524 questions total · 7pages · All types, answers revealed
Page 1 of 7
Page 2What is the purpose of the 'Tags' feature in OCI resource management?
Tags are essential for cost analysis and resource organization.
Why this answer
Tags allow you to organize and filter resources across compartments.
What is the maximum number of groups a single OCI user can be a member of?
OCI permits a user to be a member of up to 300 groups.
Why this answer
OCI enforces limits on group membership per user. The standard limit is 300 groups per user.
You have an OCI compute instance configured with an autoscaling policy. The autoscaling configuration scales out your instance pool by 2 instances when CPU exceeds 75%. You notice that during a traffic surge, the pool scales out, but shortly after, it scales right back in, causing flapping. How can you prevent this behavior?
A longer cooldown period prevents rapid oscillation (flapping) between scale-out and scale-in events.
Why this answer
Configuring an appropriate cooldown period (step delay) ensures that autoscaling waits a specified duration after a scaling event before evaluating metrics again.
You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?
Backend instances need security rules permitting ingress traffic from the load balancer's IP range or subnet.
Why this answer
Backend instances must allow incoming traffic from the load balancer's subnet or security list on the application ports. Updating the backend instance security lists or NSGs resolves the timeout.
An administrator is managing an OCI File Storage Service file system and notices that storage consumption has grown significantly. They want to identify which directories and users are consuming the most space. How can this be accomplished?
FSS exposes standard POSIX/NFS interfaces, allowing standard Linux utilities to inspect directory and file-level consumption when mounted.
Why this answer
OCI File Storage Service does not provide a native per-directory usage reporting dashboard within the console, but administrators can mount the file system and use standard Linux utilities (like du or quota tools if configured via NFS) to analyze storage consumption.
A company is running an enterprise application on OCI that requires high IOPS and low latency for its database files. The administrator needs to attach a block volume that can dynamically scale performance beyond its default capacity limits without having to detach the volume. Which Block Volume performance level should be selected?
Higher Performance delivers the highest IOPS/throughput and supports demanding enterprise database workloads.
Why this answer
Higher Performance provides the highest IOPS and throughput per GB, and volumes can be dynamically scaled up to higher performance tiers or resized without downtime.
What is the primary purpose of an OCI Virtual Cloud Network (VCN)?
A VCN provides network isolation and control for compute, database, and other OCI resources.
Why this answer
A VCN is a customizable, private software-defined network that you set up in OCI, resembling a traditional physical network.
Which feature in the Monitoring service allows you to aggregate metrics from different compartments into a single dashboard?
MQL supports cross-compartment queries using the compartment ID.
Why this answer
Cross-compartment queries are supported by the Monitoring service to view resources globally or across specific compartments.
Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)
Compartment-level scoping prevents overly broad access across the entire tenancy.
Why this answer
IAM best practices include adhering to the principle of least privilege and scoping policies to compartments rather than tenancies when possible.
You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?
Failover steering switches traffic to the secondary endpoint when the primary endpoint health check fails.
Why this answer
A Failover steering policy routes all traffic to the highest-priority healthy endpoint (Ashburn). If Ashburn fails health checks, it automatically fails over to the secondary endpoint (Phoenix).
An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?
Separate DRG route tables and import rules allow granular control over which attachments share routes.
Why this answer
In DRG version 2, you attach VCN-1 and VCN-2 to the DRG, and associate them with separate DRG route tables. The route table for VCN-1's attachment includes an import rule for the on-premises attachment, while VCN-2's route table does not.
Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?
Instance principals eliminate the need to configure individual IAM user credentials on instances.
Why this answer
Instance Principals use dynamic groups to match instances based on tags or compartment OCIDs, and policies to grant permissions. Individual IAM users are never required or created for instance principals.
Which THREE statements are true regarding Exadata Cloud Service architecture and capabilities? (Choose three.)
Exadata Cloud Service runs Oracle software on dedicated Exadata database and storage server hardware.
Why this answer
Exadata Cloud Service combines Exadata hardware with Oracle Cloud automation, supporting VM clusters, Oracle RAC, and built-in storage servers.
You have an instance pool with 5 instances. You update the associated instance configuration with a new custom image containing security patches. How do you apply this new configuration to the existing instances in the pool?
Instance pools support updating instances to match a new instance configuration via rolling replacement actions.
Why this answer
To update existing instances in an instance pool with a new instance configuration, you must perform a rolling update or recreate the instances in the pool using the instance pool rollout/update action.
An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?
