Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) 1Z0-1072-26 Questions 451–521 | Page 7/7

451

Multi-Selecteasy

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Select 2 answers

A.A fully configured Autonomous Data Warehouse

B.A 10TB Object Storage archive bucket

C.The tenancy root compartment

D.Default administrators group and initial tenancy administrator user

E.A pre-configured Kubernetes production cluster

AnswersC, D

The root compartment is created automatically for every tenancy.

Why this answer

Every new tenancy starts with the root compartment and default IAM administration constructs.

Full explanation →

452

MCQhard

You need to share a block volume across multiple compute instances. Which configuration is required?

A.Block volumes cannot be shared

B.Enable multi-attach flag

C.RAID 1 configuration

D.Use iSCSI with multiple logins

AnswerA

Block volumes are restricted to one instance at a time.

Why this answer

Block volumes do not support multi-attach. You must use a network file system instead.

Full explanation →

453

MCQmedium

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

A.In the NAT Gateway configuration settings

B.In the IPSec Connection details page under the DRG

C.In the FastConnect Virtual Circuit overview

D.In the VCN Details page under Internet Gateway

AnswerB

The IPSec Connection details provide the Oracle tunnel endpoint public IP addresses.

Why this answer

When you create an IPSec connection under the DRG details, OCI automatically provisions two redundant VPN tunnels, displaying their respective public IP addresses in the IPSec Connection details page.

Full explanation →

454

MCQmedium

You are configuring an Object Storage bucket and want to ensure that if an object is accidentally overwritten or deleted, previous versions can still be retrieved. Which feature should you enable?

A.Cross-Region Replication

B.Object Versioning

C.Object Storage Lifecycle Management

D.Bucket Retention Rules

AnswerB

Object Versioning keeps historical versions of objects when they are modified or deleted.

Why this answer

Object Versioning preserves multiple variants of an object in the same bucket, protecting against accidental overwrites and deletions.

Full explanation →

455

MCQmedium

You need to trigger a serverless function whenever an object is uploaded to an Object Storage bucket. Which service should you configure?

A.Resource Manager

B.Notifications service

C.Monitoring service

D.Events service

AnswerD

Events service triggers actions based on state changes.

Why this answer

The Events service allows you to create rules that respond to changes in resources, such as an Object-Create event in Object Storage.

Full explanation →

456

Multi-Selecteasy

Which TWO of the following are valid Object Storage tiers in OCI?

Select 2 answers

A.Fast Storage

B.Temporary Storage

C.Cold Storage

D.Archive

E.Standard

AnswersD, E

Archive is the low-cost tier.

Why this answer

Standard and Archive are the primary tiers in OCI Object Storage.

Full explanation →

457

MCQeasy

Which OCI Object Storage feature enables users without an OCI account to securely download or upload a specific object via a generated URL with a defined expiration time?

A.OCI IAM Federation

B.API Signing Keys

C.Object Storage Public Access Buckets

D.Pre-Authenticated Requests (PAR)

AnswerD

PAR allows generating time-bound URLs for downloading or uploading objects without credentials.

Why this answer

Pre-authenticated requests (PAR) provide a way to let users securely access or upload a specific object or bucket without requiring credentials, using a unique URL with an expiration time.

Full explanation →

458

Multi-Selectmedium

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Select 2 answers

A.Service Gateway

B.Dynamic Routing Gateway (DRG) attached to the VCN

C.Local Peering Gateway (LPG)

D.NAT Gateway

E.Customer-Premises Equipment (CPE) object representing your on-premises gateway IP

AnswersB, E

The DRG terminates the VPN connection on the cloud side.

Why this answer

OCI automatically provisions two redundant VPN tunnels for every Site-to-Site VPN connection. To use them, you configure a CPE object, a DRG, and configure both tunnels on your on-premises router.

Full explanation →

459

Multi-Selecteasy

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

Select 2 answers

A.object-family

B.employee-badge-readers

C.corporate-laptop-hardware

D.instance-family

E.office-wifi-routers

AnswersA, D

object-family is a valid resource type for Object Storage buckets and objects.

Why this answer

OCI IAM policies govern access to virtually all OCI resources, including compute and object storage.

Full explanation →

460

MCQhard

You are troubleshooting a slow-running query on an Exadata Cloud Service database. You suspect that smart scan is not being utilized by the storage cells. Which Exadata feature enables offloading SQL processing operations like filtering and projections directly to the storage servers?

A.Oracle Database In-Memory Column Store

B.Exadata Smart Scan (Storage Offload)

C.Hybrid Columnar Compression (HCC)

D.Automatic Storage Management (ASM) Mirroring

AnswerB

Smart Scan offloads query filtering and processing to the Exadata storage servers.

