Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) 1Z0-1085-26 Questions 1–75 | Page 1/6

Multi-Selecthard

Which THREE of the following features are supported by OCI Network Load Balancer (NLB)? (Choose three.)

Select 3 answers

A.Layer 4 (TCP, UDP, ICMP) traffic distribution

B.Handling millions of requests per second with scaling and static VIPs

C.SSL/TLS termination and certificate management

D.Source IP address preservation for backend servers

E.URL path-based routing for HTTP/HTTPS requests

AnswersA, B, D

NLB operates at Layer 4 and handles TCP, UDP, and ICMP protocols.

Why this answer

Network Load Balancer operates at Layer 4 (OSI), supports TCP, UDP, and ICMP, preserves source IP addresses, and provides ultra-high scalability with static public IPs.

Full explanation →

MCQeasy

An administrator needs to create a point-in-time, read-only copy of a Block Volume data disk for backup and disaster recovery purposes. What OCI feature should be created?

A.File Storage clone

B.Compute instance custom image

C.Object Storage archive snapshot

D.Block Volume Backup

AnswerD

Block Volume backups create point-in-time snapshots of block storage data.

Why this answer

Block Volume backups are point-in-time snapshots of a block volume that can be used to restore data or create new volumes.

Full explanation →

MCQeasy

Which OCI construct serves as the root container for all your cloud resources and acts as the logical boundary for managing users, groups, and compartments?

A.Region

B.Availability Domain

C.Tenancy

D.Compartment

AnswerC

The tenancy is your root account provided by Oracle Cloud Infrastructure, containing all your compartments, users, and resources.

Why this answer

The Tenancy is the root compartment and overarching container for all OCI resources.

Full explanation →

Multi-Selectmedium

Which THREE of the following are properties of a VCN?

Select 3 answers

A.DNS support

B.Compute shapes

C.CIDR block

D.Subnets

E.Object Storage buckets

AnswersA, C, D

Internal name resolution.

Why this answer

CIDR block, DNS support, and Subnets are fundamental VCN properties.

Full explanation →

Multi-Selecteasy

Which TWO OCI concepts are fundamental for organizing resources and managing access control within a tenancy? (Choose two.)

Select 2 answers

A.Availability Domains

B.Fault Domains

C.Internet Gateways

D.Compartments

E.IAM Policies

AnswersD, E

Compartments are logical containers used to organize and control access to OCI resources.

Why this answer

Compartments are used to organize and isolate resources, and IAM policies control who can access those resources within compartments.

Full explanation →

MCQeasy

Your organization wants to store compliance audit logs for 7 years at the absolute lowest storage cost, acknowledging that data retrieval may take several hours. Which OCI Object Storage tier should you use?

A.Archive Storage

B.Infrequent Access Storage

C.Cold Storage

D.Standard Storage

AnswerA

Archive Storage offers the lowest storage cost for long-term retention data that is rarely accessed and can tolerate multi-hour restoration times.

Why this answer

OCI Archive Storage is designed for data that is rarely accessed and must be retained for long periods, providing the lowest cost storage with a multi-hour retrieval time.

Full explanation →

Multi-Selecteasy

Which TWO OCI services are used to build and manage containerized applications? (Choose two.)

Select 2 answers

A.OCI Internet Gateway

B.Oracle Container Engine for Kubernetes (OKE)

C.OCI File Storage Service

D.OCI Block Volume

E.OCI Container Instances

AnswersB, E

OKE manages Kubernetes container clusters.

Why this answer

Oracle Container Engine for Kubernetes (OKE) and OCI Container Instances are core container services in OCI.

Full explanation →

MCQmedium

You are designing a high-throughput, fault-tolerant web application tier. You need to distribute incoming HTTP/HTTPS traffic across multiple compute instances across different availability domains within a region. Which service should you deploy?

A.Dynamic Routing Gateway (DRG)

B.OCI Load Balancer

C.OCI Traffic Director

D.OCI Network Load Balancer

AnswerB

The OCI Load Balancer provides automated traffic distribution across multiple backend servers and supports layer 7 HTTP/HTTPS routing features.

Why this answer

OCI Load Balancer is a regional service that distributes incoming traffic across backend servers across multiple availability domains, ensuring high availability.

Full explanation →

Multi-Selectmedium

Which TWO of the following are OCI storage services?

Select 2 answers

A.DNS Service

B.Block Volume

C.Load Balancer

D.Object Storage

E.Functions

AnswersB, D

Core block store.

Why this answer

Object Storage and Block Volume are primary OCI storage services.

Full explanation →

MCQeasy

What is the primary function of a Dynamic Routing Gateway (DRG) in OCI?

A.To provide a path for private traffic between a VCN and on-premises networks or remote VCNs

B.To route public internet traffic to virtual machines

C.To balance HTTP traffic across backend web servers

D.To provide private access to regional Oracle Cloud services

AnswerA

DRG connects VCNs to on-premises networks or other VCNs.

Why this answer

A DRG acts as a virtual router that provides a path for private traffic between your VCN and locations outside your VCN, such as on-premises networks or other VCNs.

Full explanation →

MCQeasy

What is the primary purpose of an OCI Service Gateway?

A.To peer two VCNs in the same region

B.To connect to on-premises data centers

C.To provide private access to regional Oracle services without traversing the public internet

D.To route public internet traffic for virtual machines

AnswerC

Service Gateway routes traffic privately to Oracle services.

Why this answer

A Service Gateway allows your VCN to access regional Oracle services (like Object Storage) privately without using public internet or NAT.

