Free 1Z0-1085-25 Practice Test Questions and Answers (2026)

Oracle Cloud Infrastructure (OCI) is distinguished in the cloud market by its offering of Bare Metal servers. This core compute component provides customers with dedicated, single-tenant physical servers, ensuring maximum performance, security, and control. Unlike virtualized environments, bare metal instances eliminate the "noisy neighbor" effect and provide direct hardware access. This capability is crucial for high-performance computing (HPC), I/O-intensive databases, and other enterprise workloads that require consistent performance and strong isolation, making it a key differentiator for OCI's computing platform.

A. Virtual Desktop Interfaces (VDIs) are a higher-level service offered by many cloud providers, not a core, differentiating compute component of OCI's fundamental infrastructure.

B. This statement is factually incorrect. OCI is architected for massive scalability to meet the demands of large enterprise workloads, which is a key feature, not a limitation.

C. While OCI provides single-tenant options, Bare Metal compute is the specific core component that differentiates its capabilities, not a generalized concept of "single-tenant storage."

1. Oracle Cloud Infrastructure Documentation

"Overview of Compute": "Oracle Cloud Infrastructure's Compute service offers both bare metal and virtual machine instances. A bare metal instance gives you dedicated physical server access for highest performance and strong isolation." This document establishes Bare Metal as a primary and distinct compute offering.

2. Oracle White Paper

"Oracle Cloud Infrastructure—A Technical Overview" (Doc ID: 11182020-WP): Section "Compute Services

" Page 8

discusses the range of compute shapes

stating

"OCI offers bare-metal compute instances

which are single-tenant servers with no hypervisor

giving customers full control of the server." This highlights the single-tenancy and control that differentiates the service.

3. Oracle Cloud Infrastructure Blog

"Bare metal

virtual machines

or containers? Which compute service is right for you?": This article explicitly positions Bare Metal instances for "workloads that are performance-intensive" and require "access to specific hardware

" confirming its role as a specialized and differentiating component for high-demand use cases.

Under the Oracle Cloud Infrastructure (OCI) Shared Security Responsibility Model, security is a shared effort between Oracle and the customer. Oracle is responsible for the security of the cloud, which includes the physical data centers and the core infrastructure. The customer is responsible for security in the cloud. This includes protecting their own data, managing user access, and configuring the security of their cloud resources. Configuring network security features like firewalls, security lists, and network security groups within their Virtual Cloud Network (VCN) is a fundamental customer responsibility to control traffic to and from their applications and workloads.

A. Ensuring the integrity of the underlying cloud infrastructure is Oracle's responsibility. The customer builds on top of this infrastructure, but does not manage its core integrity.

B. Physical security of data centers, including access controls and environmental protections, is exclusively managed by Oracle as the cloud provider.

C. Management of hardware firmware and patching the underlying hypervisors are Oracle's responsibilities to maintain the security and stability of the cloud infrastructure.

1. Oracle Cloud Infrastructure Documentation

"Security Overview": This document explicitly outlines the shared model. Under the "Customer Responsibilities" section for "Network security

" it states the customer is responsible for the "Configuration of virtual network

subnets

routing tables

and gateways. Configuration of security lists

network security groups

and network firewalls." Conversely

under "Oracle Responsibilities

" it lists "Hardware

software

networking

and facilities that run Oracle Cloud services." This directly supports option D and refutes A

B

and C.

Source: Oracle Cloud Infrastructure Documentation

"Security Overview"

Section: "Shared Security Responsibility Model".

2. Oracle Cloud Infrastructure Security Guide: This guide details the customer's role in securing their tenancy. It emphasizes that customers must configure network controls to secure their workloads.

Source: Oracle Cloud Infrastructure Security Guide

Section: "Securing the Network"

Paragraph 1. "You are responsible for securing your cloud network and its perimeters."

3. Oracle Cloud Infrastructure Documentation

"Overview of Networking": This document describes the components of a VCN that customers must configure

including Security Lists and Network Security Groups

reinforcing that this configuration is a customer task.

Source: Oracle Cloud Infrastructure Documentation

"Overview of Networking"

Section: "Comparing Security Lists and Network Security Groups".

Oracle Cloud Guard is a cloud-native service specifically designed for Cloud Security Posture Management (CSPM). It continuously monitors your Oracle Cloud Infrastructure (OCI) tenancy for security weaknesses related to configuration, identifies potential security risks, and provides recommendations for remediation. It operates by using detector recipes to identify misconfigured resources and insecure activities, and responder recipes to automatically correct problems, thereby helping to maintain a strong security posture across the cloud environment.

A. OCI Audit: This service records API calls made to OCI resources. It provides a log of events for auditing and compliance purposes but does not proactively manage or recommend fixes for security posture.

B. OCI Virtual Cloud Network (VCN): This is a foundational networking service for creating a private network in OCI. While it includes security features like Security Lists, it is not a posture management service.