The 'database-family' resource type covers all database services in OCI IAM policies.
Why this answer
Database resources in OCI are grouped under the 'database-family' resource type for IAM policies.
Which THREE storage options can be used with OCI Compute instances?
Can be mounted as a file system.
Why this answer
Block Volume, File Storage, and Object Storage are standard.
Which THREE features are supported by OCI DNS Traffic Management Steering Policies?
Failover policies automatically route traffic to backup endpoints if primary endpoints fail.
Why this answer
OCI Traffic Management steering policies support weighted round robin, failover, geolocation, ASN, and load balancer steering.
Which THREE statements regarding OCI Network Security Groups (NSGs) vs Security Lists are correct?
This is the primary architectural difference in scope between NSGs and Security Lists.
Why this answer
NSGs apply to specific VNICs and span subnets within a VCN, whereas Security Lists apply to all VNICs in a subnet. Both support stateful and stateless rules.
An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?
Peering without an Internet or NAT Gateway allows VCN-to-VCN communication while blocking the internet.
Which TWO statements regarding OCI FastConnect virtual circuits are correct?
Private virtual circuits extend your on-premises network into your VCN privately.
Why this answer
FastConnect virtual circuits can be public (for accessing public Oracle services without internet) or private (for extending your datacenter to your VCN). They support static routing or BGP dynamic routing.
Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)
Hierarchical path references in policies can break or change when a compartment's parent path changes.
Why this answer
Moving a compartment requires policies in both source and destination compartments/tenancy, and all child compartments/resources move along with it.
Which OCI service feature enables you to run software containers without provisioning virtual machines or managing Kubernetes clusters, offering simple container execution?
Container Instances run containers directly without server management.
Why this answer
OCI Container Instances provide serverless execution for containers without requiring VMs or Kubernetes clusters.
Which feature of Autonomous Database allows you to create a point-in-time read-only or read-write copy of your database instantly without duplicating all the underlying physical data blocks?
Database clones are created rapidly using storage virtualization technology.
Why this answer
Autonomous Database cloning allows you to create quick metadata-based clones (full or metadata clones) without duplicating all storage blocks initially.
You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?
Cross-tenancy authorization requires an endorsement policy in the resource tenancy and a commitment policy in the principal tenancy.
Why this answer
Cross-tenancy access requires the target tenancy (Tenancy A) to define an endorsement, and the source tenancy (Tenancy B) to define a corresponding commitment.
Which TWO deployment options are available when provisioning an Oracle Autonomous Database? (Choose two.)
Shared infrastructure is a multi-tenant option managed entirely by Oracle.
Why this answer
Autonomous Database can be provisioned on either Shared Exadata Infrastructure or Dedicated Exadata Infrastructure.
Which type of compute shape provides the lowest cost per core for general-purpose workloads by utilizing ARM-based Ampere processors?
Ampere A1 shapes use ARM processors, providing high core counts and cost efficiency.
Why this answer
OCI Ampere A1 Compute shapes (VM.Standard.A1.Flex) use ARM processors and offer high power efficiency and cost-effectiveness for scale-out workloads.
Which TWO of the following tasks can be performed using the Oracle Cloud Agent on compute instances? (Choose two.)
Run Command plugin allows executing scripts on instances securely without SSH.
Why this answer
Oracle Cloud Agent enables plugins for collecting monitoring metrics, executing run commands remotely, and managing OS compliance and patching.
An OCI customer has a VCN with CIDR 10.0.0.0/16. They have deployed a Kubernetes cluster (OKE) where worker nodes are placed in a private subnet. The cluster requires internal service discovery and pod-to-pod communication across different worker subnets. What is required in the subnet route table to support standard OKE cluster networking?
The 'local' route enables all subnets within the same VCN to communicate with each other natively.
Why this answer
Standard OKE subnets require intra-VCN routing, which is automatically handled by the default local route (10.0.0.0/16 pointing to 'local'), ensuring all subnets within the VCN can communicate freely.
You are configuring a Data Guard association for an Autonomous Database on Dedicated Infrastructure. How is the Data Guard standby database provisioned and managed?
OCI automates Autonomous Data Guard provisioning and lifecycle management.
Why this answer
On Dedicated Exadata Infrastructure, Autonomous Data Guard is enabled via the OCI Console or API by selecting the peer region, and OCI automates the provisioning and synchronization of the standby.
Which Terraform file extension does Resource Manager support?
Standard Terraform files use the .tf extension.
