Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 1–75

NLB operates at Layer 4 of the OSI model, distributing TCP, UDP and ICMP traffic based on connection tuples rather than HTTP content. This connection-oriented mechanism satisfies the stem's requirement for a layer 4 load balancing feature.

A Block Volume Backup captures a point-in-time, read-only copy of a block volume, stored independently and restorable for disaster recovery. It satisfies the stem's requirement for a point-in-time read-only copy of a data disk for backup and DR purposes.

The tenancy is the root container created when you sign up for OCI. It holds all compartments, users, and groups, and defines the top-level logical and security boundary within which every other resource is organised and access is governed.

DNS support is a configurable VCN property, toggled via the VCN's DNS settings, enabling Oracle-provided DNS resolution for instances within the VCN. This satisfies the stem's requirement for a genuine VCN property, since DNS support is configured at the VCN level rather than on individual subnets or instances.

Compartments provide logical isolation within a single tenancy, letting you group resources and attach IAM policies scoped to each compartment. This satisfies the stem's requirement for organising resources and managing access control, since policies granted at compartment level cascade to all resources inside it.

Archive Storage is OCI's lowest-cost tier, designed for long-term retention where retrieval takes hours. This satisfies both the seven-year compliance retention and minimal-cost constraints, unlike Standard or Infrequent Access tiers, which cost more and retrieve faster.

OKE provisions and manages Kubernetes clusters, giving you the managed control plane used to orchestrate and run containerised applications on OCI. It satisfies the build-and-manage requirement by handling cluster lifecycle, node pools and upgrades rather than just running a single container.

OCI Load Balancer operates at layer 7, distributing HTTP/HTTPS traffic across backend instances in multiple availability domains, satisfying the fault-tolerance and high-throughput constraints. It performs health checks and removes unhealthy backends, unlike a single-instance or layer-4-only approach, ensuring regional resilience within the specified region.

Block Volume is an OCI storage service, providing network-attached block storage for compute instances. It satisfies the stem's requirement by being a native OCI offering, unlike non-OCI alternatives. Block volumes persist independently of instance lifecycle and can be attached or detached as needed, confirming it as one of the two correct storage services.

A Dynamic Routing Gateway is a virtual router that provides a path for private traffic between a VCN and on-premises networks, remote VCNs, or other regions. It satisfies the stem by enabling private connectivity without exposing traffic to the public internet.

A Service Gateway provides private access from a VCN to supported Oracle services such as Object Storage, satisfying the no-public-internet constraint. Traffic routes over the Oracle network without exposing the instance to the internet, unlike a NAT gateway, which handles general outbound internet traffic.

Archive Storage is the only OCI tier designed for long-term retention of rarely accessed data, with retrieval times measured in hours. It satisfies the seven-year compliance retention and petabyte-scale requirements at the lowest cost per gigabyte, matching the stem's tolerance for slow retrieval.

OCI Events consumes Audit log entries as a source, letting you match rules on API activity and route them to Functions, Notifications or Streaming. This satisfies the requirement to act on audit data automatically rather than merely store or inspect it.

Guest OS patching and configuration sits entirely with the customer, since OCI's shared-responsibility model places everything above the hypervisor under tenant control. Oracle secures the physical hosts, network fabric and virtualisation layer, but the operating system running inside your compute instances — its patches, hardening and settings — remains your sole obligation.

OCI policies are purely additive: every statement in the hierarchy is a grant, and no explicit deny exists, so a child compartment cannot subtract from or weaken a root-level grant. Higher-level permissions therefore always remain in force.

OCI Dedicated Region Cloud@Customer deploys the full OCI service catalogue inside the customer's own data centre, so data never leaves the country and the infrastructure stays on-premises. This satisfies both the regulatory residency mandate and the entirely on-premises management constraint.

Object Versioning retains multiple variants of an object within a bucket, letting you recover overwritten or deleted data. It satisfies the bucket-feature requirement by preserving prior object states rather than replacing them, and can be enabled or suspended per bucket.

Flexible shapes decouple OCPU count from memory, letting you set each independently within defined minimum and maximum limits per shape, unlike fixed shapes with preset ratios. This satisfies the requirement regarding what flexible shapes actually permit.

