Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) 1Z0-1072-26 Questions 301–375 | Page 5/7

301

Multi-Selectmedium

Which THREE tools or methods can be used to load data into an Oracle Autonomous Database?

Select 3 answers

A.DBMS_CLOUD PL/SQL package (loading files from OCI Object Storage)

B.Direct raw disk block editing via FTP

C.Database Actions (SQL Developer Web data loading interface)

D.Oracle Data Pump (impdp)

E.Direct OS command line piping via 'cat' and SSH

AnswersA, C, D

DBMS_CLOUD provides procedures to load data directly from Object Storage.

Why this answer

Data can be loaded into Autonomous Database using Oracle Data Pump, Database Actions (SQL Developer Web), and DBMS_CLOUD PL/SQL package from Object Storage.

Full explanation →

302

MCQhard

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

A.Allow group SecurityAnalysts to inspect compliance-rules in tenancy

B.Allow group SecurityAnalysts to manage security-posture in tenancy

C.Allow group SecurityAnalysts to use vulnerability-scanners in compartment root

D.Allow group SecurityAnalysts to read cloud-guard-family in tenancy

AnswerD

The 'cloud-guard-family' resource type governs Cloud Guard targets, detectors, responders, and problem evaluations.

Why this answer

OCI Cloud Guard and Security Advisor resources are managed via specific resource types, primarily 'cloud-guard-family' for Cloud Guard.

Full explanation →

303

MCQeasy

What happens to the resources inside a compartment when you delete the compartment itself?

A.All resources inside the compartment are automatically deleted along with it.

B.Resources become orphaned and are managed by the tenancy administrator group.

C.The compartment cannot be deleted until all resources within it are deleted or moved to another compartment.

D.Resources are automatically moved to the root compartment.

AnswerC

OCI enforces a safety check requiring compartments to be empty before deletion is allowed.

Why this answer

Before a compartment can be deleted in OCI, it must be completely empty of all resources and child compartments.

Full explanation →

304

MCQmedium

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

A.A Public DNS Zone with an Internet Gateway

B.A Service Gateway pointing to the DNS service

C.A NAT Gateway with DNS forwarding rules

D.A Private DNS Zone associated with the VCN via a VCN view

AnswerD

Private DNS zones attached to VCNs via views enable internal DNS resolution.

Why this answer

To resolve records in a private domain within a VCN, you must create a Private DNS Zone and associate it with your VCN using a VCN view.

Full explanation →

305

MCQeasy

Which feature of Oracle Autonomous Database automatically inspects and tunes SQL statements, creates indexes, and optimizes execution plans without human intervention?

A.Oracle Enterprise Manager Tuning Pack

B.Database Resource Manager

C.Automatic Storage Management (ASM)

D.Automatic Indexing and SQL Tuning Advisor

AnswerD

Autonomous database features self-driving indexing and query optimization.

Why this answer

Autonomous Database includes built-in automated SQL tuning and indexing capabilities as part of its self-tuning architecture.

Full explanation →

306

MCQeasy

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

A.Create an IAM group, add users, assign free-form tags directly to the users, and write a policy.

B.Create a Dynamic Group, apply a tag namespace to the tenancy root, and assign compartment quotas.

C.Create a Tag Namespace, define a Tag Key within it, apply the tag to resources, and reference the tag in an IAM policy condition.

D.Define a Resource Principal, attach a tag to the instance, and create a cross-region replication policy.

AnswerC

This is the correct sequence: Tag Namespace -> Tag Key -> Tag Application -> IAM Policy Condition.

Why this answer

Tag-based access control requires creating a Tag Namespace, defining Tag Keys within that namespace, applying the tags to resources or requests, and then using tag conditionals in IAM policies.

Full explanation →

307

Multi-Selectmedium

Which TWO methods can be used to transfer data from an on-premises data center into OCI Object Storage? (Choose two.)

Select 2 answers

A.Directly mounting an Object Storage bucket as a local Windows NTFS drive via SMB protocol

B.OCI Data Transfer Appliance for offline data migration

C.Attaching an Object Storage bucket as an LVM logical volume to an on-premises server

D.OCI Command Line Interface (CLI) using multipart upload

E.Using Block Volume Export to push data into Object Storage buckets automatically

AnswersB, D

Data Transfer Appliance allows physical shipment of data devices to OCI data centers.

Why this answer

On-premises data can be uploaded to Object Storage via the OCI CLI/API over the public internet or private VCN connections (FastConnect), or shipped physically using Data Transfer Appliances.

Full explanation →

308

MCQeasy

You need to store infrequently accessed data in Oracle Cloud Infrastructure (OCI) with the lowest possible cost while maintaining data retrieval times within a few hours. Which storage tier should you choose?

A.Archive Storage

B.Block Volume

C.Standard Object Storage

D.Infrequent Access Object Storage

AnswerA

Archive Storage provides the lowest cost for infrequent access.

Why this answer

Archive Storage is designed for long-term data retention at the lowest cost, with a retrieval time of up to 4 hours.

Full explanation →

309

Multi-Selectmedium

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Select 3 answers

A.A user can belong to multiple groups.

B.Groups can be nested inside other groups to form a hierarchy.

C.Groups can own compartments directly without human members.

D.Federated identity provider groups can be mapped to OCI IAM groups.

E.Groups are used in policy statements to grant access permissions.

AnswersA, D, E

Users can be members of up to 300 different IAM groups.

Why this answer

Groups contain users, can be mapped from federated IdPs, and are used in IAM policies.

Full explanation →

310

MCQmedium

How can you ensure that data in an Object Storage bucket remains unchanged for a specific period?

