Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 76–150

Fault Domains are isolated groups within an Availability Domain with independent power and hardware. OCI schedules hypervisor maintenance one Fault Domain at a time, so instances in other Fault Domains keep running, satisfying the requirement that maintenance must not take down all service instances simultaneously.

RoCE v2 provides high-bandwidth, low-latency, and low-CPU-overhead communication between compute instances, ideal for HPC and cluster workloads. It is available on specific bare metal and HPC shapes in OCI. This directly addresses the need for extremely low latency and high bandwidth with minimal network overhead.

Multiple CPE public IPs give the DRG redundant IPSec tunnels across distinct endpoints, so a single tunnel or CPE failure does not sever connectivity. This satisfies the high-availability constraint by removing the single point of failure inherent in one tunnel.

OCI security lists are stateful by default: return traffic for an allowed inbound connection is automatically permitted without a matching egress rule. This differs from network security groups, which are also stateful, and from stateless configurations requiring explicit rules in both directions.

A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound connections. Routing private subnet traffic to the NAT Gateway enables patch downloads without exposing the instances. This is the correct and secure configuration.

A private DNS zone resolves names only within the VCNs you attach to it, so records stay invisible to the public internet. This directly satisfies the requirement for custom records scoped to a specific VCN, unlike public zones, which publish globally via OCI's internet-facing resolvers.

A service gateway provides private access to OCI services such as Object Storage and Autonomous Database over the Oracle network backbone, requiring no public IPs or internet traversal. Route table rules and security policies direct and permit that traffic from the VCN.

Cost Analysis lets users group and filter actual cost data by dimensions such as compartment, service, and tag, and it supports saving custom reports that can be shared with other users. This delivers the consolidated, near-real-time compartment-level view the finance team wants without manual spreadsheet exports.

Lower Cost is one of the three OCI Block Volume performance tiers, offering the lowest IOPS and throughput for workloads with modest demands. It satisfies the question's requirement to identify the available performance tiers alongside Balanced and Higher Performance.

Block Volume Backup Policies define scheduled backups with configurable retention, satisfying the 30-day requirement. Cross-region replication is achieved by copying backups to another region, either through policy settings or cross-region copy. This directly meets the daily automatic backup and retention constraints specified in the scenario.

OCI DNS hosts public zones that resolve globally over the internet, satisfying the requirement for managing internet-facing domains. This is distinct from private zones, which resolve only within a VCN and are not publicly reachable.

OCI's availability domains are interconnected by a dedicated, low-latency, high-bandwidth network, so synchronous replication between them meets the tight round-trip requirements that latency-sensitive workloads demand. This satisfies the stem's constraint directly: synchronous writes must acknowledge across ADs within acceptable thresholds, which the inter-AD fabric guarantees without resorting to asynchronous replication.

Availability Domains are physically separate datacentres within an OCI region, each with independent power and cooling. Distributing instances across them ensures the workload survives a single domain failure, directly satisfying the high-availability requirement in the stem.

Fault Domains are isolated rack groupings within one Availability Domain, so distributing database nodes across them prevents a single rack or hardware failure from taking down the database tier, satisfying the requirement to protect against localized hardware failures.

Bare Metal shapes give the instance direct access to the physical host, with no hypervisor layer, exposing raw local NVMe SSDs and full core counts. This satisfies the requirement for unvirtualised hardware access without overhead.

Pre-authenticated Requests embed credentials in a unique URL, granting time-limited read or write access to a specific bucket or object. This satisfies the constraint of sharing access without distributing OCI user credentials or requiring IAM identities for recipients.

Object versioning retains prior copies of an object whenever it is overwritten or deleted, allowing recovery after accidental deletion. This is a native Object Storage bucket setting, directly matching the stem's requirement to protect against accidental data loss.

Fault Domains are independent hardware groupings within a single Availability Domain, each with separate power and network. Distributing instances across them ensures the application survives a single hardware failure, which is precisely the constraint stated in the scenario.

OCI Audit automatically records all API calls against your tenancy, capturing the identity of the caller, timestamp, source IP and the exact action performed. Querying it filters the VCN deletion event, satisfying the auditor's need for precise who-deleted-what history from yesterday.

