1Z0-1072-26 Practice Questions

Question 1

You are using the Events service to trigger a Function. What is a required step before this can work?

Accepted Answer

Grant 'use' permissions on the function to the Events service. Before the OCI Events service can trigger a Function, you must grant the Events service permission to invoke the function. This is done by creating a policy that allows the Events service principal to use the function. Without this authorization, the Events service cannot call the function, and the rule will fail.

Answer

Attach a load balancer

Answer

Enable HTTP access on the function

Answer

Create a Service Connector

Question 2

You are creating an instance configuration from an existing compute instance that has two secondary data block volumes attached in addition to its boot volume. What happens to the data block volumes when you use this instance configuration to create an instance pool?

Accepted Answer

Secondary block volumes are excluded from the instance pool configuration template; instance pools manage compute instances and boot volumes.. An instance configuration captures the compute instance's shape, image, metadata, and boot volume, but secondary (data) block volumes are not included in the template. When an instance pool is created from that configuration, each new instance is provisioned with only the boot volume; the attached data volumes are excluded. This is by design because block volumes cannot be safely cloned and attached to multiple instances simultaneously.

Answer

The instance pool creation fails because secondary block volumes are prohibited in instance pools.

Answer

The block volumes become shared network file systems across all pool members simultaneously in read-write mode.

Answer

Identical copies of the block volumes are automatically created and attached to every new instance in the pool.

Question 3

You have a fleet of compute instances running in a private subnet. You want to patch their operating systems regularly using OCI OS Management service without exposing them to the public internet. What must be configured in your VCN?

Accepted Answer

A Service Gateway and a route table rule pointing traffic destined for Oracle Services to the Service Gateway. To allow private instances to access Oracle services like OS Management or Object Storage without public internet access, you must configure a Service Gateway and a corresponding route table entry.

Answer

A NAT Gateway with public IP attachment

Answer

An Internet Gateway with security list ingress rules

Answer

A Local Peering Gateway connected to Oracle's internal network

Question 4

You are designing a PCI-DSS compliant architecture on OCI. You need to ensure that all data stored on compute instance boot volumes and block volumes is encrypted using customer-managed encryption keys rather than Oracle-managed keys. Where should you configure these keys?

Accepted Answer

In OCI Vault (Key Management), assigning a master encryption key to the volumes during creation or update.. To use customer-managed encryption keys for boot volumes and block volumes, you configure a master encryption key in OCI Vault (Key Management) and assign it to the volumes during creation or update. This ensures that data at rest is encrypted with keys the customer controls, satisfying PCI-DSS requirements for key management. OCI Vault integrates natively with Block Volume and Boot Volume services for this purpose.

Answer

Via IAM user password policies.

Answer

Directly in the guest OS kernel encryption configuration files (`/etc/fstab`).

Answer

In the VCN Security List encryption settings.

Question 5

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Accepted Answer

Allow group DataReaders to read object-family in compartment DataLake. The policy statement 'Allow group DataReaders to read object-family in compartment DataLake' grants read-only access to Object Storage buckets and objects within the DataLake compartment. The 'read' verb includes the ability to list and get objects, while 'object-family' covers buckets and objects. This precisely matches the requirement for read-only access to all buckets in that compartment.

Answer

Allow group DataReaders to use buckets in compartment DataLake

Answer

Allow group DataReaders to inspect storage in tenancy

Answer

Allow group DataReaders to manage files in compartment DataLake

Question 6

What is the primary function of OCI Identity Domains?

Accepted Answer

To provide comprehensive identity and access management capabilities such as user lifecycle management, MFA, and OAuth/SAML integration.. OCI Identity Domains provide comprehensive IAM capabilities, including user lifecycle management, MFA, OAuth, SAML federation, and SCIM provisioning. They are the next-generation IAM model in OCI, replacing the legacy IAM service while maintaining compatibility. This matches option B.

Answer

To manage DNS zones and DNS resolution records.

Answer

To manage physical server racks in Oracle Cloud regions.

Answer

To isolate database traffic across virtual cloud networks.

Question 7

Which encryption method is used by default for all Object Storage buckets?

Accepted Answer

AES-256 server-side encryption. OCI Object Storage automatically encrypts all data at rest using AES-256.

Answer

RSA-4096 client-side encryption

Answer

No encryption by default

Answer

TLS 1.3 only

Question 8

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

Accepted Answer

Web: 172.16.1.0/24, App: 172.16.2.0/24, DB: 172.16.3.0/26. Option B is the only combination where all three subnets fall inside the VCN CIDR 172.16.0.0/16 and do not overlap. Web (172.16.1.0/24) provides 256 addresses for 100 hosts, App (172.16.2.0/24) provides 256 addresses for 200 hosts, and DB (172.16.3.0/26) provides 64 addresses for 50 hosts — all within the /16 and mutually exclusive.

Answer

Web: 10.0.1.0/24, App: 10.0.2.0/24, DB: 10.0.3.0/24

Answer

Web: 172.16.0.0/15, App: 172.16.0.0/16, DB: 172.16.1.0/24

Answer

Web: 172.16.1.0/24, App: 172.16.1.0/24, DB: 172.16.3.0/24

Question 9

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?

