Courseiva

Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 151225

382 questions total · 6pages · All types, answers revealed

Page 2

Page 3 of 6

Page 4
151
MCQhard

An administrator needs to configure autoscaling for a compute instance pool so that instances scale out when CPU usage exceeds 80% and scale in when CPU usage drops below 20%. Where is this autoscaling configuration applied?

A.On the OCI Load Balancer backend set
B.On an Instance Pool
C.Directly on the VCN Route Table
D.Inside an individual Compute VM's operating system configuration
AnswerB

Autoscaling configurations are attached to Instance Pools.

Why this answer

Autoscaling configurations in OCI are linked directly to an Instance Pool to automatically manage the number of instances.

152
MCQmedium

Your development team needs to deploy a multi-tier web application in OCI. To guarantee maximum high availability against unexpected power failures and cooling outages within a single data center facility, how should the application instances be distributed?

A.Place instances across multiple availability domains.
B.Place all instances in the same fault domain.
C.Assign all instances to the root compartment.
D.Deploy all instances across different global regions.
AnswerA

Spreading across availability domains ensures that an outage in one physical data center facility does not take down the entire application.

Why this answer

High availability within a region is achieved by spreading workloads across multiple availability domains.

153
MCQmedium

An administrator needs to attach a block volume to a compute instance. Which two attachment methods are supported by OCI Block Volume service?

A.Paravirtualized and iSCSI
B.NVMe-oF and Fibre Channel
C.NFS and SMB
D.HTTP and FTP
AnswerA

Paravirtualized and iSCSI are the two supported block volume attachment mechanisms.

Why this answer

OCI Block Volume supports both Paravirtualized and iSCSI attachment methods for attaching block volumes to compute instances.

154
Multi-Selectmedium

Which TWO characteristics apply to OCI Fault Domains? (Choose two.)

Select 2 answers
A.They are billing boundaries used to allocate cloud costs across different business units.
B.They require the user to manually configure top-of-rack network switches for each domain.
C.They provide protection against unexpected hardware failures and maintenance events within an Availability Domain.
D.If you do not specify a Fault Domain when launching an instance, OCI automatically assigns one using a distribution algorithm.
E.They span across multiple OCI regions to guarantee global high availability.
AnswersC, D

Fault domains isolate instances from localized rack and power failures.

Why this answer

Fault domains protect against hardware/rack failures and are selected automatically if not specified.

155
MCQmedium

An enterprise application running on OCI requires high availability across two Availability Domains within a single region. The database backend needs to be securely isolated from public internet traffic while maintaining high-speed, low-latency communication with the application servers. How should the Virtual Cloud Network (VCN) be structured?

A.Create a single VCN with only private subnets and use a NAT Gateway to allow inbound traffic to the database.
B.Deploy all resources in a single Availability Domain using Network Security Groups to isolate traffic.
C.Place both application and database instances in a single public subnet spanning both Availability Domains.
D.Create public subnets in each Availability Domain for the application servers and private subnets in each Availability Domain for the database instances.
AnswerD

Private subnets protect the database from direct external access, while multi-AD deployment ensures high availability.

Why this answer

Deploying the application servers in public subnets behind a Load Balancer and the database in private subnets across multiple ADs ensures high availability and security.

156
Multi-Selecthard

Which THREE of the following are valid OCI File Storage Service (FSS) characteristics?

Select 3 answers
A.Requires manual OS mounting
B.Elastic capacity
C.Access across ADs
D.Block-level access
E.Supports NFS protocol
AnswersB, C, E

Storage scales automatically.

Why this answer

FSS is NFS-based, multi-AD accessible, and highly scalable.

157
MCQmedium

You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the rule in the database NSG?

A.Specify the web server Network Security Group as the source
B.Configure a Dynamic Routing Gateway rule
C.Use an Internet Gateway source identifier
D.Specify the entire VCN CIDR block as the source
AnswerA

Reference the web server NSG as the source for precise tier-to-tier security rules.

Why this answer

OCI NSGs allow you to reference another NSG as the source in security rules for fine-grained access control.

158
MCQmedium

An administrator is setting up an OCI File Storage (FSS) mount target in a specific subnet. When attempting to mount the file system from a compute instance in a different subnet within the same VCN, the mount command hangs. What must be configured to allow this connection?

A.Configure security rules (Security Lists or NSGs) allowing NFS traffic (ports 111, 2048, 2049, 2050) to the mount target.
B.Add a NAT Gateway to translate NFS packets across subnets.
C.Attach the File Storage volume directly to the compute instance via iSCSI.
D.Create a Local Peering Gateway between the two subnets.
AnswerA

NFS requires specific ports open in the security lists or NSGs associated with the mount target subnet.

Why this answer

Access to File Storage requires security rules allowing TCP and UDP ports 111, 2048, 2049, and 2050 for NFS traffic between the compute instance and the FSS mount target.

159
MCQeasy

Which OCI compute feature allows you to run virtual machines on dedicated physical servers allocated exclusively to your organization?

A.OCI Container Instances
B.Dedicated Virtual Machine Hosts
C.Preemptible Instances
D.Standard Flexible VM Shapes
AnswerB

Dedicated hosts provide physical server isolation for your VMs.