Object Storage supports server-side encryption with customer-managed keys stored in OCI Vault. By selecting the Vault master encryption key as the bucket's encryption key and configuring a rotation schedule on that key, the compliance requirement for customer-managed encryption with automatic 90-day rotation is satisfied. Object Storage uses the key to encrypt data at rest, and key rotation is handled by Vault without re-encrypting existing objects.

Moving a VCN between compartments requires authorisation in both: the source compartment to detach it, and the destination to attach it. Oracle Cloud Infrastructure evaluates IAM policies against the resource's current and target compartment, so lacking manage rights in either blocks the move, satisfying the stem's prerequisite.

A region is a geographically distinct area containing one or more availability domains, letting the company place resources physically closest to its users. This directly satisfies the stem's constraint of achieving the lowest possible latency within a specific geographic area.

The Network Load Balancer forwards packets at Layer 4, so it does not terminate or inspect TCP sessions, preserving the original client source IP. This satisfies the database cluster's need for high throughput and source-IP visibility that a Layer 7 load balancer masks.

OCI Cost Analysis provides interactive dashboards that break down spending by compartment, service, and tag, letting you visualise historical trends and forecast future costs. It directly satisfies the stem's requirement to analyse and track spending, using granular cost data rather than billing invoices alone.

OCI Dedicated Region provisions a complete OCI region inside the customer's own data centre, giving physical isolation from public cloud infrastructure. This satisfies the regulatory prohibition on storing data in any public data centre, even when encrypted.

OCI Bastion creates a session-based, time-limited connection through the service's own managed endpoint, so no public IP, VPN or permanently open SSH port is needed. This satisfies the constraint of reaching the private database without exposing inbound access.

Oracle Data Guard can maintain a standby database in a different Availability Domain within the same region. It provides automatic failover and minimal data loss (with synchronous or asynchronous replication). This directly satisfies the requirement for intra-region high availability with failover to another AD.

File Storage Service exposes NFSv3 file systems mountable concurrently by many compute instances, satisfying the shared NFS requirement. Block Volume attaches to one instance at a time, and Object Storage is not a POSIX NFS file system.

File Storage Service integrates with OCI Vault, supporting both Oracle-managed and customer-managed encryption keys for file system data at rest. This satisfies the encryption action, with keys handled through the vault rather than the file system itself.

The Audit Log Configuration in the OCI Console includes an option to export audit events to an Object Storage bucket, enabling long-term retention. This directly satisfies the stem's requirement to archive all Audit log events to Object Storage for compliance.

Multi-attach lets one block volume be attached to several instances at once, satisfying the shared-access requirement. It is a distinct OCI Block Volume capability, unlike standard single-instance attachment, and is used for clustered or shared-storage workloads needing concurrent access.

Fault domains group independent hardware within an availability domain, so instances in separate fault domains avoid sharing physical hosts, satisfying the anti-affinity requirement. This hardware-level isolation limits correlated failures from power, cooling or network issues affecting a single rack, unlike logical placement controls such as availability domains.

Instance Pools with Autoscaling Configurations satisfy the elastic compute requirement: the autoscaling configuration attaches to a pool and adjusts its size between minimum and maximum instance counts based on performance metrics such as CPU utilisation. This delivers automatic scale-out during traffic spikes and scale-in when demand subsides, without manual intervention.

Scoping the statement to autonomous-databases in compartment DevCompartment grants management of Autonomous Databases only there, excluding every other resource type in that compartment. Broadening to all-resources or tenancy-level scope would breach the least-privilege requirement in the stem.

Within a single availability domain, OCI separates resources into multiple fault domains with independent power and network. Spreading compute instances across these fault domains isolates failures, so one hardware fault does not take down the whole workload, delivering high availability without a second availability domain.

Block volume backups can be copied to another OCI region, satisfying the disaster-recovery requirement by placing a restorable copy outside the source region's failure domain. This cross-region copy is distinct from cloning a volume within the same availability domain.

OCI Cloud@Customer deploys dedicated Exadata and compute infrastructure inside the corporate data centre, satisfying the extreme latency constraint for point-of-sale terminals, while Oracle manages it through the public cloud control plane, keeping data management tied to OCI.

CSV is a plain-text, comma-delimited format that spreadsheet and BI tools parse natively, satisfying the stem's ingestion requirement. OCI Usage Reports are delivered as CSV files, so financial teams can import them directly without conversion.

