Courseiva

Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) (1Z0-1072-26) — Questions 151–225

524 questions total · 7pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 7

Page 4
151
MCQmedium

You need to restore an Oracle Base Database System to a specific point in time using incremental backups and archived redo logs. Which tool should you use at the OS level if you are managing the recovery manually?

A.Data Pump (impdp)
B.Oracle Recovery Manager (RMAN)
C.OCI Block Storage Volume Snapshots
D.SQL*Loader
AnswerB

RMAN is the native physical backup and point-in-time recovery utility for Oracle databases.

Why this answer

Oracle Recovery Manager (RMAN) is the standard Oracle tool used for backup, restoration, and recovery of database files including datafiles, control files, and archived redo logs.

Full explanation →
152
MCQhard

You are setting up a File Storage mount target. What is required at the subnet level?

A.A NAT Gateway
B.A Public IP
C.A Service Gateway
D.An IP address within the subnet
AnswerD

Mount targets are accessed via a private IP address.

Why this answer

Mount targets require a specific mount target IP and security rule access.

Full explanation →
153
MCQmedium

An application running on an OCI compute instance needs to share a POSIX-compliant file system concurrently across multiple compute instances residing in different subnets of the same VCN. Which storage service is best suited for this requirement?

A.Block Volume
B.Object Storage
C.File Storage Service
D.Local NVMe
AnswerC

FSS natively supports concurrent NFS connections from multiple compute instances across the VCN.

Why this answer

File Storage Service (FSS) provides a durable, scalable, enterprise-grade network file system that can be accessed concurrently by thousands of compute instances using the standard NFS v3.0 protocol across availability domains and subnets within a VCN.

Full explanation →
154
MCQeasy

What is the primary benefit of using Oracle Autonomous Database's autoscaling feature for CPU and storage?

A.It automatically pauses billing when the database is idle for more than one hour.
B.It automatically converts your database from Transaction Processing to Data Warehouse workloads.
C.It automatically migrates the database to a different cloud region during high load.
D.It automatically increases OCPU or storage capacity when workload spikes, and scales down when demand drops.
AnswerD

Autoscaling dynamically adjusts compute or storage resources based on real-time needs.

Why this answer

Autoscaling allows the database to automatically allocate additional CPU or storage resources when workload demands increase, without manual intervention.

Full explanation →
155
Multi-Selectmedium

Which TWO of the following statements regarding OCI Instance Configurations and Instance Pools are correct? (Choose two.)

Select 2 answers
A.Instance configurations can only be created from scratch using JSON templates, never from an existing running instance.
B.An instance configuration defines the blueprint (shape, image, metadata) used to provision instances in an instance pool.
C.Instance pools can only contain instances of different shapes and operating systems.
D.Autoscaling policies cannot be attached to instance pools.
E.Instance pools can be resized manually or scaled automatically using autoscaling rules.
AnswersB, E

Instance configurations serve as the template blueprint for instance pools.

Why this answer

Instance configurations act as templates for creating instance pools, and instance pools can be scaled manually or automatically via autoscaling configurations.

Full explanation →
156
MCQeasy

Which OCI service acts as a centralized dashboard to view health status of all OCI services in your region?

A.Audit service
B.Monitoring service
C.Service Health Dashboard
D.OCI Health Check
AnswerC

The dashboard provides the current status of OCI services.

Why this answer

The OCI Status page or Health dashboard provides a global view of service status.

Full explanation →
157
MCQeasy

What is the primary function of an OCI Internet Gateway?

A.To provide private access to regional Oracle Object Storage.
B.To provide bi-directional communication between a VCN and the public internet for public subnets.
C.To connect on-premises datacenters to OCI over dedicated circuits.
D.To route traffic between two VCNs in the same region.
AnswerB

Internet Gateways enable public subnet resources to send and receive traffic from the internet.

Why this answer

An Internet Gateway provides a path for bi-directional communication between your VCN and the public internet.

Full explanation →
158
MCQhard

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

A.Configure an Identity Provider (IdP) in OCI IAM by importing the SAML 2.0 metadata from the external IdP.
B.Provision local user accounts in OCI IAM for every partner employee.
C.Write a tenancy-wide policy allowing all external users to manage tenancy resources.
D.Create an API signing key pair for each partner user in OCI IAM.
AnswerA

Establishing the SAML 2.0 Identity Provider record in OCI IAM using metadata is the mandatory first step for federation.

Why this answer

To set up external federation in OCI, you must first create an Identity Provider (IdP) record by uploading the IdP metadata XML file.

Full explanation →
159
MCQmedium

An administrator has created a File Storage Service (FSS) file system in a private subnet. Developers need to mount this file system on compute instances across three different availability domains within the same region. What is the correct way to configure network access for FSS?

A.Attach the Block Volume to multiple instances simultaneously across availability domains.
B.Deploy a mount target in one subnet and configure security lists to allow NFS traffic from instances in all required subnets.
C.Create a separate FSS file system in each availability domain and peer them.
D.Use an OCI FastConnect circuit to route NFS traffic between availability domains.
AnswerB

A mount target provides the IP address and network endpoint, allowing NFS traffic from any authorized subnet in the region.

Why this answer

FSS is regional and can be mounted across availability domains in the same region, provided that mount targets are accessible via appropriate security lists and subnet routes.

Full explanation →
160
MCQmedium

When using File Storage Service, how do you restrict access to the file system to specific instances?

