Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) (1Z0-1072-26) — Questions 226–300

Oracle Cloud Infrastructure enforces a strict structural dependency that prevents the deletion of any compartment while it still contains active child resources. To satisfy this prerequisite, you must manually terminate every contained resource or migrate them to an alternative compartment using the console or API. Only when the resource count drops to zero does the API permit the parent compartment deletion request to proceed, safeguarding against accidental orphaned assets and cascading data loss.

A private DNS zone becomes resolvable inside a VCN only when attached through a VCN view, which binds the zone to the VCN's resolver. Creating the zone alone leaves instances unable to query internal.corp records.

Tag-based policies require the full chain: a namespace, a key inside it, the tag applied to the target resource, then a condition referencing that key and value. Skipping any step leaves the policy condition unresolvable.

OCI Data Transfer Appliance provides a secure physical storage device that you populate on-premises and ship to Oracle for direct ingestion into Object Storage, satisfying the constraint of migrating massive datasets where available network bandwidth is insufficient for online transfer. This offline mechanism bypasses internet latency and bandwidth limitations by securely encrypting your data locally on specialized high-capacity hardware before physical transit.

Archive Storage provides the lowest cost per gigabyte for infrequently accessed data within Oracle Cloud Infrastructure by design, perfectly satisfying the requirement for minimal expense. Although retrieval operations require a restoration period of up to several hours before access is granted, this operational constraint aligns directly with the stipulation that retrieval times must be maintained within a few hours. This makes it the most cost-effective tier for long-term data retention where immediate access is unnecessary.

Oracle Cloud Infrastructure Identity and Access Management permits a single user account to be associated with multiple groups simultaneously, satisfying the requirement that users are not restricted to a solitary administrative domain. This many-to-many relationship mechanism aggregates permissions effectively, allowing administrators to assign cumulative policies to a user without duplicating group memberships or creating redundant accounts, thereby streamlining access control across diverse compartments.

Object Storage retention rules satisfy the specific constraint of maintaining data unchanged for a defined period by enforcing write-once-read-many (WORM) policies on buckets. When applied, these rules prevent any modifications or deletions of objects until the specified retention duration expires, ensuring strict regulatory compliance and data immutability without requiring manual intervention for each individual file.

OCI File Storage satisfies the requirement for a shared file system accessible by hundreds of Linux compute instances simultaneously because it implements the Network File System version 3 (NFSv3) protocol. This fully managed service provides a distributed file system that can be mounted concurrently across multiple Oracle Cloud Infrastructure compute nodes, making it the ideal architecture for sharing common configuration files and user home directories without file-locking conflicts or protocol mismatches.

Oracle Cloud Infrastructure (OCI) Vault is the correct feature because it satisfies the requirement to use customer-managed encryption keys for Object Storage buckets. OCI Vault integrates natively with Object Storage, allowing administrators to centrally manage and control the master encryption keys used to secure data at rest. By leveraging Vault, you maintain full lifecycle control over your keys—including rotation, creation, and scheduled deletion—instead of relying on default Oracle-managed keys, thereby fulfilling stringent security and compliance mandates.

Enforcing Multi-Factor Authentication (MFA) via security rules in Oracle Cloud Infrastructure Identity and Access Management directly satisfies the requirement to secure user accounts by adding an extra layer of verification beyond standard passwords. Administrators can configure identity provider policies and security rules to mandate MFA based on group membership, network location, or risk level, mitigating the risk of compromised credentials and ensuring robust access control across the cloud environment.

Oracle Autonomous Database eliminates manual Database Administrator intervention by automatically managing performance tuning and indexing through built-in machine learning algorithms and continuous workload monitoring. The database engine dynamically creates, rebuilds, and drops indexes based on query execution patterns, while simultaneously maintaining optimal execution plans and memory allocation. This fully automated optimisation directly satisfies the stem requirement for automated performance management, ensuring peak operational efficiency without manual tuning.

