Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) (1Z0-1085-26) — Questions 301–355

OCI Cloud@Customer deploys OCI infrastructure on the customer's premises while Oracle manages it remotely, keeping data resident locally. This meets the data residency constraint by running cloud services physically inside the customer's own facility rather than a shared public region.

Tag Defaults reference defined tag keys that belong to a tag namespace in the tenancy. The administrator selects an existing defined tag key and supplies the default value, then associates it with a compartment so new resources inherit the tag automatically.

OCI Functions executes code in response to events without any server provisioning, satisfying the stem's serverless constraint. Its maximum execution timeout of five minutes accommodates the stated short duration, whereas container or VM services would require infrastructure management the developer explicitly wants to avoid.

Every OCI IAM policy statement must name the compartment or tenancy where the policy applies, scoping which resources the rule governs. Without this location element the statement cannot be evaluated, so it satisfies the required-component constraint alongside subject, verb and resource-type.

OCI File Storage Service delivers a hierarchical, NFS-accessible shared file system, satisfying the stem's demand for file storage rather than block storage. Unlike block volumes, which present raw fixed-size blocks to a single instance, it supports concurrent multi-client access through standard file protocols, making it a valid selection alongside OCI Object Storage.

Cost Analysis in the OCI Console provides interactive charts of monthly spend trends, with filters for compartments and breakdowns by individual service. It satisfies all three stated needs: trend visualisation, compartment filtering and per-service expense examination.

Traffic destined for Object Storage must be routed to the Service Gateway, so the subnet's route table needs a rule whose destination is the Oracle Services Network service CIDR and whose target is that gateway. Without it, packets never reach the gateway.

OKE provisions and manages the Kubernetes control plane (API server, scheduler, etcd) across availability domains, while worker nodes run in the customer's tenancy and VCN. This split responsibility matches the stem's requirement that Oracle manages masters and the customer manages workers.

Remote Peering Connection attached to each region's Dynamic Routing Gateway provides the private, cross-region VCN-to-VCN link. A single DRG alone cannot span regions, so the RPC pairing is the required component for this inter-region connectivity.

Availability Domains are isolated, fault-tolerant data centre groupings within a single OCI region, each with independent power, cooling and networking. Deploying the database across them satisfies the hardware-failure resilience requirement while keeping inter-AD latency low enough for synchronous replication, unlike cross-region or multi-cloud approaches.

The IPsec connection is the encrypted tunnel object itself, binding the CPE to the DRG and carrying traffic between the on-premises network and the VCN. Without it, no IPsec VPN path exists, so it is mandatory for this topology.

Identity & Security hosts the Identity service, where administrators create groups, compartments and IAM policies under the tenancy. This satisfies the stem's requirement to manage access governance centrally, since compartments and policies are defined within Identity rather than Compute or Networking.

A NAT Gateway translates private subnet egress traffic to a public source IP, enabling instances to reach the internet while blocking unsolicited inbound connections. This satisfies the outbound-only constraint, unlike an Internet Gateway, which permits bidirectional traffic and requires public IP addresses on instances.

OCI regions are fully isolated, with no shared control plane, networking or power infrastructure between them. This independence satisfies the fault-isolation constraint, so an outage in one region cannot cascade to another, making the statement accurate for disaster recovery planning.

OCI Vault centrally stores and manages encryption keys and secrets, with policies governing their lifecycle and access. This satisfies administrative governance by centralising cryptographic material control, separating key custody from the workloads that consume those keys.

OCI regions are isolated geographic areas linked by Oracle’s dedicated private backbone, not the public internet. This satisfies the Ashburn-to-Phoenix replication requirement by providing secure, high-throughput, low-latency connectivity between regions, enabling reliable cross-region data replication without exposing traffic to public network paths.

Path-based routing inspects the request URI and forwards traffic to different backend sets according to rules matching prefixes such as /api or /web. This directly satisfies the requirement to distribute traffic by URL path, unlike simple round-robin or host-based listeners.

File Storage Service provides a shared, elastic NFSv3 file system that multiple Linux instances can mount concurrently, including across availability domains within a region. This directly satisfies the stem's requirements: simultaneous multi-instance access, NFSv3 protocol support, and cross-availability-domain reach, which block volume attachments cannot deliver.