A.OS-level permissions only
B.IAM Policies only
C.Bucket Policies
D.Export Options
AnswerD

Export options manage NFS export access.

Why this answer

Export Options in FSS allow you to define access rules by IP or CIDR.

Full explanation →
161
MCQmedium

You are configuring a Site-to-Site VPN connection and need to test connectivity between an on-premises host and an OCI compute instance. The ping fails. You check the security lists and notice that ICMP traffic is blocked. Which rule type must you add to the security list to allow incoming ping requests?

A.A Service Gateway rule for ping requests
B.An Egress rule allowing TCP port 80
C.A NAT Gateway rule for ICMP translation
D.An Ingress rule allowing ICMP traffic (Type 8, Code 0 or All)
AnswerD

Ingress ICMP rules permit incoming ping packets to reach instances.

Why this answer

To allow ping (ICMP Type 8, Code 0 for Echo Request) into a subnet, you must add a stateful Ingress Security List rule specifying ICMP as the protocol.

Full explanation →
162
MCQmedium

You are troubleshooting a function timeout in OCI Functions. You notice that the function takes 30 seconds to initialize database connections on every cold start. How can you optimize this initialization overhead?

A.Enable instance pool autoscaling on the function application.
B.Place the database connection initialization code outside the main function handler method so it executes during container warm start.
C.Increase the function memory allocation to 32 GB.
D.Migrate the function container to an OKE cluster DaemonSet.
AnswerB

Global scope initialization runs once when the container spins up (cold start) and is reused for subsequent invocations (warm starts).

Why this answer

To avoid connection overhead on every cold start, database connection pools or initialization logic can be placed outside the function handler method so that container warm starts reuse existing connections.

Full explanation →
163
MCQeasy

Which Autonomous Database deployment model runs on dedicated Exadata infrastructure residing in a customer's OCI tenancy, providing maximum isolation?

A.Exadata Cloud at Customer (ExaCC)
B.Autonomous Database on Shared Infrastructure
C.Oracle Base Database System
D.Autonomous Database on Dedicated Exadata Infrastructure
AnswerD

Dedicated infrastructure provides isolated Exadata resources exclusively for a single tenant.

Why this answer

Autonomous Database on Dedicated Exadata Infrastructure (Autonomous Dedicated) provides a completely dedicated database environment within a dedicated Exadata rack.

Full explanation →
164
Multi-Selectmedium

Which TWO statements are correct regarding OCI Block Volume backups and clones?

Select 2 answers
A.Block volume backups are stored directly in File Storage Service file systems.
B.Block volume backups require manual deletion of the parent volume before the backup can be restored.
C.Block volume backups can be restored as new volumes in any Availability Domain within the same region.
D.Block volume clones can be created instantly without waiting for a full backup to complete.
E.A block volume clone can be attached to compute instances in a different Availability Domain than the source volume.
AnswersC, D

Backups are regional resources and can be restored to any AD in the region where the backup exists.

Why this answer

Block volume clones are created instantly within the same availability domain without needing a full data copy, and block volume backups are stored in Object Storage and can be restored as new volumes across ADs.

Full explanation →
165
MCQhard

An enterprise application requires long-term compliance retention for regulatory records stored in OCI Object Storage. The administrator must ensure that stored objects cannot be modified, overwritten, or deleted by any user, including administrators, for a mandated retention period. Which feature should be used?

A.Object Storage Object Lock (Retention Rules)
B.Block Volume Replication
C.IAM Policy with Deny DELETE statements
D.Object Storage Bucket Access Policy with Read-Only permissions
AnswerA

Object Storage Retention Rules (Object Lock) enforce write-once-read-many (WORM) behavior to protect data from deletion or modification during the retention period.

Why this answer

Object Storage Object Versioining combined with Object Storage Object Lifecycle Rules or Object Lock (Retention Rules) prevents accidental or malicious deletion or modification of data for regulatory compliance.

Full explanation →
166
MCQeasy

What is the maximum number of Availability Domains (ADs) in a typical multi-AD OCI region?

A.1
B.3
C.5
D.2
AnswerB

Multi-AD OCI regions feature 3 distinct Availability Domains.

Why this answer

Standard multi-AD OCI regions contain exactly 3 Availability Domains.

Full explanation →
167
MCQmedium

What is the primary benefit of enabling 'Versioning' on an Object Storage bucket?

A.Faster data access
B.Lower storage costs
C.Improved data security
D.Recovery from accidental deletion
AnswerD

Versioning allows restoring previous versions of objects.

Why this answer

Versioning protects against accidental overwrites or deletions by keeping historical versions.

Full explanation →
168
MCQeasy

Which type of Oracle database deployment provides full administrative privileges (SYS and SYSTEM access) at the operating system and database level in OCI?

A.Autonomous JSON Database
B.Oracle Autonomous Database
C.Oracle Database Serverless Cloud Service
D.Oracle Base Database System (Virtual Machine or Bare Metal)
AnswerD

Base DB systems give customers full root OS access and database administrator rights.

Why this answer

Base Database Systems (VM and BM) provide full root access to the OS via SSH and full DBA privileges on the database.

Full explanation →
169
MCQmedium

You are provisioning an Exadata Database Service on Dedicated Infrastructure and need to choose a shape that supports high performance workloads. Which option represents a valid Exadata shape family available in OCI?

