Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 151–225

Memory Utilization is a compute instance metric available through the OCI Monitoring service when the Compute Instance Monitoring plugin is enabled on the instance. It satisfies the question's requirement for a monitorable compute metric, reporting the percentage of physical memory consumed by the instance.

OCI regions vary in topology: some comprise a single availability domain, while others contain multiple ADs. This flexibility lets workloads requiring cross-AD redundancy be placed in multi-AD regions, while single-AD regions serve latency-sensitive or less critical deployments.

Each OCI Site-to-Site VPN connection provisions two redundant IPSec tunnels per DRG attachment, each terminating on a distinct Oracle VPN endpoint. This satisfies the stem's high-availability requirement, allowing separate CPE public IPs to communicate with distinct tunnel endpoints.

Block volume backups are stored in OCI Object Storage, not in the block volume service itself. Object Storage provides durable, replicated retention independent of the source volume, so the backup survives even if the original block volume is deleted.

Standard Storage serves frequently accessed data with the lowest latency and highest throughput of the Object Storage tiers. Archive and Infrequent Access tiers trade retrieval speed and per-request latency for lower storage cost, so they fail the fast, frequent access requirement.

Infrequent Access Storage targets data accessed rarely but needing immediate availability, with lower storage cost than Standard and lower retrieval cost than Archive. This satisfies the stated requirement for rapid access with reduced retrieval charges compared with Archive tier.

Autoscaling dynamically adjusts compute instance count in response to metrics such as CPU utilisation, adding instances when the 80% threshold is breached and removing them when demand falls. This directly satisfies the stem's requirement for automatic horizontal capacity adjustment.

The OCI DNS Service is the managed Domain Name System offering, hosting public zones and records with global anycast resolution. It directly fulfils the requirement to manage domain records without operating DNS infrastructure, unlike compute or load-balancing services.

Dedicated Region Cloud@Customer delivers a complete OCI region inside the customer's own datacenter, including the full set of OCI services and the control plane, while Oracle retains responsibility for operating and managing the infrastructure. It preserves public-cloud APIs and economics while keeping data resident on the customer's premises, which fits regulated workloads.

Without a subnet route rule whose destination is the on-premises CIDR and whose target is the DRG, instances have no path back to the datacentre; the DRG alone does not populate route tables. This satisfies the missing-routing requirement.

Single-AD regions lack availability domain separation, so hardware isolation within the region depends on fault domains, which distribute instances across distinct physical racks. Because fault domains cannot survive a full region outage, cross-region replication becomes the only viable disaster recovery strategy, satisfying the stem's resilience constraint.

OCI Dedicated Region deploys the full OCI public cloud service catalogue within a customer's premises, whereas OCI Cloud@Customer delivers a subset such as Exadata Database and Compute infrastructure on-premises. That scope difference is the accurate distinction the board needs.

Tags apply user-defined key-value pairs directly to OCI resources, satisfying the stem's requirement for granular tracking and automation. Unlike compartments, which provide hierarchical isolation, or defined tags, which are governed by tag namespaces, freeform tags let any user categorise resources immediately for cost tracking, filtering and policy-driven automation.

The Limits, Quotas and Usage page in the OCI Console displays current service limits and consumption, and provides the request mechanism for increases. It satisfies the stem's requirement for a single location to view limits, usage and submit increase requests.

OCI Audit automatically records all API calls and actions performed on resources in the tenancy. It provides a comprehensive log that can be used for security auditing, compliance, and detecting suspicious activities. The logs are immutable and retained for 90 days by default, and can be exported for longer retention. This meets the requirement for centralized access auditing.

FastConnect provides a dedicated private physical link between on-premises infrastructure and OCI, bypassing the public internet and delivering predictable, consistent bandwidth. Site-to-site VPN traverses the internet with variable throughput, so it cannot satisfy the consistent-bandwidth constraint.

OCI Events emits an object-create event when a new object lands in the bucket, and an event rule invokes an OCI Functions function, which runs the script serverlessly and immediately without provisioning or managing compute instances.

Autoscaling policies act only when metric thresholds are breached and the cooldown interval has elapsed; a misconfigured threshold or active cooldown suppresses scale-out despite high CPU. This directly explains why no scaling action triggers, whereas instance health or image issues would not selectively block scale-out events.