Security lists and NSGs act as virtual firewalls for instances in a VCN. To allow database access only from the web tier, you must configure a rule that permits inbound TCP port 1521 traffic from the web tier's subnet CIDR or from the web tier's NSG. This enforces the principle of least privilege and restricts access to the database tier. Without this rule, the database would be inaccessible or overly permissive.

Object Versioning keeps multiple variants of an object in the same bucket to prevent data loss.

When a tenancy is created, OCI provisions a root compartment (which is also the tenancy itself in hierarchy terms), an initial administrator account, and a default identity domain. The root compartment cannot be deleted and serves as the top of the compartment tree. Administrators can then create child compartments, additional identity domains, and networking resources as needed for their workloads.

File Storage Service provides NFSv3 shared file systems mountable concurrently by many compute instances, satisfying the POSIX-compliant, multi-AZ requirement. Unlike Block Volume, which attaches to a single instance, FSS scales to hundreds of clients across availability domains within a region, meeting the simultaneous multi-mount constraint in the stem.

Network Security Groups apply security rules to individual VNICs, letting policy be scoped to a workload's role rather than its subnet CIDR. This satisfies the requirement to restrict inter-subnet traffic based on workload identity in a zero-trust design.

The Dynamic Routing Gateway is the VCN-side endpoint terminating the IPSec VPN, providing the attachment point for on-premises traffic. It satisfies the stem's requirement for a component inside the VCN acting as the endpoint, which a customer-premises equipment device or internet gateway cannot provide.

A regional subnet spans all availability domains within its region, so resources in any AD can use it. This is one of the two OCI VCN subnet types, contrasted with availability domain-specific subnets confined to a single AD.

OCI allows cloning existing volumes.

Availability Domains are physically separate data centres within a region, each with independent power, cooling and physical security, yet interconnected by a low-latency, high-bandwidth network. This fault isolation lets you deploy redundant resources without crossing regions.

OCI Dedicated Region places the full OCI service portfolio, including autonomous database, inside the customer's own data centre with identical APIs and local management. That exact parity plus on-premises control satisfies the healthcare client's residency and completeness constraints.

Flexible shapes decouple OCPU and memory allocation, letting the architect independently select a custom OCPU count and memory ratio. Fixed shapes bundle preset resource pairs, so they cannot satisfy the memory-intensive sizing requirement. This directly meets the stem's demand for a custom number of OCPUs and memory.

The Higher Performance tier delivers lower latency and higher IOPS/throughput per volume than Balanced or Lower Cost, using NVMe SSDs. It satisfies the stem's requirement for guaranteed high performance and low latency during heavy database operations.

A Virtual Cloud Network (VCN) is OCI's software-defined equivalent of a traditional physical network, providing subnets, route tables, and gateways within a single region. It satisfies the stem's requirement for a software-defined network construct, unlike compartments, which organise resources, or availability domains, which represent physical datacentre locations.

A regional load balancer spans multiple availability domains within a region, distributing traffic across backend servers in each and surviving an AD failure. Flexible shapes and public/private addressing are separate attributes; the regional scope is what satisfies the cross-AD availability constraint.

Block Volume Backup Policies attach to volumes and automatically create scheduled backups with defined retention, and can be copied to other regions. This satisfies the stem's daily backup, 30-day retention, and multi-region requirements without manual intervention.

A Pre-authenticated Request grants time-limited access to a specific object via a unique URL, requiring no IAM credentials or account membership. This satisfies the stem's constraint of temporary read access to one file without managing IAM user credentials.

Dynamic groups match resources such as instances by their attributes, so the instance becomes a principal that can be granted permissions without any stored secret. A policy granting that dynamic group read access on the bucket in data-prod authorizes the calls. The instance then uses its instance principals through the metadata service, and no credentials are written to disk.

Lifecycle Rules apply time-based, bucket-level policies that automatically transition objects between Standard and Infrequent Access tiers, then delete them. This directly satisfies the 30-day transition and 365-day deletion constraints without manual intervention or custom code.

Deploying workloads across geographically disparate regions protects against large-scale regional disasters, since no single region outage affects all copies. This satisfies the stem's disaster recovery requirement by providing geographic isolation, unlike availability domains, which remain within one region and share regional failure exposure.

OCI policies attach permissions to groups, so adding the user to the finance group immediately grants the same effective access as every other member. This is the intended, scalable way to manage access and requires no new policy statements. Removing the user later from the group revokes access cleanly, which simplifies offboarding and audits.