A.Exadata.X9M.8
B.BM.GPU.DenseIO2.8
C.Exadata.X9M.Quarter3
D.VM.Standard2.4
AnswerA

Exadata X9M shapes follow a format such as Exadata.X9M.8 for database servers and storage servers.

Why this answer

Exadata Database Service utilizes specific hardware shapes such as X9M and X10M, categorized by quarter, half, or full racks.

Full explanation →
170
MCQmedium

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

A.Write a policy with the condition: where request.time.hour between '09:00' and '17:00'
B.Configure an IAM security policy rule using the schedule builder in the OCI Console.
C.Use the 'time-window' parameter in the dynamic group matching rule.
D.OCI IAM policies do not support time-of-day or day-of-week conditions; this must be managed via external IdP federation policies or session token lifetimes.
AnswerD

OCI IAM policies lack time-based conditional variables; time-based access control must be handled at the Identity Provider level prior to issuing tokens.

Why this answer

OCI IAM policies do not natively support time-of-day or day-of-week conditional constraints directly in policy syntax.

Full explanation →
171
MCQeasy

What is the primary purpose of an OCI API signing key?

A.To encrypt data at rest inside Object Storage buckets.
B.To establish IPsec VPN tunnels between corporate datacenters and OCI VCNs.
C.To cryptographically sign API requests made by OCI SDKs, CLI, or REST API clients.
D.To authenticate users logging into the OCI web-based Console.
AnswerC

API signing keys authenticate programmatic requests by signing the HTTP headers.

Why this answer

API signing keys are cryptographic key pairs used to sign API requests made via the OCI CLI, SDKs, or REST API.

Full explanation →
172
MCQeasy

Your development team needs to perform automated regression testing against a production copy of an Autonomous Transaction Processing (ATP) database. Which feature allows you to create a point-in-time, space-efficient copy of the production database instantly?

A.Autonomous Database Clone (Thin Clone)
B.Cross-Region Object Storage Export
C.Autonomous Database Data Guard
D.Oracle RMAN Duplicate Database
AnswerA

Cloning creates an instant, space-efficient copy of the database.

Why this answer

Autonomous Database Clones allow you to create either a full clone or a metadata-only thin clone instantly for development and testing purposes.

Full explanation →
173
Multi-Selectmedium

Which TWO statements are true regarding OCI Storage Gateway? (Choose two.)

Select 2 answers
A.It provides native block-level SAN connectivity over Fibre Channel.
B.It runs as a virtual machine on-premises, such as on Oracle VM or VMware.
C.It can only be used with Archive Storage for instant data retrieval.
D.It replaces the need for Object Storage buckets in the cloud entirely.
E.It translates file operations (NFS) into Object Storage REST API calls.
AnswersB, E

Storage Gateway is deployed as an on-premises virtual appliance.

Why this answer

Storage Gateway is a cloud storage gateway that runs on-premises, translating file storage protocols (NFS) to object storage REST APIs.

Full explanation →
174
MCQhard

You are experiencing high latency on your FSS mount. What should you check first?

A.Block volume size
B.Network Security List rules
C.Object storage versioning
D.Bucket policies
AnswerB

Misconfigured security lists blocking NFS traffic cause latency.

Why this answer

Network security lists and mount options are common culprits for FSS latency.

Full explanation →
175
Multi-Selectmedium

Which THREE actions are required to successfully set up an Alarm?

Select 3 answers
A.Define a Metric query
B.Create a Notification Topic
C.Create an IAM user for the metric
D.Subscribe to the Notification Topic
E.Configure a Service Gateway
AnswersA, B, D

The alarm needs to know what to track.

Why this answer

To set up an alarm, you must have a metric, a notification topic, and a subscription to that topic.

Full explanation →
176
MCQhard

You are planning disaster recovery for an Exadata Database Service on Dedicated Infrastructure. You need to configure Oracle Active Data Guard with real-time apply. What unique capability does Active Data Guard provide over standard Data Guard?wirtschaft

A.It replicates data at the block level across heterogeneous database engines (e.g., PostgreSQL to Oracle).
B.It allows read-only queries to run on the physical standby database while real-time redo apply is active.
C.It automatically shards the primary database tables across multiple standby regions.
D.It allows read-write operations on the standby database while synchronizing with the primary.
AnswerB

Active Data Guard enables read-only workloads on the standby database.

Why this answer

Active Data Guard allows the physical standby database to be open for read-only queries while simultaneously applying redo received from the primary database in real time.

Full explanation →
177
Multi-Selectmedium

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Select 3 answers
A.Assign a private IP address directly to a compartment
B.Create nested child compartments up to 6 levels deep
C.Convert a compartment into a virtual cloud network
D.Delete an empty compartment
E.Move a compartment to a new parent compartment
AnswersB, D, E

OCI supports nesting compartments up to 6 levels deep from the root.

Why this answer

Compartments can be created, moved within the hierarchy (reparented), and deleted (when empty).

Full explanation →
178
Multi-Selectmedium

Which TWO types of targets can be specified in an OCI VCN route table rule?

Select 2 answers
A.Block Volume
B.NAT Gateway
C.Identity and Access Management (IAM) Policy
D.Object Storage Bucket
E.Internet Gateway
AnswersB, E

NAT Gateways can be set as route targets for outbound private internet traffic.

Why this answer

Route table targets in OCI include Internet Gateways, NAT Gateways, Service Gateways, Dynamic Routing Gateways, Local Peering Gateways, and private IPs of VNICs (such as firewalls).