Why this answer

Exadata Smart Scan (Storage Index and Offload processing) offloads database query processing tasks from the database compute nodes to the Exadata storage cells.

Full explanation →

461

MCQeasy

Which OCI service provides a POSIX-compliant file system?

A.Archive Storage

B.Object Storage

C.Block Volume

D.File Storage Service

AnswerD

FSS is fully POSIX-compliant.

Why this answer

File Storage Service provides a standard NFS-based, POSIX-compliant file system.

Full explanation →

462

MCQmedium

In Resource Manager, what is a 'Stack'?

A.A database container

B.A collection of Terraform resources

C.A storage backup set

D.A virtual machine cluster

AnswerB

A stack manages the lifecycle of your Terraform infrastructure.

Why this answer

A stack is a collection of Terraform configurations and their associated state.

Full explanation →

463

MCQeasy

Which OCI networking component acts as a virtual firewall at the subnet level?

A.Internet Gateway

B.Security List

C.Dynamic Routing Gateway

D.Service Gateway

AnswerB

Security Lists provide stateful/stateless ingress and egress packet filtering at the subnet level.

Why this answer

Security Lists act as virtual firewalls that apply to all VNICs within a given subnet.

Full explanation →

464

Multi-Selecteasy

Which TWO editions of Oracle Database are generally available for provisioning when creating an Oracle Base Database System in OCI?

Select 2 answers

A.Standard Edition 2 (SE2)

B.Enterprise Edition (EE)

C.Oracle Database Lite Edition

D.Oracle Database Express Edition (XE) Cloud Managed

E.Community Edition SQL Server

AnswersA, B

SE2 is a supported database edition for Base DB systems.

Why this answer

OCI Base Database Systems support Standard Edition 2 and Enterprise Edition.

Full explanation →

465

MCQmedium

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

A.Allow group DevOps to use pub-sub in compartment AppComp

B.Allow group DevOps to manage messaging-family in tenancy

C.Allow group DevOps to manage events, notifications in compartment AppComp

D.Allow group DevOps to inspect triggers in compartment AppComp

AnswerC

The resource types 'events' and 'notifications' govern the OCI Events and Notifications services respectively.

Why this answer

The OCI Events service and Notifications service use 'events' and 'notifications' as their resource types.

Full explanation →

466

MCQhard

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

A.The vault must be placed in the exact same subnet as the compute instance.

B.The compute instance must have its root password stored as plain text in the instance metadata.

C.The policy must allow the dynamic group to read secrets and keys in the vault compartment, and the vault key must be accessible.

D.You must attach an API signing key directly to the compute instance metadata service.

AnswerC

Accessing Vault secrets requires permissions on both the 'secrets' resource type and the 'vaults'/'keys' resource types because secrets are encrypted by vault master keys.

Why this answer

Vault secrets are encrypted using master encryption keys (master encryption keys managed in OCI Vault). For a dynamic group to read a secret, the policy must grant access to secrets and keys, and the key policy must allow decryption.

Full explanation →

467

Multi-Selecteasy

Which THREE components are involved in OCI File Storage Service?

Select 3 answers

A.Export

B.File system

C.Bucket

D.Backup gateway

E.Mount target

AnswersA, B, E

The path mapping.

Why this answer

File systems, mount targets, and exports are the main components.

Full explanation →

468

MCQhard

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

A.DYNAMIC {compartment.id IN ('ocid1.compartment..oc1..aaaa...')}

B.ALL {instance.compartment.id = 'ocid1.compartment..oc1..aaaa...'}

C.ANY {resource.compartment = 'ocid1.compartment..oc1..aaaa...'}

D.MATCH {compartment.ocid == 'ocid1.compartment..oc1..aaaa...'}

AnswerB

The correct dynamic group rule syntax for matching a compartment ID is 'instance.compartment.id = <compartment_ocid>' enclosed in ALL or ANY blocks.

Why this answer

Dynamic groups match compute instances in a compartment using the parameter 'instance.compartment.id'.

Full explanation →

469

MCQmedium

When creating an OCI Function application, you must select one or more subnets. What type of subnets should you choose if your function needs to call external public APIs over the internet?

A.Subnets with a Service Gateway only

B.Subnets configured strictly as local peering endpoints

C.Subnets with no route table entries

D.Subnets associated with a NAT Gateway or Internet Gateway route table

AnswerD

Outbound internet traffic from private subnets requires a NAT Gateway, while public subnets use an Internet Gateway.

Why this answer

If functions need outbound internet access (e.g., calling public APIs), the associated subnets must have a route table pointing to a NAT Gateway or Internet Gateway.

Full explanation →

470

Multi-Selectmedium

Which THREE actions can you perform on a block volume?