Group-based policy assignment centralises permission management, so onboarding or offboarding a user means changing group membership rather than editing many individual policies. This reduces drift and orphaned grants, satisfying the maintainable IAM structure the question asks for.

Private DNS Zones resolve hostnames to private IP addresses inside a VCN, with the zone attached to the VCN and views controlling resolution. This satisfies the requirement for internal hostname resolution without exposing records publicly.

This policy grants the group ComputeAdmins the ability to manage instances within the Production compartment only. The 'manage' verb allows full control over instances, and the scope is limited to the specified compartment. This meets the requirement of granting access to manage compute instances without granting access to other resources.

Placing the node pool across multiple subnets in different Availability Domains or Fault Domains spreads worker nodes physically, so a single rack failure cannot take down the whole pool. This satisfies the requirement to prevent downtime from one hardware rack failing.

A Block Volume Clone creates an instantaneous point-in-time copy using copy-on-write, so no bulk data movement occurs at creation. This satisfies the space-efficient, no-wait constraint, unlike a full backup-and-restore cycle, which copies all blocks before the volume becomes usable.

OCI's hierarchy is region, then availability domain, then fault domain. A region is a localized geographic area, each region has one or more availability domains that are isolated from one another, and each availability domain is subdivided into fault domains that group hardware sharing a common physical risk such as power or cooling.

An Internet Gateway provides bidirectional internet connectivity for subnets with public IP addresses, and it attaches directly to a VCN. This satisfies the stem's requirement for a gateway that can be attached to an OCI Virtual Cloud Network.

Compartments are the primary OCI construct for isolating and organizing resources and for scoping access. Placing the finance team's resources in their own compartment lets the administrator write policies that grant the team lead manage permissions on that compartment only, and it enables per-compartment cost tracking and budgets, exactly matching the isolation requirement.

Fault domains provide distinct power, cooling and network within one availability domain. Distributing application instances across them ensures a hardware failure affects only one fault domain, keeping the application reachable — fault tolerance achieved without the latency and cost of cross-region deployment.

A private subnet carries no route rule targeting an Internet Gateway, so instances lack public connectivity in either direction. Placing database servers there satisfies the isolation requirement, while a public subnet would expose them to inbound internet traffic.

Resource Locks prevent deletion or modification of a resource regardless of user privileges, including administrators, until the lock is removed. Applying a lock to production-tagged resources satisfies the requirement to block accidental deletion by any user.

OCI Resource Manager is a managed Terraform service that runs infrastructure-as-code stacks natively within your tenancy, storing state and configurations. It satisfies the requirement to define and run Terraform without external tooling or self-managed state.

Bare metal shapes run directly on dedicated physical hardware with no hypervisor, eliminating virtualisation overhead and giving full CPU, memory and network performance. This matches the scenario's requirement for dedicated servers without a virtualisation layer.

OCI Resource Manager runs Terraform configurations as managed stacks, tracking state and enabling repeatable, version-controlled provisioning. This satisfies the stem's requirement for organising and managing infrastructure configuration, since Terraform declaratively defines resources and Resource Manager applies, plans and destroys them consistently across compartments.

Cross-region replication copies bucket data to a bucket in a second OCI region, and traffic traverses Oracle's private backbone rather than the public internet. Choosing a secondary region over 500 miles away satisfies the geographic separation and no-public-internet constraints.

A Dynamic Routing Gateway (DRG) provides the virtual router that connects your VCN to on-premises networks via FastConnect or IPSec VPN. Setting the DRG as the route target forwards on-premises-bound traffic through that gateway, satisfying the requirement to route private subnet traffic correctly to the data centre.

Top-of-rack network switches sit within a single fault domain's physical boundary, so hardware failure or maintenance on one switch does not affect switches in other fault domains. This satisfies the stem's requirement for components isolated from each other across different fault domains.

Volume cloning creates a point-in-time copy of a block volume, letting you restore data after accidental deletion or corruption without affecting the source. It satisfies the stem's protection requirement through snapshot-based replication, unlike encryption or access controls, which prevent rather than recover. Cloning therefore delivers the resilience the scenario demands.