D. OCI Identity and Access Management (IAM): This service controls user access and permissions to OCI resources. It is a critical security component but its primary function is authentication and authorization, not continuous posture monitoring.

---

1. Oracle Cloud Infrastructure Documentation - Overview of Cloud Guard: "Oracle Cloud Guard is a cloud-native service that helps customers monitor

identify

achieve

and maintain a strong security posture on Oracle Cloud. Use the service to examine your Oracle Cloud Infrastructure resources for security weakness related to configuration

and your Oracle Cloud Infrastructure operators and users for risky activities." (Oracle Cloud Infrastructure Documentation

"Overview of Cloud Guard

" Section: How Cloud Guard Works).

2. Oracle Cloud Infrastructure Documentation - Overview of the Audit Service: "The Oracle Cloud Infrastructure Audit service automatically records calls to all supported Oracle Cloud Infrastructure public application programming interface (API) endpoints as log events. Currently

all services support logging by the Audit service." (Oracle Cloud Infrastructure Documentation

"Overview of the Audit Service

" First paragraph).

3. Oracle Cloud Infrastructure Documentation - Overview of IAM: "Oracle Cloud Infrastructure Identity and Access Management (IAM) service lets you control who can access your cloud resources. You can control what type of access a group of users has and to which specific resources." (Oracle Cloud Infrastructure Documentation

"Overview of IAM

" Section: How IAM Works).

4. Oracle Cloud Infrastructure Documentation - Overview of Networking: "A VCN is a customizable

software-defined network that you set up in an Oracle Cloud Infrastructure region. Like a traditional data center network

a VCN gives you complete control over your network environment." (Oracle Cloud Infrastructure Documentation

"Overview of Networking

" Section: Virtual Cloud Networks).

A Route Table in Oracle Cloud Infrastructure (OCI) contains a set of route rules that the Virtual Cloud Network (VCN) virtual router uses to determine where to send network traffic. Each rule specifies a destination CIDR block and the target (the next hop) for that traffic. The primary function is to direct traffic originating from subnets to destinations outside of the VCN, such as the internet (via an Internet Gateway), an on-premises network (via a Dynamic Routing Gateway), or another VCN (via a Local Peering Gateway).

A. A Dynamic Routing Gateway (DRG) provides the private connection to an on-premises network, not the route table itself. The route table only directs traffic to the DRG.

B. An Internet Gateway is the component that connects a VCN to the public internet. The route table contains a rule to forward internet-bound traffic to this gateway.

D. Security Lists and Network Security Groups (NSGs) define firewall rules to control (allow or deny) traffic flow between subnets and to/from other network endpoints.

1. Oracle Cloud Infrastructure Documentation

"VCN Route Tables": "For a given subnet

you use its route table to control how traffic flows from the subnet to destinations outside the VCN. The VCN's virtual router uses the rules in the table to route the traffic." (This directly supports the correct answer C).

2. Oracle Cloud Infrastructure Documentation

"Overview of Networking": "Route tables: Virtual route tables for your VCN. They have rules to route traffic from subnets to destinations outside the VCN (for example

to the internet

to your on-premises network

or to a peered VCN)." (This further reinforces answer C).

3. Oracle Cloud Infrastructure Documentation

"Security Lists": "Security lists act as virtual firewalls for your compute instances... A security list consists of a set of ingress and egress security rules that specify the types of traffic (protocol and port) allowed in and out." (This clarifies the function described in incorrect option D).

4. Oracle Cloud Infrastructure Documentation

"Internet Gateway" and "Dynamic Routing Gateway (DRG)": These documents define Internet Gateways and DRGs as the specific virtual router components that provide connectivity to the internet and on-premises networks

respectively

distinguishing their roles from that of a route table. (This supports why options A and B are incorrect).

Oracle Cloud Infrastructure (OCI) compartments are a fundamental component for organizing and isolating cloud resources. Their primary purpose is to act as logical containers to which Identity and Access Management (IAM) policies can be applied, thereby controlling access. The service specifically designed for storing and managing encryption keys and secrets is the OCI Vault service. While a vault and its keys reside within a compartment, the compartment itself does not provide the storage or management functionality; it is merely the container for the Vault resource.

A. Compartments are indeed global resources. When a compartment is created, it is available across all regions within the tenancy, allowing for a consistent organizational structure.

B. This describes the core function of compartments. IAM policies are attached to compartments (or the tenancy) to grant specific permissions to groups of users for the resources within that compartment.

D. OCI supports a hierarchical structure by allowing compartments to be nested up to six levels deep. This enables a granular organization of resources that can mirror a company's internal structure.

1. Oracle Cloud Infrastructure Documentation

"Managing Compartments": This document states

"Compartments are tenancy-wide

across all regions." It also details the process of creating nested compartments

confirming

"You can create subcompartments in compartments to create a hierarchy up to six levels deep."