The Service Gateway provides private access to Oracle services without traversing the internet, and Object Storage in the same region is a supported service. Traffic stays on the Oracle network, satisfying the requirement for regional OCI service access.

TLS termination happens at the listener, where you attach the SSL certificate bundle and select the minimum TLS protocol version. Configuring TLS 1.3 there encrypts incoming client traffic before it reaches backend servers, satisfying the requirement without touching backend sets or health checks.

A public load balancer's regional high availability comes from placing its primary subnet in one Availability Domain and a second subnet in another. Selecting subnets in two ADs gives the load balancer nodes in each, satisfying the cross-AD availability requirement.

Dynamic groups automatically include compute instances matching defined rules, unlike identity-domain groups populated by user membership. They enable instance principals to call OCI services without stored credentials, which is a distinct group type in OCI IAM.

A policy created in the root compartment is tenancy-scoped: its statements apply across the entire tenancy and every compartment inside it, unless the statement itself names a narrower compartment. Placement in root therefore grants the broadest default reach.

Network Path Analyzer traces the route between a source and destination, evaluating security lists, network security groups and route tables hop by hop. It identifies which rule blocks TCP port 1521, satisfying the reachability test requirement.

Expanding the boot volume in the OCI Console only increases the block volume's underlying capacity; the guest OS partition and file system remain unchanged. Running `resizepart` grows the partition into the new space, and `xfs_growfs` extends the XFS file system online, satisfying the requirement for additional log space without downtime.

Configuring a sign-on policy within Identity Domains enforces MFA at authentication, satisfying the requirement to challenge specific users before they reach production compartments. Group-based conditions let you target only the relevant users rather than applying MFA tenant-wide, and the policy evaluates at sign-in, so access is blocked until the second factor succeeds.

Standard shapes allocate a balanced ratio of CPU, memory, and network bandwidth, which directly satisfies the general-purpose requirement in the stem. Unlike compute-optimised or memory-optimised families that skew one resource, standard shapes suit web servers, application servers, and similar mainstream workloads without over-provisioning any single dimension.

*BackendSetHealthyInstanceCount* directly satisfies the requirement to monitor the operational status of backend servers associated with Oracle Cloud Infrastructure Public Load Balancers. This metric tracks the exact quantity of healthy backend servers currently registered within a specific backend set, enabling administrators to configure alarms and effectively gauge application availability. Because the OCI Monitoring service ingests this metric natively from the load balancer service, it serves as a primary indicator for traffic routing health and autoscaling triggers.

A Plan Job runs terraform plan against the configuration and state, producing an execution plan that previews the changes Resource Manager would make without modifying any cloud resources. Apply Jobs perform the actual changes, so they cannot serve as a preview.

Oracle Cloud Infrastructure enforces a default service limit of 50 Virtual Cloud Networks (VCNs) per region within a single tenancy to help manage resource allocation and prevent unintended architectural sprawl. This specific boundary directly satisfies the regional tenancy constraint queried in the stem. While administrators can request a service limit increase through the Oracle Cloud console if larger topologies are required, 50 remains the baseline ceiling established out-of-the-box for standard deployments.

File Storage Service (FSS) snapshots provide a read-only, point-in-time view of a file system that can be scheduled or created manually to satisfy the requirement of protecting against accidental end-user deletion. Because snapshots are immutable and stored independently of the active file system data, users cannot modify or delete the snapshot contents even if they inadvertently remove the original files from the mount target. This mechanism allows administrators to effortlessly restore the exact state of the data as it existed prior to the user error.

Provisioning an Autonomous Database requires defining the OCPU count and the storage size in Terabytes to satisfy the prompt's requirement for initial compute and storage capacity. These two distinct parameters determine the baseline resource allocation upon creation while remaining fully independent, allowing administrators to scale compute via OCPUs or expand storage capacity dynamically at any time without downtime.