Select 3 answers

A.Resize the volume

B.Mount as a website

C.Clone the volume

D.Convert to object storage

E.Create a backup

AnswersA, C, E

Resizing is supported.

Why this answer

Backups, clones, and resizing are common operations for block volumes.

Full explanation →

471

MCQeasy

What is the maximum size of a single object that can be uploaded to OCI Object Storage using a single PUT request?

A.10 TiB

B.5 TiB

C.100 GiB

D.50 GiB

AnswerA, D

Wait, the maximum size for a single PUT object upload is 50 GiB, while the total object size using multipart upload can reach 10 TiB. Let's ensure precision. Single PUT request limit is 50 GiB.

Why this answer

For standard single PUT operations, the maximum object size is 50 GiB. Larger files require multipart uploads.

Full explanation →

472

MCQmedium

You want to deploy a Windows compute instance in OCI using your own custom software pre-installed. What is the recommended workflow to achieve this?

A.Upload your local virtual machine disk (VMDK/VHD) directly to a compute instance as a running process.

B.Launch an instance from a standard Windows image, install your software, create a custom image from the boot volume, and use it to launch new instances.

C.Run a bash script via user data on every new instance launch to download and install the software every time.

D.Use Block Volume backups as direct instance templates without creating custom images.

AnswerB

This is the standard golden image creation process in OCI.

Why this answer

The workflow for custom software deployment involves launching a base image instance, installing and configuring your software, capturing a custom image from the boot volume, and using that custom image for future deployments.

Full explanation →

473

MCQmedium

Which file system protocol does OCI File Storage Service support?

A.FTP

B.iSCSI

C.NFSv3

D.SMB

AnswerC

FSS supports NFSv3.

Why this answer

FSS is based on the NFSv3 protocol.

Full explanation →

474

MCQhard

You are managing an Oracle Base Database System (DB System) on OCI and need to minimize downtime during a planned operating system patching cycle. Which action should you perform to achieve this for a 2-node RAC DB System?

A.Apply the patch simultaneously to both nodes to ensure the cluster remains synchronized.

B.Take a full manual backup, terminate the DB System, and reprovision with the new patched image.

C.Perform a rolling patch on one node at a time using the OCI console or CLI.

D.Convert the 2-node RAC to a Single Instance database, patch it, and convert it back.

AnswerC

Rolling patches allow you to patch one database home or node at a time, keeping the other node operational and ensuring zero downtime.

Why this answer

For a 2-node RAC DB System, patching is performed in a rolling fashion node by node to maintain high availability and minimize downtime.

Full explanation →

475

MCQhard

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

A.The route table on the VCN subnet does not have a route to 0.0.0.0/0.

B.The Security List on the DRG attachment blocks ICMP traffic.

C.BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.

D.The public subnet has an incorrect Internet Gateway route.

AnswerC

Mismatched peer IPs, ASNs, or blocked TCP port 179 will keep BGP in an Idle or Active state.

Why this answer

BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Full explanation →

476

MCQmedium

You are migrating workloads to OCI and need to route traffic between two VCNs that reside in the same tenancy but in different regions (Ashburn and Phoenix). Which OCI component is required to establish this cross-region connection?

A.Internet Gateway

B.Dynamic Routing Gateway (DRG)

C.Local Peering Gateway (LPG)

D.NAT Gateway

AnswerB

DRG version 2 supports cross-region VCN peering.

Why this answer

Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, configured with a remote peering connection between the two DRGs.

Full explanation →

477

MCQhard

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

A.The user's password in OCI IAM has expired and must be reset.

B.The API signing key of the IdP metadata XML file needs to be rotated daily.

C.OCI requires manual creation of local user profiles for every federated login attempt.

D.The group mapping rule in the OCI Identity Provider configuration does not match the incoming group claim in the SAML assertion.

AnswerD

OCI requires explicit group mapping rules that match the exact group name or attribute assertion sent by the external IdP.

Why this answer

Federated group mappings link external IdP group names to OCI IAM group names. If the group name in the SAML assertion does not match the mapped rule in OCI, the user cannot be authorized.

Full explanation →

478

MCQhard

You are troubleshooting an issue where an application cannot access an OCI Object Storage bucket. The IAM policies are verified as correct, and the object storage endpoint is reachable. However, the client receives HTTP 403 Forbidden errors when attempting to perform a GET request. The bucket is private. What could be causing this?

A.The VCN lacks an Internet Gateway, and traffic is attempting to go over the public internet.

B.The OCI KMS master encryption key associated with the bucket has been disabled or scheduled for deletion.

C.The bucket name is not globally unique within the tenancy.

D.The Object Storage bucket is configured in the Infrequent Access tier instead of Standard.

AnswerB

If the encryption key protecting the bucket's objects is disabled, read and write operations will fail with authorization or forbidden errors.