Source: Oracle Cloud Infrastructure Documentation

Service: Identity and Access Management

Section: Managing Compartments.

2. Oracle Cloud Infrastructure Documentation

"Overview of Vault": This source clarifies the function of the Vault service

distinguishing it from compartments. It states

"Oracle Cloud Infrastructure Vault is a managed service that lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to access resources."

Source: Oracle Cloud Infrastructure Documentation

Service: Security > Vault

Section: Overview of Vault.

3. Oracle Cloud Infrastructure Documentation

"How Policies Work": This document explains the relationship between IAM policies and compartments. It specifies

"You can attach a policy to a compartment or the tenancy. Where you attach it controls who can then modify it or delete it." This confirms that policies are applied to compartments to control access.

Source: Oracle Cloud Infrastructure Documentation

Service: Identity and Access Management

Section: How Policies Work.

Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) is the primary service for controlling access to OCI resources. Policies are the core mechanism used to enforce this control. An administrator writes a policy statement that grants a specific group of users a set of permissions (e.g., manage, read, use) on certain resource types (e.g., all-resources, instance-family) within a designated compartment. This method provides precise, fine-grained control, directly fulfilling the requirement to limit a group's management capabilities to a specific compartment.

B. OCI Cloud Guard is a security posture management service that detects and responds to misconfigurations and threats. It does not grant or define user access permissions.

C. A Network Security Group (NSG) is a virtual firewall that controls network traffic to and from resources like compute instances. It operates at the network layer, not the user identity and access layer.

D. Dynamic Groups are used for grouping OCI resources (e.g., compute instances), not users. They allow resources to make API calls to other services, which is different from user access control.

1. Oracle Cloud Infrastructure Documentation

"Overview of IAM". This document states

"You control access by creating policies. A policy is a document that specifies who can access which Oracle Cloud Infrastructure resources

and how." It further explains that policies are attached to compartments.

2. Oracle Cloud Infrastructure Documentation

"How Policies Work". This section details the policy syntax: Allow group to in compartment . This syntax directly demonstrates how to grant a group permissions within a specific compartment

which is the core of the question.

3. Oracle Cloud Infrastructure Documentation

"Overview of Cloud Guard". This document describes Cloud Guard's function: "Cloud Guard is an Oracle Cloud Infrastructure native service that helps customers monitor

identify

achieve

and maintain a strong security posture... It is not an access control mechanism for users."

4. Oracle Cloud Infrastructure Documentation

"Network Security Groups". This source clarifies

"Network security groups (NSGs) act as a virtual firewall for your compute instances and other kinds of resources... An NSG consists of a set of ingress and egress security rules that apply only to a set of VNICs of your choice in a single VCN." This confirms its role in network traffic control

not user permissions.

5. Oracle Cloud Infrastructure Documentation

"Managing Dynamic Groups". The documentation specifies

"A dynamic group is a group of OCI instances that match rules you define... You can then create policies to permit instances in the dynamic group to make API calls against Oracle Cloud Infrastructure services." This confirms dynamic groups are for resources

not users.

Security Lists and Subnets are fundamental components of an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN). Security Lists act as virtual firewalls for subnets, defining stateful ingress and egress rules that control traffic at the packet level, thereby establishing the core security posture. Subnets are required subdivisions of a VCN's IP address space that enable the logical segmentation of the network. They dictate the connectivity model (public or private) for the resources within them, forming the essential connectivity framework of the VCN.

B. Object Storage: This is a storage service for unstructured data and is not a foundational component for defining the VCN's network connectivity or security rules.

D. Instance Pools: This is a feature of the OCI Compute service used for managing the lifecycle of multiple instances, not for VCN networking or security.

E. Block Volume Service: This provides persistent block-level storage for compute instances and does not play a direct role in the VCN's security or connectivity architecture.

1. Oracle Cloud Infrastructure Documentation

"Overview of VCNs and Subnets": This document states

"A VCN is a customizable

software-defined network that you set up in an Oracle Cloud Infrastructure region... When you create a VCN

you assign a contiguous IPv4 CIDR block of your choice. You can subdivide the VCN's address range into one or more smaller address ranges called subnets." This establishes subnets as a core part of the connectivity framework.

2. Oracle Cloud Infrastructure Documentation

"Security Lists": This source defines the service's role: "A security list acts as a virtual firewall for a subnet

with a set of ingress and egress security rules that apply to all the VNICs in that subnet... Security lists are a key part of the VCN security posture." This confirms the role of Security Lists in VCN security.

3. Oracle Cloud Infrastructure Documentation

"Networking": In the core networking overview

VCNs are described with their key components: "The virtual cloud network (VCN) is the centerpiece of your network in Oracle Cloud Infrastructure. It is a virtual

private network that you set up in Oracle data centers... Key components of a VCN include subnets

route tables

security lists

gateways

and DNS." This explicitly lists Subnets and Security Lists as key components.