FSS provides a shared, elastic NFSv3 file system that multiple compute instances in the same VCN can mount concurrently. It scales automatically up to 8 EB and is designed for POSIX workloads such as HPC simulations. This matches the requirement for a shared, POSIX-compliant file system with no capacity provisioning.

The Infrequent Access tier is designed for data that is accessed less frequently but requires rapid retrieval when needed. It offers lower storage costs than the Standard tier while maintaining millisecond latency. This matches the requirement to minimize costs without sacrificing retrieval speed.

Object Storage provides durable, low-cost, internet-accessible buckets suited to long-term retention, so on-premises datasets can be copied there via CLI, API or transfer appliances. Its unlimited capacity and lifecycle tiering satisfy the long-term storage constraint without provisioning block volumes or databases.

VPUs decouple IOPS and throughput from volume size, letting you tune performance without over-provisioning capacity. This satisfies the stem's requirement that performance scales independently of storage capacity, unlike fixed-performance tiers where the two are locked together.

An ingress rule with source 0.0.0.0/0, protocol TCP, and destination port 80 permits HTTP traffic from any internet address into the subnet. This satisfies the stated requirement precisely, unlike egress rules or narrower CIDR sources.

A different OCI Region satisfies the geographic separation requirement, since each region is an isolated geographic area with independent availability domains. Cross-region replication for services such as Autonomous Data Warehouse or Base Database Service uses OCI's dedicated backbone network, keeping latency impact minimal compared with internet-based transfer.

FastConnect provides a dedicated private physical connection between your on-premises data centre and OCI, bypassing the public internet entirely. This satisfies the stem's requirements for dedicated bandwidth and predictable performance, unlike IPSec VPN, which traverses the internet and offers variable latency.

OCI Vault includes a secret management capability that allows you to store and manage secrets such as passwords, API keys, and configuration files. Secrets are versioned, and access is audited through OCI Audit. The application can retrieve secrets at runtime using the OCI SDK or CLI, with proper IAM policies. This meets the need for secure, auditable secret storage without hardcoding in container images.

API signing keys authenticate programmatic CLI and SDK requests through RSA key pairs, where the public key is stored in OCI and the private key signs each request. This satisfies the stem's requirement for a user authentication method, distinct from browser-based federation, by verifying identity for non-interactive access.

Flexible shapes decouple OCPU and memory sizing, so the administrator must specify both values within the shape's permitted ratio range. Fixed shapes instead bundle a preset OCPU-to-memory pairing, which is why selecting OCPU count and RAM amount is the required input here.

Availability domains within an OCI region are physically isolated but interconnected through a dedicated high-bandwidth, low-latency network, satisfying the requirement to understand their connectivity. This design lets resources in different availability domains communicate with minimal latency while maintaining fault isolation.

Backups of block volumes are automatically stored in Object Storage and can be used to create new volumes at any time.

An Internet Gateway is a highly available, horizontally scaled VCN component providing bidirectional routing between the VCN's subnets and the public internet, for resources with public IPs. It directly fulfils the requirement for a communication path to the public internet.

Availability domains within a region are linked by a high-bandwidth, low-latency network, enabling synchronous replication and low-latency communication between resources in different ADs. This interconnectivity is what allows multi-AD architectures to function as a cohesive, resilient region.

Compartment quotas set hard service limits, such as maximum OCPU count for compute instances, within a compartment. They constrain provisioning independently of IAM policy permissions, so developers cannot exceed four OCPUs in Staging even if their policies otherwise allow it.

Scoping policies to the department's compartment and its descendants enforces least privilege and isolates the department from other tenants of the same tenancy. This limits blast radius, simplifies audits, and aligns with Oracle's recommendation to grant access at the narrowest scope that satisfies the requirement.

Fault Domains are isolated groups within an Availability Domain, so maintenance affecting Fault Domain 1 only impacts instances there. Nodes in Fault Domains 2 and 3 remain running, which is the isolation the cluster's spread design relies on.

Compartments are the fundamental OCI construct for organizing resources into logical groups. Each department can receive its own compartment, and IAM policies written at that compartment scope grant access only to resources within it. Cost reports can also be filtered by compartment, enabling chargeback. This directly satisfies the requirement for logical separation, policy scoping, and cost tracking while keeping everything in the same tenancy and region.