A.Encryption

B.IAM policies

C.Lifecycle policies

D.Retention Rules

AnswerD

Retention rules enforce immutability.

Why this answer

Retention rules on a bucket prevent modifications or deletions for a defined duration.

Full explanation →

311

MCQeasy

Which OCI storage service is best suited for hosting shared configuration files and home directories for hundreds of Linux compute instances simultaneously using the NFSv3 protocol?

A.OCI Object Storage

B.OCI File Storage Service

C.OCI Archive Storage

D.OCI Block Volume

AnswerB

File Storage Service supports NFSv3 for shared concurrent access across multiple instances.

Why this answer

File Storage Service (FSS) provides a distributed, scalable, enterprise-grade network file system that supports the NFSv3 protocol for concurrent access from multiple instances.

Full explanation →

312

MCQmedium

You want to use your own encryption keys for Object Storage. What feature should you use?

A.Public keys

B.IAM policies

C.OCI Vault

D.Encryption Gateway

AnswerC

Vault allows using Customer-Managed Keys (CMK).

Why this answer

OCI Vault allows you to manage keys for server-side encryption.

Full explanation →

313

Multi-Selectmedium

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Select 3 answers

A.Enforce Multi-Factor Authentication (MFA) via security rules

B.Rotate or revoke API signing keys periodically

C.Disable all audit logging to hide administrative actions

D.Configure password policies governing complexity and expiration

E.Assign root compartment administrator privileges to all temporary contractors

AnswersA, B, D

MFA adds an extra layer of security for user logins.

Why this answer

Securing user accounts includes enforcing MFA, managing API signing key lifecycles, and setting strong password policies.

Full explanation →

314

Multi-Selecthard

When configuring database backups in Oracle Base Database Service, which THREE components or options can be managed or customized? (Choose three.)

Select 3 answers

A.Automated backup retention period between 7 and 60 days

B.Automatic deletion of backup files immediately after database shutdown

C.The time window during which daily automated backups start

D.Manual full or incremental backups stored in Oracle Object Storage

E.Direct replication of backup files to local customer tape drives

AnswersA, C, D

Backup retention can be configured anywhere from 7 to 60 days.

Why this answer

In Base Database Service, administrators can configure backup destinations (Object Storage), automated backup retention windows, and manual backup schedules.

Full explanation →

315

Multi-Selecteasy

Which THREE features are automatically managed by Oracle Autonomous Database without requiring manual DBA intervention?

Select 3 answers

A.Business requirement definition and data modeling

B.Performance tuning and indexing

C.Automated backups

D.Database patching and upgrades

E.Custom corporate application code development

AnswersB, C, D

Autonomous tuning and indexing optimize query performance automatically.

Why this answer

Autonomous Database automates patching, backups, and performance tuning.

Full explanation →

316

Multi-Selectmedium

Which TWO types of traffic can be routed through an OCI Service Gateway?

Select 2 answers

A.General web browsing traffic to external websites like google.com

B.Traffic destined for an on-premises datacenter via FastConnect

C.Peer traffic to another VCN in a different region

D.Traffic to OCI Object Storage in the same region

E.Traffic to Oracle Autonomous Database in the same region

AnswersD, E

Object Storage is part of the Oracle Services Network and can be accessed via Service Gateway.

Why this answer

A Service Gateway routes traffic destined for the Oracle Services Network, which includes regional services like Object Storage and Autonomous Database, as well as public Oracle services.

Full explanation →

317

MCQmedium

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

A.Allow group Developers to manage load-balancers in compartment AppCompartment

B.Allow user Developers to create load-balancers in compartment AppCompartment

C.Allow group Developers to manage lb-family in tenancy

D.Allow group Developers to use network-load-balancers in compartment AppCompartment

AnswerA

This policy correctly specifies the group, the 'manage' verb, the 'load-balancers' resource type, and the target compartment.

Why this answer

Load balancers belong to the 'load-balancers' resource type in OCI IAM policies.

Full explanation →

318

MCQeasy

Which type of tag is used to track costs across different departments?

A.Compartment tags

B.System tags

C.Defined tags

D.Free-form tags

AnswerC

Cost-tracking tags are a specific type of defined tag.

Why this answer

Cost-tracking tags are explicitly enabled to allow cost analysis in the billing dashboard.

Full explanation →

319

MCQmedium

You are configuring a Public Load Balancer in OCI. You want to ensure that incoming traffic is encrypted using TLS 1.3. Where do you configure the SSL certificate and TLS protocol version?

A.In the VCN route table settings

B.On the NAT Gateway configuration page

C.In the backend set health check policy

D.On the Load Balancer Listener configuration

AnswerD

Listeners handle SSL certificate binding and cipher/TLS protocol selections.

Why this answer

SSL certificates and TLS protocol preferences are configured on the Load Balancer Listener settings.

Full explanation →

320

Multi-Selecthard

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

Select 2 answers

A.The resource tenancy must define an endorsement policy allowing the external group to access its resources.

B.Cross-tenancy access requires every external user to have a local shadow user account.

C.Cross-tenancy policies are configured exclusively in the OCI DNS service.

D.The resource (target) tenancy must define a policy allowing the external group using the tenancy name.

E.The principal tenancy must define an endorsement policy using the 'endorse' verb.

AnswersD, E

The resource tenancy allows the external group access, referencing the principal tenancy.

Why this answer

Cross-tenancy access requires an endorsement policy in the principal tenancy and a commitment policy in the resource tenancy.

Full explanation →

321

MCQmedium

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

A.Attach a NAT Gateway to both Availability Domains.

B.Configure an LPG between the two AD subnets.

C.Select subnets in two different Availability Domains during load balancer creation.