Accepted Answer

Service Gateway. Service Gateway provides private access to Oracle services like Object Storage across the Oracle network backbone.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

Local Peering Gateway

Question 10

Which TWO characteristics apply to the OCI File Storage Service (FSS)?

Accepted Answer

Data in FSS is encrypted at rest by default.. Option B is correct because OCI File Storage Service encrypts all file system data at rest by default using Oracle-managed keys, with the option to use customer-managed keys in Vault, so no extra configuration is needed to get encryption. Option E is correct because FSS file systems are elastic: they automatically expand and shrink as data is written or deleted, and you are billed only for the storage actually used rather than a pre-provisioned capacity. Option A is wrong because FSS is a shared, network-attached NFS file system, not a block storage service for single-instance HPC boot volumes (that role belongs to Block Volume). Option C is wrong because an FSS file system is mounted within its own region and availability domain via a mount target; it is not natively mounted across multiple regions simultaneously over the public internet. Option D is wrong because FSS snapshots are space-efficient and consume storage only for changed data, and they do not require pre-allocated baseline capacity.

Answer

FSS is designed exclusively for single-instance high-performance computing (HPC) boot volumes.

Answer

FSS file systems can be natively mounted across multiple OCI regions simultaneously over the public internet.

Answer

Snapshots created in FSS consume additional baseline storage that must be explicitly pre-allocated.

Question 11

You are managing a Kubernetes cluster on OCI (OKE) and need to upgrade the Kubernetes control plane version. What happens to the existing worker nodes when you perform a control plane upgrade?

Accepted Answer

Worker nodes continue to run workloads, but you must manually or via node pool upgrades bring them to the matching version.. When you upgrade the Kubernetes control plane on OKE, the existing worker nodes are not automatically upgraded. They continue running workloads, but you must upgrade them separately — either manually or by upgrading the node pool — to match the control plane version. This is the correct behavior for OKE control plane upgrades.

Answer

The cluster becomes completely inaccessible, and all pods are evicted permanently.

Answer

Control plane upgrades are blocked until all worker nodes are upgraded first.

Answer

All worker nodes are automatically terminated and recreated with the new version.

Question 12

You are deploying a Public Load Balancer in OCI to distribute incoming web traffic across multiple backend compute instances in different availability domains. You notice that backend health checks are failing. Which component's configuration should you check first to ensure health check probes can reach the backend instances?

Accepted Answer

Security lists or Network Security Groups of the backend instances to allow traffic from the Load Balancer subnet.. Load Balancer backend health checks originate from the Load Balancer's subnet. Security Lists or NSGs attached to the backend instances must allow inbound traffic from the Load Balancer subnet on the backend application ports and health check ports.

Answer

The Service Gateway rules to enable Oracle Object Storage communication.

Answer

The Internet Gateway route table associated with the private subnets.

Answer

The Dynamic Routing Gateway route table to ensure BGP routes are propagated.

Question 13

You are deploying an Exadata Cloud Service instance and need to configure separate Virtual Machine clusters on the same Exadata rack. Which architectural feature enables this separation?

Accepted Answer

Exadata VM Clusters. Exadata VM Clusters are the architectural construct that lets you carve a single Exadata Cloud Service rack into multiple isolated VM clusters, each with its own compute nodes, storage access, and network configuration. This is the supported mechanism for multi-tenant separation on the same physical rack.

Answer

OCI Compartment boundaries

Answer

Oracle Multitenant container databases with PDB isolation

Answer

Dynamic Routing Gateways (DRG)

Question 14

You have a web application behind an OCI Public Load Balancer. You want to restrict access so that only clients coming from a specific corporate external IP address range can access your application. Where should you configure this restriction?

Accepted Answer

Load Balancer Access Control Rules (Rule Sets) or Security Lists on the Load Balancer subnet. A Public Load Balancer in OCI supports Access Control Rules (Rule Sets) that allow or deny traffic based on source CIDR blocks, and Security Lists on the load balancer's subnet can also restrict ingress by source IP. Configuring the corporate IP range as an allow rule in the load balancer's rule set (or a security list ingress rule) restricts access at the network edge before traffic reaches the backend.

Answer

Database security groups

Answer

Service Gateway route table

Answer

NAT Gateway routing rules

Question 15

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

Accepted Answer

Dynamic Routing Gateway (DRG). Cross-region VCN peering in OCI requires a Dynamic Routing Gateway (DRG) in each VCN, with a remote peering connection (RPC) established between the two DRGs. The DRG is the virtual router that provides the path for traffic between VCNs in different regions. Local peering gateways only work within a single region, so they cannot satisfy this requirement.

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Answer

Internet Gateway

Oracle Cloud Infrastructure 2026 Architect Associate 1Z0-1072-26 practice test

Three ways to study

Study 1Z0-1072-26 by domain

Study 1Z0-1072-26 by topic

Networking practice questions

Database practice questions

Identity And Access Management practice questions

Compute practice questions

Storage practice questions

Observability And Management practice questions

1Z0-1072-26 fundamentals practice questions

1Z0-1072-26 scenario practice questions

1Z0-1072-26 troubleshooting practice questions

Oracle Cloud Infrastructure 2026 Architect Associate (1Z0-1072-26) (1Z0-1072-26) practice questions