Cost-tracking tags are metadata key-value pairs applied to OCI resources that appear in Cost Analysis and cost reports, enabling spend to be grouped and allocated by business unit. They satisfy the requirement to attribute operational costs across compartments, unlike free-form tags, which are not used for cost reporting.

File Storage Service encrypts all file system data at rest automatically using AES-256, with no customer action required. This satisfies the stem's default-encryption claim, since encryption is applied by the service regardless of whether the customer supplies their own keys.

The DRG terminates the IPsec VPN and must be the route target for on-premises CIDR traffic. Without a route table rule pointing that CIDR to the DRG, instances cannot return traffic through the tunnel, even when security lists and NSGs are correct.

Preemptible Instances draw on OCI's spare capacity and cost substantially less than on-demand, but OCI can reclaim them with little notice. The stem's tolerance for sudden termination is the deciding constraint, so this fault-tolerant batch workload fits preemptible capacity exactly, unlike standard or dedicated shapes.

Fault Domains are isolated groupings of hardware within a single Availability Domain, each with independent power and cooling. Distributing instances across them protects against hardware and power failure inside that Availability Domain, whereas Availability Domains themselves address datacentre-level isolation.

Instance Pools group identical compute instances, and Autoscaling Configurations apply policies that add or remove instances based on metrics such as CPU utilisation. Together they satisfy the automatic scale-out requirement, unlike standalone instances or load balancers alone.

OCI Dedicated Regions are operated and updated by Oracle using the same control plane as public regions.

FastConnect provides a dedicated, private physical connection between your on-premises network and OCI, bypassing the public internet entirely. This satisfies the stem's requirement for a high-speed, non-internet link, letting the database back up directly to Object Storage over private peering rather than traversing public routes.

OKE is a managed Kubernetes service that provisions and orchestrates worker node compute instances to run containerised workloads. It satisfies the stem's requirement for a core OCI service providing compute capabilities, since clusters consume Compute instances as their underlying compute substrate.

FastConnect provisions a dedicated private circuit between your on-premises data centre and OCI, physically bypassing the public internet. This directly satisfies the stem's requirement for a high-speed, private connection, unlike IPSec VPN, which traverses the internet. It offers consistent bandwidth and lower latency than internet-based alternatives.

The IPv4 CIDR block defines the VCN's private address space and is mandatory at creation, since every subnet and route rule must fall within it. OCI requires this range up front, so it satisfies the stem's requirement for a specified configuration item.

An LPG peer connection alone does not route traffic; each VCN's subnet route tables must contain a rule directing the peer VCN's CIDR block to the LPG as target. Without these routes, packets have no path, so instances cannot reach the peered VCN.

Archive Storage Tier suits this scenario because it is engineered for long-term retention of infrequently accessed unstructured data at the lowest storage cost in OCI Object Storage. Its retrieval latency of hours aligns exactly with the stated acceptable retrieval window, satisfying both the cost-minimisation and tolerance-for-delay constraints in the stem.

Fault domains are physically separate racks, each with independent power, cooling and network hardware. Distributing instances across fault domains ensures anti-affinity, so a single top-of-rack switch failure cannot take down every instance, satisfying the resilience requirement.

Security Lists are subnet-scoped: every VNIC in the subnet inherits the rules automatically. NSGs are VNIC-scoped, letting you group and apply rules to a chosen set of VNICs across subnets, satisfying the question's requirement to distinguish the two mechanisms.

With SAML 2.0 federation, OCI delegates authentication entirely to the corporate IdP. Disabling the account there means the IdP rejects the assertion, so no valid SAML token reaches OCI and access fails at the source, satisfying immediate revocation.

OCI Functions is Oracle's serverless compute service, executing code on demand without provisioning or managing servers. It natively integrates with OCI Events and API Gateway, so functions can be invoked by event triggers or HTTP requests, matching the serverless, event-driven requirement exactly.

A NAT Gateway provides one-way outbound internet access for instances in private subnets, translating their private IPs and blocking unsolicited inbound connections. This satisfies the requirement to download patches while preventing inbound internet traffic, unlike an Internet Gateway, which requires public IPs.

Fault domains are the anti-affinity grouping within an availability domain, each mapping to separate physical hardware. Assigning the primary and standby to different fault domains guarantees rack-level separation inside the same data centre, satisfying the requirement that nodes never share physical infrastructure.