D.Deploy two separate load balancers and use an Internet Gateway to load balance between them.

AnswerC

Configuring primary and secondary subnets across ADs ensures high availability.

Why this answer

When provisioning an OCI Public Load Balancer, you select a primary subnet in one AD and a secondary subnet in another AD to ensure high availability across ADs.

Full explanation →

322

MCQmedium

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

A.Allow group NetworkAdmins to manage subnets, route-tables, and vcns in tenancy

B.Allow group NetworkAdmins to manage all-resources in tenancy where target.type != 'gateway'

C.Allow group NetworkAdmins to use networking in tenancy

D.Allow group NetworkAdmins to manage virtual-network-family in tenancy

AnswerA

Listing specific resource types (subnets, route-tables, vcns) excludes gateways and peering connections, satisfying the requirement.

Why this answer

OCI defines fine-grained resource types within families, such as virtual-networks, subnets, and route-tables, allowing precise policy scoping.

Full explanation →

323

Multi-Selecteasy

Which TWO types of groups exist in OCI IAM? (Choose two.)

Select 2 answers

A.Compartment security groups

B.Dynamic groups

C.Standard user groups

D.Virtual network groups

E.Billing resource groups

AnswersB, C

Dynamic groups contain cloud resources (such as compute instances) based on matching rules.

Why this answer

OCI IAM features standard user groups and dynamic groups for resources.

Full explanation →

324

MCQeasy

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

A.It applies across the entire tenancy and all compartments within it.

B.It applies exclusively to the Identity and Access Management service.

C.It must be explicitly attached to each child compartment individually to take effect.

D.It applies only to the root compartment and cannot affect child compartments.

AnswerA

A policy defined in the root compartment has global tenancy scope and governs resources across all compartments.

Why this answer

Policies created in the root compartment (tenancy) apply globally across the entire tenancy and all child compartments unless restricted.

Full explanation →

325

MCQmedium

You are troubleshooting a connection to a database instance in a private subnet. You need to verify if security list rules are blocking incoming traffic to port 1521. Which tool in OCI can you use to test reachability between an application instance and the database instance?

A.NAT Gateway packet tracer

B.OCI Network Path Analyzer

C.OCI Load Balancer health check

D.Service Gateway connectivity tester

AnswerB

Network Path Analyzer simulates packet traversal and checks security lists and route tables for reachability issues.

Why this answer

OCI Network Path Analyzer is a diagnostic tool that analyzes network reachability between two endpoints in your VCN, checking route tables, security lists, and NSGs to determine if traffic can flow.

Full explanation →

326

MCQmedium

You need to resize the boot volume of an existing OCI Linux compute instance to provide more disk space for application logs. What is the correct sequence of actions?

A.Modify the boot volume size in the OCI Console, then use OS-level commands (such as `resizepart` and `xfs_growfs`) to extend the file system.

B.Terminate the instance, detach the boot volume, attach it to another instance, expand it, and reattach it.

C.Reboot the instance; OCI automatically detects the new size and extends the file system partitions automatically.

D.Create a new block volume, mount it as the root directory, and delete the old boot volume.

AnswerA

Resizing requires updating the volume size in the console and then extending the partition and file system inside the OS.

Why this answer

To expand a boot volume, you first update the boot volume size in the OCI Console, and then you must log in to the instance and extend the operating system partition and file system to recognize the new capacity.

Full explanation →

327

MCQhard

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

A.Configure a security rule (or sign-on policy) within Identity Domains to require MFA for specific groups upon authentication.

B.Enable MFA in the tenancy root compartment settings under Compartment Quotas.

C.Write an IAM policy with the condition where request.mfa = 'true'

D.Add a tag to the user account indicating that MFA is required.

AnswerA

Identity Domains feature security rules that dictate authentication requirements, including mandatory MFA for specified groups.

Why this answer

OCI IAM supports native identity domains and security rules (formerly sign-on policies) where MFA can be enforced based on user groups and risk levels.

Full explanation →

328

MCQeasy

Which OCI compute shape family is designed specifically for general-purpose workloads, balancing CPU, memory, and network resources?

A.Dense I/O Shapes

B.HPC Shapes

C.Standard Shapes

D.GPU Shapes

AnswerC

Standard shapes offer a balanced ratio of cores, memory, and network resources for general workloads.

Why this answer

Standard compute shapes are designed for general-purpose workloads such as web servers, application servers, and small databases.

Full explanation →

329

Multi-Selectmedium

Which TWO metrics are available for monitoring OCI Public Load Balancers in OCI Monitoring service?

Select 2 answers

A.DatabaseCPUUtilization

B.BlockStorageIOPS

C.BackendSetHealthyInstanceCount

D.ComputeInstanceVCPUTime

E.BytesProcessed

AnswersC, E

This metric tracks the number of healthy instances in a backend set.

Why this answer

OCI Load Balancer metrics include bytes evaluation, backend set health, active connections, request/response latency, and HTTP status code counts.

Full explanation →

330

MCQhard

A company uses OCI Resource Manager to manage its cloud infrastructure using Terraform. A developer has modified a Terraform configuration file locally and needs to preview the changes that Resource Manager will make to the cloud environment before actually applying them. Which Resource Manager job type should be executed?

A.Plan Job

B.Apply Job

C.Import Job

D.Destroy Job

AnswerA

Correct. A Plan job creates a preview of the infrastructure changes without modifying actual resources.

Why this answer

A 'Plan' job in OCI Resource Manager generates an execution plan, showing what actions Terraform will take when applied against the current state.

Full explanation →

331

MCQeasy

What is the maximum number of VCNs allowed per region in an OCI tenancy by default (subject to service limits)?