Under the Oracle Cloud Infrastructure (OCI) Shared Security Responsibility Model, security is a partnership between Oracle and the customer. Oracle is responsible for the security of the cloud, which includes the physical data centers, host infrastructure, and the underlying network. The customer is responsible for security in the cloud.

This includes configuring network-level security controls like Security Groups and Network Access Control Lists (ACLs) to control traffic flow to their resources. Additionally, the customer is responsible for protecting their data, which involves implementing and managing data encryption for data in transit and at rest, ensuring their applications and connections use secure protocols like TLS.

B. OCI Platform Compliance Audits: Oracle is responsible for the compliance and audits of its own cloud platform and infrastructure, providing customers with attestation reports.

C. Patch Management of the OCI Hypervisor: The hypervisor is part of the core virtualization infrastructure, and its security and patching are solely Oracle's responsibility.

D. Physical Security of Cloud Infrastructure: Securing the physical data centers, including access control and environmental protections, is a fundamental responsibility of Oracle as the cloud provider.

1. Oracle Cloud Infrastructure Documentation

Security

"Overview of Security": This document outlines the shared model. It states

"You are responsible for securely configuring network elements such as virtual networks

subnets

gateways

and firewalls." This directly supports option A. It also states

"You are responsible for data classification

data encryption

and backups

" which supports option E.

Reference: Oracle Cloud Infrastructure Documentation > Security > Overview of Security > Shared Security Responsibility Model section.

2. Oracle Cloud Infrastructure Security Guide: This guide details the security approach. In the "Security Responsibilities" section

it clearly delineates tasks. Customer responsibilities include "Network Controls" (like Security Lists and Network Security Groups) and "Data Classification and Compliance

" which encompasses managing data encryption. Oracle's responsibilities are listed as "Physical Security

" "Host Infrastructure Security" (including the hypervisor)

and "Network Infrastructure Security."

Reference: Oracle Cloud Infrastructure Security Guide PDF

"Security Responsibilities" chapter

pages 6-8.

OCI Identity and Access Management (IAM) policies can include a where clause to specify conditions. This feature allows administrators to enforce more granular security by restricting access based on variables within the request context. For example, a policy can be written to only permit access from a specific range of IP addresses or require that the user has authenticated using multi-factor authentication (MFA). This directly implements an additional layer of security by ensuring that permissions are only granted when specific, verifiable conditions are met.

B. Users: Users are IAM principals (identities) that are granted permissions through policies; they are not the feature that defines conditional access rules.

C. Federation: Federation manages user identities from an external provider (e.g., Azure AD) but does not itself define the conditional logic for resource access within OCI policies.

D. Groups: Groups are collections of users for simplifying permission management. Policies are applied to groups, but the groups themselves do not contain conditional logic.

1. Oracle Cloud Infrastructure Documentation

"Policy Syntax": This document details the components of an IAM policy statement

including the where clause for conditions. It states

"You can add conditions to your policies to narrow the scope of the policy statement... A condition consists of one or more variables."

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Policies > Policy Syntax

Section: "Conditions".

2. Oracle Cloud Infrastructure Documentation

"How Policies Work": This guide explains the core concepts of IAM policies. It describes how policies grant permissions and mentions the use of conditions for more specific control.

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Policies > How Policies Work

Section: "Policy Attachment".

3. Oracle Cloud Infrastructure Documentation

"Overview of Identity and Access Management": This overview defines the core components of IAM

clearly distinguishing between principals (Users

Groups)

policies

and other features like Federation.

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Overview of IAM

Sections: "Principals"

"Policies"

"Federation".

The Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) is the fundamental networking service for OCI. It is a software-defined, private network that you set up in OCI data centers. A VCN provides complete control over your network environment, including assigning your own private IP address space, creating subnets, configuring route tables, and setting up various gateways (like Internet Gateway, NAT Gateway, and Dynamic Routing Gateway) to connect to other networks. This directly matches all the capabilities described in the question. Options B and E are identical and therefore both are correct.

A. OCI Object Storage: This is a high-performance storage platform for unstructured data. It does not create or manage virtual networks.

C. OCI Identity and Access Management (IAM): This service controls who has access to your cloud resources and what actions they can perform; it is not a networking service.

D. OCI Load Balancer: This service distributes network traffic to multiple backend servers. It operates within a VCN but is not the service used to create the VCN itself.

1. Oracle Cloud Infrastructure Documentation

"Overview of Networking": "A VCN is a virtual

private network that you set up in Oracle data centers. It is a software-defined network that closely resembles a traditional network

with firewall rules and specific types of communication gateways that you can choose to use."