Why this answer

If a bucket is private and public access is blocked or IAM policies check out, pre-authenticated requests (PAR) or missing object-read permissions, or VCN Service Gateway restrictions could cause 403 errors. Another common cause is customer-managed encryption key state changes (e.g., the KMS key was disabled).

Full explanation →

479

MCQmedium

You are configuring a custom log in OCI Logging. You want to parse and extract specific fields from unstructured application log lines using search queries. Which log feature allows you to query, analyze, and create visualizations from these ingested logs?

A.OCI Monitoring Metrics Explorer

B.OCI Events Rule Builder

C.OCI Logging Analytics Log Explorer

D.OCI Resource Manager Jobs

AnswerC

Correct. Log Explorer allows you to search, parse, and visualize logs using structured queries.

Why this answer

OCI Logging Search allows users to query ingested log data using a powerful query language, and Log Analytics offers advanced log analysis features.

Full explanation →

480

Multi-Selectmedium

Which THREE operations can be performed on an Oracle Base Database System from the OCI Console?

Select 3 answers

A.Modify the operating system kernel source code

B.Scale storage size

C.Directly modify Oracle internal data dictionary tables

D.Create manual backups

E.Apply database and grid infrastructure patches

AnswersB, D, E

You can scale storage directly from the OCI Console.

Why this answer

From the OCI Console, you can scale storage, patch database homes, and create manual backups.

Full explanation →

481

Multi-Selectmedium

Which TWO actions can you perform on an OCI Virtual Cloud Network (VCN) after it has been created?

Select 2 answers

A.Rename the underlying VCN OCID

B.Modify the primary CIDR block of the VCN

C.Create new subnets within the VCN

D.Add secondary CIDR blocks to the VCN

E.Convert a regional subnet into an Availability Domain-specific subnet

AnswersC, D

You can create additional subnets as long as they fit within the VCN CIDR blocks.

Why this answer

After creating a VCN, you can add new subnet CIDRs, add/remove gateways, modify route tables, and update security lists. However, you cannot change the primary VCN CIDR block once created.

Full explanation →

482

Multi-Selecthard

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Select 2 answers

A.Identity Domains replace Virtual Cloud Networks entirely.

B.Identity Domains support advanced features like OAuth, SAML integration, and passwordless authentication.

C.Every tenancy is restricted to having exactly one Identity Domain that cannot be changed.

D.Identity Domains store compute instance virtual disk images.

E.Identity Domains act as containers for managing users, groups, and security settings.

AnswersB, E

Identity Domains extend IAM capabilities with advanced enterprise security and identity federation features.

Why this answer

Identity Domains provide advanced governance features, user management, and can be configured as free or paid tiers depending on features required.

Full explanation →

483

Multi-Selecthard

Which THREE factors influence Block Volume performance?

Select 3 answers

A.Object versioning

B.Bucket replication setting

C.Instance shape

D.Volume size

E.Performance tier

AnswersC, D, E

Shape limits bandwidth.

Why this answer

Volume size, performance tier, and instance attachment affect throughput and IOPS.

Full explanation →

484

Multi-Selecthard

Which TWO statements are true regarding OCI VCN Flow Logs?

Select 2 answers

A.Flow logs capture information about traffic flowing through VNICs in your VCN.

B.Flow logs are only supported on public subnets.

C.Flow logs automatically encrypt your database data at rest.

D.Flow logs require an Internet Gateway to export logs out of the VCN.

E.You can configure flow logs to capture accepted traffic, rejected traffic, or both.

AnswersA, E

Flow logs record network flows such as source/destination IPs, ports, and protocols.

Why this answer

VCN Flow Logs capture accepted and rejected traffic traffic flows across VNICs in your VCN. They can be stored in OCI Object Storage or streamed to Logging Analytics.

Full explanation →

485

MCQmedium

You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?

A.Configure the token as the BGP ASN on your on-premises router.

B.Attach the token directly to the instance security list.

C.Paste the token into the OCI VCN route table settings.

D.Provide the Oracle Industry Partner token to your FastConnect provider so they can complete the provisioning from their network.

AnswerD

The provider uses the token to establish the virtual circuit link to OCI.

Why this answer

When using the FastConnect Provider model, you must provide the Oracle Industry Partner token (OCID) to your telecommunication or network provider so they can provision the circuit from their end.

Full explanation →

486

MCQeasy

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

A.MasterCompartment

B.Tenancy root (or the root compartment)

C.RootComp

D.Default-Tenant

AnswerB

Every OCI tenancy starts with a root compartment that encompasses all resources and child compartments.

Why this answer

The root compartment, which is created automatically with every tenancy, is named the tenancy root (or referred to by the tenancy name itself).