A.50 (default service limit)

B.1

C.Unlimited

D.5

AnswerA

The default VCN service limit per region is 50.

Why this answer

The default service limit for VCNs per region in an OCI tenancy is typically 50, but can be increased upon request.

Full explanation →

332

MCQmedium

A team is using OCI File Storage Service and needs to protect against accidental deletion of files by end users. Which feature should be implemented?

A.FSS Snapshots

B.Object Storage Lifecycle Policies

C.FSS Object Versioning

D.Block Volume Volume Groups

AnswerA

Snapshots provide instant, read-only point-in-time copies of file systems for data recovery.

Why this answer

File Storage Service supports snapshots, which are read-only, point-in-time versions of a file system that allow users to recover accidental deletions.

Full explanation →

333

MCQeasy

When provisioning an Autonomous Database, what parameter determines the initial compute and storage capacity allocated to the database, which can be scaled independently later?

A.Block volume IOPS and Throughput MB/s

B.Number of database threads and PGA memory limits

C.RAM size in Gigabytes and CPU core clock speed

D.OCPU count and Storage size in Terabytes

AnswerD

Autonomous Database capacity is defined by OCPUs and storage TBs.

Why this answer

Autonomous Database compute is measured in OCPUs (Oracle CPUs), and storage is measured in terabytes (TB).

Full explanation →

334

MCQeasy

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

A.Read allows users to modify resources, whereas inspect only allows viewing.

B.Read includes all inspect permissions plus the ability to get resource metadata and configuration details.

C.Read allows downloading data from Object Storage, whereas inspect allows uploading.

D.Read is more restrictive than inspect.

AnswerB

Read builds upon inspect by allowing users to view detailed configuration attributes of resources.

Why this answer

The 'read' verb includes all permissions of 'inspect' plus the ability to get full configuration metadata and details of resources.

Full explanation →

335

MCQeasy

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

A.OCI Load Balancer

B.OCI VCN Resolver

C.OCI DNS

D.OCI Traffic Management

AnswerC

OCI DNS provides resilient, scalable public and private domain name resolution.

Why this answer

OCI DNS is the managed Domain Name System service that enables customers to create and manage public and private DNS zones.

Full explanation →

336

MCQmedium

An administrator wants to automate the process of copying Block Volume backups from the Ashburn region to the Phoenix region for disaster recovery purposes. What is the recommended method?

A.Manually export the volume to an Object Storage bucket and download it in the second region.

B.Configure an OCI Object Storage lifecycle rule to replicate files across regions.

C.Attach a cross-region replication policy to the Block Volume backup policy.

D.Write an OCI Data Flow application to stream volume blocks across regions.

AnswerC

OCI automatic backup policies support adding cross-region copy rules to replicate volume backups automatically to another region.

Why this answer

Block Volume backups can be configured for automatic cross-region replication by setting up a backup policy with copy rules to destination regions.

Full explanation →

337

MCQhard

You have configured an Oracle Data Guard association between a primary Autonomous Database and a standby Autonomous Database. What happens to the standby database if the primary database experiences an unplanned regional outage?

A.The standby database remains permanently read-only and cannot accept write transactions.

B.The standby database automatically destroys itself and reprovisions in the primary region.

C.You can perform a failover operation in the OCI Console to promote the standby database to primary.

D.Data Guard automatically switches back to the primary database via split-brain prevention algorithms.

AnswerC

Manual or automated failover promotes the standby database to accept read-write traffic.

Why this answer

In Autonomous Database Data Guard, if the primary goes down, you can manually initiate a role transition (switchover/failover) or rely on automatic failover depending on the configuration, promoting the standby to primary.

Full explanation →

338

MCQhard

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

A.Mismatched IKE security parameters (Phase 1 or Phase 2) or blocked UDP ports 500/4500 on the firewall.

B.The NAT Gateway is misconfigured.

C.The FastConnect virtual circuit is disabled.

D.The VCN subnet route table is missing a route to 0.0.0.0/0.

AnswerA

IPSec negotiation fails if Phase 1 or Phase 2 settings (encryption, hashing, DH groups) do not match on both ends, or if ISAKMP/IPSec ports are blocked.

Why this answer

VPN tunnel down status is commonly caused by mismatched IKE security parameters (Phase 1/Phase 2 pre-shared key, encryption/authentication algorithms, Diffie-Hellman groups) or blocked UDP ports 500/4500 on local firewalls.

Full explanation →

339

MCQhard

You are troubleshooting a performance issue on an OCI compute instance. You suspect that the instance is experiencing CPU throttling due to credits being exhausted. Which compute shape type are you most likely using?

A.HPC (High-Performance Computing) Shape

B.Standard AMD Flexible Shape with baseline OCPU performance enabled

C.Bare Metal Standard Shape

D.GPU Shape

AnswerB

Burstable instances use CPU credits to allow temporary bursting above baseline, which can lead to throttling if credits run out.

Why this answer

Burstable instances (such as VM.Standard.E3.Flex or VM.Standard.E4.Flex configured with baseline OCPU utilization or specific micro/standard burstable settings) use CPU credits. If credits are exhausted, performance is throttled to the baseline.

Full explanation →

340

MCQhard

You are configuring a Lifecycle Policy for an Object Storage bucket. You want to automatically move objects older than 30 days to Archive Storage. What is the correct rule configuration?

A.Use the 'Delete' action with a 30-day threshold.

B.Use the 'Move' action to a new bucket.

C.Use the 'Archive' action with a 30-day threshold.

D.Use the 'Restore' action.

AnswerC

The Archive action moves objects to the Archive tier.

