAdmins to manage all-resources in tenancy

Answer

Allow group UserAdmins to manage users in tenancy

Question 4

An enterprise architect is designing a highly available and resilient web application in OCI. Which THREE strategies should be implemented to ensure maximum uptime and fault isolation? (Choose three.)

Accepted Answer

Configure OCI Traffic Management to automatically route client requests away from an impaired region.. High resilience involves multi-AD/FD placement, cross-region disaster recovery, and automated traffic management.

Answer

Rely solely on single-instance virtual machines with automatic daily backups instead of multi-node clustering.

Answer

Deploy all database and application instances in a single Fault Domain to optimize network latency.

Question 5

An organization requires a highly available IPsec VPN connection from their on-premises data center to an OCI VCN. To ensure high availability, what is the recommended architecture for the Dynamic Routing Gateway (DRG) and customer premise equipment (CPE)?

Accepted Answer

Redundant VPN tunnels utilizing multiple CPE public IP addresses terminating on the DRG.. OCI supports redundant VPN tunnels across multiple CPE public IPs terminating on a DRG to ensure high availability and failover.

Answer

A single VPN tunnel connecting to a single CPE device.

Answer

Configuring active-passive peering across two separate VCNs.

Answer

Using an Internet Gateway instead of a DRG with redundant static routes.

Question 6

An organization is setting up a hybrid network architecture using OCI FastConnect with a Partner/Provider model. They need to ensure that their on-premises network can communicate with multiple VCNs across different regions using private IP addresses without traversing the public internet. Which OCI component is mandatory to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG). A Dynamic Routing Gateway (DRG) version 2 supports attaching to FastConnect and can peer across regions or connect multiple VCNs to a single on-premises connection.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 7

You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?

Accepted Answer

Missing route table entries directing traffic to the Local Peering Gateway in both VCNs. VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.

Answer

Using security lists instead of Network Security Groups

Answer

Attaching an Internet Gateway to the peering connection

Answer

Enabling Flow Logs on the subnets

Question 8

Which TWO statements are true regarding OCI Flexible Compute shapes? (Choose two.)

Accepted Answer

Network bandwidth scales proportionally with the number of OCPUs selected on flexible shapes.. Option A is correct because OCI flexible shapes tie network bandwidth to the OCPU count: as you increase the number of OCPUs, the available network bandwidth scales proportionally, so a shape with more OCPUs gets more bandwidth. Option E is correct because flexible shapes let you independently choose the OCPU count and the memory amount within the shape's allowed range, rather than being locked to a fixed memory-per-OCPU ratio. Option B is wrong because flexible shapes are available for both Virtual Machine and Bare Metal instances, not Bare Metal only. Option C is wrong because boot volume resizing is supported independently of whether a shape is flexible. Option D is wrong because flexible shapes specifically allow you to vary memory per OCPU instead of forcing a fixed tier.

Answer

Flexible shapes are only available on Bare Metal instances and cannot be used with Virtual Machines.

Answer

Flexible shapes do not support boot volume resizing.

Answer

You must select a fixed tier of memory for every OCPU selected.

Question 9

A multinational corporation has strict data residency regulations that prohibit their core financial data from leaving their physical corporate headquarters, yet they want to use OCI managed services and the exact same control plane API. Which OCI deployment model satisfies these requirements?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region or OCI Cloud@Customer allows organizations to run OCI services on-premises, maintaining data residency while using the public cloud control plane and APIs.

Answer

OCI Multi-Cloud Interconnect

Answer

OCI Public Cloud Region

Answer

OCI Global Edge Services

Question 10

An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?

Accepted Answer

No IAM policy has been created that grants permissions to the dynamic group.. A dynamic group only defines membership based on matching rules; it grants no permissions by itself. Permissions are granted exclusively through IAM policies that reference the dynamic group as the principal. If no such policy exists, instances in the group receive nothing, which is the most likely cause described.

Answer

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Answer

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Answer

Dynamic groups cannot be used in IAM policies; only user groups can.

Question 11

Which TWO statements are true regarding OCI Flexible Compute shapes? (Choose two.)

Accepted Answer

You can independently configure the number of OCPUs and memory (RAM) when launching a flexible VM.. Option A is correct because OCI Flexible Compute shapes let you independently choose the number of OCPUs and the amount of memory (RAM) within the shape's supported range when launching a flexible VM, rather than being locked to a fixed OCPU-to-memory ratio. Option E is correct because on flexible shapes the network bandwidth scales proportionally with the number of OCPUs selected, so more OCPUs yield higher maximum network throughput. Option B is wrong because flexible shapes are available for both Virtual Machine and Bare Metal instances, not Bare Metal only. Option C is wrong because boot volume resizing is supported independently of whether the shape is flexible. Option D is wrong because flexible shapes specifically allow you to vary memory per OCPU rather than forcing a fixed memory tier for each OCPU.

Answer

Flexible shapes are only available on Bare Metal instances and cannot be used with Virtual Machines.

Answer

Flexible shapes do not support boot volume resizing.

Answer

You must select a fixed tier of memory for every OCPU selected.

Question 12

Which THREE statements are true regarding the architecture and design principles of OCI Availability Domains (ADs) and Regions?