Full explanation →
179
MCQhard

An administrator wishes to enable Autonomous Data Guard for an Autonomous Database on Dedicated Exadata Infrastructure. What is the primary benefit of enabling this feature?

A.It automatically provisions a standby database and handles failover and switchover operations to ensure high availability.
B.It allows read-write operations simultaneously on both primary and standby databases across regions.
C.It automatically shards tables across two different cloud regions to speed up write operations.
D.It reduces cloud storage billing by compressing redundant backup blocks on the standby instance.
AnswerA

Autonomous Data Guard automates standby provisioning and failover workflows for maximum availability.

Why this answer

Autonomous Data Guard provides high availability by automatically maintaining a standby database in a different availability domain or region with zero data loss protection.

Full explanation →
180
Multi-Selecthard

Which THREE features are supported by Oracle Base Database Service on virtual machines? (Choose three.)

Select 3 answers
A.Automated daily and weekly backups to OCI Object Storage
B.Automatic zero-downtime shard migration across tenants
C.Complete root access to the underlying compute instances
D.Oracle Data Guard configuration for high availability
E.Automatic scaling of physical server hardware racks
AnswersA, C, D

Automated backups are a core feature of Base Database Service.

Why this answer

Base Database Service on VMs supports Data Guard, automated backups, database edition changes (e.g., Enterprise to High Performance), and custom DB systems.

Full explanation →
181
MCQmedium

How do you ensure data integrity for uploads to Object Storage?

A.Encryption
B.Versioning
C.HTTPS
D.MD5 checksum
AnswerD

Calculating and providing an MD5 checksum validates integrity.

Why this answer

Using MD5 hashing ensures the object was not corrupted during transit.

Full explanation →
182
MCQhard

You need to migrate a 10 TB Oracle Database from an on-premises data center to OCI Base Database Service with minimal downtime. Which migration tool leverages Oracle Data Guard to achieve near-zero downtime?

A.SQL Developer database copy wizard
B.Oracle Data Pump export and import
C.OCI Object Storage manual file copy using multipart uploads
D.Oracle Zero Downtime Migration (ZDM) with physical migration method
AnswerD

ZDM utilizes Oracle Data Guard under the hood to replicate data to the cloud with minimal cutover downtime.

Why this answer

Oracle Zero Downtime Migration (ZDM) automates database migrations using Data Guard for physical migrations with minimal downtime.

Full explanation →
183
Multi-Selectmedium

Which THREE features are core capabilities of the OCI Audit service? (Choose three.)

Select 3 answers
A.Automatically recording API calls for all OCI services within a tenancy.
B.Enabling retention configuration of audit log data to meet compliance requirements.
C.Triggering auto-scaling groups based on real-time memory usage metrics.
D.Real-time execution of Terraform infrastructure code modifications.
E.Providing a searchable history of who made API calls, from which IP, and when.
AnswersA, B, E

Correct. Audit automatically captures API activity across the tenancy.

Why this answer

OCI Audit automatically records calls to all supported OCI public API endpoints, supports querying via Log Explorer, and retains logs for a specified period.

Full explanation →
184
Multi-Selecthard

Which THREE security best practices should be implemented when deploying and managing OCI Functions? (Choose three.)

Select 3 answers
A.Using dynamic groups and IAM policies to grant functions least-privilege access to other OCI resources
B.Attaching function applications to private subnets within a VCN when connecting to private backend services
C.Storing database credentials and API keys in OCI Vault rather than hardcoding them in source code
D.Hardcoding tenancy administrator credentials in environment variables for easy access
E.Disabling authentication on API Gateways triggering functions to allow open public access
AnswersA, B, C

Dynamic groups and IAM policies provide secure resource principals for functions.

Why this answer

Security best practices for functions include using dynamic groups and IAM policies for least-privilege resource access, storing sensitive strings in OCI Vault, and deploying functions in private subnets with VCN integration.

Full explanation →
185
Multi-Selecthard

Which TWO characteristics distinguish Exadata Cloud Service (ExaCS) from standard Oracle Base Database Systems?

Select 2 answers
A.Requirement to run exclusively on Windows Server operating systems
B.Exclusive reliance on standard OCI Block Volume iSCSI storage
C.Support for Hybrid Columnar Compression (HCC)
D.Inclusion of intelligent storage servers supporting Smart Scan capability
E.Inability to use Oracle Real Application Clusters (RAC)
AnswersC, D

HCC is an Exadata-specific storage feature.

Why this answer

ExaCS features specialized Exadata storage servers with Smart Scan and supports Hybrid Columnar Compression, unlike standard Base DB systems.

Full explanation →
186
MCQhard

You are designing a disaster recovery strategy for an OCI compute instance. You need to replicate boot volume backups to a secondary region. How should you accomplish this?

A.Configure a local peering gateway between the two regions' boot storage endpoints.
B.Boot volume backups cannot be copied across regions; you must recreate the instance manually.
C.Use the OCI Console or CLI to copy the boot volume backup to the destination region.
D.Attach the boot volume backup as an Object Storage bucket and sync via FTP.
AnswerC

Backups support native cross-region copying for disaster recovery.

Why this answer

Boot volume backups can be copied across regions using the cross-region copy feature in the OCI Console or CLI, allowing you to restore them as boot volumes in another region.

Full explanation →
187
MCQeasy

Which OCI service is best suited for real-time monitoring of CPU and Memory utilization on a Compute instance?