Full explanation →

MCQeasy

A company needs to store petabytes of data that is rarely accessed but must be retained for compliance for 7 years. Retrievals can take up to several hours. Which storage tier should they use?

A.Standard Storage

B.Infrequent Access Storage

C.Archive Storage

D.Block Volume Backups

AnswerC

Archive Storage is ideal for long-term compliance retention with multi-hour retrieval times.

Why this answer

Archive Storage is the lowest-cost OCI Object Storage tier designed for long-term retention of infrequently accessed data with a multi-hour retrieval time.

Full explanation →

Multi-Selecthard

Which THREE actions can be performed using OCI Audit log data? (Choose three.)

Select 3 answers

A.Adjust monthly budget limits dynamically

B.Automatically modify IAM policy syntax errors

C.Trigger automated workflows and notifications via OCI Events based on audit log entries

D.Archive logs automatically to an Object Storage bucket

E.Query historical API activity using OCI Search or Logging

AnswersC, D, E

OCI Events can capture audit log events to trigger notifications or serverless functions.

Why this answer

OCI Audit logs can be queried, streamed to streaming services, archived to Object Storage, and used with Events/Notifications.

Full explanation →

MCQeasy

An administrator needs to understand where the boundary of customer responsibility lies when deploying compute instances in Oracle Cloud Infrastructure. According to the OCI shared-responsibility model, which responsibility falls solely on the customer?

A.Guest operating system patching and configuration on the compute instances

B.Hypervisor patching and firmware updates on the physical host

C.Redundancy and cooling of the physical networking hardware

D.Physical security of the data center hosting the compute instances

AnswerA

The customer owns the operating system configuration, updates, and application security.

Why this answer

In the OCI shared-responsibility model, OCI is responsible for security OF the cloud, including the underlying physical infrastructure, virtualization, and global network. The customer is responsible for security IN the cloud, which includes guest OS patching, data classification, firewall configurations, and identity and access management.

Full explanation →

MCQhard

An enterprise has multiple child compartments under a root tenancy. A security administrator wants to ensure that a specific IAM policy written in the root tenancy cannot be overridden or weakened by child compartment policies. How does OCI handle policy evaluation across hierarchical boundaries?

A.OCI evaluates policies alphabetically and applies the first matching statement.

B.Policies are additive across the hierarchy; higher-level grants cannot be blocked because OCI has no explicit deny statements.

C.Root tenancy policies are automatically disabled if any child compartment policy exists.

D.Child compartment policies take precedence and override parent compartment policies.

AnswerB

OCI IAM is purely additive. If access is granted at the tenancy or parent level, child policies cannot strip those permissions away.

Why this answer

OCI IAM policies are additive. Permissions granted at higher levels (like tenancy or parent compartments) flow down and cannot be blocked or denied by child compartment policies since OCI does not have explicit DENY rules.

Full explanation →

MCQhard

Your organization requires a localized cloud environment that provides access to all OCI services, but data must remain strictly within a specific country due to regulatory mandates, and the infrastructure must be managed entirely on-premises. Which OCI offering is appropriate?

A.OCI FastConnect

B.OCI VPN Connect

C.OCI Dedicated Region Cloud@Customer

D.OCI Public Cloud Region

AnswerC

Dedicated Region Cloud@Customer brings all OCI services to the customer's data center.

Why this answer

OCI Dedicated Region Cloud@Customer provides all OCI services locally on-premises.

Full explanation →

Multi-Selectmedium

Which THREE features are provided by OCI Object Storage buckets? (Choose three.)

Select 3 answers

A.Direct NFSv3 file system mounting

B.Object Versioning

C.Lifecycle Management Rules

D.Block-level iSCSI disk formatting

E.Pre-authenticated Requests (PARs)

AnswersB, C, E

Versioning protects against accidental overwrites and deletions.

Why this answer

OCI Object Storage supports versioning, pre-authenticated requests, and lifecycle management rules.

Full explanation →

Multi-Selectmedium

Which TWO statements are true regarding Oracle Cloud Infrastructure (OCI) Compute Flexible Shapes?

Select 2 answers

A.When you use a flexible shape, you must scale OCPUs and memory in a fixed, predefined ratio.

B.Flexible shapes are only supported with Intel Xeon processor families.

C.Flexible shapes cannot be resized once the compute instance has been provisioned.

D.Flexible shapes allow you to independently customize the amount of memory and the number of OCPUs for a virtual machine instance.

E.Flexible shapes are available for both AMD and Ampere-based virtual machine instances.

AnswersD, E

Flexible shapes give customers granular control to size OCPUs and memory independently to fit their exact workload needs.

Why this answer

Flexible shapes allow you to customize the number of OCPUs and amount of memory independently, and they are available for both AMD and Ampere Arm-based processors.

Full explanation →

Multi-Selecthard

Which THREE statements are accurate regarding OCI Object Storage capabilities and architecture? (Choose three.)

Select 3 answers

A.Object Versioning can be enabled to protect against accidental overwrites and deletions.

B.Object Storage buckets can be directly mounted to Linux file systems via NFSv3 protocol natively.

C.Archive Storage data can be retrieved instantly upon API call without prior restoration requests.

D.Object Storage buckets are regional resources spanning all availability domains in a region.

E.Standard Storage tier data can be accessed instantly without retrieval delays.

AnswersA, D, E

Object Versioning keeps multiple variants of an object in the same bucket to prevent data loss.

