1Z0-1085-26 Practice Questions

Question 1

An enterprise architect is designing a highly available and resilient web application in OCI. Which THREE strategies should be implemented to ensure maximum uptime and fault isolation? (Choose three.)

Accepted Answer

Configure OCI Traffic Management to automatically route client requests away from an impaired region.. High resilience involves multi-AD/FD placement, cross-region disaster recovery, and automated traffic management.

Answer

Rely solely on single-instance virtual machines with automatic daily backups instead of multi-node clustering.

Answer

Deploy all database and application instances in a single Fault Domain to optimize network latency.

Question 2

You need to restrict access to a specific compute instance based on the application it is running, without affecting other instances in the same subnet. Which security feature should you use?

Accepted Answer

Network Security Groups. Network Security Groups (NSG) allow fine-grained security at the VNIC level.

Answer

Dynamic Routing Gateway

Answer

Route Tables

Answer

Security Lists

Question 3

Which THREE types of gateways can be attached to an OCI Virtual Cloud Network (VCN)? (Choose three.)

Accepted Answer

NAT Gateway. In OCI, a VCN can have a NAT Gateway (B), which lets instances in a private subnet initiate outbound internet connections without exposing them to inbound traffic, and an Internet Gateway (D), which provides bidirectional internet connectivity for instances in public subnets. A Service Gateway (E) is also attachable to a VCN and enables private access to Oracle services such as Object Storage or Autonomous Database without traversing the internet. By contrast, a Storage Gateway (A) is not an OCI VCN gateway type — OCI offers a Storage Gateway appliance for hybrid on-premises access to Object Storage, but it is not attached to a VCN as a gateway. A Database Gateway (C) is likewise not a VCN-attachable gateway in OCI; database connectivity is handled through other constructs such as private endpoints or the service gateway.

Answer

Storage Gateway

Answer

Database Gateway

Question 4

An organization is setting up a hybrid network architecture using OCI FastConnect with a Partner/Provider model. They need to ensure that their on-premises network can communicate with multiple VCNs across different regions using private IP addresses without traversing the public internet. Which OCI component is mandatory to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG). A Dynamic Routing Gateway (DRG) version 2 supports attaching to FastConnect and can peer across regions or connect multiple VCNs to a single on-premises connection.

Answer

Internet Gateway

Answer

Local Peering Gateway

Answer

NAT Gateway

Question 5

You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?

Accepted Answer

Missing route table entries directing traffic to the Local Peering Gateway in both VCNs. VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.

Answer

Using security lists instead of Network Security Groups

Answer

Attaching an Internet Gateway to the peering connection

Answer

Enabling Flow Logs on the subnets

Question 6

A multinational corporation has strict data residency regulations that prohibit their core financial data from leaving their physical corporate headquarters, yet they want to use OCI managed services and the exact same control plane API. Which OCI deployment model satisfies these requirements?

Accepted Answer

OCI Dedicated Region. OCI Dedicated Region or OCI Cloud@Customer allows organizations to run OCI services on-premises, maintaining data residency while using the public cloud control plane and APIs.

Answer

OCI Multi-Cloud Interconnect

Answer

OCI Public Cloud Region

Answer

OCI Global Edge Services

Question 7

A developer has deployed a Node.js web application on an OCI Compute instance, but external users cannot access the application on port 3000. The instance's VCN has a security list allowing TCP traffic on port 3000. What additional OS-level configuration is likely blocking the traffic?

Accepted Answer

The local OS firewall (such as firewalld or iptables) running on the compute instance.. Even when the VCN security list allows TCP port 3000, the instance's local OS firewall (firewalld, iptables, or nftables) can independently block inbound traffic. OCI security lists and NSGs operate at the VCN level, not inside the guest OS, so both layers must permit the traffic. This is the most likely OS-level cause of the connectivity failure.

Answer

The OCI Object Storage bucket policy restricting HTTP ports.

Answer

The VCN Service Gateway intercepting local port requests.

Answer

The Dynamic Routing Gateway dropping layer 4 packets.

Question 8

Which TWO of the following are core tenets of the OCI distributed cloud model? (Choose two.)

Accepted Answer

Offering flexible deployment options including public cloud, dedicated regions, and hybrid cloud solutions.. Option B is correct because the OCI distributed cloud model is defined by flexible deployment choices, spanning public multi-tenant regions, dedicated regions (such as OCI Dedicated Region and Oracle Alloy), and hybrid offerings like Exadata Cloud@Customer and Compute Cloud@Customer. Option D is correct because a core promise of OCI's distributed cloud is delivering the same cloud services, OCI Console/management tooling, and API parity consistently across those deployment models, so workloads and automation remain portable. Option A is wrong because OCI explicitly does not limit its services to Oracle-operated public multi-tenant data centers; the distributed cloud model extends services to customer and partner sites. Option C is wrong because database services such as Autonomous Database and Base Database Service run in OCI public regions, dedicated regions, and on-premises, not exclusively on-premises. Option E is wrong because in OCI public regions Oracle owns and manages the physical hardware, while customers manage only their own resources and configurations.

Answer

Providing cloud services exclusively through public multi-tenant data centers operated solely by Oracle.

Answer

Restricting all database services to run exclusively on-premises.

Answer

Requiring customers to manage their own underlying physical hardware in OCI public regions.

Question 9

An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?

Accepted Answer

No IAM policy has been created that grants permissions to the dynamic group.. A dynamic group only defines membership based on matching rules; it grants no permissions by itself. Permissions are granted exclusively through IAM policies that reference the dynamic group as the principal. If no such policy exists, instances in the group receive nothing, which is the most likely cause described.