The Oracle Cloud Infrastructure Identity and Access Management verb hierarchy grants progressively broader access, where the 'inspect' permission strictly limits a principal to listing and viewing basic resource metadata without accessing configuration details. By contrast, the 'read' verb encompasses every capability of 'inspect' while lifting this restriction to explicitly permit retrieving full resource configuration details and metadata. This satisfies the functional requirement in the stem to differentiate the broader metadata and configuration access level of 'read' from the purely enumerative scope of 'inspect'.

Oracle Cloud Infrastructure DNS is the designated managed service that directly satisfies the requirement for authoritative Domain Name System management by supporting the creation and hosting of both public-facing and internal, private DNS zones. It enables organisations to configure and propagate custom domain records securely across virtual cloud networks and external internet endpoints without deploying custom BIND servers.

An unplanned regional outage on the primary Autonomous Database prevents automatic recovery because replication is asynchronous or regional infrastructure is unavailable, satisfying the constraint of a severe site failure. To restore database availability, you can manually execute a failover operation via the OCI Console or API. This process promotes the standby database to become the new primary, instantly establishing a new primary role and allowing client applications to resume read-write operations against the promoted database instance in the surviving region.

An IPSec tunnel stays DOWN when IKE Phase 1 or Phase 2 parameters differ between peers, or when UDP ports 500 and 4500 are blocked. Correct CPE addressing and internet connectivity do not help if negotiation cannot complete or the encrypted packets are filtered.

Baseline OCPU performance on a Standard AMD flexible shape uses burst credits; exhausting them throttles the instance to the baseline fraction of each OCPU. This directly explains the observed CPU throttling, unlike fixed shapes or high-performance variants that never draw on credits.

Object Storage Lifecycle Policies natively support transitioning objects directly to Archive Storage based on an age-based time threshold. Configuring the rule to target objects older than 30 days using the Archive action precisely satisfies the explicit requirement in the stem to automate the migration of data to the long-term cold storage tier without manual intervention.

OCI allows you to replicate custom images across tenancies and regions natively via the console, CLI, or API without manually exporting to Object Storage first. This direct cross-region copy capability directly satisfies the requirement for regional image management highlighted in the stem, enabling administrators to deploy standardized compute instances globally with minimal administrative overhead.

Storage auto-scaling on Autonomous Database grows allocated storage automatically as consumption approaches the limit, with no manual intervention, capped at three times the base storage size. This matches the stated behaviour and bounds the maximum expansion.

A Dynamic Routing Gateway (DRG) acts as a virtual router that establishes private pathways to satisfy the requirement for secure, non-public connectivity between a Virtual Cloud Network (VCN) and external environments. By attaching a DRG to your VCN, you can aggregate routing for multiple connection types—such as FastConnect private circuits, IPSec VPN tunnels, and Remote Peering Connections between different VCNs—thereby enabling scalable, enterprise-grade traffic encapsulation without traversing the public internet.

Oracle Real Application Clusters (RAC) natively provides database high availability by enabling multiple cluster nodes to concurrently access a single shared database storage pool. If a single compute node or virtual machine experiences a hardware or software failure, transparent application failover reroutes active sessions to surviving nodes without service interruption. This architecture directly satisfies the stem's requirement for a native feature that delivers high availability.

Transit routing through a Dynamic Routing Gateway (DRG) relies on route tables and import distributions to propagate prefixes correctly between attachments. For VCN-B instances to reach the on-premises datacenter via FastConnect, the DRG attachment for VCN-B must be associated with a DRG route table that includes an import route distribution populated with the on-premises routes. Since VCN-A succeeds while VCN-B fails, the absence of this specific import configuration on VCN-B's route table prevents it from learning the required on-premises network paths.

Cloning a block volume utilises point-in-time metadata pointer architecture to instantly provision a new storage entity without requiring a full data copy operation. This satisfies the constraint of creating an immediate, independent volume because the storage service references existing data blocks instantaneously, allowing read and write operations to commence straight away on a fully decoupled resource, regardless of the source volume size.

Kubernetes Network Policies provide the namespace-level traffic isolation required to restrict communication between pods in Namespace A and Namespace B. By defining ingress and egress rules at the IP block or pod selector level, a Network Policy enforces fine-grained Layer 3 and Layer 4 security controls within an Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) cluster. This natively satisfies the network segregation constraint specified in the stem without requiring external service mesh configurations.