Why this answer

OCI Object Storage is regional, highly durable, provides standard and archive tiers, and allows data immutability via Object Versioning and Object Locking.

Full explanation →

Multi-Selecthard

Which TWO statements are correct regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs)? (Choose two.)

Select 2 answers

A.Security Lists can reference another Security List as a rule source.

B.Security Lists apply to all VNICs contained within a specific subnet.

C.Network Security Groups can only be used in public subnets.

D.Network Security Groups apply to a specific set of VNICs chosen across multiple subnets.

E.Security Lists do not support stateful firewall rules.

AnswersB, D

Security lists are subnet-level security constructs.

Why this answer

Security lists apply to entire subnets, while NSGs apply to specific sets of VNICs chosen by the administrator. Both support stateful and stateless rules.

Full explanation →

MCQmedium

Your application running on OCI compute instances requires a shared POSIX-compliant file system that can be mounted simultaneously by hundreds of compute instances across multiple availability domains. Which OCI storage service should you select?

A.Block Volume

B.Object Storage

C.File Storage Service (FSS)

D.Archive Storage

AnswerC

File Storage Service provides a shared POSIX-compliant file system using the NFS protocol, mountable across multiple availability domains.

Why this answer

OCI File Storage Service (FSS) provides a durable, scalable, enterprise-grade network file system that supports the standard NFS v3.0 protocol and can be mounted concurrently from multiple instances across availability domains.

Full explanation →

MCQhard

A security engineer is designing a zero-trust architecture for a microservices environment in OCI. Traffic between compute instances in different subnets must be restricted based on individual workload roles rather than entire subnet CIDR blocks. Which OCI networking feature should be implemented?

A.Security Lists

B.Local Peering Gateways

C.Stateful Route Tables

D.Network Security Groups (NSGs)

AnswerD

NSGs allow defining security rules that apply to a specific set of VNICs, regardless of which subnets they reside in.

Why this answer

Network Security Groups (NSGs) provide virtual firewall rules for a set of VNICs of your choice, allowing fine-grained security rules independent of subnet architecture.

Full explanation →

MCQhard

You need to allow traffic from an on-premises site to a VCN using a VPN. What component is required in the VCN to act as the endpoint?

A.Dynamic Routing Gateway

B.Service Gateway

C.NAT Gateway

D.Internet Gateway

AnswerA

DRG is the virtual router for private connections.

Why this answer

A Dynamic Routing Gateway (DRG) is the required gateway for VPN connections.

Full explanation →

Multi-Selectmedium

Which THREE OCI networking components are regional constructs rather than availability domain-specific? (Choose three.)

Select 3 answers

A.Service Gateway

B.Virtual Cloud Network (VCN)

C.Subnets (can be regional or AD-specific)

D.Compute Instances

E.Internet Gateway

AnswersA, B, E

Service Gateways operate at the regional level.

Why this answer

Virtual Cloud Networks, Internet Gateways, and Service Gateways are regional OCI resources.

Full explanation →

Multi-Selectmedium

Which TWO of the following are types of OCI VCN subnets?

Select 2 answers

A.Global

B.Regional

C.Public-only

D.Reserved

E.Availability domain-specific

AnswersB, E

Spans all ADs.

Why this answer

Subnets can be regional or availability domain-specific.

Full explanation →

MCQmedium

Which of the following is a capability of the OCI Block Volume service?

A.Global replication

B.Direct console access

C.Volume cloning

D.Automatic OS patching

AnswerC

OCI allows cloning existing volumes.

Why this answer

Block volumes support automatic and manual backups to Object Storage.

Full explanation →

MCQeasy

Which of the following best describes the isolation level between OCI Availability Domains within the same region?

A.They are located in different countries to ensure compliance with international tax laws.

B.They are completely isolated from each other with independent power, cooling, and physical security, while being connected by a low-latency network.

C.They share physical power supplies and network switches to reduce operational costs.

D.They operate as independent public clouds with separate IAM user directories.

AnswerB

ADs are engineered with independent infrastructure to ensure failure isolation.

Why this answer

Availability domains are isolated with independent power, cooling, and network infrastructure, preventing correlated failures.

Full explanation →

Multi-Selectmedium

Which THREE storage options can be attached or mounted to an OCI Compute virtual machine instance? (Choose three.)

Select 3 answers

A.OCI Object Storage bucket (mounted as block device)

B.OCI File Storage Service (via NFS)

C.OCI Container Instance storage

D.OCI Block Volume

E.OCI Boot Volume

AnswersB, D, E

FSS can be mounted via NFS on compute VMs.

Why this answer

Compute instances can use Boot Volumes, Block Volumes, and File Storage Service (via NFS).

Full explanation →

MCQhard

An architect is evaluating OCI's distributed cloud offerings. A client in the healthcare sector requires an on-premises deployment that includes the complete portfolio of OCI cloud services, autonomous database capabilities, and exact API parity with the public cloud, all managed locally. Which OCI solution should be proposed?

A.OCI Dedicated Region

B.Oracle Autonomous Database on Dedicated Exadata Infrastructure in the Public Cloud

C.OCI Exadata Cloud@Customer

D.OCI Compute Cloud@Customer

AnswerA

OCI Dedicated Region delivers all OCI public cloud services, management tools, and APIs directly into the customer's data center.

Why this answer

OCI Dedicated Region brings the complete set of OCI public cloud services into the customer's data center.

Full explanation →

MCQeasy

A cloud architect needs to provision an Oracle Cloud Infrastructure (OCI) Compute instance with a custom number of OCPUs and memory for a memory-intensive application. Which shape type should the architect select?