Accepted Answer

Some OCI regions are built with a single availability domain, while others contain multiple availability domains.. Option C is correct because OCI regions vary in topology: some regions are single-AD (for example, certain smaller or newer regions), while most commercial regions contain three availability domains, so the statement accurately reflects that AD count is not uniform across regions. Option D is correct because each OCI region is an independent, isolated geographic area, and regions are deliberately separated by large distances so that a regional failure does not affect other regions. Option E is correct because ADs within the same region are interconnected through a high-bandwidth, low-latency network, which enables multi-AD architectures such as cross-AD replication and low-latency synchronous data mirroring. Option A is incorrect because an availability domain is confined to a single region and cannot span multiple geographic countries. Option B is incorrect because each availability domain has independent power, cooling, and physical security infrastructure; sharing those would defeat the fault-isolation purpose of ADs.

Answer

An availability domain can span across multiple geographic countries to maximize data locality.

Answer

Availability domains share power, cooling, and physical security infrastructure to reduce operational overhead.

Question 13

Which TWO methods can be used to connect an on-premises data center to an OCI Virtual Cloud Network? (Choose two.)

Accepted Answer

OCI FastConnect. OCI FastConnect (C) is correct because it provides a dedicated, private physical connection between an on-premises data center and an OCI VCN, bypassing the public internet for higher bandwidth and more consistent latency. OCI Site-to-Site VPN (D) is also correct because it establishes an IPsec VPN tunnel over the public internet between the on-premises customer-premises equipment (CPE) and a Dynamic Routing Gateway (DRG) attached to the VCN, enabling encrypted hybrid connectivity. Internet Gateway with Public IP (A) only provides outbound/inbound internet access for resources in the VCN and does not create a dedicated or private link to an on-premises network. Local Peering Gateway (B) connects two VCNs within the same OCI region, not an on-premises data center. Object Storage Gateway (E) is a service for accessing Object Storage from on-premises or other clouds, not a method for connecting a data center network to a VCN.

Answer

Internet Gateway with Public IP

Answer

Local Peering Gateway

Answer

Object Storage Gateway

Question 14

You need to allow database instances in a private subnet to communicate with Object Storage over the private network. Which service is required?

Accepted Answer

Service Gateway. A Service Gateway allows communication between VCN and OCI public services over the OCI private network.

Answer

NAT Gateway

Answer

Internet Gateway

Answer

VPN Connect

Question 15

You need to migrate a legacy application to OCI that requires a specific IP address to be retained for compliance. Which OCI networking feature allows you to attach a specific public IP to an instance?

Accepted Answer

Reserved Public IP. Reserved Public IPs are long-lived public IP addresses that can be assigned to resources and retained after the resource is deleted.

Answer

Ephemeral Public IP

Answer

Private IP

Answer

Service Gateway IP

Question 16

An enterprise application deployed on OCI is experiencing frequent Layer 7 HTTP flood attacks and SQL injection attempts. Which OCI service provides comprehensive protection against these web vulnerabilities?

Accepted Answer

OCI Web Application Firewall. OCI Web Application Firewall (WAF) is a cloud-based, PCI-compliant security service that protects applications from malicious internet traffic, including cross-site scripting (XSS), SQL injection, and HTTP floods.

Answer

Cloud Guard

Answer

Virtual Cloud Network Security Lists

Answer

Network Security Groups

Question 17

An architect is designing an application that requires data replication between two OCI regions. The primary region is Ashburn and the secondary region is Phoenix. What is the foundational nature of OCI's multi-region architecture regarding inter-region traffic?

Accepted Answer

OCI regions are independent geographic areas connected by Oracle's high-speed private network backbone, allowing secure cross-region replication.. OCI regions are completely independent and connected by secure, high-speed global network backbones, allowing safe cross-region data transfer.

Answer

All inter-region traffic must traverse the public internet via encrypted IPsec VPN tunnels.

Answer

OCI regions are isolated from each other; cross-region data transfer requires third-party WAN optimizers.

Answer

Inter-region communication is restricted to metadata only; user data cannot be moved between regions.

Question 18

A database administrator needs to take an instantaneous, point-in-time, space-efficient copy of a large block volume without waiting for full data copying to complete. Which Block Volume feature should they use?

Accepted Answer

Block Volume Clone. Volume Clones provide an immediate, point-in-time copy of a block volume using metadata pointers, allowing immediate access without waiting for a full physical copy.

Answer

Boot volume attachment

Answer

Standard Block Volume Backup

Answer

Cross-region replication policy

Question 19

An administrator wants to configure automated backup policies for OCI Block Volumes attached to production databases. They need a policy that takes daily backups and retains them for 30 days, as well as weekly backups retained for 1 year. How can this be accomplished?

Accepted Answer

Create a user-defined Volume Backup Policy specifying multiple schedules with distinct retention periods.. OCI Block Volume backups support user-defined backup policies that allow combining multiple schedules (e.g., daily and weekly) with custom retention periods.

Answer

Enable Object Storage lifecycle management rules on the attached volume.

Answer

Configure a Compute Autoscaling policy with custom volume snapshot triggers.

Answer

Manually run scripts using the OCI CLI every day and week.

Question 20

A security engineer is designing a zero-trust architecture for a microservices environment in OCI. Traffic between compute instances in different subnets must be restricted based on individual workload roles rather than entire subnet CIDR blocks. Which OCI networking feature should be implemented?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) provide virtual firewall rules for a set of VNICs of your choice, allowing fine-grained security rules independent of subnet architecture.

Answer

Security Lists

Answer

Local Peering Gateways

Answer

Stateful Route Tables