2. Oracle Cloud Infrastructure Documentation

"VCNs and Subnets": "A VCN covers a single

contiguous IPv4 CIDR block of your choice... You can subdivide the VCN into one or more subnets... For each subnet

you create a route table with rules that determine how traffic is directed out of the subnet."

3. Oracle Cloud Infrastructure Documentation

"Gateways": This section details the various gateways (Internet Gateway

NAT Gateway

Dynamic Routing Gateway

Service Gateway

Local Peering Gateway) that are components of a VCN

enabling connectivity to the internet

on-premises networks

and other services.

The Oracle Cloud Infrastructure (OCI) Universal Credits model is a flexible prepayment plan. Customers purchase a block of credits, often with an annual commitment, which can then be used as a universal currency to pay for any eligible OCI Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) offering. This provides the flexibility to switch between different services and regions without needing to change contracts, consuming credits based on actual usage of the various services.

A. This describes the "Pay As You Go" (PAYG) model, which is a separate pricing option that does not typically involve prepaid credits or an upfront commitment.

C. This describes a fixed resource bundle or a non-flexible package, which is contrary to the core principle of Universal Credits that allows for flexible consumption across all services.

D. This is incorrect because different OCI services have distinct prices. Universal Credits is a payment method, not a flat-rate pricing structure for all services.

1. Oracle Cloud Infrastructure Documentation

"Oracle Cloud Pricing": Under the "Universal Credits (Annual Flex)" section

it states

"Commit to an annual amount of Universal Credits... Use credits for any eligible IaaS or PaaS cloud service in any region." This directly supports the concept of using prepaid credits for any service.

Source: Oracle.com

Cloud Pricing Page.

2. Oracle PaaS and IaaS Universal Credits Service Descriptions Document: In Section 1

"Description

" the document specifies

"Oracle PaaS and IaaS Universal Credits provides You with access to the Oracle PaaS and IaaS Cloud Services... You may provision and use any of the Oracle PaaS and IaaS Cloud Services against the single pool of credits purchased."

Source: Oracle Contracts

"Oracle PaaS and IaaS Universal Credits Service Descriptions

" Page 1

Section 1.

3. Oracle Cloud Infrastructure Documentation

"Frequently Asked Questions for Oracle Universal Credits": In response to "What is Universal Credits?"

the documentation states

"Oracle Universal Credits is the most flexible way to buy and consume cloud services. With Universal Credits

you have one simple contract that provides unlimited access to all current and future Oracle PaaS and IaaS services..."

Source: Oracle.com

Cloud Economics FAQ.

A fault domain is a grouping of hardware and infrastructure, such as racks and power distribution units, within a single Oracle Cloud Infrastructure (OCI) Availability Domain. Each Availability Domain contains three fault domains. Their primary purpose is to provide anti-affinity, allowing you to distribute your application's instances across different physical hardware. This design ensures that a hardware failure or maintenance event affecting one fault domain does not impact instances running in the other fault domains, thereby increasing the application's resilience and availability.

A. This is the opposite of a fault domain's purpose. Placing instances on the same hardware creates a single point of failure, which fault domains are designed to prevent.

C. The low-latency, high-bandwidth network connects Availability Domains within a region, but this is not the function of fault domains, which operate within a single Availability Domain.

D. Encryption of traffic is a network security feature managed through services like Network Security Groups and the underlying OCI network fabric, not a function of fault domains.

1. Oracle Cloud Infrastructure Documentation. (2024). Regions and Availability Domains. Oracle. Retrieved from https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm.

Reference Details: In the section "Fault Domains

" the documentation states

"A fault domain is a grouping of hardware and infrastructure within an availability domain... Fault domains provide anti-affinity: they let you distribute your instances so that they are not on the same physical hardware within a single availability domain."

2. Oracle Cloud Infrastructure Documentation. (2023). Best practices for your cloud topology. Oracle. Retrieved from https://docs.oracle.com/en/solutions/oci-best-practices/index.html.

Reference Details: In the section "Design for failure

" it recommends

"Within an AD

use fault domains to protect against unexpected hardware failures or planned outages for maintenance. A fault domain is a logical grouping of hardware that provides high availability."

Oracle Cloud Infrastructure (OCI) is architected around geographically isolated regions. Each region is a separate geographic area that operates independently and is completely isolated from other regions. This intentional isolation is a core design principle for achieving high availability and fault tolerance. By deploying applications across multiple regions, an organization can design a disaster recovery strategy that protects against large-scale, region-wide events, thereby enhancing global resilience and ensuring service continuity.

A. OCI regions contain a finite number of availability domains (typically one or three), not an unlimited number. The concept of "infinite scalability" is an overstatement.

B. Regions are intentionally isolated, not interconnected to share resources for automatic compensation. Cross-region connectivity must be explicitly configured for disaster recovery, but they do not inherently share resources.