Why this answer

Dedicated Virtual Machine Hosts provide physical servers dedicated solely to your tenancy for compliance and isolation requirements.

160
MCQhard

You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?

A.Near-real-time (typically within a few minutes)
B.Only when the instance is stopped and restarted.
C.Dynamic group membership is static and never updates after initial creation.
D.Exactly every 24 hours during the daily IAM sync cycle.
AnswerA

OCI continuously evaluates dynamic group rules, updating membership shortly after a resource changes its compartment or attributes.

Why this answer

Dynamic group membership evaluations happen dynamically and near-real-time as instances change states or compartments.

161
Multi-Selecteasy

Which TWO metrics can be monitored using OCI Monitoring service for compute instances? (Choose two.)

Select 2 answers
A.VCN Route Table Rule Count
B.Memory Utilization
C.Object Storage Bucket Count
D.Subnet CIDR block utilization
E.CPU Utilization
AnswersB, E

Memory utilization is tracked (often requiring the monitoring agent).

Why this answer

OCI Monitoring tracks standard metrics such as CPU utilization and Memory utilization for compute instances.

162
Multi-Selecthard

Which THREE statements are true regarding the architecture and design principles of OCI Availability Domains (ADs) and Regions?

Select 3 answers
A.An availability domain can span across multiple geographic countries to maximize data locality.
B.Availability domains share power, cooling, and physical security infrastructure to reduce operational overhead.
C.Some OCI regions are built with a single availability domain, while others contain multiple availability domains.
D.OCI regions are completely independent of other regions and are separated by vast geographic distances.
E.Availability domains within the same region are connected by a high-bandwidth, low-latency network.
AnswersC, D, E

OCI regions can be single-AD or multi-AD regions depending on customer demand and regional architecture.

Why this answer

OCI regions contain ADs, ADs are isolated from each other, and regions are independent geographic areas.

163
MCQhard

A network engineer is configuring a Site-to-Site VPN between an on-premises data center and an OCI VCN. To ensure high availability, the setup requires multiple customer-premises equipment (CPE) public IP addresses communicating with distinct Oracle VPN tunnel endpoints on the DRG. How many default tunnels does each OCI VPN connection provision per DRG attachment?

A.Eight tunnels
B.Two tunnels
C.One tunnel
D.Four tunnels
AnswerB

OCI Site-to-Site VPN provides two distinct tunnels per connection by default for high availability.

Why this answer

Each OCI Site-to-Site VPN connection automatically provisions two redundant tunnels terminating on distinct OCI gateway hardware endpoints for high availability.

164
MCQmedium

When creating a block volume backup, where is the data stored?

A.File Storage
B.The same volume
C.Local SSD
D.Object Storage
AnswerD

Backups are automatically offloaded to Object Storage.

Why this answer

Block volume backups are stored in OCI Object Storage.

165
MCQeasy

Which OCI Object Storage tier is optimized for storing active data that requires fast and frequent access with lowest latency?

A.Archive Storage
B.Infrequent Access Storage
C.Standard Storage
D.Backup Storage Tier
AnswerC

Standard storage is optimized for frequent, fast access to active data.

Why this answer

Standard storage tier is the default tier for hot data that is accessed frequently.

166
MCQeasy

Which OCI Object Storage tier is recommended for storing data that is accessed infrequently, but requires rapid access when needed with lower retrieval costs than Archive?

A.Standard Storage
B.Infrequent Access Storage
C.Boot Volume storage
D.Archive Storage
AnswerB

Infrequent Access is optimized for data accessed less often with rapid retrieval.

Why this answer

Infrequent Access storage tier is designed for data accessed less frequently, offering lower storage costs than Standard and faster retrieval than Archive.

167
MCQmedium

You need to automatically increase the number of compute instances in your cluster when CPU utilization exceeds 80%. Which service should you use?

A.Autoscaling
B.OCI Events
C.Load Balancer
D.Instance Pools
AnswerA

Autoscaling monitors and scales instance pools.

Why this answer

Autoscaling allows automatic adjustment of instance counts based on performance metrics.

168
MCQeasy

Which OCI service provides a managed Domain Name System (DNS) to manage your domain records?

A.Load Balancer
B.FastConnect
C.Object Storage
D.DNS Service
AnswerD

The OCI DNS service is the native managed DNS solution.

Why this answer

OCI DNS service manages public and private DNS zones.

169
Multi-Selecthard

Which THREE of the following statements about OCI Object Storage lifecycle management rules are true? (Choose three.)

Select 3 answers
A.Lifecycle rules require manual execution via the OCI CLI every time objects are uploaded.
B.Lifecycle rules can be applied to specific object name prefixes within a bucket.
C.Lifecycle rules can automatically delete objects after a specified number of days.
D.Lifecycle rules can automatically transition objects from Standard storage to Infrequent Access or Archive storage.
E.Lifecycle rules are restricted to buckets with versioning disabled.
AnswersB, C, D

Rules can target specific folders or prefixes rather than the entire bucket.

Why this answer

Lifecycle rules can automatically transition objects to Archive/Infrequent Access or delete them based on age, and can target specific object name prefixes.

170
MCQmedium

An administrator has configured a Dynamic Routing Gateway (DRG) to connect an on-premises datacenter to an OCI VCN using an IPsec VPN. However, on-premises servers cannot communicate with instances in the VCN. Which VCN routing configuration is missing?

A.A route rule in the subnet route table with the on-premises CIDR as the destination and the DRG as the target.
B.A security list rule allowing ingress TCP traffic from the local VCN CIDR.
C.A NAT Gateway attached to the DRG to translate internal IP addresses.
D.A route rule in the subnet route table with a destination of 0.0.0.0/0 and target as the Internet Gateway.
AnswerA

Subnets must have a route pointing to the DRG for traffic originating from the on-premises network.

Why this answer

Traffic coming from the DRG needs a route rule in the VCN route table pointing to the DRG as the target for the on-premises CIDR block.

171
MCQhard

When evaluating OCI regions for deploying a new application, you notice that some regions are designated as having multiple availability domains while others have only one. What is a key design implication when deploying to a single-AD region?

A.Compute instances are automatically spread across other global regions.
B.You must rely on fault domains for hardware isolation and another region for disaster recovery.
C.Storage services are automatically replicated across public clouds.
D.You cannot deploy fault domains in a single-AD region.
AnswerB

Single-AD regions provide fault domains for rack-level isolation, requiring cross-region architectures for site-level DR.

Why this answer

Single-AD regions lack multiple physical data center facilities, so high availability must rely on fault domains for hardware isolation.

172
MCQhard

An architect needs to explain OCI's distributed cloud model to a board of directors. The board is confused about the difference between OCI Dedicated Region and OCI Cloud@Customer. Which distinction is accurate?

A.Dedicated Region is managed entirely by the customer, whereas Cloud@Customer is managed by Oracle administrators remotely.
B.Cloud@Customer requires internet access to function, whereas Dedicated Region operates entirely without power redundancy.
C.Dedicated Region provides the complete set of OCI public cloud services on-premises, while Cloud@Customer delivers specific OCI services (such as Exadata and Compute infrastructure) on-premises.
D.Dedicated Region is hosted by Oracle in a public facility, whereas Cloud@Customer is hosted in a partner data center.
AnswerC

Dedicated Region delivers all OCI services locally, whereas Cloud@Customer delivers targeted infrastructure and database services.

Why this answer

Dedicated Region brings the entire public cloud stack on-premises, while Cloud@Customer brings specific services (like databases and core infrastructure).

173
MCQeasy

Which OCI administrative feature allows you to organize and categorize cloud resources using user-defined key-value pairs for granular tracking and automation?

A.Tags
B.Compartments
C.Identity Domains
D.Service Limits
AnswerA

Tags (Free-form and Defined) let you attach metadata key-value pairs to OCI resources for organization, filtering, and cost tracking.

Why this answer

Tags provide key-value metadata attachment to OCI resources.

174
MCQeasy

Where in the OCI Console can an administrator view current service limits, usage, and request a service limit increase?

A.Cloud Guard
B.Limits, Quotas and Usage
C.Cost Analysis
D.Identity Domains
AnswerB

This section displays current usage against service limits and provides a direct workflow to request increases.

Why this answer

The 'Limits, Quotas and Usage' section under Governance and Administration in the OCI Console is where service limits are managed.

175
MCQhard

A company requires a dedicated, private connection between their on-premises data center and OCI that provides consistent bandwidth. Which service is recommended?

A.FastConnect
B.NAT Gateway
C.Site-to-Site VPN
D.Local Peering Gateway
AnswerA

FastConnect is a dedicated physical link.

Why this answer

FastConnect provides private, dedicated connectivity between on-premises and OCI.

176
MCQeasy

An application developer needs to trigger a data-processing script immediately whenever a new object is uploaded to an OCI Object Storage bucket. Which OCI service should be used to execute the script in a serverless manner?

A.Autonomous Database scheduled jobs
B.OCI Functions triggered via OCI Events
C.Compute Instance Cron jobs
D.Oracle Container Engine for Kubernetes CronJobs
AnswerB

OCI Events detect object creation in Object Storage and invoke OCI Functions serverlessly.

Why this answer

OCI Events service captures changes to cloud resources and can automatically trigger OCI Functions in response to Object Storage uploads.

177
MCQhard

An administrator is configuring autoscaling on an OCI Instance Pool. They notice that the autoscaling configuration is not triggering scale-out actions despite high CPU utilization. What is a likely cause?

A.The VCN Security List lacks an inbound rule for autoscaling metrics
B.The instance pool is attached to an Internet Gateway instead of a NAT Gateway
C.The compute instances are using Flexible shapes instead of Bare Metal
D.The autoscaling policy threshold or cooldown period is misconfigured
AnswerD

Improper metric thresholds or active cooldown periods prevent trigger actions.

Why this answer

Autoscaling requires a co-configured scaling policy with defined thresholds and cooldown periods linked to the instance pool. If the cooldown period is active or thresholds are improperly configured, scaling won't occur.

178
MCQhard

An administrator is designing a highly available application across three fault domains in an OCI availability domain. If an instance in Fault Domain 1 requires maintenance, how are resources in Fault Domain 2 and Fault Domain 3 affected?

A.Instances in Fault Domain 2 are migrated into Fault Domain 1.
B.All virtual network traffic across the availability domain is temporarily suspended.
C.Fault Domain 2 and 3 remain fully operational and unaffected.
D.Resources in Fault Domain 2 and 3 are automatically rebooted during Fault Domain 1 maintenance.
AnswerC

Fault domains are independent, ensuring localized maintenance impact.

Why this answer

Fault domains are completely isolated; maintenance or failure in one fault domain has no impact on instances in other fault domains.

179
Multi-Selectmedium

Which TWO types of tags are supported in Oracle Cloud Infrastructure? (Choose two.)

Select 2 answers
A.Compartment-bound tags
B.Encrypted tags
C.System-enforced tags
D.Defined tags
E.Free-form tags
AnswersD, E

Defined tags are controlled by administrators using namespaces and tag keys defined in IAM.

Why this answer

OCI supports Free-form tags and Defined tags.

180
MCQmedium

A security administrator wants to implement stateful packet filtering at the individual instance level within a VCN subnet, allowing different rules to apply to different groups of instances in the same subnet. Which OCI feature should be used?

A.Dynamic Routing Gateway firewall rules
B.Security Lists
C.Internet Gateway security policies
D.Network Security Groups (NSGs)
AnswerD

NSGs allow fine-grained, instance-level security rules for specific VNICs within a subnet.

Why this answer

Network Security Groups (NSGs) act as virtual firewalls that provide security rules applied to a specified set of VNICs, unlike security lists which apply to entire subnets.

181
Multi-Selectmedium

When architecting a solution for high availability in OCI, which TWO factors should be considered to ensure that your application remains resilient?

Select 2 answers
A.Placing all compute instances in a single Fault Domain for performance
B.Distributing compute resources across multiple Fault Domains
C.Configuring all services to exist in the same compartment for simplified access
D.Using a single load balancer with no backends
E.Using multiple Availability Domains or Regions for geographic redundancy
AnswersB, E

Distributing across FDs protects against rack-level or hardware failure.

Why this answer

High availability is achieved through the use of multiple fault domains for hardware resilience and multiple availability domains (or regions) for site-level resilience.

182
Multi-Selecthard

Which TWO statements are true regarding OCI Flexible Compute shapes? (Choose two.)

Select 2 answers
A.You can independently configure the number of OCPUs and memory (RAM) when launching a flexible VM.
B.Flexible shapes are only available on Bare Metal instances and cannot be used with Virtual Machines.
C.Flexible shapes do not support boot volume resizing.
D.You must select a fixed tier of memory for every OCPU selected.
E.Network bandwidth scales proportionally with the number of OCPUs selected on flexible shapes.
AnswersA, E

Flexible shapes allow independent custom selection of OCPUs and RAM.

Why this answer

Flexible compute shapes allow independent scaling of OCPUs and memory, and are available for both virtual machine and certain bare metal or specialized instance families.

183
MCQeasy

What is the primary characteristic of an Oracle Cloud Infrastructure Availability Domain?

A.A software-defined network boundary that connects local data centers to the OCI backbone.
B.A logical grouping of users and compartments for billing purposes.
C.One or more data centers located within a region, fault-isolated from each other with independent power and cooling.
D.A hardware rack dedicated entirely to a single enterprise customer on-premises.
AnswerC

Availability domains are isolated, fault-tolerant data centers within a region designed so that a failure in one does not affect another.

Why this answer

Availability domains are distinct, standalone data centers within a region, featuring independent power, cooling, and network infrastructure.

184
MCQmedium

An application running on an Oracle Cloud Infrastructure (OCI) compute instance needs secure, private access to Object Storage in the same region without traversing the public internet. Which architecture should you implement?

A.Configure a Service Gateway in your VCN and add a route rule with the destination set to the Object Storage service CIDR.
B.Attach a NAT Gateway to your VCN and route traffic destined for Object Storage through it.
C.Deploy an Internet Gateway and use security lists to block all inbound traffic except Object Storage traffic.
D.Set up a Local Peering Gateway and peer your VCN directly to the Object Storage public namespace.
AnswerA

A Service Gateway allows your VCN to securely access OCI services like Object Storage privately over OCI's internal network backbone.

Why this answer

To securely access OCI Object Storage privately from a VCN without public internet, you should configure a Service Gateway and a corresponding route table rule targeting the Object Storage service.

185
MCQeasy

An administrator needs to organize OCI resources to manage billing and access control for different departments. Which OCI feature is designed for this purpose?

A.Compartment
B.Tenancy
C.Fault Domain
D.Availability Domain
AnswerA

Compartments allow administrators to group resources for access control and billing management.

Why this answer

Compartments are the primary tool for logically organizing and isolating resources, which simplifies policy management and cost tracking.

186
Multi-Selecteasy

Which TWO OCI compute offerings allow you to run workloads without managing physical server hardware or underlying hypervisors? (Choose two.)

Select 3 answers
A.Bare Metal Compute Instances
B.Standard Flexible Virtual Machines
C.OCI Functions
D.OCI Container Instances
E.Standard Dedicated Virtual Machine Hosts
AnswersA, C, D

Bare Metal requires full server management.

Why this answer

OCI Container Instances and OCI Functions are serverless compute options requiring no infrastructure management.

187
MCQhard

An enterprise application deployed across multiple OCI subnets requires a Layer 4 load balancer that can handle millions of packets per second with ultra-low latency and preserve client source IP addresses. Which service should you deploy?

A.OCI API Gateway
B.Network Load Balancer
C.Dynamic Routing Gateway
D.Public Load Balancer (Layer 7)
AnswerB

Network Load Balancer provides Layer 4 high-performance TCP/UDP load balancing preserving source IPs.

Why this answer

Network Load Balancer (NLB) operates at Layer 4, handles high throughput and packet rates with low latency, and preserves source IPs.

188
MCQeasy

Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?

A.OCI Cloud Guard
B.OCI Audit
C.OCI Logging Analytics
D.OCI Cost Analysis
AnswerA

Cloud Guard detects security misconfigurations and insecure operational states across your OCI tenancy.

Why this answer

OCI Cloud Guard scans OCI resources for security misconfigurations and risky activities, providing actionable remediation steps.

189
MCQmedium

An organization is evaluating the OCI distributed cloud model and requires an environment that is completely managed and operated by Oracle, yet deployed within the customer's own building to meet stringent data residency regulations. Which product meets this?

A.OCI Hybrid Gateway
B.OCI Public Cloud
C.OCI Compute Instance
D.OCI Dedicated Region
AnswerD

OCI Dedicated Region brings all OCI services directly to a customer's data center.

Why this answer

OCI Dedicated Region provides all OCI cloud services locally in the customer's data center, managed by Oracle.

190
Multi-Selecthard

Which THREE components or services are part of the OCI distributed cloud strategy, providing flexibility in where and how cloud services are consumed?

Select 3 answers
A.OCI Resource Manager
B.OCI Cloud@Customer
C.OCI Public Cloud
D.OCI Data Catalog
E.OCI Dedicated Region
AnswersB, C, E

This brings OCI services into the customer's on-premises environment.

Why this answer

The OCI distributed cloud model includes Public Cloud, Dedicated Region, and Cloud@Customer as core offerings to meet various business needs.

191
MCQmedium

A database administrator needs to share a multi-gigabyte Oracle Database backup file stored in an OCI Object Storage bucket with an external auditor who does not have an OCI account. How can this be achieved securely without granting IAM console access?

A.Generate a Pre-authenticated Request (PAR) for the specific backup object with an expiration date.
B.Configure a Service Gateway to allow external IP ranges to access the bucket.
C.Make the entire bucket public by modifying the bucket access policy.
D.Create a temporary IAM user account with Object Storage Reader permissions.
AnswerA

PARs allow secure, time-limited external access to a single object or bucket without an OCI account.

Why this answer

Pre-authenticated requests (PARs) provide a unique URL to download or upload a specific object or bucket without requiring user credentials.

192
MCQhard

You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?

A.Using security lists instead of Network Security Groups
B.Missing route table entries directing traffic to the Local Peering Gateway in both VCNs
C.Attaching an Internet Gateway to the peering connection
D.Enabling Flow Logs on the subnets
AnswerB

Without route table entries pointing to the LPG, traffic cannot find its way across the peering connection.

Why this answer

VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.

193
Multi-Selecteasy

Which TWO networking services or gateways in OCI can be used to route traffic from a VCN to the public internet? (Choose two.)

Select 2 answers
A.Internet Gateway
B.Dynamic Routing Gateway
C.Service Gateway
D.Local Peering Gateway
E.NAT Gateway
AnswersA, E

Internet Gateway allows bidirectional public internet traffic.

Why this answer

Internet Gateway and NAT Gateway both facilitate traffic flowing from a VCN out to the public internet.

194
MCQmedium

You created a Defined Tag namespace called 'Department' and a key called 'CostCenter'. However, developers are forgetting to add these tags when creating compute instances. How can you ensure that every new compute instance created in a specific compartment automatically receives these tags without relying on manual user input?

A.Write an IAM policy with a tag enforcement condition.
B.Use OCI Audit to retroactively tag unlabelled resources.
C.Set up a compartment quota for tagging.
D.Configure Tag Defaults for the compartment.
AnswerD

Tag defaults automatically inject defined tag keys and values upon resource creation within the target compartment.

Why this answer

Tag defaults allow administrators to specify default values for defined tags that are automatically applied to all resources created within a compartment.

195
MCQhard

You need to allow your OKE cluster to access a private database. Where should the database be placed for the best security practice?

A.The same public subnet as OKE
B.Private subnet
C.Management subnet
D.Public subnet
AnswerB

Private subnets prevent direct public access.

Why this answer

Placing the database in a private subnet and using NSGs to allow traffic from the OKE nodes is best practice.

196
Multi-Selecteasy

An engineer needs to deploy flexible compute instances on OCI. Which TWO parameters can be independently adjusted when configuring a flexible compute shape? (Choose two.)

Select 2 answers
A.Amount of Memory (RAM)
B.GPU manufacturer and core architecture
C.Hypervisor version and vendor
D.Number of OCPUs
E.Physical motherboard serial number
AnswersA, D

Memory can be allocated independently of OCPUs within supported shape limits.

Why this answer

Flexible shapes allow users to customize the number of OCPUs and the amount of memory independently to fit workload requirements.

197
MCQmedium

Your development team needs to deploy microservices orchestrated via Kubernetes with automated worker node scaling and managed control plane upgrades. Which OCI service should you provision?

A.OCI Functions
B.OCI Container Instances
C.OCI Compute Instances with Docker
D.Oracle Container Engine for Kubernetes (OKE)
AnswerD

OKE is the managed Kubernetes service in OCI.

Why this answer

Oracle Container Engine for Kubernetes (OKE) is a fully managed, scalable, and highly available service where you can deploy your containerized applications.

198
MCQeasy

A security officer wants to monitor security risks across multiple OCI tenancies and compartments from a single consolidated dashboard. Which OCI service should they configure?

A.OCI Cloud Guard
B.OCI Bastion
C.OCI Web Application Firewall
D.OCI Vault
AnswerA

Cloud Guard aggregates security findings across compartments and tenancies into a single dashboard.

Why this answer

OCI Cloud Guard is a cloud security posture management service that helps customers monitor, assess, identify, and maintain a strong security posture on OCI by detecting misconfigured resources and insecure user activities.

199
MCQmedium

You need to deploy a batch processing job that can tolerate sudden termination by OCI if compute capacity is reclaimed, significantly reducing your compute costs. Which instance type should you choose?

A.Standard Flexible VM Shape
B.Preemptible Instance
C.Dedicated Virtual Machine Host
D.Standard Bare Metal Shape
AnswerB

Preemptible instances offer discounted compute capacity subject to reclamation.

Why this answer

Preemptible instances are spare compute capacity offered at a lower price that can be reclaimed by OCI when capacity is needed.

200
MCQeasy

A cloud architect needs to deploy a lightweight web application in OCI that requires rapid provisioning without managing underlying virtual machine infrastructure, operating systems, or cluster orchestration. Which OCI service should be selected?

A.OCI Functions
B.OCI Container Instances
C.Oracle Container Engine for Kubernetes (OKE)
D.Compute Standard Flex Instances
AnswerB

Container Instances are serverless containers that let you run applications instantly without managing underlying VMs.

Why this answer

OCI Container Instances provide a serverless experience to run containers quickly without needing to manage servers or clusters like OKE.

201
MCQhard

What happens to an Ephemeral Public IP when you stop a compute instance?

A.It is assigned to a new instance
B.It remains assigned
C.It is released
D.It changes to a private IP
AnswerC

Ephemeral IPs do not persist.

Why this answer

Ephemeral public IPs are released when the instance is stopped or terminated.

202
Multi-Selectmedium

Which THREE storage tiers are available in OCI Object Storage? (Choose three.)

Select 3 answers
A.Higher Performance Storage
B.Standard Storage
C.Archive Storage
D.Infrequent Access Storage
E.Balanced Performance Storage
AnswersB, C, D

Standard storage is for frequent access.

Why this answer

OCI Object Storage offers Standard, Infrequent Access, and Archive storage tiers.

203
MCQmedium

How does OCI ensure that high-availability requirements are met within a single region?

A.Availability Domains
B.Multiple VCNs
C.Multiple Load Balancers
D.Global clusters
AnswerA

ADs are isolated data centers within a region.

Why this answer

Availability Domains (ADs) and Fault Domains (FDs) provide physical isolation.

204
MCQmedium

You need to grant an external auditing firm read-only access to view all resources across your entire OCI tenancy without allowing them to make any changes. What is the most efficient way to achieve this?

A.Create an IAM policy: 'Allow group Auditors to inspect all-resources in tenancy'
B.Export all resource configurations to a CSV file and email them weekly.
C.Create an IAM policy: 'Allow group Auditors to manage all-resources in tenancy'
D.Manually add the auditor accounts as co-administrators of the root tenancy.
AnswerA

The 'inspect' verb allows listing and viewing resources across the tenancy without permitting any modifications.

Why this answer

Using the 'inspect' or 'read' verb across 'all-resources' at the tenancy level grants read-only visibility to auditors.

205
MCQeasy

Which OCI storage service is best suited for sharing configuration files across multiple Linux virtual machine instances simultaneously?

A.OCI Block Volume
B.Local NVMe Storage
C.OCI File Storage Service
D.OCI Object Storage
AnswerC

FSS allows concurrent multi-instance NFS mounting.

Why this answer

OCI File Storage Service (FSS) provides a shared network file system that can be mounted simultaneously by multiple instances.

206
MCQeasy

An administrator needs to store infrequently accessed backups in OCI Object Storage that require long-term retention and can tolerate a retrieval time of up to several hours. Which storage tier is most cost-effective?

A.Infrequent Access Storage
B.Archive Storage
C.Standard Storage
D.Block Volume Backups tier
AnswerB

Archive Storage provides the lowest storage cost for long-term retention with a multi-hour retrieval time.

Why this answer

Archive Storage is designed for data that is rarely accessed and has a multi-hour retrieval latency, offering the lowest cost.

207
Multi-Selectmedium

Which TWO of the following statements are correct regarding OCI Compute flexible shapes? (Choose two.)

Select 2 answers
A.When using a flexible shape, increasing OCPUs automatically decreases available memory proportionally.
B.Flexible shapes are supported across multiple processor architectures, including AMD and Intel.
C.Flexible shapes allow users to independently customize the number of OCPUs and memory.
D.Flexible shapes are restricted to bare-metal instances only and cannot be used with virtual machines.
E.Flexible shapes do not support attaching Block Volumes via iSCSI.
AnswersB, C

OCI supports flexible VM shapes on AMD, Intel, and Ampere processors.

Why this answer

Flexible shapes allow independent customization of OCPUs and memory, and they are available across multiple modern compute families (such as AMD and Intel).

208
Multi-Selecthard

Which THREE of the following are features of OCI Load Balancer?

Select 3 answers
A.SSL termination
B.Weighted Round Robin
C.Path-based routing
D.Autoscaling of backends
E.DNS management
AnswersA, B, C

Offloads encryption.

Why this answer

SSL termination, path-based routing, and weighted round robin are key features.

209
MCQhard

A database administrator must establish a high-throughput, highly reliable hybrid connection between an on-premises data center and OCI. The connection must bypass the public internet and guarantee steady throughput with SLA-backed performance. Which networking service combination meets these criteria?

A.Service Gateway connected to an IPSec VPN
B.IPSec VPN connected to an Internet Gateway
C.OCI FastConnect connected to a Dynamic Routing Gateway (DRG)
D.Local Peering Gateway connected to a NAT Gateway
AnswerC

FastConnect provides dedicated private connectivity, terminating on a DRG attached to the VCN.

Why this answer

FastConnect provides a dedicated, private connection with higher speeds and SLAs, bypassing the public internet, paired with a Dynamic Routing Gateway (DRG) on the VCN side.

210
MCQmedium

Your application requires 99.99% uptime. You decide to deploy instances across three Fault Domains (FD-1, FD-2, FD-3) within Availability Domain 1. When launching a new compute instance, what happens if you do not explicitly specify a Fault Domain?

A.The instance is placed in a default scratchpad fault domain and must be manually moved later.
B.OCI places the instance in Fault Domain 1 by default every time.
C.OCI automatically assigns the instance to a Fault Domain using a load-balancing algorithm that distributes instances evenly across all available Fault Domains.
D.The instance fails to launch until a Fault Domain is explicitly provided in the API request.
AnswerC

If left unspecified, OCI selects a fault domain automatically to ensure even distribution across FDs.

Why this answer

If no fault domain is specified, OCI automatically distributes instances evenly across the available fault domains using a round-robin approach.

211
Multi-Selectmedium

Which TWO of the following are valid OCI Object Storage storage tiers? (Choose two.)

Select 2 answers
A.Ephemeral SSD Tier
B.Archive Storage Tier
C.Standard Tier
D.High-Performance Flash Tier
E.Magnetic Tape Tier
AnswersB, C

Archive Storage Tier is for long-term cold storage.

Why this answer

OCI Object Storage provides Standard and Archive storage tiers (along with Infrequent Access).

212
Multi-Selecthard

Which THREE of the following OCI services are considered serverless?

Select 3 answers
A.Functions
B.Object Storage
C.Compute Instances
D.Container Instances
E.Bare Metal
AnswersA, B, D

Fully serverless.

Why this answer

Functions, Container Instances, and Object Storage (managed) are effectively serverless.

213
MCQhard

An enterprise application running on OCI Compute instances requires shared block storage that can be attached in read/write mode across multiple virtual machines simultaneously. What is the recommended OCI solution?

A.Use Object Storage mounted as a block device
B.Attach a single Block Volume in read/write mode to multiple instances simultaneously
C.Use OCI File Storage Service (FSS) for concurrent shared access
D.Configure Local NVMe drives as a shared cluster disk
AnswerC

FSS provides concurrent multi-instance read/write shared file storage via NFS.

Why this answer

Standard block volumes cannot be attached read/write to multiple instances. Clustered databases or specialized clustered file systems using shared block volumes with clustered device mapping or File Storage Service are required. (File Storage Service provides standard concurrent shared file storage).

214
MCQmedium

You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the ingress rule in the database NSG?

A.Configure a Dynamic Routing Gateway rule
B.Use an Internet Gateway source identifier
C.Specify the web server Network Security Group as the source
D.Specify the CIDR block of the entire VCN as the source
AnswerC

Reference the web server NSG as the source for precise tier-to-tier security rules.

Why this answer

OCI NSGs allow you to reference another NSG as the source in security rules, enabling tight access control between tiers without managing IP addresses.

215
MCQmedium

A web application deployed across multiple compute instances experiences fluctuating traffic loads throughout the day. The infrastructure needs to automatically add or remove compute instances based on CPU utilization metrics. Which OCI service combination provides this capability?

A.Container Instances combined with Object Storage lifecycle rules
B.Instance Pools combined with Compute Autoscaling
C.Virtual Cloud Network with Dynamic Routing Gateway autoscaling
D.Load Balancer combined with Block Volume backups
AnswerB

Instance pools group similar instances, and autoscaling adjusts the pool size based on rules.

Why this answer

Compute Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics such as CPU utilization.

216
MCQmedium

You are configuring a VCN and need to ensure that instances in a private subnet can access the internet to download updates without exposing them to incoming traffic. Which component is required?

A.Dynamic Routing Gateway
B.Service Gateway
C.NAT Gateway
D.Internet Gateway
AnswerC

NAT Gateway provides secure outbound-only internet access.

Why this answer

A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound connections.

217
MCQmedium

You are deploying a mission-critical web application that must remain available even if an entire Oracle Cloud Infrastructure availability domain experiences a major outage. The application architecture requires two compute instances. How should you provision these instances to achieve high availability?

A.Deploy both instances in the same Availability Domain but assign them to different Fault Domains.
B.Deploy both instances in separate OCI Regions using an explicit cross-region pairing gateway.
C.Deploy one instance in Availability Domain 1 and the other instance in Availability Domain 2.
D.Deploy both instances in the same Availability Domain and configure autonomous cross-AD scaling.
AnswerC

Placing instances across different Availability Domains ensures that an outage affecting one AD will not take down both instances.

Why this answer

To protect against availability domain failures, instances must be placed in separate Availability Domains within the same OCI region.

218
MCQeasy

An enterprise customer requires strict residency and data sovereignty within their own physical data center, yet demands full compatibility with standard OCI cloud services and APIs. Which OCI deployment model best fits this requirement?

A.OCI Cloud@Customer
B.OCI Public Cloud
C.OCI Dedicated Region Cloud@Customer
D.Hybrid Multi-Cloud Interconnect
AnswerA

OCI Cloud@Customer provides OCI cloud services on-premises in the customer's own data center.

Why this answer

Oracle Cloud Infrastructure (OCI) Dedicated Region and Cloud@Customer allow enterprises to run OCI services on-premises. Specifically, OCI Cloud@Customer brings OCI public cloud services directly to the customer's data center behind their firewall.

219
Multi-Selecthard

Which THREE features are associated with OCI Defined Tags and Tagged-Based Access Control (TBAC)? (Choose three.)

Select 3 answers
A.Defined tags replace IAM policies entirely for access control.
B.Defined tags can only be created as free-form strings without any governance.
C.Defined tags require a Tag Namespace to be created first.
D.Tag defaults can automatically apply defined tags to resources created in a compartment.
E.IAM policies can evaluate resource tag values using target.tag variables.
AnswersC, D, E

Defined tags must belong to a pre-created tag namespace managed by administrators.

Why this answer

Defined tags require tag namespaces, support tag defaults, and can be evaluated in IAM policies for TBAC.

220
MCQhard

You have two VCNs in the same region that need to communicate privately. Which component must be configured?

A.DRG
B.Internet Gateway
C.Local Peering Gateway
D.NAT Gateway
AnswerC

LPGs enable VCN-to-VCN communication within a region.

Why this answer

Local Peering Gateways (LPG) are required for VCN peering within the same region.

221
MCQhard

An administrator needs to route internet-bound traffic from private compute instances through a NAT Gateway. What route table configuration is required in the private subnet?

A.Destination: 0.0.0.0/0, Target: NAT Gateway
B.Destination: 0.0.0.0/0, Target: Service Gateway
C.Destination: 10.0.0.0/16, Target: Internet Gateway
D.Destination: VCN CIDR, Target: NAT Gateway
AnswerA

Directing 0.0.0.0/0 to the NAT Gateway routes all outbound internet traffic through it.

Why this answer

A private subnet route table must have a rule directing destination CIDR 0.0.0.0/0 to the NAT Gateway target.

222
MCQhard

You need to migrate a legacy application to OCI that requires a specific IP address to be retained for compliance. Which OCI networking feature allows you to attach a specific public IP to an instance?

A.Ephemeral Public IP
B.Private IP
C.Reserved Public IP
D.Service Gateway IP
AnswerC

Reserved Public IPs are persistent and can be assigned to VNICs.

Why this answer

Reserved Public IPs are long-lived public IP addresses that can be assigned to resources and retained after the resource is deleted.

223
Multi-Selecthard

Which THREE of the following are components of an OCI Load Balancer?

Select 3 answers
A.Security Lists
B.Listeners
C.Route Tables
D.Backend sets
E.Load balancing policies
AnswersB, D, E

The entry point for client requests.

Why this answer

Backend sets, listeners, and policies are core components of an OCI Load Balancer.

224
MCQeasy

Which statement best describes the geographical relationship between OCI Regions and Availability Domains?

A.Regions and availability domains are completely independent and interchangeable concepts.
B.A region is a localized geographic area that contains one or more availability domains.
C.Each availability domain represents a separate public cloud region in a different country.
D.An availability domain spans across multiple global regions to provide high availability.
AnswerB

OCI regions are localized geographic areas containing multiple fault-tolerant availability domains.

Why this answer

Regions contain one or more availability domains, and multiple regions make up the OCI global footprint.

225
Multi-Selectmedium

Which TWO of the following networking components are used to control traffic flow between subnets?

Select 2 answers
A.Network Security Groups
B.Internet Gateway
C.Object Storage
D.FastConnect
E.Security Lists
AnswersA, E

VNIC-level traffic rules.

Why this answer

Security Lists and Network Security Groups are the primary traffic filtering tools.

Page 2

Page 3 of 6

Page 4

All pages