A.GPU shape

B.Standard shape

C.DenseIO shape

D.Flexible shape

AnswerD

Flexible shapes allow independent configuration of OCPUs and memory.

Why this answer

Flexible shapes allow users to customize the number of OCPUs and the amount of memory independently, making them ideal for workloads that require specific resource ratios.

Full explanation →

MCQhard

An application requires a block volume with guaranteed high performance and low latency for heavy database operations. Which OCI Block Volume performance tier should you select?

A.Archive Tier

B.Higher Performance

C.Balanced

D.Lower Cost

AnswerB

Higher Performance provides maximum IOPS and performance.

Why this answer

Higher Performance provides maximum IOPS and throughput for demanding database workloads.

Full explanation →

MCQmedium

When you create a compute instance in an OCI region that has three availability domains, and you do not explicitly specify an availability domain or fault domain, how does OCI handle the placement?

A.OCI places it in the first availability domain and fault domain by default every time.

B.Creation fails until you explicitly choose a fault domain.

C.The instance is created in a paused state until placement is manually resolved.

D.OCI automatically distributes the instance across availability domains and fault domains for high availability.

AnswerD

OCI automatically places instances to optimize fault tolerance when not explicitly specified.

Why this answer

If not specified, OCI automatically selects an availability domain and distributes instances across fault domains to ensure high availability.

Full explanation →

MCQmedium

You are designing a secure web application architecture. You want to ensure that incoming database traffic is restricted to only web servers belonging to a specific Network Security Group, without exposing database ports to the rest of the subnet. Which feature enables this?

A.Dynamic Routing Gateway policies

B.Internet Gateway rules

C.Network Security Groups (NSGs)

D.Security Lists

AnswerC

NSGs provide VNIC-level security rules with cross-NSG references.

Why this answer

Network Security Groups (NSGs) allow you to specify security rules referencing other NSGs as sources or destinations for fine-grained filtering.

Full explanation →

MCQeasy

What is the term used in OCI to describe a software-defined version of a traditional physical network, including subnets, route tables, and gateways?

A.Subnet Gateway

B.Virtual Cloud Network (VCN)

C.Local Peering Network

D.Virtual Private Network (VPN)

AnswerB

VCN is the core software-defined networking construct in OCI.

Why this answer

A Virtual Cloud Network (VCN) is a customizable, software-defined private network that you set up in OCI.

Full explanation →

MCQmedium

You are configuring an OCI Load Balancer and want to ensure high availability by distributing traffic across backend servers in different availability domains within a region. Which type of load balancer should you deploy?

A.Availability Domain-specific Load Balancer

B.Dynamic Routing Load Balancer

C.Regional Load Balancer

D.Local Peering Load Balancer

AnswerC

Regional load balancers span multiple availability domains for high availability.

Why this answer

A regional load balancer distributes traffic across backend servers across multiple availability domains within the region.

Full explanation →

MCQhard

You need to ensure that database block volumes are automatically backed up every day with a retention policy of 30 days across multiple regions. What OCI feature should you use?

A.Manual OCI CLI snapshot scripts

B.Object Storage Lifecycle Management rules

C.Compute Instance Autoscaling configurations

D.Block Volume Backup Policies

AnswerD

Backup policies automate scheduled backups, retentions, and cross-region copying natively.

Why this answer

Volume Backup Policies allow you to assign predefined or custom backup schedules (daily, weekly, monthly) with automated cross-region replication and retention rules.

Full explanation →

MCQmedium

To secure a subnet, you need to define rules that restrict traffic based on the source and destination at the packet level. Which OCI resource provides this stateful security?

A.Network Security Groups (NSG)

B.Security Lists

C.Dynamic Routing Gateway

D.Route Tables

AnswerB

Security Lists are subnet-level firewall rules.

Why this answer

Security Lists provide stateful packet filtering for all VNICs in a subnet.

Full explanation →

MCQeasy

An administrator needs to temporarily grant read access to a specific file in an OCI Object Storage bucket to a colleague without managing IAM user credentials. What feature should be used?

A.Bucket public access toggle

B.VCN Security List rule modification

C.IAM Group policy update

D.Pre-authenticated Request (PAR)

AnswerD

PARs provide time-limited URL access to specific objects without IAM credentials.

Why this answer

Pre-authenticated requests (PARs) provide a convenient way to grant secure, time-limited download or upload access to individual objects.

Full explanation →

MCQeasy

An administrator needs to ensure that data in an OCI Object Storage bucket is automatically transitioned from Standard storage to Infrequent Access storage after 30 days, and then deleted after 365 days. Which Object Storage feature should be used?

A.Object Storage Lifecycle Rules

B.Block Volume Auto-Backup Policies

C.VCN Security Lists

D.IAM Policy Statements

AnswerA

Lifecycle rules automate moving objects between storage tiers and purging them after defined periods.

Why this answer

Object Storage Object Lifecycle Management rules allow automating the transition and deletion of objects based on age.

Full explanation →

MCQeasy

What is a key benefit of OCI's multi-region architecture for enterprise disaster recovery?

A.It eliminates the need for data backups by synchronizing all data locally across fault domains.

B.It ensures that all regions share the same physical power grid to reduce energy consumption.

C.It allows developers to bypass IAM security policies when migrating data between regions.

D.It allows organizations to deploy workloads across geographically disparate regions to protect against large-scale regional disasters.