C. Availability domains are designed to be isolated from each other within a region, with independent power, cooling, and networking to prevent single points of failure. They do not share these critical resources.

1. Oracle Cloud Infrastructure Documentation

"Regions and Availability Domains": "An Oracle Cloud Infrastructure region is a localized geographic area... Regions are independent of other regions and can be separated by vast distances—across countries or even continents." This statement directly supports the concept of region isolation for fault tolerance (Answer D). The document also clarifies

"A region is composed of one or more availability domains

" refuting the "unlimited" claim in option A.

2. Oracle Cloud Infrastructure Documentation

"Resilience in Oracle Cloud Infrastructure": "Availability domains are isolated from each other

are fault tolerant

and are very unlikely to fail simultaneously... Because the availability domains do not share physical infrastructure

such as power or cooling

or the internal availability domain network

a failure that impacts one availability domain is unlikely to impact the availability of the others." This directly refutes the idea of shared resources for cost efficiency as stated in option C.

The most critical first step after gaining access to a new Oracle Cloud Infrastructure (OCI) tenancy is to secure the administrative access itself. The initial user has extensive permissions, and protecting this account is paramount. Enabling Multi-Factor Authentication (MFA) adds a vital second layer of security, ensuring that even if a password is compromised, unauthorized access is prevented. This foundational action secures the primary control plane of the tenancy before any resources are provisioned or configurations are made, aligning with security best practices for cloud environments.

B. Deploying applications is a functional step that should only occur after the environment's foundational security controls are in place.

C. Allocating budgets is a crucial cost management and governance task, but it does not secure the account from unauthorized access, which is the primary security concern.

D. Creating a Virtual Cloud Network (VCN) is a prerequisite for deploying most resources, but securing administrative access with MFA should precede any resource creation.

1. Oracle Cloud Infrastructure Documentation

"Securing IAM": In the section "Use Multi-Factor Authentication (MFA)

" the documentation states

"Oracle strongly recommends that you require multi-factor authentication (MFA) for all users. With MFA enabled

users are required to provide a time-based one-time password in addition to their user name and password to sign in to the Console." This highlights MFA as a fundamental and strongly recommended security measure.

2. Oracle Cloud Infrastructure Security Guide

Section 2.2 "Securing Your Tenancy": This guide outlines the initial steps for securing a new tenancy. It emphasizes securing the default administrator account and creating new users and groups with appropriate permissions

a process where enabling MFA is a critical component for establishing a strong security posture from the start.

3. Oracle Cloud Infrastructure Documentation

"Getting Started with OCI"

Section "Set Up Your Tenancy": This guide for new users details the initial administrative tasks. Securing user access is presented as a primary step before proceeding to create network resources or deploy applications. The section on managing users implicitly and explicitly directs administrators to enforce strong authentication policies like MFA.

Oracle Autonomous Database is a fully managed cloud database service that uses machine learning to automate database administration tasks. It is designed to be "self-driving," "self-securing," and "self-repairing." This includes automating database provisioning, scaling compute and storage independently without downtime, and managing backups. Its core features include using artificial intelligence to monitor and tune workloads automatically, as well as applying security patches and updates with no service interruption. This comprehensive automation, driven by AI, directly aligns with all the capabilities mentioned in the question.

A. OCI MySQL Database Service is a managed service for MySQL, but it lacks the advanced AI-driven self-tuning and fully autonomous management capabilities characteristic of the Autonomous Database.

C. OCI Virtual Cloud Network (VCN) is a foundational networking service for creating and managing private networks in OCI; it is not a database service.

D. OCI NoSQL Database Cloud Service is a managed service for NoSQL databases. While it automates provisioning and scaling, it does not include the specific AI-based autonomous tuning features.

1. Oracle Cloud Infrastructure Documentation

"What Is Autonomous Database?": "Oracle Autonomous Database is a fully managed

preconfigured database environment... Autonomous Database handles creating the database

backing up the database

patching and upgrading the database

and growing or shrinking the database." It further describes the self-driving capabilities that automate database tuning and management.

2. Oracle Cloud Infrastructure Documentation

"Overview of Autonomous Database": "Autonomous Database is a cloud database that uses machine learning to automate database tuning

security

backups

updates

and other routine management tasks traditionally performed by DBAs." This explicitly confirms the use of machine learning (AI) for automation.

3. Oracle Cloud Infrastructure Documentation

"Overview of the MySQL Database Service": This document describes the MySQL service as a fully managed service that automates tasks like backup and recovery

but it does not mention the AI-driven

self-tuning capabilities that define the Autonomous Database.

4. Oracle Cloud Infrastructure Documentation

"Overview of the VCN": This source defines a VCN as "a customizable

software-defined network that you set up in an Oracle Cloud Infrastructure region

" confirming it is a networking service

not a database.