Why this answer
Resource Manager supports standard .tf files for configuration.
An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?
DRG route tables enable transit routing between VCNs attached to the same DRG by managing route propagation and custom routing rules.
Why this answer
DRG route tables allow you to customize how traffic flows between attachments. By using DRG attachments and custom route tables on the DRG, you can route traffic from Spoke1 to the Hub VCN attachment, and then from the Hub back out to Spoke2.
You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?
IP multicast is not supported in OCI VCN routing.
Why this answer
OCI Virtual Cloud Networks (VCNs) operate at Layer 3 and do not support IP multicast traffic. Application architectures must be redesigned to use unicast or alternative synchronization mechanisms.
You need to grant an OCI Function permission to read objects from an OCI Object Storage bucket. How should you configure this securely?
Dynamic groups and IAM policies provide secure, credential-less resource-to-resource authentication in OCI.
Why this answer
To allow OCI Functions or other services to access other OCI resources securely, you create a dynamic group containing the function(s) and write an IAM policy granting that dynamic group permissions to access the target resource.
Which TWO statements are true regarding OCI IP addresses and VNICs?
A primary private IP address is mandatory when creating a VNIC.
Why this answer
Every VNIC has a primary private IP address assigned from its subnet CIDR block, and can optionally have secondary private IP addresses and public IP addresses (ephemeral or reserved).
Which TWO actions should you take to troubleshoot an OCI compute instance that has become completely unresponsive and unreachable over SSH? (Choose two.)
Serial console provides direct text access to troubleshoot unresponsive systems.
Why this answer
When an instance is unreachable over SSH, you can use the Serial Console to view boot logs and interactive terminal prompts, or check instance metrics in OCI Monitoring.
You are managing a Kubernetes cluster on OCI (OKE) and need to upgrade the Kubernetes control plane version. What happens to the existing worker nodes when you perform a control plane upgrade?
Control plane and worker node upgrades are decoupled in OKE; worker nodes must be upgraded separately.
Why this answer
When you upgrade the control plane in OKE, the worker nodes continue running workloads normally, but they should eventually be upgraded to remain within supported version skew limits.
Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)
The metadata XML file contains the necessary endpoints, certificates, and entity IDs.
Why this answer
Configuring a SAML 2.0 IdP requires the IdP metadata XML file (or metadata URL) and a name for the IdP in OCI.
Which THREE configurations are required for a functioning File Storage Service mount?
Required for access control.
Why this answer
A mount target, a subnet, and export options are essential.
What is the primary benefit of using OCI Container Instances compared to managing containers on OCI Container Engine for Kubernetes (OKE)?
Container Instances provide serverless execution for containers, removing infrastructure management overhead.
Why this answer
OCI Container Instances are serverless container execution environments that allow you to run containers instantly without having to provision, manage, or scale underlying virtual machines or Kubernetes control planes.
You are configuring a Data Guard association for an Oracle Base Database System. You want to minimize performance impact on the primary database while ensuring zero data loss in the event of a failure. Which Data Guard protection mode should you configure?
Maximum Availability provides zero data loss with automatic fallback to asynchronous mode if the standby fails.
Why this answer
Maximum Availability protection mode guarantees zero data loss (synchronous redo transport) while ensuring that if the standby is unavailable, the primary continues processing transactions asynchronously.
Which THREE actions should you take when preparing a custom Linux VM image for export and import across OCI tenancies or regions? (Choose three.)
Removing persistent network rules prevents interface naming conflicts when launched on new hardware.
Why this answer
When preparing custom images for export/import, you must ensure cloud-init is installed and configured, clean up persistent network rules (like udev rules), and ensure the image is in a supported format (QCOW2 or RAW).
You are deploying a Container Engine for Kubernetes (OKE) cluster and want to ensure that worker nodes are distributed across separate physical hardware infrastructures to maximize fault tolerance. Which feature should you configure during cluster creation?
Configuring node pools across multiple fault domains ensures node distribution on separate physical hardware.
Why this answer
Fault domains ensure that instances are distributed across physical hardware that has independent power and top-of-rack switches. OKE supports specifying fault domains or availability domains for node pools.
Which THREE of the following are true about OCI Block Volume backups?
Backup policies automate the process.
Why this answer
They can be manual or scheduled, and they are stored in Object Storage.
An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?
The 'policies' resource type combined with the 'read' verb allows viewing all IAM policies across the tenancy without granting write access.
Why this answer
Viewing policies without modification requires the 'read' or 'inspect' verb on the 'policies' resource type.
