Oracle 1Z0-1072-26 Real Exam Questions [October 2026 Update]

The Security Lists versus Network Security Groups distinction is where the largest concentration of OCI Architect Associate exam failures occur – not because Security Lists are unfamiliar, but because candidates who have studied both understand each one in isolation without clearly understanding when the exam expects each to be recommended and why. Both control inbound and outbound network traffic in OCI. Both use allow-rules (OCI denies traffic by default – rules open specific traffic, never block it). The operational difference is the scope at which each applies.

Security Lists apply to all VNICs in a subnet – every resource in the subnet inherits every Security List rule attached to that subnet. A Security List rule opening port 443 inbound applies to every instance in the subnet regardless of whether a specific instance needs that access. Network Security Groups apply at the VNIC level – individual resources are added to specific NSGs and receive only those NSGs’ rules. An NSG opening port 443 applies only to the resources that have been explicitly added to that NSG, leaving all other resources in the same subnet unaffected.

The exam tests this distinction in HA and security design scenarios: “A subnet contains both web servers and application servers. The web servers must allow inbound HTTPS from the internet; the application servers must not. Which security mechanism correctly implements this?” Security Lists cannot implement this – a Security List rule opening the subnet to HTTPS applies to every instance in the subnet including the application servers. NSGs implement it correctly – a separate NSG for web servers allows HTTPS; application servers are not in that NSG. Candidates who have only studied the two mechanisms individually and not practised this scenario-comparison question type will select Security Lists for scenario questions that require NSG granularity.

Exam Snapshot

Six Domain Weights

Domain 1: Identity and Access Management (IAM)

Identity Domains are the IAM tenant management boundary in OCI. Every OCI tenancy has a Default Identity Domain that contains the root compartment’s IAM configuration. Additional identity domains can be created for different user populations or with different authentication policies.

Compartments are logical containers that group related OCI resources for access control and cost management. All OCI resources live in exactly one compartment. Compartments can be nested – a parent compartment can contain child compartments. IAM policies apply to compartments.

IAM policies control what actions users and groups can perform on OCI resources. Policy syntax: Allow group <GroupName> to <verb> <resource-type> in compartment <CompartmentName>. Verbs in ascending order of permission: inspect (list resources), read (list and read resource details), use (list, read, and perform most actions on existing resources), manage (full control including create and delete). The exam tests which verb is required for a described user capability requirement.

Dynamic Groups allow OCI resource instances themselves (compute instances, Functions, API Gateway) to be granted IAM policies – enabling OCI services to call other OCI services without embedding user credentials. The exam tests Dynamic Groups as the correct approach for service-to-service authorization within OCI.

Domain 2: Networking (24% – Largest Domain)

Virtual Cloud Network (VCN) is OCI’s software-defined private network. A VCN is created in one OCI region and has a CIDR block (e.g., 10.0.0.0/16). Within the VCN, subnets subdivide the address space – each subnet is created in one or more Availability Domains (Regional subnets span all ADs in the region; AD-specific subnets exist in one AD only). The exam tests regional vs. AD-specific subnets and when each is appropriate.

Route Tables direct traffic out of subnets to gateways. Each subnet has one Route Table. Route rules specify a destination CIDR and a target gateway – traffic matching the destination exits through the specified gateway.

Internet Gateway provides a two-way path between VCN resources with public IP addresses and the public internet. Requires the subnet’s Route Table to have a route pointing 0.0.0.0/0 to the Internet Gateway.

NAT Gateway provides one-way outbound internet access for resources in private subnets – resources can initiate outbound connections to the internet but cannot receive unsolicited inbound connections. The exam tests Internet Gateway vs. NAT Gateway: Internet Gateway is for public-facing resources that need to receive inbound traffic; NAT Gateway is for private resources that need only outbound internet access.

Service Gateway routes traffic from a VCN to Oracle services (Object Storage, Autonomous Database) over Oracle’s internal backbone network rather than the public internet – eliminating the need for public IPs or NAT for these service calls.

Local VCN Peering connects two VCNs in the same region – resources in each VCN can communicate privately using private IP addresses. Requires a Local Peering Gateway in each VCN and matching route rules.

Remote VCN Peering connects VCNs in different OCI regions through Oracle’s backbone network. Requires Remote Peering Connection (DRG-based in current OCI) in each VCN.