The Client Credentials Wallet (wallet.zip) contains the mTLS certificates, private key, and tnsnames.ora entry required for mutual TLS authentication to the Autonomous Database. Downloading it from the OCI Console satisfies the stem's constraint of securely connecting database client applications, since the wallet supplies the credentials those clients present during the TLS handshake.

Group mapping only synchronises identities; it grants no permissions. OCI authorises every action through IAM policies, so without a policy allowing the mapped groups to inspect or use resources, authenticated users hit NotAuthorized. The 404 confirms authentication succeeded but authorisation failed.

OCI user groups function as logical containers that aggregate individual IAM users to simplify permission management. By attaching identity policies directly to a group rather than to individual accounts, administrators can efficiently govern access to OCI resources at scale. This mechanism satisfies the requirement for managing user permissions collectively, mirroring the group-based access control patterns found in Microsoft Entra ID, ensuring that all members inherit the same set of authorised privileges across the tenancy.

Oracle Cloud Infrastructure instance pools continuously monitor the health of member instances to ensure the desired capacity is maintained. Regardless of the schedule-based policy configured for Monday, the pool’s underlying health management mechanism detects hardware degradation and automatically triggers a replacement process. This ensures the pool satisfies the current capacity constraint of five instances throughout the weekend, as the autoscaling service prioritises maintaining the defined instance count independently of any future scheduled scaling events.

Security lists in OCI are stateful, meaning return traffic for an allowed inbound connection is automatically permitted without a separate egress rule. This satisfies the question's requirement for a correct characteristic, unlike network security groups' stateless behaviour or the misconception that security lists are stateless.

To move a compute instance, you need appropriate permissions in both the source compartment (to manage the instance) and the destination compartment (to create resources). This ensures that you have authorization to perform the move operation across compartment boundaries.

Rolling infrastructure maintenance patches one component at a time while RAC keeps the database available across surviving nodes, and Data Guard provides synchronous zero-data-loss replication to a standby. Together they deliver zero data loss and minimal downtime during planned hardware maintenance.

Stateful security lists or NSGs must permit outbound traffic; a missing egress rule blocks OS update downloads even when the NAT Gateway route exists. Checking egress rules first isolates the most common cause of this failure.

OCI Identity and Access Management enforces a strict hierarchical inheritance model where permissions flow exclusively downward from parent compartments to child compartments. Consequently, a policy authored within a child compartment lacks the structural scope to override this boundary and grant access to resources residing higher up in the tenancy tree. This fundamental scoping rule satisfies the hierarchical constraint specified in the stem, ensuring that administrative delegation remains contained and cannot escalate privileges beyond the compartment's immediate ancestry.

The Log Group organises storage, the Unified Agent collects and forwards instance logs, and a custom Log binds that agent configuration to the group. This sequence satisfies ingesting application logs from multiple compute instances into OCI Logging.

Selecting private endpoint access when provisioning the Autonomous Database creates a private IP in the chosen VCN subnet, so all client connections stay inside the OCI network. This satisfies the isolation requirement because no public endpoint is exposed, and access can be further restricted with security lists or network security groups on that subnet.

OCI Vault (Key Management) allows you to provision and control customer-managed master encryption keys to satisfy the strict PCI-DSS regulatory constraint requiring enterprise ownership of cryptographic material. By assigning these specific keys to compute instance boot volumes and block volumes during creation or update, you override default Oracle-managed encryption and ensure that all data-at-rest is secured using keys managed directly within your designated vault service.

A Service Gateway gives private-subnet instances access to Oracle Services Network endpoints, including OS Management, without traversing the internet. The route table rule directing Oracle Services traffic to that gateway is what satisfies the no-public-internet constraint.