OCI Container Instances run containers directly without provisioning or managing compute hosts or Kubernetes clusters, billing per second for the resources consumed. This serverless-container model satisfies the requirement to deploy rapidly without managing underlying infrastructure.

OCI Regions are isolated geographic areas with independent infrastructure, so workloads in a separate region keep running when one region suffers a network partition. This geographic separation delivers the business continuity the multi-region architecture depends on.

OCI Exadata Cloud@Customer deploys Exadata infrastructure physically within the organisation's own data centre, satisfying the on-premises constraint, while Oracle retains infrastructure maintenance and the OCI console provides unified management. Unlike OCI Dedicated Region, which replicates a broader set of OCI services on-premises, Cloud@Customer targets Exadata database workloads specifically.

OCI Regions are physically separate geographic areas, each containing independent availability domains with isolated power, cooling and network infrastructure. Replicating data between two OCI Regions hundreds of miles apart satisfies the business continuity mandate for an independent jurisdiction, since no single regional failure can affect the disaster recovery site.

OCI Dedicated Region deploys the full cloud region inside the customer's own data centre, so workloads and data never leave the facility. This satisfies the stem's data residency and control requirement, which traditional public cloud regions cannot guarantee.

OKE's managed control plane runs on OCI tenancy infrastructure, so Oracle handles upgrades, patching and availability of the API server and etcd, satisfying the reduced-management-overhead constraint. Worker nodes remain in your compartment, giving you workload control without operating control-plane components yourself.

A Private DNS Resolver with forwarding rules sends queries for custom internal domains to the on-premises DNS server reached over FastConnect, satisfying the hybrid resolution constraint. Forwarding rules direct specific zones to designated external DNS servers, unlike the default VCN resolver, which only handles OCI-managed names.

OCI Container Instances runs containers directly without provisioning Kubernetes clusters or virtual machines, satisfying the serverless-container and rapid-start constraint. It provides a serverless compute environment for single containers, unlike OKE, which requires managing cluster infrastructure and node pools.

OCI's private global network backbone carries replication traffic between regions entirely off the public internet, satisfying the cross-region data transfer requirement. Unlike public-internet replication, this dedicated fibre path delivers predictable latency and bandwidth for Oracle Data Guard redo transport, while encryption in transit keeps standby synchronisation secure.

Fault domains are isolated groupings of hardware within a single Availability Domain, each with independent power and network. Distributing instances across them protects against hardware failure where only one Availability Domain exists, which availability domains alone cannot address.

A Pre-Authenticated Request embeds credentials in a URL, granting time-limited access to a specific object or bucket without requiring an IAM identity or authentication. This satisfies the need to share a resource temporarily with external parties.

The load balancer terminates client connections and inserts the original client address into the X-Forwarded-For header. Configuring web servers to log that header restores the true public client IP instead of the load balancer's internal private address.

Fault domains are isolated groupings of hardware within a single availability domain, each with independent power and cooling. Spreading instances across them prevents one physical rack or power supply failure from taking down every instance, satisfying the stem's single-availability-domain constraint.

Container Engine for Kubernetes provisions and manages OCI-hosted Kubernetes clusters, handling control plane lifecycle, node pools and upgrades. It is the platform service for running containerised workloads, directly matching the stem's requirement to host containers and manage clusters.

Object Storage Lifecycle Rules define policy-based actions on objects matching age or name-prefix filters, so a rule specifying 90 days triggers automatic transition to Archive tier without manual intervention or external scheduling. This directly satisfies the stem's automation constraint, unlike replication, retention locks, or pre-authenticated requests, which address different requirements.

HTTPS encrypts traffic between clients and the load balancer using TLS, protecting credentials and data in transit. The scenario asks for the recommended securing protocol, and HTTPS terminates TLS on the listener, unlike plain HTTP which transmits unencrypted.

When launching an instance through the Console, the Compute Instance Wizard offers a default networking option that creates a VCN, a public subnet, an internet gateway, and a default security list with rules allowing SSH and ICMP. This is specifically designed to reduce the manual steps for newcomers. The developer can launch a working instance in minutes without pre-building networking, which matches the stated goal of avoiding manual configuration.

Peering alone does not route traffic; each VCN's route table must contain a rule directing the peer CIDR to the LPG. Without this rule, packets have no path to the gateway, so private communication between the two VCNs fails despite the peering link existing.