Why this answer

The lifecycle policy uses JSON-based rules to define action, name filter, and age threshold.

Full explanation →

341

Multi-Selecthard

Which THREE of the following features or actions are supported when managing OCI Custom Images? (Choose three.)

Select 3 answers

A.You can copy a custom image directly to another OCI region using native cross-region image copy features.

B.You can use a custom image as the boot source when creating an instance configuration for an instance pool.

C.Custom images automatically sync operating system patches from Oracle update servers daily.

D.You can export a custom image to an OCI Object Storage bucket.

E.You can directly mount and edit files inside a custom image using the OCI Console file manager.

AnswersA, B, D

OCI allows copying custom images across regions for multi-region deployments.

Why this answer

Custom images can be exported to Object Storage, copied across regions, and used to launch instances. However, they cannot be edited directly as files while inside the image repository.

Full explanation →

342

MCQhard

You manage an Autonomous Database instance and want to configure Auto-Scaling for storage. What is the behavior of storage auto-scaling when enabled?

A.It scales down storage during low usage windows to reduce monthly cloud billing.

B.It automatically deletes old backups to free up block storage when thresholds are reached.

C.It automatically adds OCPUs whenever storage utilization exceeds 80 percent.

D.It automatically expands storage space as needed without user intervention, up to three times the base storage size.

AnswerD

Storage auto-scaling dynamically increases storage up to 3x the specified space without requiring manual resizing.

Why this answer

When storage auto-scaling is enabled, Autonomous Database automatically increases storage space as your data grows, up to 3 times the initial allocated size.

Full explanation →

343

MCQeasy

What is the primary function of an OCI Dynamic Routing Gateway (DRG)?

A.To provide public internet access for public subnets.

B.To load balance web requests across backend servers.

C.To provide access to regional Object Storage.

D.To provide a private connection between your VCN and on-premises networks or other VCNs.

AnswerD

DRGs serve as the gateway for hybrid cloud and VCN transit routing.

Why this answer

A DRG is a virtual router that provides a path for private traffic between your VCN and on-premises networks (via FastConnect or Site-to-Site VPN) or other VCNs.

Full explanation →

344

Multi-Selecthard

Which THREE features are provided natively by Exadata Cloud Service to deliver high performance and high availability for Oracle databases? (Choose three.)

Select 3 answers

A.Automatic translation of PL/SQL code into native AWS Redshift SQL syntax.

B.Oracle Real Application Clusters (RAC) support for database high availability.

C.Exadata Smart Scan to offload SQL query processing to storage servers.

D.RDMA over Converged Ethernet (RoCE) network fabric for ultra-low latency internal cluster interconnects.

E.Client-managed hypervisor patching via direct SSH access to Dom0 dom0 hypervisor nodes.

AnswersB, C, D

Exadata natively supports multi-node RAC configurations for continuous database availability.

Why this answer

Exadata Cloud Service leverages Smart Scan (offloading SQL processing to storage cells), Exadata RDMA over Converged Ethernet (RoCE) for ultra-low latency cluster communication, and built-in database high availability through RAC.

Full explanation →

345

MCQhard

An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?

A.The DRG attachment for Vcn-B is associated with a DRG route table that lacks the import route distribution for the on-premises network.

B.VCN CIDRs must be identical for transit routing to function.

C.FastConnect only supports a single VCN attachment at a time.

D.Vcn-B must use an Internet Gateway instead of a DRG.

AnswerA

DRG route tables and import/export distributions govern transit routing between attachments.

Why this answer

In DRG version 2, route distribution and DRG route tables control traffic between attachments. If Vcn-B cannot reach on-premises, its DRG attachment is likely associated with a DRG route table that lacks import routes for the on-premises attachment, or vice versa.

Full explanation →

346

MCQhard

You are using Resource Manager to deploy infrastructure. You need to ensure that the terraform state file is automatically locked to prevent concurrent modifications. How should you handle this?

A.Use Resource Manager's native managed state backend

B.Enable the 'StateLock' tag on the stack resources

C.Configure a manual state lock in the Terraform provider block

D.Create a dedicated OCI Object Storage bucket for state locking

AnswerA

Resource Manager manages state and locking automatically.

Why this answer

Resource Manager handles state locking automatically when you run jobs, ensuring consistency without manual intervention.

Full explanation →

347

MCQhard

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

A.Allow dynamic-group BatchProcessors to manage objects in tenancy CONDITION tag.Project.Name = 'Analytics'

B.Allow dynamic-group BatchProcessors to manage objects in tenancy where target.tag.Project.Name = 'Analytics'

C.Allow dynamic-group BatchProcessors to manage objects in tenancy IF target.tag.Project.Name == 'Analytics'

D.Allow dynamic-group BatchProcessors to manage objects in tenancy WITH tag Project.Name = 'Analytics'

AnswerB

This policy correctly combines the principal, verb, resource type, scope, and a valid target tag condition using the 'where' keyword.

Why this answer

OCI IAM policy conditions are appended using the 'where' keyword followed by variable evaluations like target.tag or request.tag.

Full explanation →

348

MCQeasy

What is the main benefit of using a 'Clone' of a block volume?

A.Creating an immediate, independent volume

B.Backup automation

C.Reducing storage usage

D.Moving to another region

AnswerA

Cloning creates a usable volume instantly.

Why this answer

Clones allow you to create a new, independent volume from a point-in-time snapshot.

Full explanation →

349

MCQhard

You are managing an OKE cluster and need to restrict network traffic so that pods in Namespace A cannot communicate with pods in Namespace B. What Kubernetes object should you configure?