Full explanation →

487

Multi-Selecteasy

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Select 2 answers

A.manage

B.write

C.delete

D.execute

E.inspect

AnswersA, E

Manage is the highest-level verb in OCI IAM policies, granting full control.

Why this answer

OCI IAM policies support exactly four standard verbs: inspect, read, use, and manage.

Full explanation →

488

Multi-Selectmedium

Your organization is implementing dynamic groups to manage automated deployments from OCI Functions and Compute instances. Which THREE of the following matching rule criteria are valid for constructing OCI dynamic groups? (Choose three.)

Select 3 answers

A.Matching by compartment OCID (ALL {instance.compartment.id = 'ocid1...'})

B.Matching by local Linux operating system user accounts (e.g., /etc/passwd UID).

C.Matching by specific static IAM user password expiration dates.

D.Matching by compute instance OCID (ALL {instance.id = 'ocid1...'})

E.Matching by resource defined tags (ALL {resource.tags.department = 'Finance'})

AnswersA, D, E

You can match instances or resources residing within a specific compartment OCID.

Why this answer

Dynamic group matching rules can evaluate instance OCIDs, compartment OCIDs, resource tags (defined tags), and image OCIDs. They do not evaluate local Unix user accounts or static IAM user passwords.

Full explanation →

489

Multi-Selectmedium

Which THREE features are supported by OCI Load Balancer?

Select 3 answers

A.TCP layer 4 load balancing

B.Automatic packet filtering like a Next-Gen Firewall

C.HTTP/HTTPS layer 7 load balancing

D.SSL termination

E.Direct database query routing without backend compute instances

AnswersA, C, D

Load balancers support TCP stream proxying at layer 4.

Why this answer

OCI Load Balancers support TCP, HTTP, and HTTPS listeners, SSL termination, health checks, and multiple load balancing algorithms like weighted round robin and least connections.

Full explanation →

490

MCQhard

You need to increase the size of an existing Block Volume. What is the correct procedure?

A.Snapshot and clone

B.Use the 'Resize' action in the console

C.Delete and recreate the volume

D.Attach a second volume and mirror

AnswerB

Resizing increases the volume capacity dynamically.

Why this answer

You can increase the size of a volume without detaching it, then expand the file system on the OS.

Full explanation →

491

Multi-Selectmedium

Which THREE protocols are supported for Notifications subscriptions?

Select 3 answers

A.SNMP

B.Email

C.HTTPS

D.PagerDuty

E.FTP

AnswersB, C, D

Standard notification channel.

Why this answer

Notifications supports Email, PagerDuty, and HTTPS.

Full explanation →

492

Multi-Selecthard

Which THREE of the following actions can be performed using OCI Container Engine for Kubernetes (OKE)? (Choose three.)

Select 3 answers

A.Upgrading the Kubernetes control plane version independently of worker nodes

B.Running serverless container instances without any Kubernetes pod orchestration

C.Directly modifying the underlying Linux kernel parameters of the OKE-managed control plane master nodes

D.Automatically resizing worker node pools based on pod resource demands using the Cluster Autoscaler

E.Configuring node pools across multiple fault domains or availability domains

AnswersA, D, E

OKE decouples control plane upgrades from worker node upgrades.

Why this answer

OKE supports automated cluster upgrades, cluster autoscaling via cluster autoscaler, and configuring worker node pools across multiple fault domains or availability domains.

Full explanation →

493

Multi-Selecthard

Which THREE of the following operations are supported by OCI Vault in the context of storage?

Select 3 answers

A.Encryption of Block Volumes

B.Encryption of Object Storage

C.Encryption of ephemeral storage

D.Encryption of compute memory

E.Encryption of File Storage

AnswersA, B, E

Vault manages keys for Block volumes.

Why this answer

Encrypting buckets, block volumes, and file systems.

Full explanation →

494

MCQmedium

You have deployed an OCI Function and invoked it, but it returns a timeout error. What is the maximum execution timeout limit supported by OCI Functions?

A.Infinite

B.900 seconds (15 minutes)

C.60 seconds

D.3600 seconds (1 hour)

AnswerB

The maximum timeout for an OCI Function invocation is 900 seconds.

Why this answer

OCI Functions have a configurable timeout limit up to a maximum of 900 seconds (15 minutes).

Full explanation →

495

Multi-Selectmedium

Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?

Select 3 answers

A.OCI Compartment quota limits

B.Failover routing

C.ASN-based routing

D.SQL query performance metrics

E.Geolocation-based routing

AnswersB, C, E

Failover policies route traffic to primary endpoints and fail over to secondary endpoints if the primary fails.

Why this answer

OCI Traffic Management steering policies support multiple traffic steering strategies including Failover, Load Balancer, Geolocation, ASN-based, and Compute-based routing.