FastConnect is OCI’s private, dedicated network connectivity service – a physical circuit (or partner-provided virtual circuit) providing private, high-bandwidth, low-latency connectivity between an on-premises network and OCI. The exam tests FastConnect vs. Site-to-Site VPN: FastConnect is dedicated private circuit connectivity with consistent latency; Site-to-Site VPN is encrypted internet-based connectivity with variable latency.

Load Balancer vs. Network Load Balancer:

OCI Load Balancer operates at Layer 7 (HTTP/HTTPS) – understands HTTP headers, supports SSL termination, URL path routing, and session persistence. Appropriate for web application load balancing.

OCI Network Load Balancer operates at Layer 4 (TCP/UDP) – forwards connections at the packet level without inspecting HTTP content. Higher throughput, lower latency, preserves source IP. Appropriate for non-HTTP traffic, very high-volume applications, and scenarios requiring source IP preservation.

Security Lists vs. Network Security Groups (the most tested Networking distinction – see the hook section for full analysis): Security Lists apply to all resources in a subnet; NSGs apply to individually selected VNICs. Use NSGs when different resources in the same subnet need different security rules.

Domain 3: Compute (14%)

Compute shapes define the number of OCPUs, amount of memory, and networking bandwidth for a compute instance. Shape families: Standard (general purpose), DenseIO (local NVMe storage for high-IOPS workloads), HPC (high-performance computing with RDMA networking), GPU (for AI/ML and graphics workloads), Optimized (high-frequency CPU for single-threaded workloads). Flexible shapes (Standard and Optimized) allow OCPU and memory to be selected independently within defined limits.

Bare Metal vs. Virtual Machine instances: Bare Metal gives the entire physical server to one tenant – maximum performance, no hypervisor overhead. VM instances run on shared physical hardware managed by OCI’s hypervisor – flexible, fast to provision, appropriate for most workloads.

Compute instance configuration: The exam tests boot volume selection (custom images, platform images), instance metadata service (IMDS) for retrieving instance configuration from within the instance, cloud-init for boot-time configuration scripting, and SSH key pair configuration for secure access.

Autoscaling: Instance pools provide a managed group of instances launched from a shared configuration. Autoscaling policies scale the instance pool’s size in response to metric thresholds (CPU utilisation, memory) or on a schedule. The exam tests when autoscaling is the correct solution – workloads with variable demand that need elastic compute capacity.

Domain 4: Storage (20%)

Block Volume is persistent, durable block storage attached to a compute instance – behaves like a local disk but persists independently of the instance’s lifecycle. Detachable and re-attachable to different instances. Appropriate for databases, file systems, and any application requiring a mounted disk.

Block Volume performance tiers: Lower Cost (for cold data), Balanced (default general-purpose), Higher Performance, Ultra-High Performance. The exam tests performance tier selection by IOPS and throughput requirements.

Boot Volume is the block volume containing the instance’s operating system. Boot volumes persist after instance termination – an instance can be restarted from its boot volume without data loss.

Object Storage is OCI’s scalable, S3-compatible object store. No filesystem – data is stored as objects in buckets, accessed via REST API. Three tiers: Standard (frequently accessed data, immediate access), Infrequent Access (lower cost, minimum 31-day storage commitment), Archive (lowest cost, objects must be restored before access, 1-hour restore time). The exam tests tier selection by access frequency and retrieval latency requirements.

File Storage provides a managed NFS file system that multiple compute instances can mount simultaneously – appropriate for shared file access scenarios (web content, application binaries shared across a cluster, lift-and-shift of NFS-dependent workloads). File Storage uses mount targets as the network access point – a mount target must be in the same subnet as or reachable from the instances that will mount the file system.

Domain 5: Database (14%)

Autonomous Database is Oracle’s self-driving, self-securing, self-repairing database. Two workload types: Autonomous Data Warehouse (ADW – optimised for analytics queries: parallel processing, columnar format, no index management required) and Autonomous Transaction Processing (ATP – optimised for mixed OLTP and analytics workloads).

Dedicated vs. Shared Exadata Infrastructure:

Autonomous Database Shared (default) runs on Oracle-managed Exadata infrastructure shared with other tenants – fastest to provision, no infrastructure management required.

Autonomous Database Dedicated runs on customer-dedicated Exadata Cloud infrastructure – complete isolation, customisable maintenance windows and database configurations, appropriate for strict compliance or performance isolation requirements.