Instance configurations in Oracle Cloud Infrastructure capture the blueprint for compute instances, including the boot volume and compute shape, but deliberately exclude attached secondary data block volumes. When you provision an instance pool from this template, the constraint that secondary block volumes are omitted ensures that every newly scaled instance starts with only its boot volume. Consequently, administrators must manage data persistence separately from the elastic scaling lifecycle provided by the instance pool.

Elastic resource scaling lets you increase CPU cores on an Autonomous Transaction Processing database online, with no downtime, because compute resources are decoupled from storage. This directly satisfies the no-downtime constraint, unlike scaling that requires a restart.

Granting `read object-family` at compartment scope lets the DataReaders group list and read every bucket and object within DataLake, matching the read-only requirement. The `object-family` verb set covers buckets, objects and their metadata, while compartment-level placement confines access to DataLake alone, satisfying the stated constraint without granting write permissions.

Satisfying the explicit requirement to avoid creating individual accounts for external auditors, federating via a SAML 2.0-compliant Identity Provider maps external user sessions directly to Oracle Cloud Infrastructure groups through identity provider policies and dynamic resource mappings. Provisioning local IAM users would contradict the core design of federated authentication, which delegates credential management and user lifecycle operations entirely to the external IdP such as Microsoft Entra ID or Okta, thereby rendering manual account creation completely unnecessary.

Oracle Cloud Infrastructure Identity Domains directly satisfy the requirement for comprehensive identity and access management by extending traditional tenancy security into a unified administrative boundary. By consolidating user lifecycle management, multi-factor authentication, and standards-based federation protocols like OAuth and SAML into a single architecture, Identity Domains directly address the stem's constraint for centralised governance. This capability differentiates them from legacy native users and groups by offering enterprise-grade synchronisation, seamless third-party identity provider integration, and granular access controls across complex multi-cloud deployments.

Expanding a boot volume in the Console only grows the block device; the guest OS partition table and file system remain at 47 GB until you extend the partition and resize the file system. The Console operation alone cannot propagate the change into the running OS.

Oracle Cloud Infrastructure Object Storage enforces Advanced Encryption Standard with 256-bit keys (AES-256) server-side encryption natively for all buckets and data objects by default. This automatic protection directly satisfies the requirement for zero-configuration, platform-managed security at rest without requiring manual key generation or bucket policy modifications from administrators.

The VM.Standard.A1.Flex shape allows users to flexibly configure OCPU and memory resources for Oracle Cloud Infrastructure Ampere A1 Compute instances. To satisfy the minimum resource constraint mandated by the flexible shape architecture, you must allocate at least 1 OCPU. This baseline configuration permits workloads to scale incrementally up to the maximum limit supported by the tenancy or service limits, ensuring precise capacity planning for ARM-based deployments without over-provisioning hardware resources.

Object versioning in Oracle Cloud Infrastructure Object Storage satisfies the requirement to retain multiple variants of an object within the same bucket. When this feature is enabled, uploading a new object with the same name as an existing one automatically creates a new version instead of overwriting the original data, generating a unique version ID for each iteration. This mechanism protects critical datasets against accidental overwrites or malicious deletions, allowing administrators to retrieve previous states directly from the storage bucket without external backups.

Oracle Cloud Infrastructure (OCI) Archive Storage is specifically designed for long-term data retention where access is infrequent, satisfying the administrator's requirement for a cost-effective archiving strategy. To enforce this intended use case for cold data, OCI imposes a strict minimum storage duration commitment of 90 days. If data is deleted or overwritten before this 90-day threshold has elapsed, a pro-rated early deletion charge is applied, which directly addresses the cost-optimisation constraint inherent in long-term data archiving planning.

Configuring an instance pool to span multiple Availability Domains directly satisfies the requirement to distribute instances evenly across a multi-AD region for high availability. When you select multiple Availability Domains during the placement configuration, the Oracle Cloud Infrastructure control plane automatically balances new instance launches across the chosen domains. This mechanism prevents single-hardware-failure domains from impacting your entire application tier, ensuring fault tolerance and high availability as requested in the scenario.