Which TWO services provide visibility into your infrastructure usage and health?
Provides metric and health data.
Why this answer
Monitoring and Logging are the primary tools for observability.
Which THREE components are required when setting up OCI Functions to build, push, and deploy a serverless function? (Choose three.)
The fn CLI is used to initialize, build, and deploy functions.
Why this answer
To deploy OCI Functions, you need an Application container, an Oracle Container Registry (OCIR) repository to store function images, and the Fn CLI tool to build and deploy.
When provisioning an Exadata Database Service on Dedicated Infrastructure, what is the fundamental hardware unit that you provision first before creating database deployments?
You provision the Exadata Infrastructure resource first, representing the physical hardware rack, before deploying VM clusters and databases.
Why this answer
To use Exadata Database Service on Dedicated Infrastructure, you must first provision an Exadata Cloud Infrastructure resource (the rack/hardware), and then create VM clusters and databases on it.
Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)
Instance principals use temporary tokens managed by the local metadata service.
Why this answer
Instance principals allow compute instances to make API calls securely without managing credentials, authorized via dynamic groups and policies.
You are managing an OKE cluster and need to inspect application container logs that are written to stdout/stderr by pods running on worker nodes. What is the standard kubectl command to view these logs?
`kubectl logs` streams or prints stdout/stderr from container pods.
Why this answer
`kubectl logs <pod-name>` is the standard command to retrieve container logs from stdout/stderr in a Kubernetes cluster.
Which TWO actions can be performed on an Oracle Autonomous Transaction Processing database using the OCI Console? (Choose two.)
You can modify OCPUs and storage dynamically through the OCI console.
Why this answer
Through the OCI Console, administrators can manage database users, scale CPU and storage resources, restart the database, and configure backups.
Which command-line utility is used to manage OCI Block Volumes?
The OCI CLI is used to interact with the OCI control plane.
Why this answer
The OCI CLI is the standard tool to manage all OCI resources, including block volumes.
Which TWO actions can you perform in the Logging service?
Logs are indexed for fast searching.
Why this answer
Logging allows you to search logs and create alarms on logs.
Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?
Security Lists act as virtual firewalls for all VNICs in a subnet.
Why this answer
Security Lists (at the subnet level) and Network Security Groups (at the VNIC level) are the two primary virtual firewall features used in OCI to control ingress and egress traffic.
You are managing a large OKE cluster and notice that pods are failing to schedule because the worker nodes have run out of ephemeral storage. What is the most robust architectural solution to address this?
Kubernetes ephemeral storage writes to the node's root filesystem (boot volume). Increasing boot volume size provides more ephemeral storage space.
Why this answer
Ephemeral storage on OKE nodes is tied to the boot volume or local storage. To fix ephemeral storage exhaustion, you can resize the worker node boot volumes, add node pools with larger boot volumes, or configure emptyDir volumes to use specific storage mediums.
Which THREE resource types are associated with networking and can be managed via OCI IAM policies? (Choose three.)
virtual-network-family covers VCNs, subnets, gateways, and related networking components.
Why this answer
Networking resource types include virtual-network-family, subnets, route-tables, and security-lists.
Which TWO of the following metrics are commonly used in OCI Autoscaling configurations for Instance Pools? (Choose two.)
Memory utilization is also supported as a threshold metric for autoscaling.
Why this answer
Autoscaling configurations for instance pools in OCI support CPU utilization and Memory utilization metrics.
You are troubleshooting a custom OCI compute image that fails to boot properly after launching an instance. The instance gets stuck in a pre-boot state. Where can you view serial console logs to diagnose the low-level boot sequence and kernel panic messages?
Serial console connections provide direct text-based access to the instance's console output during boot.
Why this answer
OCI provides access to the serial console for compute instances, allowing administrators to view low-level kernel boot messages, GRUB menus, and interactive login prompts even if network access is down.
You are setting up DNS steering in OCI Traffic Management using a Response Pool. An endpoint in the pool fails its health check. How does OCI Traffic Management respond to DNS queries?
Health checks ensure DNS steering policies dynamically route around failed endpoints.
Why this answer
When an endpoint fails its health check, OCI Traffic Management automatically removes it from the DNS response rotation, routing queries only to healthy endpoints according to the steering policy.
You need to automate the movement of old backups to Archive storage. Which approach is most efficient?
Lifecycle policies handle this automatically.
Why this answer
Lifecycle policies automate this task without manual intervention.