OKE with virtual nodes provides a serverless Kubernetes experience where you do not manage worker nodes. Pods run on virtual nodes that scale automatically, and you pay only for the resources your pods request. This matches the need for no node management, automatic scaling, and consumption-based billing.

Fault domains are isolated groupings of hardware within an availability domain, each with independent power and network. Maintenance in Fault Domain 1 therefore cannot affect instances in Fault Domains 2 and 3, which continue running normally.

Defined tags use a namespace and predefined key-value schema governed by policies, enabling consistent, controlled tagging across compartments. This satisfies the question's requirement for a supported tag type in Oracle Cloud Infrastructure, distinct from the unstructured free-form alternative.

Network Security Groups apply stateful rules at the VNIC level, so instances within one subnet can belong to different NSGs with distinct rule sets. Security Lists, by contrast, apply uniformly to every instance in a subnet.

Distributing compute across fault domains isolates workloads from hardware failures within an availability domain, since each fault domain has independent power and network. This directly satisfies the resilience requirement by preventing a single hardware fault from taking down all instances, keeping the application available during localised outages.

Flexible shapes decouple OCPU and memory allocation, letting you specify each independently within the shape's permitted ratio range at launch. This directly satisfies the stem's requirement that OCPUs and RAM be configured separately rather than in fixed bundles.

An Availability Domain comprises one or more physically separate data centres within a region, each with independent power and cooling. This fault isolation lets you distribute resources so a single AD failure does not affect workloads in other ADs.

A Service Gateway provides private connectivity from a VCN to OCI services such as Object Storage, so traffic never leaves the Oracle network. Adding a route rule targeting the Object Storage service CIDR directs that traffic through the gateway, satisfying the requirement to avoid the public internet while staying within the same region.

Compartments are logical containers within a tenancy that isolate resources for billing and access control. Each department can receive its own compartment, with IAM policies and budgets scoped to it, satisfying the requirement to separate departmental costs and permissions.

Network Load Balancer operates at Layer 4, passing TCP/UDP packets through without proxy termination, which delivers millions of packets per second at ultra-low latency and preserves the client source IP. Layer 7 alternatives terminate connections and rewrite addresses, breaking the source-IP constraint.

OCI Cloud Guard continuously monitors resources against security best practices and industry benchmarks, satisfying the stem's diagnostic and compliance requirement. It detects misconfigurations and insecure activity through configurable detector recipes, then raises problems and responds automatically. Unlike posture-only tools, it also triggers corrective actions, directly meeting the continuous monitoring constraint.

OCI WAF inspects HTTP and HTTPS requests at Layer 7 and ships with managed rule sets that detect common web exploits including cross-site scripting and SQL injection. It can automatically add offending client IPs to an access-control block list for a configurable duration, which directly matches the automatic blocking requirement. It reduces operational burden because Oracle maintains and updates the managed rule sets.

OCI Cloud@Customer places OCI infrastructure and services physically in the customer's data centre, managed remotely by Oracle. It satisfies the distributed cloud requirement by extending public cloud consumption to on-premises locations where data residency or latency constraints prevent using Oracle's regions.

A Pre-authenticated Request generates a unique URL granting time-bound access to the specific backup object, requiring no OCI account or IAM console permissions. This satisfies the requirement to share a multi-gigabyte file securely with an external auditor.

An LPG requires matching route rules in both VCNs pointing to the gateway for the peer's CIDR. If either VCN's route table lacks that entry, return or forward traffic is dropped, producing the intermittent packet loss described.

Internet Gateway allows bidirectional public internet traffic.

Tag Defaults attach the specified namespace and key automatically to resources created in a compartment, so every new compute instance inherits Department and CostCenter without developer action. This satisfies the constraint of removing manual tagging input while enforcing consistent cost allocation.

Placing the database in a private subnet removes it from public internet routing, so only resources inside the VCN, such as the OKE cluster, can reach it. This satisfies the best-security-practice constraint by keeping the database unreachable externally.

Flexible shapes decouple OCPU count from memory allocation, so RAM can be tuned independently within the shape's permitted ratio range. This satisfies the stem's requirement for independently adjustable parameters, unlike fixed shapes where the OCPU-to-memory ratio is locked. Memory is therefore one of the two valid answers.