Answer

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Answer

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Answer

Dynamic groups cannot be used in IAM policies; only user groups can.

Question 10

You have a parent compartment named 'ParentComp' and a child compartment named 'ChildComp'. If you write an IAM policy at the root tenancy level granting a group access to 'ParentComp', what is the inheritance rule regarding 'ChildComp'?

Accepted Answer

The policy automatically applies to ChildComp because permissions inherit downward in compartment hierarchies.. Policies defined at a parent compartment or tenancy level automatically inherit down to all nested child compartments.

Answer

ChildComp never inherits permissions; a separate policy must always be written for every child compartment.

Answer

Parent compartment policies are blocked if child compartments exist.

Answer

Permissions inherit upward from ChildComp to ParentComp.

Question 11

Which TWO statements are true regarding OCI Flexible Compute shapes? (Choose two.)

Accepted Answer

You can independently configure the number of OCPUs and memory (RAM) when launching a flexible VM.. Option A is correct because OCI Flexible Compute shapes let you independently choose the number of OCPUs and the amount of memory (RAM) within the shape's supported range when launching a flexible VM, rather than being locked to a fixed OCPU-to-memory ratio. Option E is correct because on flexible shapes the network bandwidth scales proportionally with the number of OCPUs selected, so more OCPUs yield higher maximum network throughput. Option B is wrong because flexible shapes are available for both Virtual Machine and Bare Metal instances, not Bare Metal only. Option C is wrong because boot volume resizing is supported independently of whether the shape is flexible. Option D is wrong because flexible shapes specifically allow you to vary memory per OCPU rather than forcing a fixed memory tier for each OCPU.

Answer

Flexible shapes are only available on Bare Metal instances and cannot be used with Virtual Machines.

Answer

Flexible shapes do not support boot volume resizing.

Answer

You must select a fixed tier of memory for every OCPU selected.

Question 12

Which TWO statements describe OCI Service Limits? (Choose two.)

Accepted Answer

Service limits restrict the maximum amount of a resource you can consume in a tenancy or region.. Service limits are thresholds set on resource consumption per tenancy/region, and administrators can request increases via the console.

Answer

Service limits cannot be increased under any circumstances.

Answer

Service limits are managed entirely by writing IAM policy statements.

Answer

Service limits apply only to Object Storage and cannot restrict compute or networking.

Question 13

Which THREE statements are true regarding the architecture and design principles of OCI Availability Domains (ADs) and Regions?

Accepted Answer

Some OCI regions are built with a single availability domain, while others contain multiple availability domains.. Option C is correct because OCI regions vary in topology: some regions are single-AD (for example, certain smaller or newer regions), while most commercial regions contain three availability domains, so the statement accurately reflects that AD count is not uniform across regions. Option D is correct because each OCI region is an independent, isolated geographic area, and regions are deliberately separated by large distances so that a regional failure does not affect other regions. Option E is correct because ADs within the same region are interconnected through a high-bandwidth, low-latency network, which enables multi-AD architectures such as cross-AD replication and low-latency synchronous data mirroring. Option A is incorrect because an availability domain is confined to a single region and cannot span multiple geographic countries. Option B is incorrect because each availability domain has independent power, cooling, and physical security infrastructure; sharing those would defeat the fault-isolation purpose of ADs.

Answer

An availability domain can span across multiple geographic countries to maximize data locality.

Answer

Availability domains share power, cooling, and physical security infrastructure to reduce operational overhead.

Question 14

An administrator needs to store infrequently accessed backups in OCI Object Storage that require long-term retention and can tolerate a retrieval time of up to several hours. Which storage tier is most cost-effective?

Accepted Answer

Archive Storage. Archive Storage is designed for data that is rarely accessed and has a multi-hour retrieval latency, offering the lowest cost.

Answer

Infrequent Access Storage

Answer

Standard Storage

Answer

Block Volume Backups tier

Question 15

Which TWO methods can be used to connect an on-premises data center to an OCI Virtual Cloud Network? (Choose two.)

Accepted Answer

OCI FastConnect. OCI FastConnect (C) is correct because it provides a dedicated, private physical connection between an on-premises data center and an OCI VCN, bypassing the public internet for higher bandwidth and more consistent latency. OCI Site-to-Site VPN (D) is also correct because it establishes an IPsec VPN tunnel over the public internet between the on-premises customer-premises equipment (CPE) and a Dynamic Routing Gateway (DRG) attached to the VCN, enabling encrypted hybrid connectivity. Internet Gateway with Public IP (A) only provides outbound/inbound internet access for resources in the VCN and does not create a dedicated or private link to an on-premises network. Local Peering Gateway (B) connects two VCNs within the same OCI region, not an on-premises data center. Object Storage Gateway (E) is a service for accessing Object Storage from on-premises or other clouds, not a method for connecting a data center network to a VCN.

Answer

Internet Gateway with Public IP

Answer

Local Peering Gateway

Answer

Object Storage Gateway

Oracle Cloud Infrastructure Foundations 2026 Associate 1Z0-1085-26 practice test

Three ways to study

Study 1Z0-1085-26 by domain

Study 1Z0-1085-26 by topic

Security Services practice questions

Getting Started With Oci practice questions

Core Oci Services practice questions

Governance And Administration practice questions

1Z0-1085-26 fundamentals practice questions

1Z0-1085-26 scenario practice questions

1Z0-1085-26 troubleshooting practice questions

Oracle Cloud Infrastructure Foundations 2026 Associate (1Z0-1085-26) (1Z0-1085-26) practice questions