Each OCI region is isolated from every other region, with no shared infrastructure or control plane between them. This independence satisfies the stem's description of regional architecture, ensuring fault isolation and data residency, and it distinguishes regions from availability domains, which do share a region's infrastructure.

Customer-managed keys in OCI Vault allow the organization to create, manage, and rotate keys according to their own policies. They can set a rotation schedule of 90 days and maintain control over key access. Object Storage supports encryption with customer-managed keys, and this meets the compliance requirement for customer-managed encryption with defined rotation.

A public load balancer provides a regional, fault-tolerant entry point that spreads HTTP/HTTPS traffic across backend instances in multiple availability domains. It satisfies the stem's requirement for a resilient entry point, unlike a private load balancer, which only serves internal clients within a VCN.

OCI Functions is a fully managed, serverless platform that executes code triggered by events, scaling automatically without provisioning or patching virtual servers. This satisfies the constraint of running code on demand with no infrastructure management, unlike Compute instances.

OCI Traffic Management performs DNS-based health checks and failover, steering client requests to a healthy region when the primary becomes impaired. This directly satisfies the fault-isolation and maximum-uptime constraints by removing regional single points of failure, complementing multi-AD deployment and load balancing across availability domains.

Network Security Groups apply stateful allow or deny rules at the instance's virtual NIC or subnet level, so rules can target a single compute instance without altering other instances sharing the subnet. This satisfies the requirement to restrict access per application instance.

SSL termination happens at the listener, which references a certificate bundle stored in the load balancer's certificate configuration. Associating that certificate with the HTTPS listener satisfies the stem's requirement for secure traffic with SSL termination at the load balancer.

OCI best practise caps compartment nesting at six levels beneath the tenancy root. A seven-level structure exceeds this limit, complicating policy inheritance and IAM management, so six levels is the recommended maximum depth for the hierarchy.

OCI Functions is a fully managed, serverless platform that executes code in response to events or HTTP requests, so no server or runtime provisioning is needed. This directly satisfies the stem's requirement to run event-triggered functions without managing infrastructure.

OCI Functions is a serverless platform that executes code in response to events, with OCI provisioning and scaling the runtime environment. This satisfies the constraint because no operating system or hypervisor management is exposed to the customer.

Security Lists are subnet-level constructs applied to every VNIC in the subnet, whereas NSGs are VNIC-level and apply only to the specific VNICs you add. This axis of difference determines how granularly you can target security rules.

Detector recipes define the conditions and rules that Cloud Guard evaluates against resources in each compartment. Overly permissive IAM policies matching those conditions generate the reported problems, so the findings originate from detector recipes rather than responders or targets.

Instance Pool health checks monitor instance state, and auto-healing terminates and recreates instances that fail checks or land on failed hardware. This directly satisfies the stem's requirement for automatic replacement after catastrophic physical hardware failure.

A Service Gateway provides private access to Oracle services such as Autonomous Database over the OCI backbone, keeping traffic off the public internet. It is configured within the VCN and satisfies both the privacy and backbone-network constraints.

Lifecycle Management Policies apply rule-based transitions between Object Storage tiers, automatically demoting objects to Archive Storage once they reach the specified 90-day age threshold. This satisfies the stem's cost-saving requirement without manual intervention or application changes, since the policy runs server-side against object metadata.

An OCI region is a geographic area comprising one or more isolated availability domains, each with independent power and networking. This containment relationship satisfies the stem's constraint: availability domains exist only within a region, never spanning regions.

Availability Domains are isolated by separate power, cooling and network within a region, while Fault Domains isolate hardware within one. Spreading tiers across them ensures a single facility or hardware failure cannot take down every instance, meeting the high-availability design goal.

The OCI Audit service automatically records all API activity in the tenancy, including Object Storage operations such as DeleteBucket, and retains events for 90 days by default. Filtering by compartment and event type surfaces the principal identity, source IP, and timestamp, which directly answers who deleted the bucket and when.

OCI Object Storage is designed for massive volumes of unstructured data, storing images and backups as objects in buckets without filesystem or block constraints. Its durability and elastic capacity suit this requirement better than Block Volume or File Storage.