Oracle Cloud Infrastructure (OCI) Cloud Guard and Identity and Access Management (IAM) are foundational security services. OCI Cloud Guard is a cloud security posture management (CSPM) service that continuously monitors an OCI tenancy for security misconfigurations and risky activities, providing automated remediation. OCI Identity and Access Management (IAM) is the core service for controlling access to all OCI resources. It manages authentication and authorization through policies, users, and groups, ensuring that only authorized entities can perform specific actions, which is a cornerstone of a strong security posture.

A. OCI FastConnect is a networking service that provides a private, dedicated connection to OCI, not a service specifically for managing security posture.

B. OCI Compute Service is an infrastructure service for provisioning and managing virtual machine instances, not a dedicated security service.

D. OCI Block Volume is a storage service that provides persistent block-level storage for compute instances, not a security management tool.

1. Oracle Cloud Infrastructure Documentation

"Overview of Cloud Guard": "Oracle Cloud Guard is a cloud-native service that helps customers monitor

identify

achieve

and maintain a strong security posture on Oracle Cloud. Use the service to examine your Oracle Cloud Infrastructure resources for security weakness related to configuration

and your Oracle Cloud Infrastructure operators and users for risky activities." (Document ID: E97345-21

Section: "Overview of Cloud Guard")

2. Oracle Cloud Infrastructure Documentation

"Overview of Identity and Access Management": "Oracle Cloud Infrastructure Identity and Access Management (IAM) service lets you control who has access to your cloud resources. You can control what type of access a group of users has and to which specific resources." (Document ID: E97345-21

Section: "Overview of Identity and Access Management")

3. Oracle Cloud Infrastructure Documentation

"Overview of FastConnect": "Oracle Cloud Infrastructure FastConnect provides an easy way to create a dedicated

private connection between your data center and Oracle Cloud Infrastructure." (Document ID: E97345-21

Section: "Overview of FastConnect")

4. Oracle Cloud Infrastructure Documentation

"Overview of the Compute Service": "The Oracle Cloud Infrastructure Compute service lets you provision and manage compute hosts

known as instances." (Document ID: E97345-21

Section: "Overview of the Compute Service")

Oracle Cloud Guard is OCI's native cloud security posture management (CSPM) service. It provides a centralized and unified view of the security posture for an entire tenancy. Cloud Guard continuously monitors OCI resources and activities for security misconfigurations and threats using detector recipes. When a problem is identified, it can trigger responder recipes to automatically remediate the issue, such as stopping an instance or revoking user permissions. This aligns perfectly with the requirement for a centralized platform for automated detection and remediation across all OCI assets.

A. Web Application Firewall (WAF): WAF is a service that protects web applications from malicious HTTP/S traffic at the application layer, not a centralized platform for all OCI assets.

B. Identity and Access Management (IAM): IAM is a foundational service for controlling access to resources through authentication and authorization, not a platform for detecting and remediating threats.

C. Vault: Vault is a key management and secrets management service used for data protection, not for monitoring security posture or remediating threats across the tenancy.

1. Oracle Cloud Infrastructure Documentation

"Overview of Cloud Guard."

"Oracle Cloud Guard is a cloud-native service that helps customers monitor

identify

achieve

and maintain a strong security posture on Oracle Cloud... Cloud Guard detects misconfigured resources and insecure activity across your tenancy and provides security administrators with the visibility to triage and resolve cloud security issues. Once detected

Cloud Guard can suggest

assist

or take corrective actions to remediate the issues based on your configuration."

2. Oracle Cloud Infrastructure Documentation

"Overview of Web Application Firewall (WAF)."

"Oracle Cloud Infrastructure Web Application Firewall (WAF) is a cloud-based

Payment Card Industry (PCI) compliant

global security service that protects applications from malicious and unwanted internet traffic." This confirms its scope is limited to web applications.

3. Oracle Cloud Infrastructure Documentation

"Overview of Identity and Access Management."

"Oracle Cloud Infrastructure Identity and Access Management (IAM) service lets you control who can access your cloud resources." This defines its role as an access control mechanism.

4. Oracle Cloud Infrastructure Documentation

"Overview of Vault."

"Oracle Cloud Infrastructure Vault is a key management service that stores and manages master encryption keys and secrets for secure access to resources." This specifies its function is managing cryptographic materials.

Relying solely on Availability Domains (ADs) is a high-availability (HA) strategy, not a disaster recovery (DR) strategy for a regional outage. ADs are physically separate, fault-isolated data centers located within the same OCI region. While this design protects against the failure of a single AD, it offers no protection if the entire region becomes unavailable. A robust DR plan for a regional outage fundamentally requires using a second, geographically distinct OCI region to host redundant resources and replicated data.

A. Backup and restore is a valid DR pattern (e.g., Pilot Light, Cold Standby) recommended for workloads that can tolerate higher recovery time objectives (RTO).

