Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) (1Z0-1072-26) — Questions 376–404

When utilising the Oracle provider model for FastConnect, provisioning is split between the Oracle Cloud Infrastructure Console and the telecommunications partner's management plane. Having generated the Oracle Industry Partner token (OCID) within the OCI console, you must share this unique identifier with your designated network service provider. This satisfies the architectural constraint of the provider-managed workflow, allowing the external partner to reference the exact OCI circuit configuration and complete the Layer 2 or Layer 3 provisioning from their side.

Creating a tenancy automatically generates the root compartment, named after the tenancy itself, which sits at the top of the compartment hierarchy. Every other compartment nests beneath it, and tenancy-level policies are attached here, satisfying the question's requirement for the default top-level compartment.

The `manage` verb acts as a comprehensive permission set within OCI IAM, granting users the ability to perform all operations on a specific resource type, including the creation, deletion, and modification of associated components. By satisfying the requirement to identify a valid verb for policy statements, this option provides the highest level of administrative control available in the OCI authorisation model. Unlike the granular access controls found in Microsoft Entra ID, this verb encapsulates all CRUD actions, ensuring full lifecycle management of the targeted cloud resources.

OCI Load Balancer provides native support for TCP layer 4 load balancing, which satisfies the requirement for handling non-HTTP traffic. By operating at the transport layer, the service performs packet forwarding based on source and destination IP addresses and ports without inspecting application-layer data. This mechanism ensures efficient routing for protocols such as database connections or custom binary streams, allowing administrators to balance traffic across backend sets while maintaining high availability for services that do not necessitate layer 7 application-aware processing.

Selecting the 'Resize' action within the Oracle Cloud Infrastructure console triggers an online volume expansion, which satisfies the requirement to increase the size of an existing Block Volume without necessitating a detachment or service interruption. This mechanism updates the volume's metadata and backend storage allocation dynamically. Once the console operation completes, you must manually extend the file system on the attached compute instance to utilise the newly available capacity, ensuring the operating system recognises the expanded logical block device.

Email serves as a primary delivery mechanism for OCI Notifications, satisfying the requirement for supported subscription protocols by enabling asynchronous message distribution to end-users. When an event triggers a notification, the service dispatches an SMTP-based message directly to the configured recipient address. This integration ensures that administrators receive critical alerts without requiring custom API polling. Furthermore, it functions seamlessly alongside other supported protocols like HTTPS and PagerDuty, providing a reliable communication channel that remains independent of Microsoft Entra ID authentication constraints.

OCI Container Engine for Kubernetes decouples the control plane lifecycle from the worker node pools, allowing administrators to initiate version upgrades for the API server and scheduler independently. This architectural separation satisfies the requirement for granular cluster management, enabling users to maintain control plane stability while performing rolling updates on worker nodes. By leveraging this independent upgrade mechanism, operators can ensure compatibility with specific Kubernetes versions and security patches without forcing an immediate, synchronous update across the entire compute infrastructure.

OCI Vault integrates seamlessly with the Block Volume service to facilitate data-at-rest protection through the use of Customer-Managed Keys. By leveraging the Key Management Service, administrators can assign a master encryption key to a specific volume, ensuring that all data blocks are encrypted using the Advanced Encryption Standard. This mechanism satisfies the storage operation constraint by providing a centralised, hardware-backed security layer for persistent block storage, a functionality distinct from identity-based access control systems like Microsoft Entra ID.

OCI Functions enforces a strict execution timeout limit of 900 seconds, which directly addresses the timeout error encountered in the scenario. When a function exceeds this 15-minute threshold, the OCI platform terminates the process to prevent runaway resource consumption. This constraint is a fundamental architectural boundary for serverless workloads within the environment. Developers must ensure that long-running tasks are offloaded to alternative services, such as OCI Data Integration or OCI Container Instances, to remain within this defined execution window.

Security lists or network security groups must explicitly permit ingress and egress traffic on port 1522 to satisfy the connectivity constraint imposed by the private endpoint architecture. Since the Autonomous Database resides within a private subnet, the stateful or stateless firewall rules act as the primary gatekeepers, ensuring that the application instance can successfully establish a TCP connection to the database listener. Without these specific rules, the VCN's default security posture would block the necessary traffic, preventing the application from reaching the database resource.

OCI IAM policies function exclusively through additive permissions, meaning they only grant access rather than restricting it. Unlike Microsoft Entra ID, which incorporates explicit deny assignments to override existing permissions, the OCI grammar lacks a deny construct entirely. Consequently, the evaluation logic relies solely on the union of all applicable allow statements. This architectural constraint ensures that security posture is defined strictly by the presence of positive authorisation, simplifying policy management by eliminating the complex conflict resolution required when explicit denials are present.

The ALL or ANY operator determines whether every or just one condition in the rule must match, so it is mandatory syntax. Without it, OCI cannot evaluate multiple matching criteria, making the rule invalid for identifying compute instances.

A Dynamic Routing Gateway acts as the regional transit hub, terminating the FastConnect virtual circuit and routing traffic to attached VCNs. Critically, DRG route tables support inter-region routing via remote peering or DRG attachments, satisfying the requirement to reach multiple VCNs across different OCI regions through one dedicated connection.