OKE provides a managed Kubernetes control plane plus node pools with automated worker scaling and managed upgrades, satisfying the orchestration, scaling and upgrade requirements. Container Instances lacks Kubernetes orchestration, and OCI Functions is event-driven rather than cluster-based.

OCI Cloud Guard aggregates security findings across tenancies and compartments into one dashboard, satisfying the consolidated monitoring constraint. It detects misconfigurations and risky activity via detectors and responder recipes, reporting centrally through the Cloud Guard console. This cross-tenancy visibility is precisely what the security officer requires.

Ephemeral IPs do not persist.

Standard Storage is the default hot tier for frequently accessed data, offering low latency and high durability, and satisfies the requirement of naming a tier available in OCI Object Storage alongside Infrequent Access and Archive.

Availability Domains are isolated, fault-tolerant datacentre groupings within a region, each with independent power, cooling and network. Distributing resources across them satisfies the high-availability requirement, since a single AD failure does not affect instances running in the others.

Granting the Auditors group `inspect all-resources in tenancy` at the tenancy root satisfies the read-only, tenancy-wide constraint: the verb `inspect` permits listing and viewing resource metadata without create, update, or delete rights, and scoping to the tenancy covers every compartment. This avoids per-compartment policies, making it the most efficient approach.

OCI File Storage Service exposes NFS file systems that many Linux instances can mount and share concurrently, which suits shared configuration files. Object Storage and Block Volume cannot be mounted simultaneously by multiple instances as a POSIX file system, so they fail this requirement.

Archive Storage is the lowest-cost tier, designed for long-term retention of rarely accessed data with retrieval times measured in hours, matching the stated tolerance. Standard and Infrequent Access tiers cost more and offer faster retrieval than the scenario requires.

SSL termination lets the load balancer decrypt incoming HTTPS traffic at the listener, then forward plain HTTP to backend servers, offloading certificate handling and CPU cost from those servers. OCI Load Balancer supports configuring certificates on listeners for exactly this purpose.

FastConnect provides a dedicated, private physical circuit that bypasses the public internet, satisfying the bypass and SLA-backed throughput constraints. The Dynamic Routing Gateway terminates that private virtual circuit and routes traffic between the on-premises network and the OCI VCN, delivering the required high-throughput, reliable hybrid connectivity.

This is correct because OCI Bastion service supports both SSH and RDP session types. When creating a session, you specify a maximum TTL, and the session is automatically terminated after that period. This enhances security by limiting the duration of access. The service also provides auditing of sessions. This meets the administrator's requirement for secure, temporary access.

Archive Storage is a genuine Object Storage tier designed for rarely accessed data retained for long periods, offering the lowest storage cost with higher retrieval latency. It sits alongside Standard and Infrequent Access as a valid tier.

NSG ingress rules reference other NSGs as source, letting the database NSG accept traffic from any VNIC in the web server NSG regardless of IP changes. CIDR-based sources would require manual updates whenever web server addresses shift, so NSG-as-source satisfies the dynamic grouping constraint.

Instance Pools group identical Compute instances, and Compute Autoscaling policies scale pool size automatically based on metrics such as CPU utilisation. Together they satisfy the stem's requirement to add or remove instances dynamically as traffic fluctuates.

A NAT Gateway provides outbound-only internet access for instances in a private subnet, translating their private IPs to a public address. It satisfies the constraint of allowing update downloads while blocking unsolicited inbound traffic, since no inbound path is created.

Availability domains within a region have independent power, cooling and network infrastructure, so an outage affecting one does not affect another. Placing one compute instance in each of two availability domains satisfies the requirement that the application survive the loss of an entire availability domain.

OCI Key Management is a managed service that allows you to create, rotate, and manage encryption keys and secrets. It integrates with other OCI services for data encryption at rest and in transit. It provides centralized control and auditing, making it ideal for financial services requiring strict security and compliance.

OCI Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics like CPU utilization. It supports scale-out and scale-in policies with thresholds, and integrates with load balancers. This directly meets the requirement for automatic scaling with minimal operational overhead.

Defined tags must belong to a pre-created tag namespace managed by administrators.

Local Peering Gateway connects two VCNs within the same region over Oracle's private backbone, satisfying the private communication requirement without traversing the internet. It is the only OCI construct designed for intra-region VCN-to-VCN peering, unlike Dynamic Routing Gateway, which serves remote or on-premises connectivity.