DB Systems are Oracle Database deployments on compute instances managed by OCI – supporting Oracle Database Enterprise Edition with features like Real Application Clusters (RAC) for high availability across multiple instances and Data Guard for disaster recovery with automatic failover. DB Systems provide more customisation control than Autonomous Database.

Exadata Cloud Infrastructure is Oracle’s Exadata hardware hosted in OCI data centres – the highest-performance database infrastructure, supporting all Oracle Database features including In-Memory, Multitenant, and all performance options.

Domain 6: Observability and Management

Monitoring collects time-series metrics from OCI services automatically – CPU utilisation, network throughput, disk IOPS, and many others without requiring any agent installation. Metric queries use MQL (Monitoring Query Language) to filter, aggregate, and visualise metric data. Alarms notify specified endpoints (email, PagerDuty, OCI Notifications) when metrics cross defined thresholds.

Logging ingests log data from OCI services (audit logs, VCN flow logs, service logs) and custom application sources. Log groups organise related log sources. Log retention and archiving policies control how long logs are kept before moving to Object Storage Archive tier.

Logging Analytics provides ML-powered log analysis – anomaly detection, pattern clustering, and saved search queries across multi-source log ingestion.

OCI Notifications delivers messages to subscribers (email, SMS, HTTPS, PagerDuty, Slack) in response to events or alarm triggers. The exam tests Notifications as the fanout delivery mechanism for alarm alerts and OCI Events-triggered workflows.

5 Study Tips for Oracle 1Z0-1072-26

• Study Security Lists vs. Network Security Groups at the scenario level – practise identifying which mechanism cannot implement a described security requirement and why, not just what each mechanism does.
• Study all three storage types (Block Volume, Object Storage, File Storage) with the access model and use case that distinguishes each – block volume is mounted like a disk, object storage is REST API access, file storage is NFS shared mount.
• Study Object Storage tiers (Standard, Infrequent Access, Archive) with the minimum storage commitment and retrieval latency that make each tier the wrong choice for described access requirements.
• Study the gateway types (Internet Gateway, NAT Gateway, Service Gateway, FastConnect) as route table decisions – for each described traffic flow, know which gateway type belongs in the route table.
• Practice with Cert Empire’s 1Z0-1072-26 exam questions across all six domains with the architecture design scenario format – selecting the right combination of OCI services for described requirements – at the depth the real exam uses.

Best Study Resources

• Cert Empire 1Z0-1072-26 exam questions PDF and practice simulator (October 2026 edition).
• Oracle official OCI Architect Associate exam page (education.oracle.com – search “1Z0-1072-26”).
• Oracle Cloud Infrastructure Documentation (docs.oracle.com/en-us/iaas/Content/home.htm).
• Oracle University: Oracle Cloud Infrastructure Architect Associate course.
• OCI Always Free tier (cloud.oracle.com – hands-on practice with VCN, Compute, Storage, and Autonomous Database at no cost).

Why Candidates Choose Cert Empire for Oracle 1Z0-1072-26 Preparation

Free Practice Tests

Sample our 1Z0-1072-26 questions before purchasing. Test your VCN networking knowledge, storage tier selection reasoning, and IAM policy syntax understanding before committing.

Regular Updates

OCI adds new services and updates existing ones with each quarterly release. Our 1Z0-1072-26 question bank is continuously reviewed against current OCI documentation and official exam objectives.

Free Exam Guides

Every purchase includes our free 1Z0-1072-26 exam guide covering all six domains with their weights, the Security Lists vs. NSG decision framework, storage type comparison, and a structured study plan prioritising Networking and Storage as the two highest-weight domains.

PDF Exam Questions – Study Anywhere, Anytime

Download your 1Z0-1072-26 questions instantly after purchase. Study on any device or print the PDF. No login required after download, no expiry on the file.

24/7 Chat Support

Available at any hour for questions about your materials, your order, or specific OCI architecture concepts – including Security List vs. NSG decisions, gateway type selection, and Autonomous Database tier distinctions.

3 Months of Unlimited Access

Three full months of unlimited access to the 1Z0-1072-26 question bank and simulator. Revisit Networking scenarios, Storage tier selection questions, and IAM policy syntax exercises as many times as needed.

Official Vendor Resources – Learn from the Source

Every solution in our 1Z0-1072-26 question bank links directly to the relevant official Oracle Cloud Infrastructure documentation – the specific OCI service documentation page behind every answer – so every correct answer connects you to the authoritative source.