C. Creating redundant application instances in multiple regions is a primary strategy for achieving low RTO/RPO in an active-passive or active-active DR configuration.

D. Cross-region replication for services like Block Volume, Object Storage, and Autonomous Database is a critical component for protecting data against a regional failure.

1. Oracle Cloud Infrastructure Documentation

"Regions and Availability Domains": "An availability domain is one or more data centers located within a region... Use multiple availability domains to ensure high availability... To protect your applications from a regional failure

you can create a disaster recovery solution by using cross-region features." This source directly contrasts the use of ADs for HA with the need for cross-region solutions for DR.

2. Oracle Cloud Infrastructure Documentation

"Disaster Recovery in the Cloud": Under the section "Disaster Recovery Topologies

" the document states

"A region is a localized geographic area

and an availability domain is one or more data centers located within a region... A disaster recovery solution requires at least two regions." This explicitly states that DR requires more than one region

making a single-region

multi-AD strategy insufficient.

3. Oracle Cloud Infrastructure Documentation

"Best practices for your cloud topology": In the section "Plan for disaster recovery

" it advises

"To ensure that your solution is resilient to the failure of an entire region

we recommend that you deploy in multiple regions... Don't rely on backups in the same region." This reinforces that single-region strategies

including those relying only on ADs

are not sufficient for DR.

The Oracle Cloud Infrastructure (OCI) Compute service offers several types of instances to meet various performance and isolation requirements. These include Bare Metal instances, which provide dedicated physical server access; Virtual Machine (VM) instances, which are standard multi-tenant virtualized environments; and Dedicated Virtual Machine Hosts, which allow customers to run VMs on single-tenant, dedicated physical servers. The term "Nano instance" is not an official instance type or shape classification within the OCI Compute service. While OCI offers various instance shapes with different resource allocations, none are designated as "Nano."

A. Virtual Machine is a core offering of the OCI Compute service, providing standard virtualized compute environments on shared hardware.

B. Bare Metal instances are a key differentiator for OCI, offering customers direct, non-virtualized access to physical server hardware.

C. Dedicated Virtual Machine Host is an OCI feature that provides single-tenant hardware for running virtual machine instances with enhanced isolation.

1. Oracle Cloud Infrastructure Documentation. (2024). Overview of Compute. Oracle. Retrieved from https://docs.oracle.com/en-us/iaas/Content/Compute/Concepts/computeoverview.htm. (In the "Compute Instances" section

the document explicitly lists Bare Metal

Virtual Machine

and Dedicated Virtual Machine Host as the primary instance types.)

2. Oracle Cloud Infrastructure Documentation. (2024). Compute Shapes. Oracle. Retrieved from https://docs.oracle.com/en-us/iaas/Content/Compute/References/computeshapes.htm. (This document details the available shapes for VM and Bare Metal instances

and the term "Nano" is not used.)

3. Oracle Cloud Infrastructure Documentation. (2024). Dedicated Virtual Machine Hosts. Oracle. Retrieved from https://docs.oracle.com/en-us/iaas/Content/Compute/Concepts/dedicatedvmhosts.htm. (This page provides a detailed description of the Dedicated Virtual Machine Host offering

confirming it as a valid type.)

The Oracle Cloud Infrastructure (OCI) Load Balancing service is the correct feature for this task. It automatically distributes traffic from a single entry point to multiple backend servers, which can be located in different availability domains within a region. This architecture is fundamental for building fault-tolerant applications. If one availability domain experiences an outage, the load balancer can redirect traffic to the healthy servers in the other availability domains, ensuring high availability and continuous service for end-users.

A. Virtual Cloud Network (VCN) Peering is used to connect two VCNs, enabling private traffic flow between them. It does not distribute incoming application traffic.

B. Route Tables contain rules that direct network traffic from subnets to destinations like gateways or other VCNs. They manage network paths, not application load distribution.

C. An Internet Gateway provides a path for network traffic between a VCN and the public internet. It is a connectivity component, not a traffic distribution mechanism.

1. Oracle Cloud Infrastructure Documentation

"Overview of Load Balancing": "A load balancer improves resource utilization

facilitates scaling

and helps ensure high availability. ... You can distribute traffic across your instances within an availability domain or across availability domains

ensuring that your applications are highly available." (Section: How Load Balancing Works)

2. Oracle Cloud Infrastructure Documentation

"Load Balancer Concepts": "To ensure that your service remains available

you can distribute your backend servers across multiple availability domains. When a load balancer's health check policy detects an unhealthy backend server

it stops sending traffic to that server." (Section: High Availability)

3. Oracle Cloud Infrastructure Documentation

"VCN Peering": "VCN peering is the process of connecting multiple virtual cloud networks (VCNs). With a peering

the VCNs can communicate with each other using private IP addresses without the traffic traversing the internet or your on-premises network." (Section: VCN Peering)