A default route (0.0.0.0/0) in the private subnet's route table directs all internet-bound traffic to the NAT Gateway, satisfying the requirement to route outbound traffic from private compute instances. The NAT Gateway then translates source addresses, enabling outbound connectivity while preventing inbound internet access.

The OCI Load Balancer service distributes incoming traffic across multiple backend servers in one or more availability domains. It provides health checks, SSL termination, and session persistence, ensuring high availability and scalability. This is the correct service for distributing web traffic and improving application responsiveness.

A reserved public IP is allocated to your tenancy and persists independently of any instance, so it can be detached and reattached to satisfy the compliance requirement that the same address is retained across migrations or instance rebuilds.

Listeners define the IP address, port and protocol on which the load balancer accepts incoming traffic, and reference the backend set that handles it. Without a listener the load balancer cannot receive client connections, satisfying the requirement that listeners are a core component.

A region is a distinct, localised geographic area, and each region houses one or more isolated availability domains. This satisfies the stem's requirement to describe the geographical relationship: availability domains exist within a region, not across regions, matching OCI's fault-tolerance architecture.

IAM users are the OCI identity objects that represent individual people who authenticate to the Console or APIs. Creating one user per engineer gives each a distinct identity that can later be collected into groups and granted access through policies, and OCI also supports federating users from an external identity provider such as Microsoft Entra ID instead of issuing local credentials.

Oracle is responsible for the physical security of data centers, including access controls, surveillance, and environmental protections. This is part of the security 'of' the cloud, which Oracle manages. Customers do not have access to these facilities and rely on Oracle to secure the physical infrastructure.

Network Load Balancers operate as pass-through Layer 4 devices, forwarding packets without terminating or rewriting the connection, so the original client source IP reaches backends unchanged. This satisfies the stem's requirement of source IP preservation, unlike proxy-based load balancers.

OCIR is OCI's native, fully managed registry for storing and sharing OCI-compliant container images, integrating directly with OKE and identity policies. It satisfies the stem's requirement for a natively provided container image registry rather than a third-party or self-hosted alternative.

OCI Functions executes event-driven code without provisioning servers, billing only for invocation duration, which suits a short-lived periodic job. However, it caps execution at five minutes, so a genuinely long-running batch would breach that limit. For a stateless task terminating on completion, this serverless model satisfies the no-server-management constraint precisely.

A Service Gateway provides private access to Oracle services such as Object Storage without internet traversal, and the VCN route table needs a rule targeting the service's CIDR via that gateway. Both components together satisfy the private-routing constraint.

A region is composed of one or more isolated Availability Domains, each with independent power, cooling and networking, which satisfies the stem's requirement for an accurate characteristic. This contrasts with Fault Domains, which are groupings within a single Availability Domain rather than region-level constructs.

Active-active across two low-latency OCI regions with synchronous replication keeps both sites current, giving near-zero RPO, while automated traffic management failover redirects users within seconds, meeting the seconds-level RTO. Warm standby or backup-based patterns cannot achieve both targets.

Changing the volume's performance tier directly raises the provisioned IOPS and throughput limits of the block volume, satisfying the requirement to improve performance without detaching it from the compute instance. Oracle Cloud Infrastructure offers Lower Cost, Balanced, Higher Performance and Ultra High Performance tiers, each setting distinct IOPS and throughput ceilings.

OCI Container Instances run containers without provisioning or managing underlying compute, so no worker nodes or cluster control plane are needed. This satisfies the stem's demand for the primary benefit: serverless execution. Unlike Container Engine for Kubernetes, which requires node pools, it bills only for resources consumed during execution.

Block Volume provides NVMe-backed, low-latency storage that can be attached as a boot volume to compute instances, meeting the high-performance requirement. Unlike Object or File Storage, it offers the persistent, block-level access a VM's operating system needs, and its performance tiers let you match IOPS to workload demand.

Flexible shapes let you specify an exact OCPU and memory ratio, scaling independently rather than choosing fixed bundles. This satisfies the question's requirement for a valid OCI compute shape type alongside bare metal and fixed shapes.

FastConnect offers two distinct connectivity models: via a service provider, where the provider handles the physical cross-connect, and via colocation, where your equipment connects directly at the exchange. This directly satisfies the stem's requirement for multiple supported models, confirming the statement as accurate.