Full explanation →

496

MCQmedium

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

A.Allow group AppSupport to read monitoring-family in tenancy

B.Allow group AppSupport to use metrics in tenancy

C.Allow group AppSupport to inspect telemetry in tenancy

D.Allow group AppSupport to manage alarms in compartment root

AnswerA

The 'monitoring-family' resource type combined with the 'read' verb allows viewing metrics, alarms, and notifications without modification rights.

Why this answer

Monitoring service resources include metrics and alarms, governed by the 'monitoring-family' resource type.

Full explanation →

497

Multi-Selectmedium

Which THREE network components must be correctly configured in a VCN to allow an application instance in a private subnet to connect to an Autonomous Database with a private endpoint?

Select 3 answers

A.Security lists or network security groups allowing traffic on port 1522

B.DNS configuration to resolve the private IP address of the database endpoint

C.An Internet Gateway attached to the private subnet

D.A Public Load Balancer fronting the private IP address

E.A subnet designated for the Autonomous Database private endpoint

AnswersA, B, E

Autonomous Database uses port 1522 for mTLS / TLS connections.

Why this answer

Private endpoints require a subnet in the VCN, appropriate security rules, and DNS resolution/service gateways or VCN peering if accessing across VCNs.

Full explanation →

498

Multi-Selecthard

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Select 2 answers

A.There are no explicit 'Deny' rules in OCI IAM policy grammar.

B.Tenancy root policies always override and cancel compartment-level policies.

C.Explicit deny statements take precedence over all allow statements.

D.Policy evaluation stops immediately upon encountering the first matching statement.

E.If multiple policies apply, permissions are cumulative (additive).

AnswersA, E

OCI IAM policies consist entirely of 'Allow' statements.

Why this answer

OCI IAM policies evaluate additively across compartments, and there are no explicit denies.

Full explanation →

499

Multi-Selecteasy

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Select 2 answers

A.A user password hash

B.A logical wrapper operator (ALL or ANY)

C.Matching criteria enclosed in curly braces {}

D.An API signing key fingerprint

E.A VCN security list ID

AnswersB, C

Every dynamic group rule must begin with either ALL or ANY to evaluate the matching criteria.

Why this answer

Dynamic group rules must start with a logical operator (ALL or ANY) followed by matching criteria enclosed in curly braces.

Full explanation →

500

MCQhard

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

A.NAT Gateway

B.Dynamic Routing Gateway (DRG)

C.Local Peering Gateway (LPG)

D.Internet Gateway

AnswerB

A DRG is the required router for connecting on-premises networks and enabling cross-region or multi-VCN transit routing.

Why this answer

A Dynamic Routing Gateway (DRG) version 2 acts as a virtual router that provides a single point of entry for your network traffic and supports attachments to multiple VCNs across regions, as well as on-premises connections via FastConnect or VPN.

Full explanation →

501

MCQmedium

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

A.Allow group SecurityOps to manage log-files in tenancy

B.Allow group SecurityOps to use audit in tenancy

C.Allow group SecurityOps to read audit-events in tenancy

D.Allow group SecurityOps to inspect audit-trails in compartment root

AnswerC

The 'audit-events' resource type paired with the 'read' verb allows reading audit logs across the specified scope.

Why this answer

Audit logs are accessed via the 'audit-events' resource type in OCI IAM policies.

Full explanation →

502

Multi-Selecthard

Which THREE statements regarding OCI VCN DNS and Hostname resolution are correct?

Select 3 answers

A.Instances in a VCN can resolve each other using their assigned hostnames.

B.Public DNS zones cannot be hosted on OCI.

C.The VCN Resolver can forward DNS queries to on-premises DNS servers.

D.You can create custom private DNS zones and associate them with your VCN.

E.OCI requires you to deploy external bind DNS servers for basic VCN hostname resolution.

AnswersA, C, D

VCN Resolver provides automatic internal DNS name resolution between instances.

Why this answer

OCI assigns internal domain names to instances based on VCN and subnet configuration. Instances can resolve each other using hostname prefixes or fully qualified domain names (FQDNs), and custom DNS zones can be integrated.

Full explanation →

503

MCQhard

If you detach a Block Volume, what happens to the data?

A.Data is lost if not backed up

B.Data remains intact

C.Data is encrypted for migration

D.Data is deleted

AnswerB

Block volumes are persistent independent of compute.

Why this answer

Detaching a volume does not affect the data stored on it; it remains persistent.

Full explanation →

504

MCQmedium

You are managing an Oracle Base Database System and need to configure automated backups to retain backups for a custom period (e.g., 60 days). Where can you configure this retention period?

A.By modifying retention rules on Object Storage lifecycle policies

B.In the DB system backup configuration settings within the OCI Console

C.Backup retention is fixed at 30 days and cannot be modified.