AnswerD

Deploying across multiple regions protects business operations against wide-scale regional outages or disasters.

Why this answer

Multi-region architecture enables disaster recovery by placing backup infrastructure in a geographically separate region.

Full explanation →

Multi-Selecthard

Which TWO OCI compute features help in achieving cost optimization?

Select 2 answers

A.GPU Instances

B.Preemptible Instances

C.Bare Metal

D.Dedicated Hosts

E.Autoscaling

AnswersB, E

Offers lower cost for interruptible tasks.

Why this answer

Preemptible instances and Autoscaling are primary tools for managing compute costs.

Full explanation →

MCQhard

An organization requires a highly available IPsec VPN connection from their on-premises data center to an OCI VCN. To ensure high availability, what is the recommended architecture for the Dynamic Routing Gateway (DRG) and customer premise equipment (CPE)?

A.A single VPN tunnel connecting to a single CPE device.

B.Redundant VPN tunnels utilizing multiple CPE public IP addresses terminating on the DRG.

C.Configuring active-passive peering across two separate VCNs.

D.Using an Internet Gateway instead of a DRG with redundant static routes.

AnswerB

Redundant tunnels across multiple CPEs provide automatic failover and high availability.

Why this answer

OCI supports redundant VPN tunnels across multiple CPE public IPs terminating on a DRG to ensure high availability and failover.

Full explanation →

MCQeasy

Which OCI service allows you to back up your on-premises data to the cloud for long-term storage?

A.Block Volume

B.Object Storage

C.FastConnect

D.Compute Instance

AnswerB

Object storage provides a durable and scalable destination for backups.

Why this answer

Object Storage with lifecycle policies is commonly used for backup storage.

Full explanation →

Multi-Selecthard

Which THREE of the following statements are true regarding OCI Block Volume backups and performance? (Choose three.)

Select 3 answers

A.Block volume performance can be scaled independently of storage capacity by adjusting Volume Performance Units (VPUs).

B.Block volumes can only be attached to a single compute instance across multiple regions simultaneously.

C.Block volume backups are always full backups and incremental backups are not supported.

D.Block volume backups can be copied across different OCI regions.

E.You can resize a block volume online without detaching it from the compute instance.

AnswersA, D, E

Users can select different performance tiers or adjust VPUs to scale IOPS and throughput.

Why this answer

Block Volume performance can be scaled independently using performance units, backups can be automated via policies, and volumes can be resized online.

Full explanation →

MCQmedium

You are configuring security lists for a subnet hosting web servers. You want to allow incoming HTTP traffic on port 80 from any IP address on the internet. How should you configure the ingress rule?

A.Source: 0.0.0.0/0, Protocol: TCP, Destination Port: 80

B.Source: Internet Gateway, Protocol: ICMP

C.Source: 10.0.0.0/16, Protocol: UDP, Destination Port: 443

D.Source: 0.0.0.0/0, Protocol: UDP, Destination Port: 80

AnswerA

Source 0.0.0.0/0 allows traffic from any IP on port 80.

Why this answer

An ingress security rule allowing TCP traffic on destination port 80 with source CIDR 0.0.0.0/0 permits public HTTP access.

Full explanation →

MCQmedium

You are designing a disaster recovery strategy for an OCI database. The primary requirement is to replicate data to a completely different geographic area with minimal latency impact. Which OCI architectural component should you utilize for the DR site?

A.A different Fault Domain within the same Availability Domain

B.A different Availability Domain in the same region

C.A different OCI Region

D.A separate Compartment within the same region

AnswerC

Cross-region replication utilizes a completely separate geographic OCI region to protect against regional disasters.

Why this answer

Disaster recovery across geographic regions requires deploying resources in a secondary OCI region.

Full explanation →

MCQmedium

You need to connect an on-premises data center to an OCI Virtual Cloud Network with dedicated, high-bandwidth, and predictable network performance that bypasses the public internet entirely. Which OCI networking service should you implement?

A.Internet Gateway

B.Local Peering Gateway

C.Site-to-Site VPN

D.FastConnect

AnswerD

FastConnect provides a dedicated private network connection bypassing the public internet.

Why this answer

OCI FastConnect provides a dedicated, private connection between your on-premises data center and OCI with higher bandwidth and better reliability than the public internet.

Full explanation →

Multi-Selectmedium

Which TWO methods can be used to authenticate users accessing OCI services? (Choose two.)

Select 2 answers

A.Secure Shell (SSH) key pairs stored in IAM policies

B.Shared tenancy root certificates

C.API signing keys for CLI and SDK access

D.Username and password with multi-factor authentication (MFA)

E.IAM compartment credentials

AnswersC, D

API signing keys are required for programmatic access via the CLI, SDKs, and API requests.

Why this answer

Users can authenticate via passwords/MFA in Identity Domains, API signing keys, auth tokens, or federated identity providers.

Full explanation →

MCQmedium

An administrator needs to create a flexible OCI compute virtual machine instance. Which parameters are required when selecting a flexible compute shape?

A.Physical socket count and hypervisor version

B.Number of OCPUs and amount of memory (RAM)

C.Only the fixed instance shape family name

D.Network bandwidth allocation and disk spindle speed

AnswerB

Flexible shapes allow custom configuration of OCPUs and memory.

Why this answer

Flexible compute shapes require specifying the number of OCPUs and the amount of memory (RAM) independently.

Full explanation →

MCQhard

An administrator wants to use Tagged-Based Access Control (TBAC) in OCI IAM policies. Which condition syntax is used in an IAM policy to check if a resource has a specific defined tag value during a request?