A.Resource Manager
B.Logging service
C.Events service
D.Monitoring service
AnswerD

Monitoring provides real-time metrics for OCI resources.

Why this answer

The Monitoring service automatically collects standard metrics for Compute instances.

Full explanation →
188
Multi-Selectmedium

Which TWO actions can be performed on an active OCI Block Volume without detaching it from the compute instance? (Choose two.)

Select 2 answers
A.Change the volume from Balanced performance tier to Higher Performance tier
B.Delete the block volume while it is attached
C.Migrate the volume to a different availability domain
D.Increase the volume size (resizing)
E.Convert a block volume into a File Storage Service mount target
AnswersA, D

Performance tiers can be modified dynamically on attached volumes.

Why this answer

OCI Block Volumes support live resizing and dynamic performance tier adjustments without requiring volume detachment.

Full explanation →
189
MCQmedium

You are using the Events service to trigger a Function. What is a required step before this can work?

A.Attach a load balancer
B.Enable HTTP access on the function
C.Grant 'use' permissions on the function to the Events service
D.Create a Service Connector
AnswerC

The events service needs IAM permissions to execute the target function.

Why this answer

You must have a policy that allows the Events service to invoke the function.

Full explanation →
190
Multi-Selectmedium

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Select 3 answers
A.Source IP address of the API request (request.ip)
B.The user's corporate salary bracket
C.Target resource defined tags (target.tag)
D.Source subnet OCID of the API request (request.subnet.id)
E.The local weather conditions in the data center region
AnswersA, C, D

request.ip allows policies to restrict access based on client IP or CIDR blocks.

Why this answer

OCI IAM policies support conditional variables such as request.ip, request.subnet.id, and target.tag.

Full explanation →
191
Multi-Selecthard

Which THREE statements regarding OCI VCN Route Tables are correct?

Select 3 answers
A.Each subnet in a VCN must be associated with a route table.
B.Route tables perform firewall packet inspection like Network Security Groups.
C.A subnet can be associated with multiple route tables simultaneously.
D.A single route table can be associated with multiple subnets.
E.Route rules support specific CIDRs as well as the default destination 0.0.0.0/0.
AnswersA, D, E

Every subnet relies on an associated route table to determine packet forwarding.

Why this answer

Route tables contain rules that map destination CIDR blocks to target gateways. Each subnet must be associated with a route table, and route tables can be shared across multiple subnets.

Full explanation →
192
Multi-Selecthard

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Select 2 answers
A.An NSG can contain VNICs from multiple different subnets within the same VCN.
B.Every subnet must have at least one NSG associated with it by default.
C.NSG rules can reference other NSGs as the source or destination.
D.NSGs can span across multiple different VCNs in the same region.
E.NSGs replace Security Lists entirely and Security Lists are deprecated.
AnswersA, C

NSGs span subnets within the same VCN, allowing granular grouping of VNICs.

Why this answer

NSGs apply only to a specified set of VNICs and are independent of VCN subnets. They support both stateful and stateless rules.

Full explanation →
193
Multi-Selecteasy

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

Select 2 answers
A.Manage group memberships for the user
B.Modify the physical hardware serial number of the user's laptop
C.Deactivate or block a user account
D.Configure the user's home Wi-Fi router security settings
E.Directly access the user's corporate email inbox
AnswersA, C

Administrators assign and remove users from IAM groups.

Why this answer

Administrators can deactivate user accounts, force password resets, and manage group memberships.

Full explanation →
194
MCQeasy

What is the primary way to access an Object Storage bucket via a private endpoint?

A.Internet Gateway
B.NAT Gateway
C.Service Gateway
D.DRG
AnswerC

Service Gateway provides private access to OCI public services.

Why this answer

A Service Gateway allows private access from a VCN to Object Storage.

Full explanation →
195
Multi-Selectmedium

Which TWO protocols are supported for OCI Site-to-Site VPN IPSec tunnels?

Select 2 answers
A.BGP over SSL
B.IKEv1
C.HTTPS tunneling
D.SNMPv3
E.IKEv2
AnswersB, E

IKEv1 is supported for legacy or compatibility requirements in OCI VPNs.

Why this answer

OCI Site-to-Site VPN supports Internet Key Exchange (IKE) protocol versions IKEv1 and IKEv2 for establishing IPSec VPN tunnels.

Full explanation →
196
MCQeasy

You need to deploy a traditional Oracle Database on OCI where you have complete administrative root access to the underlying operating system and database server. Which Oracle Database service should you choose?

A.OCI NoSQL Database
B.Exadata Cloud Service with Autonomous Container Databases
C.Oracle Base Database Service
D.Oracle Autonomous Database
AnswerC

Base Database Service provides full control over the database and operating system.

Why this answer

Oracle Base Database Service allows you full administrative control, including SYSDBA access and root access to the underlying virtual machine compute instances.

Full explanation →
197
Multi-Selectmedium

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

Select 3 answers
A.Read configuration metadata of resources
B.Modify tenancy-level IAM administrator passwords for other users
C.Automatically bypass all VCN security lists
D.Create and delete resources within the resource family
E.Inspect and list resources
AnswersA, D, E

Manage includes all read and inspect privileges.

Why this answer

The 'manage' verb encompasses all permissions: inspect, read, use, and full creation/deletion capabilities.

Full explanation →
198
MCQmedium

When provisioning an Oracle Base Database Service DB system, which storage management software is used underneath to provide high performance and reliable storage volumes?