Oracle Cloud Infrastructure File Storage Service natively supports the Network File System version 3 (NFSv3) protocol, allowing traditional enterprise workloads and Linux-based compute instances to mount file systems directly over the network. This satisfies the requirement for standard protocol compatibility by enabling multiple clients to concurrently access shared storage using POSIX-compliant file locking and metadata operations, ensuring seamless integration for legacy applications migrating to the cloud.

To survive a single CPE failure, a second on-premises CPE with its own pair of IPSec tunnels to the DRG is required. OCI supports multiple CPEs per IPSec connection, and each CPE can have its own redundant tunnels. Without a second CPE, a hardware failure at the primary CPE would take down all tunnels.

The IP Hash load balancing policy uses a hash-based algorithm derived from the client's source and destination IP addresses to route incoming requests. This technical mechanism directly satisfies the requirement to ensure that requests from the same client always reach the same backend server, maintaining session persistence based entirely on network layer identifiers without needing application-level cookies.

Audit logs in OCI are retained for 365 days by default, satisfying the question's requirement for the standard retention period without additional configuration. This fixed one-year window applies automatically to the Audit service, after which entries are purged unless archived separately to Object Storage.

Allocating the web subnet a 172.16.1.0/24 CIDR provides 256 addresses (254 usable), accommodating the required 100 hosts. The app subnet uses 172.16.2.0/24, yielding 254 usable IPs to satisfy the 200-host constraint. The database subnet uses 172.16.3.0/26, supplying 62 usable addresses for the 50 hosts. All three subnets fit strictly within the parent VCN CIDR of 172.16.0.0/16, remain entirely non-overlapping, and reserve the necessary Oracle Cloud Infrastructure network addresses per subnet.

Oracle Cloud Infrastructure File Storage service utilises the Network File System (NFSv3) protocol to provide shared access from multiple compute instances simultaneously. This directly satisfies the requirement to share a file system across different availability domains because a File Storage file system is regional, existing independently within a specific region while being securely mountable by targets placed across any availability domain within that same region.

Oracle Cloud Infrastructure Object Storage provides an infinitely scalable, highly durable repository that natively supports public access and HTTP/HTTPS serving directly from a designated bucket. This directly satisfies the requirement for hosting static website content, as static assets such as HTML, CSS, and client-side JavaScript do not require compute processing or dynamic server-side rendering, allowing them to be served efficiently and cost-effectively at scale without provisioning virtual machines.

Auto Scaling adjusts ATP compute (ECPUs) automatically in response to workload demand, satisfying the stem's requirement for scaling up and down without manual intervention. It operates independently of storage autoscaling, so it directly meets the no-intervention constraint.

Health check probes originate from the Load Balancer's subnet, so the backend instances' security lists or NSGs must permit inbound traffic from that source. Without an ingress rule allowing the probe traffic, health checks fail even though the load balancer itself is configured correctly.

Load balancer rule sets filter client traffic by source IP before it reaches backends, while security lists on the load balancer subnet restrict ingress. Either enforces the corporate IP range restriction at the network edge.

Exadata VM Clusters provide the architectural separation, letting multiple independent VM clusters coexist on one Exadata rack with isolated compute, storage access and networking. This satisfies the requirement to configure separate clusters on the same physical infrastructure.

A Dynamic Routing Gateway (DRG) is required because local VCN peering only supports communication within the same region, whereas connecting VCN-1 in Ashburn to VCN-2 in Phoenix necessitates remote Vcn peering across different regions. The DRG acts as a router that provides a path for private traffic between disparate cloud regions, satisfying the geographical constraint of the design scenario by encapsulating and routing packets across the Oracle Cloud Infrastructure backbone.

Cluster Placement Groups explicitly satisfy the requirement to group multiple compute instances within a low-latency, high-bandwidth physical placement group. This feature uses underlying Oracle Cloud Infrastructure network fabrics to position instances closely together on the same physical infrastructure, thereby minimising network round-trip time and maximising throughput for tightly coupled workloads such as high-performance computing (HPC) clusters or distributed databases that demand extreme network performance.