A.where tag.Department.CostCenter = '1004'

B.where target.tag.Department.CostCenter = '1004'

C.where resource.metadata.tag = '1004'

D.where request.tag.value = '1004'

AnswerB

This condition checks whether the target resource being accessed has the specified defined tag value.

Why this answer

TBAC in OCI uses target.tag.<namespace>.<key>.value in IAM policy conditions to verify resource tags.

Full explanation →

MCQhard

You are writing an IAM policy for a group that needs to manage block storage volumes, but you want to ensure they can only perform these actions from a specific corporate IP address range (`192.168.1.0/24`). How should you write the policy condition?

A.where request.ip = 192.168.1.0/24

B.where request.ip = target.ip

C.where request.ip = cidr('192.168.1.0/24')

D.where request.ip = '192.168.1.0/24'

AnswerC

The correct OCI condition syntax for IP range restriction uses the cidr function: 'where request.ip = cidr("192.168.1.0/24")'.

Why this answer

OCI IAM policy conditions support request.ip using the cidr function to restrict access to specific source IP ranges.

Full explanation →

MCQhard

You are reviewing the network architecture of an OCI region and need to understand the connectivity between availability domains. Which statement is accurate regarding availability domain inter-connectivity?

A.Availability domains are connected by a high-bandwidth, low-latency network.

B.Availability domains are isolated from each other and cannot communicate directly over the network.

C.Communication between availability domains must route through the public internet.

D.Availability domains share the same physical power infrastructure to ensure identical latency.

AnswerA

OCI connects availability domains with high-speed, low-latency network fabrics.

Why this answer

Availability domains are connected to each other by a low-latency, high-bandwidth network, enabling synchronous replication and distributed architectures.

Full explanation →

Multi-Selectmedium

Which TWO statements accurately describe OCI Block Volume backups?

Select 2 answers

A.Block volume backups can only be restored within the exact same availability domain where they were created.

B.Creating a block volume backup requires stopping the attached compute instance to ensure data integrity.

C.Block volume backups are stored in OCI Object Storage and can be restored as new volumes.

D.Block volume backups cannot be copied across different OCI regions.

E.You can configure volume backup policies to automate incremental and full backups on a recurring schedule.

AnswersC, E

Backups of block volumes are automatically stored in Object Storage and can be used to create new volumes at any time.

Why this answer

OCI allows both manual and automated scheduled backups, and backups can be copied across different OCI regions for disaster recovery.

Full explanation →

MCQhard

An organization must comply with strict data sovereignty laws requiring that their cloud environment remain physically isolated from the public internet and operated independently, yet still receive continuous updates and feature parity with OCI public cloud. Which deployment model satisfies this requirement?

A.OCI Dedicated Region

B.OCI Hybrid Cloud via VPN Connect.

C.OCI FastConnect with a dedicated private circuit.

D.OCI Public Cloud with a dedicated Virtual Cloud Network (VCN).

AnswerA

OCI Dedicated Region is a self-contained cloud region deployed in a customer's data center, isolated from the public cloud yet receiving regular Oracle updates.

Why this answer

OCI Dedicated Region provides a fully isolated region within the customer's data center, managed by Oracle, with identical APIs and services to the public cloud.

Full explanation →

MCQeasy

What is the primary purpose of an OCI Internet Gateway when attached to a Virtual Cloud Network (VCN)?

A.To peer two VCNs within the same tenancy

B.To provide a communication path between the VCN and the public internet

C.To connect on-premises data centers via private circuits

D.To route traffic privately to Oracle services like Object Storage

AnswerB

Internet Gateway enables bidirectional internet communication.

Why this answer

An Internet Gateway provides a path for bidirectional network traffic between your VCN and the public internet.

Full explanation →

Multi-Selecteasy

Which TWO of the following statements accurately describe OCI Availability Domains? (Choose two.)

Select 2 answers

A.Availability domains are connected to each other by a high-bandwidth, low-latency network.

B.Availability domains are purely logical constructs with no physical representation.

C.Availability domains are isolated from each other and do not share power or cooling infrastructure.

D.A single fault domain can span across multiple availability domains.

E.Availability domains are shared across multiple distinct OCI regions.

AnswersA, C

ADs within a region communicate via a high-speed private network.

Why this answer

Availability domains are isolated, independent data centers within a region, connected by a low-latency network. They do not share infrastructure or power.

Full explanation →

MCQmedium

Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?

A.OCI Budgets

B.Service Limits

C.Compartment Quotas

D.IAM Policy Statements

AnswerC

Compartment quotas allow tenancy administrators to restrict resource consumption and hard limits within specific compartments.

Why this answer

Compartment quotas allow administrators to set resource limits (such as max OCPUs or counts) on specific compartments to enforce financial and capacity governance.

Full explanation →

MCQhard

An application administrator is configuring a high-availability database cluster across three Fault Domains in a single Availability Domain. During a scheduled infrastructure maintenance event affecting Fault Domain 1, the administrator notices that one of the database nodes becomes unreachable. What is the expected behavior of OCI Fault Domains in this scenario?

A.The database cluster automatically fails over its primary role to an instance in a different Availability Domain.

B.Only instances in Fault Domain 1 are impacted by the maintenance, while instances in Fault Domains 2 and 3 continue to run normally without disruption.

C.The entire Availability Domain is taken offline to synchronize the maintenance state across all Fault Domains.

D.Instances in Fault Domain 1 are automatically migrated to Fault Domain 2, causing a brief network partition.