A.Oracle Automatic Storage Management (ASM)
B.ZFS Storage Appliance software
C.EXT4 journaling file system
D.Linux Logical Volume Manager (LVM)
AnswerA

Oracle ASM is the built-in volume manager and file system for Oracle databases on OCI DB systems.

Why this answer

Oracle Base Database Service utilizes Oracle Automatic Storage Management (ASM) for managing database storage volumes.

Full explanation →
199
MCQeasy

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

A.A SSH key pair generated specifically for IAM authentication.
B.A password and an MFA token code.
C.An API signing key pair (PEM format) and its corresponding fingerprint.
D.A pre-authenticated request URL.
AnswerC

OCI CLI and SDKs authenticate API requests using an RSA public/private API signing key pair uploaded to the user profile.

Why this answer

Programmatic access requires API signing key pairs (public/private key) along with the user's tenancy OCID, user OCID, and region.

Full explanation →
200
MCQmedium

Which service is the best choice for storing thousands of small, frequently accessed image files?

A.Archive Storage
B.Block Volume
C.File Storage
D.Object Storage
AnswerD

Object storage is ideal for media files.

Why this answer

Object Storage is optimized for high-scale, flat-namespace object storage.

Full explanation →
201
Multi-Selecthard

Which THREE features are associated with OCI Dedicated Virtual Machine Hosts? (Choose three.)

Select 3 answers
A.Visibility into host-level resource capacity and placement control
B.Exclusive physical hardware tenancy isolation where no other tenants share the physical server
C.The ability to place multiple virtual machine instances across the dedicated physical host
D.Automatic multi-cloud replication across AWS and Azure physical datacenters
E.The ability to convert the dedicated host directly into a Kubernetes master node without OS reinstallation
AnswersA, B, C

Dedicated hosts provide visibility into available OCPUs and memory on the physical host.

Why this answer

Dedicated VM hosts provide physical hardware isolation, allow you to run multiple virtual machine instances on a single dedicated server, and give you visibility into host resource capacity.

Full explanation →
202
MCQhard

You are designing an IAM policy hierarchy for a multi-tenant OCI environment. You write the following statement in the root compartment: 'Define tenancy TenantA as ocid1.tenancy.oc1..aaaaaaa...; Define group NetworkAdmins as ocid1.group.oc1..aaaaaaa...; Allow group NetworkAdmins to manage virtual-network-family in tenancy TenantA'. What type of policy cross-tenancy grant does this represent?

A.A cross-tenancy policy where TenantA is the granting tenancy and the principal belongs to an external identity provider.
B.A local policy granting compartment-level administration.
C.A cross-tenancy policy where the remote group is granted permissions within the defining tenancy.
D.An invalid policy because cross-tenancy policies cannot span virtual network families.
AnswerC

Cross-tenancy access involves using 'Define tenancy' and 'Define group' statements to grant external principals access to local resources.

Why this answer

This represents a remote policy (or cross-tenancy access) where the administrator of TenantA trusts a principal (NetworkAdmins) from another tenancy by defining the remote tenancy and group, and allowing them access.

Full explanation →
203
MCQmedium

You are troubleshooting a deployment failure in Resource Manager. Where can you see the detailed Terraform output logs?

A.Events logs
B.Job logs
C.Audit logs
D.Cloud Shell logs
AnswerB

The Job execution logs contain the complete Terraform output.

Why this answer

The Job details page in Resource Manager shows the full output of the terraform apply/plan operations.

Full explanation →
204
MCQeasy

Which OCI storage service is best suited for big data workloads requiring high throughput?

A.Archive Storage
B.Block Volume
C.Object Storage
D.File Storage
AnswerB

Block Volume provides high throughput and IOPS.

Why this answer

Block Volume is optimized for high-performance throughput for data-intensive apps.

Full explanation →
205
MCQeasy

What is the maximum number of Route Tables allowed per Virtual Cloud Network (VCN) in OCI?

A.Exactly 1
B.Exactly 2
C.Zero
D.Multiple (subject to service limits)
AnswerD

You can create multiple route tables in a VCN to apply different routing rules to different subnets.

Why this answer

While there is a generous service limit, multiple route tables can be created and associated with different subnets within a VCN.

Full explanation →
206
MCQeasy

Which component of the Notifications service is used to define the destination for alerts?

A.Topic
B.Subscription
C.Policy
D.Alarm
AnswerB

The subscription maps the topic to a specific endpoint.

Why this answer

A Subscription defines the delivery protocol (e.g., Email, PagerDuty, Slack) for a Topic.

Full explanation →
207
MCQmedium

Which tool provides a graphical way to manage Object Storage lifecycle policies?

A.OCI CLI
B.API Explorer
C.Web Console
D.Terraform
AnswerC

The console provides a point-and-click interface.

Why this answer

The OCI Web Console provides the interface for lifecycle policy management.

Full explanation →
208
MCQmedium

You are scaling up an Oracle Base Database System (VM) to add more storage to your existing database data disk group (+DATA). What is the correct procedure in the OCI Console?

A.Terminate the DB system, create a larger block volume, and attach it as root.
B.Create a clone of the database to a new shape with higher storage limits.
C.Edit the DB system storage size in the OCI Console to allocate more storage.
D.Log into the OS via SSH, format a new iSCSI disk, and manually add it to the ASM disk group using SQL*Plus.
AnswerC

Editing the storage size in the console triggers automatic backend resizing and ASM expansion.