A.Kubernetes Horizontal Pod Autoscalers

B.OCI VCN Security Lists

C.OCI API Gateway Access Rules

D.Kubernetes Network Policies

AnswerD

Network Policies enforce pod-level and namespace-level network isolation within the cluster.

Why this answer

Kubernetes NetworkPolicies allow you to define rules controlling network traffic flow between pods and namespaces based on labels and selectors.

Full explanation →

350

MCQeasy

When connecting securely to an Autonomous Database instance, what file must be downloaded from the OCI Console and provided to your database client applications?

A.An SSH private key (.pem)

B.Client Credentials Wallet (wallet.zip)

C.Oracle Wallet Manager Master Encryption Key

D.tnsnames.ora configuration text file only

AnswerB

The client credentials wallet contains the certificates and connection details needed for secure mTLS connection.

Why this answer

Autonomous Database requires mutual TLS (mTLS) authentication by default, which is established using credentials packaged in a Wallet zip file.

Full explanation →

351

MCQhard

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

A.The SAML assertion signature certificate has expired in the external IdP.

B.Federated users cannot access OCI without first creating local user accounts.

C.No IAM policies have been created granting permissions to the mapped OCI IAM groups.

D.The user's browser blocked the OCI redirection cookies.

AnswerC

Authentication (SSO) is successful via federation, but authorization requires IAM policies referencing the mapped OCI IAM groups.

Why this answer

Successful authentication via federation only proves who the user is; authorization requires IAM policies to be written that grant the mapped OCI IAM groups permissions to resources.

Full explanation →

352

MCQeasy

Which of the following describes an OCI user group?

A.A collection of users who can be assigned IAM policies to govern access to OCI resources.

B.A network security group used to filter traffic between subnets.

C.A collection of compute instances grouped for auto-scaling.

D.A collection of compartments sharing a common budget.

AnswerA

Groups aggregate users so policies can be applied efficiently to multiple people at once.

Why this answer

An OCI group is a collection of users who share the same access requirements and policies.

Full explanation →

353

MCQmedium

An administrator wants to allow a group of developers to create and manage Kubernetes clusters (OKE - Oracle Container Engine for Kubernetes) in a specific compartment named 'K8sCompartment'. Which policy statement is correct?

A.Allow group Developers to manage containers in tenancy

B.Allow group Developers to use kubernetes in compartment K8sCompartment

C.Allow group Developers to read k8s-clusters in compartment K8sCompartment

D.Allow group Developers to manage cluster-family in compartment K8sCompartment

AnswerD

The 'cluster-family' resource type governs OKE clusters, node pools, and related Kubernetes infrastructure.

Why this answer

Container Engine for Kubernetes resources are managed using the 'cluster-family' resource type in OCI IAM policies.

Full explanation →

354

MCQhard

You are configuring an autoscaling policy for an instance pool. You choose a schedule-based policy to scale out the pool to 20 instances every Monday at 8:00 AM. What happens if an instance within the pool fails due to hardware degradation during the weekend when the pool size is set to 5?

A.The instance pool automatically replaces the failed instance immediately to maintain the current desired capacity of 5.

B.The failed instance is left in a failed state until Monday at 8:00 AM when the scheduled scaling event runs.

C.The autoscaling configuration disables itself due to a health check failure.

D.The entire instance pool is shut down to prevent data corruption.

AnswerA

Instance pools automatically replace unhealthy instances to maintain the current pool size.

Why this answer

Instance pools continuously monitor the health of instances. If an instance fails or is unhealthy, the instance pool automatically terminates it and provisions a replacement instance to maintain the desired capacity of the pool at that moment.

Full explanation →

355

Multi-Selecthard

Which THREE characteristics of OCI Security Lists are correct?

Select 3 answers

A.Security list rules are stateful by default.

B.Security lists are applied at the subnet level.

C.Security lists support stateless rules as an option.

D.A subnet can have a maximum of only one security list.

E.Security lists can be assigned to individual VNICs independently of subnets.

AnswersA, B, C

Stateful rules automatically allow return traffic for established connections.

Why this answer

Security lists are virtual firewalls applied at the subnet level, they are stateful by default (though stateless can be configured), and their rules apply to all VNICs in the subnet.

Full explanation →

356

MCQhard

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

A.Compute instances must be manually added to dynamic groups via the IAM console.

B.The compute instances must be restarted for IAM policies to take effect.

C.Dynamic groups only support tagging rules, not compartment OCID rules.

D.Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.

AnswerD

There is a propagation delay of a few minutes when new resources are created before dynamic group membership is evaluated and updated.

Why this answer

Dynamic group matching rule evaluation is not always instantaneous, but more importantly, compute instances must be explicitly configured with resource principal or instance principal features depending on the SDK version, and matching rules take a short time to evaluate newly created resources.

Full explanation →

357

MCQhard

You are designing a high availability architecture for a mission-critical Oracle Exadata Database Service. You need to ensure zero data loss and minimal downtime during planned hardware maintenance. Which Oracle feature should you leverage?

A.Rolling infrastructure maintenance combined with Real Application Clusters (RAC) and Data Guard

B.Manual database export using Data Pump during the maintenance window

C.OCI Load Balancer health checks with DNS failover

D.Cold backups taken right before maintenance window execution

AnswerA

RAC provides node-level high availability, Data Guard provides DR, and rolling maintenance allows zero-downtime patching.

Why this answer

Exadata infrastructure maintenance is coordinated with Oracle Data Guard switchover or RAC rolling maintenance to ensure continuous application availability.

Full explanation →

358

MCQhard

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

A.Check if the instances have public IP addresses assigned.

B.Check if an Internet Gateway is also attached to the VCN.