AnswerB

Fault Domains provide anti-affinity and fault isolation so that infrastructure failures or maintenance in one FD do not affect others.

Why this answer

Fault domains are isolated hardware and power groupings. Maintenance events or hardware failures impact only the specific Fault Domain being maintained, leaving other Fault Domains unaffected.

Full explanation →

MCQeasy

Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?

A.Cost-tracking tags

B.IAM policies

C.Budgets

D.Compartment quotas

AnswerA

Defined tags enabled for cost-tracking allow you to aggregate and analyze spending by specific tag keys and values in OCI Cost Analysis.

Why this answer

Tags in OCI allow you to attach metadata to resources, which can then be used in Cost Analysis for tracking and allocating spend.

Full explanation →

Multi-Selecthard

Which TWO statements are true regarding OCI File Storage Service (FSS)? (Choose two.)

Select 2 answers

A.File storage data is stored entirely within a single compute instance's local NVMe drive.

B.File Storage file systems have a hard maximum capacity limit of 50 Gigabytes.

C.File Storage requires iSCSI protocol configuration on every client instance.

D.All data stored in OCI File Storage is encrypted at rest by default.

E.File Storage file systems can be mounted concurrently by thousands of compute instances using NFSv3.

AnswersD, E

FSS automatically encrypts all file system data at rest.

Why this answer

FSS supports concurrent NFS mounts across instances and encrypts all file system data at rest by default.

Full explanation →

MCQhard

You are troubleshooting a connectivity issue where an on-premises server cannot reach an OCI compute instance over an IPsec VPN tunnel. The security list and NSG rules are verified as correct. What is another common OCI networking configuration that must be checked?

A.Confirm that the subnet has a Service Gateway attached

B.Check that the compute instance has a public IP address assigned

C.Verify that an Internet Gateway is attached to the VCN

D.Ensure the VCN route table has a rule pointing on-premises CIDR to the DRG

AnswerD

Without a route table entry pointing to the DRG, return or outbound packets cannot traverse the VPN.

Why this answer

The VCN route table must have a rule pointing traffic destined for the on-premises subnet to the Dynamic Routing Gateway (DRG).

Full explanation →

MCQmedium

A company is running a batch processing workload on OCI and wants to optimize compute costs by using spare capacity. The workload can tolerate sudden termination if OCI reclaims the capacity. Which compute instance type should be deployed?

A.Preemptible Instances

B.Reserved Capacity Instances

C.Standard Flexible Compute Instances

D.Dedicated Virtual Machine Hosts

AnswerA

Preemptible instances are offered at a discount using spare capacity and can be reclaimed by OCI.

Why this answer

Preemptible instances allow customers to utilize spare OCI compute capacity at a significant discount, with the caveat that OCI can reclaim them when needed.

Full explanation →

MCQeasy

What is the primary purpose of OCI Fault Domains within an Availability Domain?

A.To isolate network traffic between different virtual cloud networks (VCNs).

B.To provide fault tolerance against hardware and power failures within an Availability Domain.

C.To segregate billing and cost-management data across different departments.

D.To define geographic boundaries for global data residency compliance.

AnswerB

Fault domains isolate infrastructure failures so that instances in other fault domains remain unaffected.

Why this answer

Fault domains group physical hardware (servers, storage, switches) to provide anti-affinity and fault isolation.

Full explanation →

MCQeasy

A web application experiencing fluctuating traffic needs a compute solution that automatically scales out the number of virtual machine instances based on CPU utilization. Which combination of OCI services should be configured?

A.Container Instances and OKE

B.Compute Instances and Load Balancer

C.Instance Pools and Autoscaling Configurations

D.Bare Metal Instances and NAT Gateway

AnswerC

Instance pools group instances together, and autoscaling configurations adjust capacity dynamically.

Why this answer

Instance Pools and Autoscaling Configurations work together to automatically provision or terminate compute instances based on defined performance metrics.

Full explanation →

MCQmedium

An enterprise cloud architect is evaluating OCI's distributed cloud model and wants to understand how resource management, IAM policies, and API endpoints are handled across a customer's OCI Dedicated Region compared to standard public regions. Which statement accurately describes the control plane architecture?

A.Dedicated regions cannot access native OCI services like Object Storage or Autonomous Database.

B.Dedicated regions do not support Identity and Access Management (IAM) because they are entirely disconnected from Oracle.

C.Dedicated regions share the same public cloud control plane, APIs, and management tools, ensuring identical operational experiences.

D.Dedicated regions require a completely isolated, on-premises local control plane managed independently by local administrators.

AnswerC

OCI Dedicated Regions are operated and updated by Oracle using the same control plane as public regions.

Why this answer

OCI Dedicated Regions are managed remotely by the same control plane and APIs used in OCI public regions, ensuring uniform management while data remains local.

Full explanation →

MCQeasy

When designing a highly available web application on OCI, an architect wants to ensure that if a fiber-optic cable is accidentally cut leading into one specific data center facility, user traffic can automatically fail over to a completely independent facility within the same metropolitan area. What should the architect use?

A.Multiple Fault Domains

B.Multiple Availability Domains

C.Single Availability Domain with multiple compartments

D.Multiple Tenancies

AnswerB

Availability domains are housed in separate physical data centers with independent facility infrastructure and networking.

Why this answer

Availability Domains are designed to be fault-tolerant with independent power, cooling, and network infrastructure, meaning they do not share infrastructure dependencies.

