20+ practice questions focused on Security Services — one of the most tested topics on the Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security Services PracticeA financial services company runs a three-tier web application in OCI. The security team wants to ensure that traffic to the database tier is restricted to only the application tier's subnet, and that all traffic is logged for auditing. They have already created a VCN with separate subnets for web, application, and database tiers. Which OCI feature should they use to enforce these subnet-level traffic restrictions?
Explanation: Security lists are the correct choice because they operate at the subnet level, allowing rules that permit traffic only from specific CIDR blocks, such as the application subnet. They also integrate with VCN Flow Logs for auditing. NSGs, while useful, apply to VNICs and are not subnet-scoped. Route tables and Internet Gateways do not provide traffic filtering or logging for this purpose.
A security engineer must ensure that a web application running on OCI compute instances can only be accessed from a specific corporate IP range, and that the instances themselves can reach the internet for software updates. The engineer decides to use security lists at the subnet level. Which statement correctly describes how security lists enforce these requirements?
Explanation: OCI security lists are stateless subnet-level firewalls, so both ingress and egress rules must be explicitly defined, including for return traffic. This is different from stateful firewalls that automatically allow return traffic. The engineer must create rules to permit the corporate IP range inbound and internet-bound traffic outbound, plus corresponding rules for return packets. This ensures the application is protected and functional.
A security architect must ensure that all data written to Object Storage buckets in a regulated compartment is encrypted with keys that the organization generates, rotates, and can immediately disable, and that the encryption keys never leave an HSM-controlled boundary. The organization also wants the ability to move a key between OCI regions in a backup scenario. Which OCI service should the architect use to meet these requirements?
Explanation: The requirement is for customer-controlled encryption keys held in hardware security modules, with the ability to rotate, disable, and export for regional backup. OCI Vault is the only listed service that stores master encryption keys in FIPS 140-2 Level 3 HSMs, supports virtual private vaults, and allows key lifecycle operations including disabling and backup. Certificate and posture services do not manage data-encryption keys.
A cloud administrator needs to grant a new employee read-only access to all resources in a specific compartment. The employee should not be able to modify or delete any resources. Which OCI IAM policy statement should the administrator use?
Explanation: In OCI IAM, the 'inspect' verb grants read-only access to resources, allowing the user to list and view metadata but not modify them. The 'read' verb is similar but may not include all read operations. 'Use' and 'manage' grant additional privileges that exceed the requirement. Therefore, 'inspect' is the correct verb for read-only access to all resources in a compartment.
A company is deploying a web application on OCI and wants to protect it from common web threats such as SQL injection and cross-site scripting. They also want to control access based on geographic location. Which two OCI services should they use? (Choose two.)
Explanation: The correct services are WAF and WAF with geo-blocking rules, which together provide protection against web threats and geographic access control. WAF is designed to filter and monitor HTTP traffic, blocking SQL injection and XSS, and it can enforce geo-blocking. The other options operate at different layers or serve different purposes, such as network filtering, security posture management, or identity management.
+15 more Security Services questions available
Practice all Security Services questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security Services. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security Services questions on the 1Z0-1085-26 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security Services is tested as part of the Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) blueprint. Practicing with targeted Security Services questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 1Z0-1085-26 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security Services is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security Services practice session with instant scoring and detailed explanations.
Start Security Services Practice →