C.Check the subnet security lists or NSGs for a matching egress rule allowing outbound traffic to the internet.

D.Check if a Service Gateway is attached to the VCN.

AnswerC

Security rules govern traffic flow; outbound packets must be allowed by security list egress rules or NSGs.

Why this answer

Security lists or NSGs associated with the private subnet must have an egress rule allowing outbound traffic to 0.0.0.0/0 (all ports or specific ports like 80/443). Without matching egress rules, traffic hitting the NAT gateway will be dropped.

Full explanation →

359

Multi-Selecthard

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

Select 2 answers

A.Compartment names in policy statements are case-insensitive and can be replaced by user OCIDs.

B.Policies are attached directly to individual users rather than groups.

C.Policies defined in a child compartment cannot grant permissions on resources in parent compartments.

D.Policies can grant permissions across completely unrelated tenancies without any endorsement or commitment.

E.When referencing nested compartments, the full hierarchical path separated by colons must be used if not a direct child.

AnswersC, E

Policies flow downwards in the compartment hierarchy, never upwards.

Why this answer

Policies must specify a valid scope (compartment or tenancy) and correctly reference subjects and resources.

Full explanation →

360

MCQhard

An administrator needs to restore an encrypted block volume backup to a different Availability Domain within the same OCI region. How should this be achieved?

A.Copy the backup to the target region first, then restore it.

B.Export the backup to an Object Storage bucket, download it on-premises, and re-upload it to the new AD.

C.Create a volume clone in the source AD and attach it across ADs.

D.Directly select the existing backup in the console and choose to restore it to a volume in the target Availability Domain.

AnswerD

Block volume backups are regional resources and can be restored to any Availability Domain within the same region.

Why this answer

Block volume backups in OCI are stored in Object Storage and are automatically available across all Availability Domains within the same region. The administrator can directly restore the backup to a volume in any AD within that region.

Full explanation →

361

MCQhard

You need to ingest custom application logs from multiple compute instances into OCI Logging. What is the correct sequence of components you must configure within OCI?

A.Create a Notification Topic, add HTTP endpoints, and enable Audit logs.

B.Create a Log Group, install and configure the OCI Logging Unified Agent on the instances, and create a custom Log pointing to the agent configuration.

C.Create a Resource Manager stack, deploy a Terraform template, and configure an email subscription.

D.Create a Monitoring Alarm, configure OCI Events, and link them to an Object Storage bucket.

AnswerB

Correct. Custom logs require a Log Group, a properly configured Unified Agent on the instances, and a Log resource.

Why this answer

To ship custom logs from compute instances, you install the Unified Agent, configure a log group, and create a log resource associated with a unified agent configuration.

Full explanation →

362

Multi-Selectmedium

Which TWO methods can be used to connect securely to an Autonomous Database instance? (Choose two.)

Select 2 answers

A.TLS authentication without a wallet when using private endpoints configured with a keystore

B.Mutual TLS (mTLS) authentication using a downloaded credentials wallet file

C.Unencrypted plain text TCP/IP sockets on port 1521

D.Direct unauthenticated HTTP REST calls without authorization headers

E.Direct SSH tunneling through port 22 without database credentials

AnswersA, B

Wallet-less TLS connections are supported when configured on private endpoints.

Why this answer

Connections to Autonomous Database can be made using Mutual TLS (mTLS) with a credentials wallet, or through TLS without a wallet if private endpoint or TLS authentication is configured.

Full explanation →

363

Multi-Selectmedium

Which TWO methods can be used to connect to an Autonomous Database securely from an on-premises application server?

Select 2 answers

A.Using a downloaded client credentials wallet (mTLS connection)

B.Direct SSH tunneling through the database control plane

C.Unencrypted Telnet connection over port 1521

D.Anonymous FTP file transfer into the database home

E.Using TLS authentication with a private endpoint and hostname without a wallet

AnswersA, E

Wallet-based mTLS is the standard secure connection method.

Why this answer

Autonomous Database supports mutual TLS (mTLS) via downloaded wallets and TLS connections using private endpoints or database names.

Full explanation →

364

Multi-Selecthard

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

Select 3 answers

A.Compartments automatically replicate resources across OCI regions for high availability.

B.Compartments can be used to set granular budget limits and cost tracking.

C.Compartments isolate network traffic between VCNs automatically without security lists.

D.IAM policies inherit downwards from parent compartments to child compartments.

E.Compartment depth is limited to a maximum of 6 levels below the root tenancy.

AnswersB, D, E

Budgets can be scoped to compartments for cost monitoring.

Why this answer

Compartment design should reflect organizational structure, policy inheritance, and quota management.

Full explanation →

365

MCQeasy

Which tier of Block Volume performance allows you to dynamically adjust the IOPS/GB?

A.Lower Cost

B.Balanced

C.Archive

D.Ultra High Performance

AnswerB

Balanced tier allows performance scaling.

Why this answer

Balanced and Higher Performance tiers allow dynamic adjustment of performance settings.

Full explanation →

366

MCQhard

You are designing a PCI-DSS compliant architecture on OCI. You need to ensure that all data stored on compute instance boot volumes and block volumes is encrypted using customer-managed encryption keys rather than Oracle-managed keys. Where should you configure these keys?

A.Via IAM user password policies.

B.Directly in the guest OS kernel encryption configuration files (`/etc/fstab`).

C.In OCI Vault (Key Management), assigning a master encryption key to the volumes during creation or update.

D.In the VCN Security List encryption settings.

AnswerC

OCI Vault enables customer-managed encryption keys (CMK) for boot and block volumes.

Why this answer

Customer-managed keys are managed in OCI Vault (Key Management Service - KMS), and you can assign a master encryption key to boot volumes and block volumes when provisioning them.