Full explanation →

MCQmedium

You need to back up an on-premises database directly to OCI Object Storage using a dedicated, high-speed connection that does not use the public internet. Which networking service should you use?

A.Internet Gateway

B.FastConnect

C.Site-to-Site VPN

D.Local Peering Gateway

AnswerB

FastConnect provides dedicated private connections suitable for large database backups.

Why this answer

FastConnect provides dedicated private connectivity between on-premises data centers and OCI, bypassing the public internet.

Full explanation →

Multi-Selecteasy

Which TWO core OCI services provide compute capabilities? (Choose two.)

Select 2 answers

A.OCI File Storage Service

B.Oracle Container Engine for Kubernetes (OKE)

C.OCI Object Storage

D.OCI Virtual Cloud Network

E.Compute Instances

AnswersB, E

OKE provides managed container compute clusters.

Why this answer

Compute Instances and Oracle Container Engine for Kubernetes (or Container Instances) provide compute power in OCI.

Full explanation →

MCQeasy

An OCI tenant requires a dedicated, high-speed, private network connection from their on-premises data center to OCI that bypasses the public internet entirely. Which OCI service should be provisioned?

A.Service Gateway

B.IPsec VPN

C.Internet Gateway

D.FastConnect

AnswerD

FastConnect provides a dedicated private connection bypassing the public internet.

Why this answer

OCI FastConnect provides dedicated, private, high-bandwidth connections between an on-premises network and OCI.

Full explanation →

Multi-Selectmedium

Which THREE configuration items are specified when creating an OCI Virtual Cloud Network (VCN)? (Choose three.)

Select 3 answers

A.Availability Domain assignment

B.CIDR Block (IPv4)

C.VCN Name

D.DNS Label

E.GPU count specification

AnswersB, C, D

A CIDR block defines the IP address range for the VCN.

Why this answer

Creating a VCN requires specifying a name, a DNS label, and a CIDR block.

Full explanation →

MCQhard

An enterprise has two VCNs in the same OCI region. VCN-A needs to communicate with VCN-B. The VCN CIDR blocks do not overlap. The administrator configures a Local Peering Gateway (LPG) on VCN-A and another on VCN-B, and establishes the peer connection. However, instances in VCN-A still cannot reach instances in VCN-B. What additional step is required?

A.Modify the default Security List to allow inbound traffic from the same VCN CIDR.

B.Attach an Internet Gateway to both VCNs to route traffic between them.

C.Create a Dynamic Routing Gateway (DRG) and attach both VCNs to it.

D.Add route rules in the respective subnet route tables pointing the peer VCN's CIDR block to the LPG target.

AnswerD

Route table rules are mandatory for directing traffic into the Local Peering Gateway.

Why this answer

Peering gateways require explicit route rules in the subnet route tables pointing traffic destined for the peer VCN CIDR to the local LPG.

Full explanation →

MCQeasy

A company needs to store unstructured data such as log files, images, and backups in OCI for long-term retention at the lowest possible cost, and data retrieval times of several hours are acceptable. Which OCI Object Storage tier should be chosen?

A.Block Volume Backup Tier

B.Infrequent Access Tier

C.Archive Storage Tier

D.Standard Tier

AnswerC

Archive Storage provides the lowest cost for long-term retention with multi-hour retrieval times.

Why this answer

Archive Storage is designed for data that is rarely accessed and requires long-term retention, offering the lowest storage cost with a retrieval time of up to 4 hours.

Full explanation →

MCQmedium

You are designing a web application hosted in OCI. You want to ensure that if a top-of-rack switch fails inside a data center, your application remains online. How are OCI Fault Domains engineered to address this specific risk?

A.Fault domains provide automatic geographic failover across different countries.

B.Fault domains automatically replicate virtual machine memory across different availability domains.

C.Each Fault Domain has its own dedicated external internet gateway to route traffic around broken switches.

D.Fault domains are isolated racks with their own power, cooling, and network hardware, ensuring anti-affinity for instance placement.

AnswerD

Fault domains ensure that virtual instances do not share the same physical hardware, power source, or top-of-rack switch.

Why this answer

Fault domains isolate hardware, power supplies, and top-of-rack network switches within an availability domain.

Full explanation →

Multi-Selecthard

Which THREE of the following statements regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs) are correct? (Choose three.)

Select 3 answers

A.Security Lists apply to all VNICs in a specific subnet, whereas NSGs apply to a specific set of VNICs chosen by the user.

B.Security Lists are stateless by default and require manual configuration for stateful tracking.

C.Both Security Lists and Network Security Groups support stateful and stateless firewall rules.

D.An instance VNIC can be associated with multiple Network Security Groups.

E.Network Security Groups require rules to reference subnet CIDR blocks rather than other NSGs.

AnswersA, C, D

Security lists are subnet-level, while NSGs are VNIC-level.

Why this answer

Security lists apply to entire subnets and are stateful by default, whereas NSGs apply to specific VNICs and also support stateful or stateless rules.

Full explanation →

MCQhard

Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?

A.The user can still log into OCI using local OCI IAM password credentials.

B.OCI will prompt the user to reset their OCI password.

C.The user retains access until their active OCI API signing key expires.

D.Authentication fails immediately at the IdP, preventing access to OCI.

AnswerD

Since authentication is federated, OCI defers authentication checks to the corporate IdP. A disabled IdP account blocks login.

Why this answer

Federated authentication relies on the corporate IdP; once disabled there, the user cannot successfully authenticate or generate security assertions for OCI.

Full explanation →

Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 1–75