Deep Knowledge – Every Answer, Every Option, Fully Explained

Every 1Z0-1072-26 question includes a complete explanation covering not just why the correct gateway, security mechanism, or storage tier is right, but precisely why each incorrect option fails – whether Security Lists are recommended where NSG granularity is required, a NAT Gateway is suggested where an Internet Gateway is needed, or Object Storage Standard is selected where Archive tier’s restore delay makes it inappropriate. Each explanation references the specific OCI documentation behind the answer.

Interactive Practice Simulator – Think Like the Exam

Our simulator presents OCI architecture design scenarios exactly as the real 1Z0-1072-26 exam does – describing a workload requirement and testing which combination of VCN components, compute shapes, storage types, and IAM policies correctly satisfies all stated constraints. Per-question feedback explains the full architectural reasoning behind every correct and incorrect option.

Backed by a Full Money-Back Guarantee

If our 1Z0-1072-26 exam questions do not help you pass, you receive a full refund – no questions asked, no conditions.

FAQ’s

What is the Oracle 1Z0-1072-26 certification?

1Z0-1072-26 is the Oracle Cloud Infrastructure 2026 Architect Associate exam. It validates the ability to design and architect solutions on OCI – covering IAM, VCN networking and connectivity, compute instances and autoscaling, Block/Object/File Storage, Oracle databases and Autonomous Database, and OCI Observability and Management.

What is the difference between a Security List and a Network Security Group?

Security Lists apply to all resources in a subnet – every instance in the subnet inherits all Security List rules. Network Security Groups apply to individually selected VNICs – only resources explicitly added to an NSG receive its rules. Use NSGs when different resources in the same subnet need different security rules.

What is the difference between OCI Load Balancer and Network Load Balancer?

OCI Load Balancer operates at Layer 7 (HTTP/HTTPS) – supports SSL termination, URL routing, and session persistence. OCI Network Load Balancer operates at Layer 4 (TCP/UDP) – higher throughput, lower latency, preserves source IP. Use Load Balancer for web application traffic; Network Load Balancer for non-HTTP traffic or source IP preservation requirements.

What is the difference between Object Storage Standard, Infrequent Access, and Archive tiers?

Standard is for frequently accessed data with immediate retrieval. Infrequent Access has a 31-day minimum storage commitment and lower storage cost for data accessed less than once per month. Archive has the lowest storage cost but requires objects to be restored (up to 1 hour) before they can be accessed – appropriate for long-term retention of rarely accessed data.

What is an Autonomous Database in OCI?

Autonomous Database is Oracle’s self-managing, self-securing cloud database that automates provisioning, patching, tuning, and backup. Two workload types: Autonomous Data Warehouse (ADW) for analytics and Autonomous Transaction Processing (ATP) for mixed transactional and analytics workloads. Available on shared Exadata infrastructure (multi-tenant) or dedicated Exadata (single-tenant isolation).

What is a Dynamic Group in OCI IAM?

A Dynamic Group allows OCI resource instances (compute instances, Functions, API Gateway) to be granted IAM permissions – enabling those services to call other OCI APIs without embedding user credentials. The exam tests Dynamic Groups as the correct approach for service-to-service authorization.

How many questions are on the 1Z0-1072-26 exam?

The exam contains 55 multiple-choice questions. You have 90 minutes to complete it, requiring a 68% passing score (approximately 38 correct answers of 55 scored questions). The exam costs USD $245.

What OCI hands-on experience is recommended before taking the 1Z0-1072-26 exam?

Oracle recommends familiarity with OCI fundamentals and hands-on experience with IAM, Networking, Compute, and Storage. The OCI Always Free tier provides permanent access to core OCI services – including two compute instances, Object Storage, Autonomous Database, and VCN – for hands-on practice at no cost.

Related Certifications Worth Exploring

Candidates who earn the OCI Architect Associate and want to broaden their OCI credentials will find the Oracle 1Z0-1067-26 (OCI Cloud Ops Professional 2026) exam questions page covers advanced OCI operations – infrastructure deployment, automation, IAM, monitoring, cost optimization, and business continuity skills that build naturally on associate-level architecture knowledge. For those specializing in cloud-native application architecture on OCI, the Oracle 1Z0-1084-26 (OCI Developer Professional 2026) exam questions page covers containerization, OKE, Oracle Functions, API Gateway, serverless technologies, application security, and monitoring that complement the infrastructure design skills validated by the Architect Associate credential.