You need to ensure that your Resource Manager stack uses a specific version of Terraform. Where is this configured?
The Terraform version is selected at the stack level.
Why this answer
You define the Terraform version during the creation of the stack settings.
You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?
The ANY operator combined with matching criteria for instance.id and freeform/defined tags is the correct syntax for dynamic groups.
Why this answer
Dynamic group matching rules support matching conditions using ALL or ANY operators with parameters such as instance.id and tag.namespace.tagkey.
Which THREE services integrate directly with OCI IAM for access control and governance? (Choose three.)
Object Storage uses IAM policies to control bucket and object access.
Why this answer
OCI services such as Object Storage, Compute, and Database integrate with IAM for authorization and security.
Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)
Compute instances are the primary resource in instance-family.
Why this answer
The 'instance-family' resource type encompasses compute instances, boot volumes, and associated volume attachments.
Which THREE factors should you evaluate when determining whether to use an Oracle Base Database System versus Exadata Cloud Service?
Exadata features are required if leveraging Smart Scan and HCC.
Why this answer
Decision factors include workload performance/scale requirements, Advanced Exadata features like Smart Scan, and budget/cost considerations.
Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?
The correct dynamic group syntax for defined tags includes the namespace, key, and .value property equal to the target string.
Why this answer
Dynamic group rules support defined tags using the syntax tag.<namespace>.<tagkey>.value = '<value>' or similar notation depending on the exact schema, but standard OCI grammar uses tag.namespace.tagkey.value = 'val' or tag.namespace.tagkey = 'val'. Specifically, for defined tags: tag.Department.CostCenter.value = '400'.
Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)
Instances can be grouped by the compartment in which they reside.
Why this answer
Dynamic group rules support matching by compartment ID, instance ID, and defined/freeform tags.
You need to back up an Oracle Base Database System to an external target or move database files manually using RMAN. Which OCI storage service is typically used as a staging area for manual RMAN backups?
Object Storage is the standard cloud target for RMAN backup sets and database exports.
Why this answer
OCI Object Storage is used for storing RMAN backup sets when performing manual backups or database migrations.
Which THREE things must be configured to use Logging Analytics?
This defines the format and parsing.
Why this answer
Logging Analytics requires a log group, a log source, and an entity.
You manage an instance pool backed by an autoscaling configuration. The pool reaches its maximum limit of 10 instances due to a traffic spike. A hardware maintenance event triggers a retirement notification for one of the instances in the pool. How does OCI Instance Pools with Autoscaling handle this retired instance?
Instance pools manage the lifecycle of instances to ensure the target number of instances are operational, substituting retired instances seamlessly.
Why this answer
Instance pools automatically replace unhealthy or retired instances to maintain the desired capacity. If an instance is retired, the pool provisions a new instance to replace it, even if autoscaling has reached its maximum size, because minimum/desired capacity rules take precedence over instance retirement recovery.
NAT Gateways provide unidirectional outbound internet access for private resources.
Which service should you use to migrate physical data centers to OCI via physical hardware shipping?
This service uses physical appliances for bulk data move.
Why this answer
Data Transfer Service uses physical appliances to move data.
Static IPSec connections require explicit static route definitions in OCI for all destination subnets.
Why this answer
When using static routing for an OCI Site-to-Site VPN, you must define the static route rules (on-premises networks and VCN static routes) in the OCI IPSec connection configuration so Oracle knows which traffic to tunnel.
An OCI administrator needs to ensure that infrequently accessed data stored in an Object Storage bucket automatically transitions to Archive Storage after 90 days to reduce costs. Which feature should the administrator configure?
Lifecycle rules allow you to automate moving objects between tiers or deleting them after a certain period.
Why this answer
Object Storage Lifecycle Policy rules can be created to automatically transition objects from Standard storage to Infrequent Access or Archive Storage based on a specified number of days since creation or modification.
You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?
Preserving client IP allows backend servers to log the true client IP instead of the load balancer IP.
Why this answer
To preserve client source IP addresses, you should enable 'Backend Set - SSL/TCP' or configure proxy protocol / appropriate backend header settings depending on the listener type, but specifically in OCI Load Balancer, backend sets support preserving client IP headers.
What is the function of the OCI IAM 'inspect' verb?
Inspect grants listing/enumeration rights only, making it the most restrictive verb.
Why this answer
The 'inspect' verb allows users to list resources within a compartment or tenancy without viewing their sensitive configuration details or contents.
Page 1 of 7
Page 2Practice 1Z0-1072-26 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →