Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 226–300

A public load balancer distributes inbound traffic across backend instances, while instance pools supply identical compute members and autoscaling configurations adjust pool size on demand. Together they deliver the scaling and load balancing the web application architecture requires.

OCI IAM federation supports SAML 2.0 identity providers, allowing users to authenticate against an external directory and then assume OCI roles through group mappings. Federating with an existing enterprise IdP lets the new engineer sign in with corporate credentials, eliminating the need for a locally managed OCI password.

A regional subnet spans every availability domain within its region, satisfying the requirement for a subnet not confined to a single AD. Unlike AD-specific subnets, which are locked to one availability domain, regional subnets extend across all ADs in the region, giving the architect maximum placement flexibility.

File Storage Service provides a shared, POSIX-compliant NFS file system mountable concurrently by many Compute instances across subnets. This satisfies the requirement for simultaneous shared access across hundreds of instances, unlike Block Volume, which attaches to a single instance.

Flexible shapes decouple OCPU and memory allocation, letting you select each independently within supported ratios. This satisfies the requirement to scale CPU and memory separately, unlike fixed shapes where both are bundled in preset combinations.

Route table rules determine whether traffic from the public subnet has a path to an internet gateway. Without a 0.0.0.0/0 route targeting the IGW, the instance cannot reach the internet regardless of other configuration. This is the first check because routing is the fundamental prerequisite for outbound connectivity.

Compartments provide the logical isolation boundary within a tenancy, letting administrators group resources per department and attach IAM policies scoped to each compartment. This delivers both organisation and access control, which regions or availability domains do not provide.

Fault domains are independent hardware groupings within an availability domain, so patching or maintenance is applied to one fault domain at a time. Distributing instances across fault domains prevents simultaneous maintenance events, directly satisfying the high-availability requirement in the stem.

OCI Usage Reports automatically generate daily CSV reports of billing and usage, delivered to an Object Storage bucket you specify. This satisfies the daily automated export requirement without custom scripting, enabling downstream financial analysis and reporting.

OCI Load Balancer distributes incoming client traffic across backend Compute instances and terminates SSL/TLS at the listener, satisfying both the even-distribution and SSL-offload requirements. Flexible shapes and policies such as weighted round robin let the architect balance load without decrypting on each web server.

Paravirtualized attachment is a supported OCI Block Volume attachment method, using the hypervisor's virtio driver rather than emulating a device. It satisfies the question's requirement for a valid attachment method, delivering higher performance than emulated options while requiring no iSCSI configuration inside the instance.

OCI Budgets evaluate spend against thresholds and route alerts through the Notifications service, which fans out to email, PagerDuty, Slack and similar subscriptions. This satisfies the requirement that alerts reach recipients beyond the Console, enabling proactive cost governance.

Ultra High Performance is the only OCI Block Volume tier delivering the highest IOPS per volume, with up to 225,000 IOPS, designed for unpredictable bursty I/O. Lower tiers cap IOPS well below this, so they cannot meet the stated requirement.

Intra-region Availability Domain traffic traverses Oracle's dedicated network fabric rather than the public internet, providing high bandwidth and low latency. This satisfies the connectivity statement precisely, and explains why multi-AD architectures remain viable for performance-sensitive workloads within a single region.

Oracle Interconnect for Azure provides a dedicated, private, high-bandwidth, low-latency link between OCI and Microsoft Azure regions, bypassing the public internet. It directly satisfies the multi-cloud requirement for extremely low latency and high throughput between the tenancy and Azure.

OCI Load Balancers terminate incoming SSL/TLS connections at the listener and forward decrypted traffic to backend servers, offloading cryptographic processing. This reduces CPU overhead on backends and centralises certificate management, satisfying the SSL offloading statement.

OCI Web Application Firewall inspects Layer 7 HTTP traffic, filtering malicious requests and blocking SQL injection payloads before they reach the application. It directly addresses both the HTTP flood and injection constraints named in the stem, unlike network-layer defences that cannot parse application content.

Network Security Groups apply rules at the VNIC level, so only the chosen database instances receive the restriction while the subnet's own security lists stay untouched. This satisfies the fine-grained, subnet-independent constraint that security lists cannot meet.

Compute Cloud@Customer delivers OCI Compute and associated services on hardware installed in the customer's datacentre, with control-plane connectivity to OCI. Data stays on-premises, satisfying the stem's requirement for a customer-controlled deployment model meeting residency rules.

A DRG accepts Site-to-Site VPN attachments, supporting both static and dynamic (BGP) routing, connecting on-premises networks to OCI. This satisfies the hybrid connectivity requirement, as the DRG acts as the regional routing hub between your premises and VCNs.

An OCI Internet Gateway is a highly available, horizontally scaled VCN component that provides bidirectional connectivity between the VCN and the public internet. It satisfies the requirement to route inbound and outbound public traffic for resources with public IP addresses.

Bare Metal shapes give the instance a whole physical server, so no hypervisor layer sits between the operating system and hardware. That removes virtualisation overhead and prevents noisy-neighbour contention, satisfying the stem's demands for dedicated hardware, maximum performance and strong isolation.

OCI Monitoring ingests metric data from resources such as compute instances and emits alarms when thresholds are breached, satisfying the requirement for native metric monitoring with threshold-based alerting. It provides the metrics namespace, alarm rules and notifications that the scenario demands, without third-party tooling or manual polling.

The policy scopes the manage verb on compartments to AppCompartment, letting the architect create and manage sub-compartments beneath it. Because the grant is confined to that compartment rather than the tenancy root, full tenancy administration rights are not conferred.

TLS/SSL encrypts application and load balancer traffic in transit, protecting data moving between clients and OCI endpoints. This directly satisfies the stem's requirement for securing data in transit within OCI networking, distinct from at-rest encryption or network segmentation controls.

Responder recipes define automated actions that Cloud Guard triggers when a detector identifies a problem, enabling remediation without manual intervention. This satisfies the requirement for features that actively secure the tenancy, rather than merely reporting posture.

Container Instances integrate with OCI File Storage, letting you mount file systems as volumes directly into containers. This satisfies the persistent shared storage requirement, unlike ephemeral local container storage, and avoids managing block volumes or custom drivers.

Object storage replicates objects across multiple devices or availability domains, delivering very high durability with negligible annual data loss probability. This satisfies the stem's requirement for a primary benefit, exceeding typical single-volume block storage resilience.

The CPE object represents the on-premises VPN device, recording its public IP address so OCI can build the IPsec tunnels. Without it, the DRG cannot identify the remote endpoint, so the site-to-site VPN connection cannot be established.

Customer-managed keys in OCI Vault give the organisation sole control over key creation, rotation and deletion, rather than Oracle-managed keys. Assigning that CMK to the Object Storage bucket ensures all stored data is encrypted under a key the customer manages, meeting the compliance mandate.

A fault domain groups hardware within an availability domain, so placing the instance in a chosen fault domain isolates it from failures affecting other racks while remaining in the same AD, as the stem requires.

Object Lifecycle Management rules define policies that automatically transition or delete objects based on age, such as deleting after 90 days. This directly satisfies the retention compliance requirement without manual intervention, unlike retention locks or versioning.

Container Instances provides serverless container execution, letting you run individual containers without provisioning or managing underlying compute hosts. It satisfies the stem's requirement to manage containerized workloads by offering a lightweight, fully managed runtime for single containers, complementing OCI Container Engine for Kubernetes for orchestration-heavy scenarios.

Availability Domains are isolated, physically separate data centres within a region, each with independent power, cooling and network. Spreading workloads across multiple ADs removes the single point of failure of one facility, so an outage in one AD does not affect instances running in another.

A service gateway provides private access to Oracle services such as Autonomous Database, keeping traffic off the public internet. It satisfies the no-public-internet constraint by routing VCN traffic to the Oracle Services Network via the region's service CIDR label, unlike NAT or internet gateways.

A NAT gateway lets instances in private subnets initiate outbound internet connections without exposing them to inbound traffic. OCI permits attaching it to a VCN, satisfying the stem's requirement for a valid attachable gateway type.

The Dynamic Routing Gateway is the mandatory virtual router that attaches to VCNs and connects them to FastConnect private virtual circuits. It enables private IP reachability across multiple VCNs in different regions without public internet traversal.

OCI Dedicated Region places the entire cloud region, including the control plane, inside the customer's own data centre, so financial data never leaves headquarters. It still exposes the same OCI control plane APIs as public regions, satisfying both the residency constraint and the managed-services requirement.

Compartments are logical partitions within a tenancy used to isolate and delegate administration of resources. Separate compartments for networking, security tooling and application workloads give each team scoped IAM policies, matching the required administrative boundaries.

Cross-Region Replication asynchronously copies Block Volume backups to a chosen destination region, satisfying the disaster recovery requirement. Copying backups manually between regions is not the supported automated mechanism, and Object Storage replication applies to buckets, not block volume backups.

Infrequent Access Storage suits data accessed rarely yet required instantly, matching the stem's availability constraint. Unlike Archive tiers, which need rehydration hours before retrieval, this tier keeps objects immediately readable while charging lower storage rates than Hot, cutting cost for millions of small, seldom-touched files.

A regional OCI Load Balancer spans multiple availability domains, so it can distribute HTTP/HTTPS traffic across backend compute instances in different ADs, satisfying the resilience constraint. A flexible or private load balancer confined to one AD would not achieve cross-AD distribution.

Security lists filter traffic at the VCN's virtual network interface, not inside the guest OS. A host firewall such as firewalld or iptables independently drops inbound TCP 3000, so it is the additional OS-level control blocking access despite the permissive security list.

OCI's distributed cloud spans public regions, dedicated regions and hybrid offerings such as Dedicated Region Cloud@Customer and Roving Edge, so workloads run wherever latency, data residency or sovereignty demands. This directly satisfies the stem's requirement for flexible deployment options, distinguishing OCI from single-deployment public cloud providers.

A user-defined Volume Backup Policy supports multiple independent schedules, each with its own frequency and retention period, so daily-30-day and weekly-1-year backups coexist in one policy. Predefined policies offer fixed schedules and cannot express distinct retention periods, failing the stated requirement.

Dynamic group membership alone confers no access; permissions require an IAM policy binding that names the group as principal. Without such a policy, matching rules populate membership but grant nothing, so instances receive no permissions — exactly the missing-policy constraint described in the stem.

IAM policies in Oracle Cloud Infrastructure cascade downward through the compartment hierarchy, so a policy granting access at ParentComp also applies to ChildComp. This satisfies the stem's inheritance question: child compartments automatically receive the parent's policy permissions without a separate statement.

Service limits are hard quotas capping consumption of a resource within a tenancy or region, such as compute cores or load balancers. This matches the stem's description directly, distinguishing limits from compartment quotas and from capacity availability.

OCI's default IPsec parameters may not match the on-premises firewall's required Phase 1 and Phase 2 settings, so defining a custom IPsec connection with those exact algorithms and lifetimes restores tunnel negotiation. Default connections offer no parameter override, causing the mismatched-proposal packet drops described.

OCI Container Instances runs Docker containers directly without managing servers or Kubernetes worker nodes, satisfying the serverless container requirement. It differs from OKE, which requires managing node pools, and from Functions, which is event-driven rather than long-running.

A Managed OKE cluster runs the Kubernetes control plane entirely within Oracle's tenancy, with worker nodes deployed as node pools in the customer's VCN. This matches the stem's requirement that OCI manages master nodes while workers run in the team's VCN.

FastConnect provides a dedicated, private physical circuit between the on-premises network and OCI, bypassing the public internet. It satisfies the requirement for an on-premises-to-VCN connection while offering predictable latency and higher bandwidth than internet-based alternatives.

An Internet Gateway is the VCN component that provides a routed path to the public internet, enabling bidirectional traffic for resources in public subnets with public IP addresses. It satisfies the requirement for connectivity between the VCN and external networks, unlike NAT or Service Gateways.

The Layer 7 Load Balancer operates at the application layer, enabling HTTP/HTTPS routing, SSL termination, and cookie-based session persistence. Layer 4 balancing handles only TCP/UDP, so it cannot inspect cookies or terminate SSL for this scenario.

Preemptible instances run on spare capacity and can be reclaimed by OCI at short notice, delivering substantial discounts suited to fault-tolerant batch workloads. The stem's tolerance of sudden termination matches this reclaimable model, unlike on-demand or reserved capacity.

A secondary region must actually host the required services and have capacity for the production workload before failover can succeed. Selecting regions lacking those services or headroom makes recovery impossible, so this consideration satisfies the stem's demand for viable failover targets.

Identity domains are the OCI IAM construct that provides an isolated container for users, groups, and identity-provider configuration within a tenancy. Each domain has its own namespace, so business units can be separated while the tenancy remains centrally billed. Policies can then grant a group in that domain access scoped to specific compartments or resources.

A service gateway provides private access from a subnet to Oracle Cloud Infrastructure Object Storage, keeping traffic off the public internet. It satisfies the stem's private-network constraint, since database instances in the private subnet route to Object Storage through the gateway rather than traversing the internet or requiring a NAT gateway.

Deploying regional instances in OCI regions matching user geography places compute close to each user group, and OCI Traffic Management steers DNS requests to the nearest healthy region. Together these minimise latency for North American, European and Asian users, satisfying the stem's global latency constraint.

Tag Defaults apply predefined tags automatically to resources at creation, based on compartment or tenancy rules. This satisfies the requirement for project-code tagging without manual user action, unlike defined tags or policies that only enforce compliance.

Preemptible Instances tap spare OCI capacity at steep discounts, satisfying the stem's cost-reduction goal. They can be reclaimed with little notice, so they suit only fault-tolerant workloads that checkpoint or tolerate interruption. That trade-off between price and reliability is precisely why the option pairs lower cost with fault tolerance.

File Storage Service provides a POSIX-compliant, shared, high-performance file system mountable by multiple compute instances concurrently across availability domains. This satisfies both constraints in the stem: POSIX semantics and cross-availability-domain shared access, which object and block storage cannot deliver.

An OCI Region is a localized geographic area composed of one or more availability domains, which are isolated datacentres within that region. This matches the stem's request for the definition, distinguishing regions from availability domains and fault domains.

Backend sets group the compute instances or IP addresses that receive traffic, paired with health checks and policies. The listener and load balancer reference a backend set to route incoming requests to the correct servers.

OCI DNS public zones host authoritative records for internet-facing domains, letting you create and manage A, CNAME and TXT entries. This directly satisfies the stem's requirement to register and manage public DNS records for a domain hosted on OCI.

OCI Dedicated Region delivers a complete OCI region within a customer's premises, isolated from public tenancy and fully Oracle-managed. It satisfies the distributed cloud requirement by providing region-scale services and control-plane independence for organisations with strict sovereignty or compliance constraints.

Budgets allow you to set financial limits and configure automated alerts when forecasted or actual spend crosses set percentages.

Object Storage public buckets serve objects directly over HTTP without any compute instance, so no VM web server is provisioned. Enabling public visibility on the bucket satisfies the stem's constraint of hosting static HTML, images and JavaScript entirely on OCI.

OCI FastConnect provides a dedicated, private physical or logical connection between on-premises infrastructure and OCI, bypassing the public internet. This satisfies the requirement for predictable, high-speed performance, unlike IPSec VPN, which traverses the internet and offers variable latency.

Oracle Container Engine for Kubernetes provides a managed Kubernetes control plane while leaving worker node compute under customer control, matching the stated split of responsibilities. OCI Container Instances and Functions abstract away nodes entirely, so they cannot satisfy the requirement to manage worker nodes yourself.

Bare Metal instances give the tenant the entire physical server with no hypervisor layer, so no other customer shares CPU, memory or network hardware. This hardware-level separation satisfies workloads demanding strict isolation, licensing on physical cores, or non-virtualised performance.

Container Instances runs containers directly on OCI-managed infrastructure, removing the need to provision or patch Kubernetes clusters, node pools, or servers. This serverless container runtime satisfies the stem's constraint of running Docker containers quickly without orchestration overhead.

In OCI, MFA is configured within Identity Domains, where administrators enable it per user or group and users enrol their authenticators. Managing MFA here satisfies the requirement to ensure users configure it for their accounts, since Identity Domains governs authentication policy for the tenancy.

The customer configures identity controls within OCI Identity and Access Management, including user accounts, password policies and MFA enforcement. Oracle secures the underlying cloud infrastructure, but identity governance remains a tenant responsibility, satisfying the stem's requirement for account, credential and authentication management ownership.

A private subnet reaches the internet only when its route table contains a 0.0.0.0/0 rule targeting the NAT Gateway. Without that route, traffic has no path outbound, regardless of the gateway's attachment or permissive security lists. The stem confirms the gateway exists and egress is allowed, isolating the missing route as the cause.