Why this answer

For Base DB systems, you can increase the storage size directly in the OCI Console, and ASM automatically recognizes and resizes the disk groups.

Full explanation →
209
MCQeasy

What is the primary purpose of OCI compartments?

A.To replace Virtual Cloud Networks for internal subnetting.
B.To isolate physical data center hardware for specific customers.
C.To automatically replicate data across multiple OCI regions for disaster recovery.
D.To organize and isolate cloud resources for security, access control, and billing management.
AnswerD

Compartments provide logical organization, fine-grained access control via policies, and cost tracking.

Why this answer

Compartments are logical isolations used to organize and control access to OCI resources across projects and departments.

Full explanation →
210
MCQeasy

Which feature allows you to restrict access to an Object Storage bucket to only specific VCNs?

A.Bucket Policies
B.Encryption
C.Object Versioning
D.Lifecycle Rules
AnswerA

Bucket policies allow granular access control based on IP or CIDR.

Why this answer

Service Gateways and IAM policies allow restricted access to Object Storage from VCNs.

Full explanation →
211
MCQmedium

A database administrator requires a Block Volume attached to an Oracle Linux compute instance to deliver ultra-high IOPS and throughput with minimal latency for a high-transaction workload. Which volume performance level should be selected?

A.Archive
B.Ultra High Performance
C.Lower Cost
D.Balanced
AnswerB

Ultra High Performance provides maximum IOPS and throughput per GB for demanding database workloads.

Why this answer

Higher VPU (Volume Performance Units) settings such as Higher Performance or Ultra High Performance provide the necessary IOPS and throughput required for mission-critical, low-latency databases.

Full explanation →
212
MCQmedium

You are configuring an OCI Public Load Balancer and notice that backend instances are marked as unhealthy. Upon inspecting the health check URL on the backend server via curl, it returns HTTP 200. What is the most likely reason the load balancer still reports them as unhealthy?

A.The VCN has an Internet Gateway attached.
B.The load balancer shape is set to 10 Gbps instead of 100 Mbps.
C.Security lists or NSGs on the backend instances are blocking traffic from the Load Balancer subnet on the listener/health check port.
D.The NAT Gateway is misconfigured.
AnswerC

Backend security rules must allow incoming health check probes from the load balancer.

Why this answer

If backend servers return HTTP 200 locally but are unhealthy in the load balancer, security list rules or NSGs on the backend subnet are likely blocking incoming health check probes from the load balancer subnet.

Full explanation →
213
MCQhard

An OCI administrator creates a subnet and associates a security list with it. An instance in this subnet cannot connect to an external API on HTTPS (port 443). The security list has an ingress rule for port 443, but no egress rules defined. Why is the connection failing?

A.Ingress rules apply to outbound connections.
B.The instance needs a public IP address to make outbound API calls.
C.Port 443 is blocked globally across all OCI regions.
D.The security list lacks an egress rule allowing outbound traffic to port 443 (or all ports), or the default egress rule was removed.
AnswerD

Outbound connections initiated by an instance require a matching egress rule in stateful security lists.

Why this answer

By default, OCI Security Lists are stateful, meaning return traffic for ingress is automatically allowed. However, outbound (egress) traffic initiated by the instance requires an explicit egress rule (or a default egress rule allowing all traffic out) if egress rules are modified or restricted.

Full explanation →
214
MCQhard

You are managing an OKE cluster and need to perform a major Kubernetes version upgrade. You want to minimize application downtime during the upgrade process of worker nodes. What feature should you configure on your node pools during upgrade?

A.Node pool rolling update settings with maxSurge and maxUnavailable configured
B.Pausing the Kubernetes API server while upgrading individual node kernels via SSH
C.Simultaneous termination of all worker nodes to force quick cluster recreation
D.Converting all worker nodes to serverless container instances
AnswerA

Configuring rolling update parameters ensures orderly replacement of nodes without interrupting workloads.

Why this answer

When upgrading OKE node pools, you can configure maximum surge and maximum unavailable parameters to perform rolling node upgrades with zero application downtime.

Full explanation →
215
Multi-Selecthard

Which THREE statements regarding OCI IPv6 implementation in VCNs are correct?

Select 3 answers
A.Security lists and NSGs support rules for IPv6 traffic filtering.
B.Subnets within an IPv6-enabled VCN can be assigned /64 IPv6 prefixes.
C.IPv6 is mandatory for all new VCN creation in OCI.
D.IPv6 addresses in OCI require a NAT Gateway for outbound internet access.
E.You can assign an IPv6 GUA (Globally Unique Address) prefix of /56 to your VCN.
AnswersA, B, E

Security rules can be configured for IPv6 CIDRs just like IPv4.

Why this answer

OCI supports IPv6 addressing. You can assign IPv6 CIDR blocks (/56) to your VCN, assign IPv6 subnets (/64) to subnets, and configure security rules and route tables for IPv6 traffic.

Full explanation →
216
Multi-Selecthard

When designing a comprehensive tagging strategy in OCI, which THREE practices or features should you implement for effective governance and cost management? (Choose three.)

Select 3 answers
A.Use IAM policies to control which user groups are permitted to update specific defined tag values.
B.Rely exclusively on Freeform Tags to eliminate administrative overhead for tag namespaces.
C.Use Defined Tags to organize and enforce a controlled namespace and key-value structure.
D.Configure OCI Notifications to convert tag keys into email subscriptions automatically.
E.Implement Tag Defaults to automatically apply specific tags to all resources created in a compartment.
AnswersA, C, E

Correct. IAM policies can govern who can apply or modify defined tags.