Full explanation →

367

MCQmedium

You have a fleet of compute instances running in a private subnet. You want to patch their operating systems regularly using OCI OS Management service without exposing them to the public internet. What must be configured in your VCN?

A.A NAT Gateway with public IP attachment

B.An Internet Gateway with security list ingress rules

C.A Service Gateway and a route table rule pointing traffic destined for Oracle Services to the Service Gateway

D.A Local Peering Gateway connected to Oracle's internal network

AnswerC

Service Gateways enable private access to Oracle services (such as OS Management) from private subnets.

Why this answer

To allow private instances to access Oracle services like OS Management or Object Storage without public internet access, you must configure a Service Gateway and a corresponding route table entry.

Full explanation →

368

MCQmedium

You are creating an instance configuration from an existing compute instance that has two secondary data block volumes attached in addition to its boot volume. What happens to the data block volumes when you use this instance configuration to create an instance pool?

A.The instance pool creation fails because secondary block volumes are prohibited in instance pools.

B.The block volumes become shared network file systems across all pool members simultaneously in read-write mode.

C.Identical copies of the block volumes are automatically created and attached to every new instance in the pool.

D.Secondary block volumes are excluded from the instance pool configuration template; instance pools manage compute instances and boot volumes.

AnswerD

Secondary block volume attachments are not part of standard instance pool creation templates.

Why this answer

Instance configurations capture the instance metadata, shape, image, and boot volume settings. However, secondary block volume attachments are typically not cloned or automatically attached as independent writable block volumes for every new instance in the pool unless explicitly defined or managed via shared storage like File Storage.

Full explanation →

369

MCQmedium

An administrator needs to scale up CPU cores for an existing Oracle Autonomous Transaction Processing database without causing application downtime. Which feature of Autonomous Database allows this?

A.Database migration via Oracle Zero Downtime Migration tool

B.Manual resizing through operating system configuration files

C.Autonomous Database Elastic Resource Scaling

D.Database cloning

AnswerC

Elastic resource scaling enables automatic or manual scaling of compute and storage online with zero downtime.

Why this answer

Autonomous Database supports online scaling of both CPU OCPUs and storage capacity without interrupting running workloads.

Full explanation →

370

MCQhard

You need to extract specific JSON fields from your logs to create custom metrics. Which tool should you use?

A.Logging Query Language (LQL)

B.Terraform HCL

C.Management Dashboard

D.Events service

AnswerA

LQL allows parsing and extraction for custom metrics.

Why this answer

Log search uses the Logging query language, but saved searches or Logging Analytics can create metrics based on log content.

Full explanation →

371

MCQmedium

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

A.Allow group DataReaders to use buckets in compartment DataLake

B.Allow group DataReaders to inspect storage in tenancy

C.Allow group DataReaders to manage files in compartment DataLake

D.Allow group DataReaders to read object-family in compartment DataLake

AnswerD

The 'object-family' resource type encompasses both buckets and objects, and the 'read' verb grants listing and retrieval permissions within the specified compartment.

Why this answer

Object Storage buckets and objects are managed using the 'object-family' resource type in OCI IAM policies.

Full explanation →

372

MCQmedium

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

A.Map the Identity Provider's user group to an Oracle Cloud Infrastructure IAM group.

B.Create an IAM policy granting the mapped OCI group read access to the FinanceAudits compartment.

C.Manually create individual IAM user accounts for each auditor in the Oracle Cloud Infrastructure Console.

D.Configure the Identity Provider (IdP) metadata XML file in the OCI IAM identity provider console.

AnswerC

Federation avoids the need to manually provision individual user accounts in OCI.

Why this answer

To federate an IdP, you must configure the IdP, create an IdP group, map that IdP group to an OCI group, and write a policy granting the OCI group access. You do not manually create local IAM users for the federated users.

Full explanation →

373

MCQeasy

What is the primary function of OCI Identity Domains?

A.To manage DNS zones and DNS resolution records.

B.To provide comprehensive identity and access management capabilities such as user lifecycle management, MFA, and OAuth/SAML integration.

C.To manage physical server racks in Oracle Cloud regions.

D.To isolate database traffic across virtual cloud networks.

AnswerB

Identity Domains serve as containers for identity and access management, supporting advanced governance features.

Why this answer

Identity Domains provide advanced identity governance, user management, and authentication features in OCI, extending traditional IAM capabilities.

Full explanation →

374

MCQmedium

You have an existing compute instance with a standard boot volume size of 47 GB. Your application requires 200 GB. You successfully increase the boot volume size to 200 GB in the OCI Console. However, when you run `df -h` inside the guest OS, it still shows 47 GB. What is the cause?

A.The guest OS partition and file system have not yet been resized to claim the expanded storage.

B.OCI does not support expanding boot volumes online; you must reboot the instance.

C.You must detach the boot volume and reattach it for the OS to notice the change.

D.Boot volumes have a hard cap of 50 GB unless converted to Block Volumes.

AnswerA

The OS file system must be extended after resizing the volume in the console.

Why this answer

While OCI resizes the physical storage block device at the hypervisor level, the guest operating system partition and file system must be manually or automatically extended to utilize the new space.

Full explanation →

375

MCQmedium

Which encryption method is used by default for all Object Storage buckets?

A.AES-256 server-side encryption

B.RSA-4096 client-side encryption

C.No encryption by default

D.TLS 1.3 only

AnswerA

This is the default encryption standard for Object Storage.

Why this answer

OCI Object Storage automatically encrypts all data at rest using AES-256.

Full explanation →

Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) (1Z0-1072-26) — Questions 301–375