Oracle Cloud Infrastructure provides an integrated DNS resolver that automatically manages internal hostname resolution within a Virtual Cloud Network. By assigning a unique hostname to each virtual network interface card, the platform enables instances to communicate using these labels rather than relying solely on private IP addresses. This mechanism satisfies the requirement for seamless intra-VCN connectivity, functioning independently of external identity providers like Microsoft Entra ID, as the OCI-native resolver maintains the authoritative records for all instances provisioned within the specified subnet.

Detaching a block volume in Oracle Cloud Infrastructure simply unmounts the storage from the compute instance without triggering a deletion process. Because the volume exists as a persistent, independent resource decoupled from the lifecycle of the virtual machine, the underlying data blocks remain stored within the storage pool. This mechanism ensures that the volume satisfies the constraint of data persistence, allowing the storage to be reattached to a different instance or re-mounted later without any loss of information.

Retention is set per DB system under Backup Configuration in the OCI Console, where the retention period field accepts values from 1 to 60 days. This directly satisfies the stem's 60-day custom retention requirement, since the setting applies to the Base Database System's automated backups rather than individual manual backups.

Instance Pools provision identical compute instances from an instance configuration, and autoscaling adjusts the pool size automatically in response to demand metrics. This satisfies the requirement for both template-driven consistency and elastic capacity, which standalone instance creation cannot deliver.

The OCI Load Balancer integrates with the Kubernetes Ingress Controller, which watches Ingress resources and programs path-based routing rules onto a single flexible load balancer. This exposes multiple HTTP and HTTPS microservices through one public IP, meeting the stated requirement natively.

Integrating OCI Vault allows you to satisfy the requirement of using customer-managed keys instead of Oracle-managed keys for Transparent Data Encryption. By leveraging the Key Management Service, you maintain full control over the lifecycle of the master encryption keys stored within a FIPS 140-2 Level 3 hardware security module. This integration enables the database to perform cryptographic operations using your own keys, ensuring that you retain sovereignty over the data-at-rest protection mechanism rather than relying on default provider-managed infrastructure.

The Read verb grants permission to view logging resources and their contents without allowing creation, modification, or deletion, which require Manage or Use. This precisely satisfies the stem's constraint that developers read logs across all compartments while being unable to alter any logging resources.

Lifecycle rules operate as an automated background process within Oracle Cloud Infrastructure Object Storage, eliminating the need for manual intervention to manage data retention. By defining policies based on object age or prefix, the service autonomously transitions data to archive tiers or deletes expired objects. This mechanism directly satisfies the requirement for automated execution, ensuring that storage costs are optimised and data governance policies are enforced consistently without requiring administrators to manually trigger scripts or perform recurring management tasks.

Oracle Base Database System on Virtual Machine shapes are scaled by editing the DB system and changing the OCPU count or shape, which resizes the underlying compute without redeployment. This satisfies the month-end spike requirement.

Custom forwarders let the VCN Resolver send queries for specific internal domains to your own DNS servers while still resolving internet names, satisfying both requirements. Internet Resolver alone handles only public names; private views serve OCI-assigned hostnames.

The OCI CLI serves as the primary command-line interface tool designed specifically to interact with the OCI REST APIs, enabling comprehensive management of core infrastructure resources like compute instances, VCNs, and block volumes. By providing a unified syntax for these services, it satisfies the stem’s constraint for a tool capable of handling foundational infrastructure components. Unlike browser-based consoles or external identity providers like Microsoft Entra ID, this tool executes direct programmatic requests to the OCI control plane to automate and manage complex cloud environments efficiently.

Establishing an IPSec connection between the Customer Premises Equipment (CPE) and the Dynamic Routing Gateway (DRG) is essential for creating the encrypted tunnel required by the stem. This component satisfies the requirement for a secure, site-to-site communication path by encapsulating traffic between the on-premises network and the OCI VCN. Without this specific logical link, the infrastructure cannot facilitate the routing of packets across the public internet, thereby failing to establish the necessary connectivity between the two distinct datacenter environments.

Managing file-storage-family in FSCompartment grants the Developers group full control over FSS file systems and mount targets, since that aggregate covers all file-storage resource types. Scoping the statement to FSCompartment satisfies the compartment constraint, and manage supplies the create, update and delete verbs the task requires.

OCI IAM policies are additive: evaluation unions all applicable statements, and access is granted if any statement allows the requested operation. No deny rule overrides a grant, so overlapping policies at root and compartment levels simply accumulate permissions.

A Service Gateway provides private connectivity to OCI public services, such as Object Storage, without traversing the public internet. By routing traffic through this gateway, database instances residing in a private subnet maintain their isolation while accessing backend storage endpoints over the Oracle network backbone. This configuration satisfies the constraint of ensuring secure, private communication for resources that lack public IP addresses, effectively bypassing the need for a NAT gateway or public internet exposure for these specific service-bound requests.

Custom image launch options let you specify the NIC virtualisation mode and UEFI boot parameters, such as secure boot and firmware settings, when instances launch from that image. This satisfies the non-standard hardware requirements, since these settings cannot be altered on a running instance after launch.