Why this answer

Effective OCI tagging relies on defined tags, tag defaults, and IAM policies to restrict tag value modifications.

Full explanation →
217
MCQhard

You are running an application on an OKE cluster. You want to ensure that specific pods belonging to a high-priority database caching tier are never scheduled onto the same worker node as each other to avoid a single node failure taking down the entire cache tier. What Kubernetes feature should you configure?

A.Persistent Volume Claims
B.Kubernetes Network Policies
C.Horizontal Pod Autoscaler
D.Pod Anti-Affinity
AnswerD

Pod anti-affinity ensures that specific pods are dispersed across different worker nodes.

Why this answer

Kubernetes pod anti-affinity allows you to specify rules that prevent pods with matching labels from being scheduled on the same node, availability domain, or fault domain.

Full explanation →
218
Multi-Selecthard

Which THREE things can you do with Resource Manager?

Select 3 answers
A.Provision infrastructure using Terraform
B.Scan for malware on compute instances
C.Directly patch OS images
D.Import existing Terraform configurations
E.Maintain Terraform state files
AnswersA, D, E

This is the primary function of the service.

Why this answer

Resource Manager supports provisioning resources, managing state, and importing existing configurations.

Full explanation →
219
MCQeasy

What is the primary purpose of OCI Object Storage?

A.High-performance cache
B.Database storage
C.Unstructured data storage
D.OS swap space
AnswerC

Object storage is ideal for logs, media, and backups.

Why this answer

Object storage is designed for unstructured data storage.

Full explanation →
220
MCQeasy

An application requires an Oracle Autonomous Database that supports complex analytical queries, reporting, and high-throughput data warehousing workloads. Which workload type should you select during provisioning?

A.JSON Database
B.APEX
C.Data Warehouse
D.Transaction Processing
AnswerC

Data Warehouse is the correct workload type for complex analytics and reporting.

Why this answer

Autonomous Data Warehouse (ADW) is optimized for data warehousing, complex analytical queries, and reporting workloads, whereas ATP is optimized for OLTP workloads.

Full explanation →
221
MCQmedium

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

A.It routes all traffic to a single primary datacenter until manual failover occurs.
B.It routes users based strictly on their geographic location.
C.It distributes traffic across multiple endpoints according to assigned weights and health checks.
D.It routes traffic based on client ASN numbers.
AnswerC

Load Balancer steering policies distribute traffic across pools based on weights and liveness.

Why this answer

Load Balancer steering distributes traffic across a pool of endpoints based on specified weights and health status, similar to load balancing algorithms.

Full explanation →
222
MCQhard

An OCI customer has an architecture where VCN-A, VCN-B, and VCN-C are connected to a central DRG in a Hub-and-Spoke topology. VCN-A needs to communicate with VCN-B, but VCN-C must be completely isolated from VCN-A. How should the DRG route tables and attachments be configured?

A.Configure NAT Gateways on all spoke VCNs.
B.Attach an Internet Gateway to VCN-C to block internal DRG traffic.
C.Use custom DRG route tables for each attachment, ensuring VCN-A's route table does not import routes from VCN-C's attachment.
D.Delete all subnets in VCN-C.
AnswerC

Custom DRG route tables and import/export controls allow precise isolation between spoke VCNs.

Why this answer

To isolate VCN-C from VCN-A, you assign VCN-A and VCN-C attachments to separate DRG route tables. VCN-A's route table imports routes for VCN-B but does not import routes for VCN-C, and vice versa.

Full explanation →
223
MCQmedium

You are managing an Oracle Base Database System and need to configure automated backups. By default, where does OCI store these automated backups?

A.A customer-managed File Storage Service (FSS) mount target
B.An Oracle-managed Object Storage bucket
C.The local root file system (/u01) of the database VM
D.A locally attached block volume separate from the database data disk
AnswerB

Oracle-managed Object Storage is the default repository for automated DB backups.

Why this answer

OCI stores automated backups of database systems in an Oracle-managed Object Storage bucket specific to your tenancy.

Full explanation →
224
MCQeasy

Your development team needs instances residing in a private subnet to download software patches and updates from the Oracle Cloud Infrastructure (OCI) Object Storage service without exposing those instances to the public internet. Which gateway should you configure?

A.Service Gateway
B.Internet Gateway
C.NAT Gateway
D.Local Peering Gateway
AnswerA

A Service Gateway allows private access to OCI services like Object Storage without public internet exposure.

Why this answer

A Service Gateway routes traffic from a VCN to supported Oracle services, such as Object Storage, within the Oracle network fabric without going over the public internet.

Full explanation →
225
MCQeasy

Which utility is used to authenticate and push custom container images built for OCI Functions to the Oracle Registry (OCIR)?

A.VCN Management Console
B.Terraform CLI
C.OCI Object Storage CLI
D.Docker CLI
AnswerD

Docker CLI is standard for tagging, logging into registries, and pushing container images.

Why this answer

Docker CLI (or podman) is used to log in to OCIR (`docker login iad.ocir.io`) using an auth token and push container images.

Full explanation →
Page 2

Page 3 of 7

Page 4

All pages

1234567

Practice 1Z0-1072-26 by domain

Target a specific domain to shore up weak areas.

DatabaseNetworkingIdentity And Access ManagementComputeStorageObservability And Management
See all domains with question counts →