D.By editing the 'init.ora' parameter file using SQL*Plus

AnswerB

Backup retention policies (such as 7 to 60 days) are configured in the DB system backup settings.

Why this answer

In OCI Base Database Systems, you can configure automated backup retention and backup windows during creation or by editing the backup configuration in the OCI Console.

Full explanation →

505

MCQeasy

Which OCI service feature enables you to automatically create identical compute instances based on an instance configuration and adjust the pool size based on demand?

A.Instance Pools and Autoscaling

B.Dedicated Virtual Machine Hosts

C.Compute Cluster Placement Groups

D.Managed File Storage

AnswerA

Instance pools manage groups of identical instances, and autoscaling adjusts their count based on demand.

Why this answer

Instance Pools combined with Autoscaling Configurations allow you to manage groups of identical instances and scale them automatically.

Full explanation →

506

MCQmedium

You have an OKE cluster and want to expose multiple HTTP and HTTPS microservices running in your cluster externally using a single public IP address and path-based routing. Which OCI native component should you deploy?

A.Internet Gateway directly attached to worker node pods

B.Service Gateway

C.OCI Network Load Balancer

D.OCI Load Balancer with Kubernetes Ingress Controller

AnswerD

The OCI Load Balancer Ingress Controller manages Layer 7 HTTP/HTTPS routing, SSL termination, and path-based routing.

Why this answer

OCI Load Balancer or Native Ingress Controller integrated with OCI Load Balancer allows you to route external traffic to different Kubernetes services based on paths or hostnames.

Full explanation →

507

MCQmedium

You are managing an Oracle Base Database System and need to secure data at rest by using your own encryption keys rather than Oracle-managed keys. Which OCI service must you integrate with the database?

A.Oracle Cloud Guard

B.OCI Vault (Key Management Service)

C.Identity and Access Management (IAM) Policies

D.OCI Object Storage Server-Side Encryption

AnswerB

OCI Vault allows customers to create and manage master encryption keys for database TDE.

Why this answer

Customer-managed encryption keys for Oracle databases in OCI are managed using OCI Vault (Key Management Service).

Full explanation →

508

MCQmedium

Your team needs to allow a group of developers to read logs in the Logging service across all compartments, but you want to ensure they cannot modify or delete any logging resources. Which of the following IAM policy verbs should you use?

A.Manage

B.Read

C.Use

D.Inspect

AnswerB

Read gives permissions to inspect resources plus get the content of the resources (such as log objects).

Why this answer

OCI verbs include inspect, read, use, and manage. 'Inspect' lets you list resources, 'read' includes inspect plus getting resource content (like log data), 'use' includes read plus updating/patching, and 'manage' includes all actions. To read logs without modifying, 'read' is appropriate.

Full explanation →

509

MCQeasy

A DBA needs to configure automatic backups for an Oracle Base Database Service instance. Which retention period range is natively supported for automated backups?

A.30 days to 365 days

B.1 day to 14 days

C.7 days to 60 days

D.1 hour to 24 hours

AnswerC

OCI supports automated backup retention from 7 to 60 days for Base Database systems.

Why this answer

Oracle Base Database Service supports automated backup retention periods ranging from 7 days to 60 days.

Full explanation →

510

Multi-Selecthard

Which THREE are characteristics of Object Storage lifecycle rules?

Select 3 answers

A.Automated execution

B.Supports database commands

C.Real-time trigger

D.JSON-based configuration

E.Name-based filtering

AnswersA, D, E

The system runs rules in the background.

Why this answer

JSON-based, filterable by name, and target-specific actions.

Full explanation →

511

MCQmedium

You are managing an Oracle Base Database System (Virtual Machine) and need to scale up the compute shape to a higher number of OCPUs to handle an upcoming month-end processing spike. Which action should you perform?

A.Terminate the current DB system and provision a new one with the larger shape, then restore from a manual backup.

B.Stop the database instance via SQL*Plus and run the 'alter system modify shape' command.

C.Edit the DB system configuration in the OCI Console and update the OCPU count or shape directly.

D.Attach an additional block storage volume with higher performance tiers to absorb the extra compute load.

AnswerC

Editing the DB system shape or OCPU count directly is the supported method for vertical scaling.

Why this answer

For Oracle Base Database Systems, you can scale up the compute shape by modifying the OCPU core count or shape directly from the OCI Console without losing data.

Full explanation →

512

MCQmedium

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

A.Internet Gateway DNS proxy

B.Service Gateway name server

C.NAT Gateway DNS translation

D.VCN Resolver custom forwarders

AnswerD

Custom forwarders allow the VCN resolver to route specific private domain queries to internal name servers.