PARs grant time-limited access to a specific object or bucket via a unique URL, letting external users read or write without OCI credentials or IAM policies. This is an Object Storage-native sharing mechanism, satisfying the question's requirement for features tied directly to the service.

OCI Object Storage delivers 99.999999999% durability across availability domains and redundancy tiers, meeting the high-durability requirement. Its infrequent-access and archive tiers provide the lowest cost per gigabyte for backup data, and objects are accessed via API rather than mounted as a file system, satisfying the no-immediate-mounting constraint.

Security Zones enforce immutable, compartment-level policies that automatically deny any action violating the specified security policy, including attaching a public IP to a compute instance. Because the rule is recipe-based and cannot be overridden or disabled by users, it satisfies the compliance requirement for guaranteed, continuous enforcement in the production compartment.

OCI Object Storage imposes no bucket-level capacity ceiling; a bucket can hold practically boundless data. Limits apply per object (about 10 TiB) and per tenancy, not to the bucket's total size, so the default maximum is effectively unlimited.

Flexible Virtual Machine shapes decouple OCPU and memory allocation, letting you select each independently within defined ratios rather than accepting a fixed bundle. This directly satisfies the stem's requirement for flexible sizing, unlike standard shapes where the two are locked together.

Vault Secrets stores credentials such as connection strings and API tokens in encrypted vaults, letting applications retrieve them programmatically at runtime. This directly satisfies the requirement to avoid hardcoding credentials, unlike plain Object Storage or config files, because secrets are centrally managed, audited and rotated without redeployment.

OCI Load Balancer integrates with the Kubernetes Ingress controller to expose multiple HTTP services behind one public IP, satisfying the single-IP and URL path routing constraint. Its layer 7 listeners and routing policies evaluate request paths, unlike layer 4 network load balancers, which cannot route by URL.

OCI enforces distinct resource quotas and limits for Security Lists versus NSGs within a VCN.

Private DNS Resolver forwarding rules direct queries for specific on-premises domains to the corporate directory server's IP addresses over the FastConnect link, while all other names resolve normally within the VCN. This satisfies the stem's custom resolution requirement.

Fault Domains are independent groupings of hardware within a single Availability Domain, each with separate power and network infrastructure. Distributing the three nodes across FD-1, FD-2 and FD-3 provides infrastructure-failure isolation when only one Availability Domain exists in the region.

Autoscaling configurations attach to an Instance Pool, defining scaling policies that monitor metrics and adjust instance count. Applying it there satisfies the CPU-based scale-out and scale-in requirement, unlike configuring it on individual instances or load balancers.

OCI Block Volume supports attaching volumes either paravirtualized, where the hypervisor presents the device to the instance, or via iSCSI, where the instance connects to the volume over the network. Both are valid attachment methods for compute instances.

Each fault domain groups hardware sharing a single physical rack and power source, so an outage or maintenance event affects only that grouping. Isolating instances across fault domains within an availability domain satisfies the stem's protection requirement against hardware failure.

Public subnets in each Availability Domain host the application servers, while private subnets in each Availability Domain hold the databases, giving both high availability and isolation from internet traffic. Intra-VCN traffic stays on the low-latency network, meeting the stem's constraints.

File systems grow and shrink online without provisioning fixed capacity upfront, and you pay only for consumed storage. This satisfies the requirement for elastic capacity, distinguishing FSS from block volumes that must be sized in advance.

NSG rules reference NSGs as source or destination rather than CIDR blocks, so naming the web server NSG as source permits exactly those instances and updates automatically as membership changes. This satisfies the requirement for NSG-to-NSG communication.

NFS mounts require TCP and UDP traffic on ports 111, 2048, 2049 and 2050 to reach the mount target. Security Lists or NSGs in the target subnet must permit this traffic, otherwise the mount hangs waiting for a response.

Managing instances in Dev grants full lifecycle control over compute, including create and delete. Granting only read on virtual-network-family lets developers see the VCN and its security rules for troubleshooting but prevents any modification, since read is non-mutating. Together they satisfy both the operational need and the restriction on changing security rules.

Dedicated Virtual Machine Hosts allocate an entire physical server to a single tenancy, so no other customer's instances share the hardware. This satisfies the exclusive-allocation constraint, unlike standard multi-tenant shapes or bare metal instances, which do not provide host-level tenancy isolation.