Why this answer

The VCN Resolver handles DNS resolution for instances. You can configure custom DNS forwarders in the VCN Resolver to forward queries for specific private domains to internal DNS servers while resolving internet queries normally.

Full explanation →

513

Multi-Selectmedium

Which TWO are common performance issues for Block Volumes?

Select 2 answers

A.Too many users

B.IOPS saturation

C.Lack of encryption

D.Network bandwidth limitation

E.Storage bucket latency

AnswersB, D

Exceeding tier limits causes latency.

Why this answer

Network congestion and excessive IOPS exceeding the limit are common.

Full explanation →

514

MCQeasy

Which command-line interface tool is used for managing core OCI infrastructure such as compute instances, VCNs, and block volumes?

A.kubectl

B.docker

C.fn

D.oci CLI

AnswerD

The oci CLI manages core OCI infrastructure services.

Why this answer

The `oci` CLI (OCI Command Line Interface) is the comprehensive tool used to manage core OCI services.

Full explanation →

515

Multi-Selecthard

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Select 3 answers

A.Internet Gateway attached to the private subnets

B.IPSec Connection between the CPE and the DRG

C.Local Peering Gateway (LPG)

D.Dynamic Routing Gateway (DRG) attached to the VCN

E.Customer-Premises Equipment (CPE) object in OCI

AnswersB, D, E

The IPSec Connection binds the CPE and DRG together and establishes encrypted tunnels.

Why this answer

A Site-to-Site VPN requires a Customer-Premises Equipment (CPE) object representing your gateway, a Dynamic Routing Gateway (DRG) attached to your VCN, and an IPSec Connection containing tunnels configured with static or dynamic routing.

Full explanation →

516

MCQmedium

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

A.Allow group Developers to terminate instances in tenancy where client.subnet = '192.168.100.0/24'

B.Allow group Developers to use instance-family in tenancy where request.ip in ('192.168.100.0/24')

C.Allow group Developers to inspect instances in tenancy where request.ip = '192.168.100.0/24'

D.Allow group Developers to manage instance-family in tenancy where request.ip = '192.168.100.0/24'

AnswerB

The 'in' operator with request.ip correctly evaluates whether the client IP falls within the specified CIDR block for policy enforcement.

Why this answer

OCI IAM policies support conditional access using the 'request.ip' variable in combination with logical operators like 'in'.

Full explanation →

517

MCQmedium

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

A.Allow group Developers to read storage-systems in tenancy

B.Allow group Developers to manage file-storage-family in compartment FSCompartment

C.Allow group Developers to manage mount-targets in compartment FSCompartment

D.Allow group Developers to use nfs-shares in compartment FSCompartment

AnswerB

The 'file-storage-family' resource type covers file systems, mount targets, and exports, and 'manage' grants full control within the compartment.

Why this answer

File Storage resources are managed using the 'file-storage-family' resource type in OCI IAM policies.

Full explanation →

518

MCQhard

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

A.OCI policies are additive; if any applicable policy grants access, the user is authorized.

B.Explicit deny statements always take precedence over allow statements.

C.Compartment-level policies take strict precedence, overriding and nullifying tenancy root policies.

D.The most recently created policy overrides all older conflicting policies.

AnswerA

OCI IAM uses an additive evaluation model where permissions from all applicable policies accumulate; there are no explicit denies.

Why this answer

OCI IAM evaluates policies based on an additive model (most permissive wins) across the hierarchy, but specific scoping and explicit denials do not exist (there is no explicit deny statement in OCI IAM).

Full explanation →

519

MCQmedium

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?

A.Service Gateway

B.Internet Gateway

C.NAT Gateway

D.Local Peering Gateway

AnswerA

Service Gateways connect private subnets to regional Oracle services privately.

Why this answer

Service Gateway provides private access to Oracle services like Object Storage across the Oracle network backbone.

Full explanation →

520

MCQeasy

What is the maximum number of volumes you can attach to a single compute instance?

A.32

B.8

C.Unlimited

D.1

AnswerA

Most shapes support up to 32 attachments.

Why this answer

The limit depends on the compute shape, but there is a defined maximum for block volumes.

Full explanation →

521

MCQhard

You are migrating a legacy application to OCI. The application requires a specific network interface card (NIC) virtualization mode and custom UEFI boot parameters that are not standard. Where should you configure these custom launch options?

A.Inside the VCN Security List configurations

B.Via the compute instance's operating system kernel parameters

C.In the Custom Image launch options settings

D.In the Instance Configuration template parameters

AnswerC

Launch options are defined at the custom image level to dictate firmware, network, and boot behavior.

Why this answer

Launch options can be customized when creating a custom image or by updating the launch options of an existing custom image in OCI to specify firmware, network virtualization, and boot options.

Full explanation →

Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) (1Z0-1072-26) — Questions 451–521