Free 1Z0-1072-23 sample questions

Correct answer: Network Security Groups (NSGs), because they can be applied to specific VNICs and allow for application-centric security rule definition.

Network Security Groups (NSGs) are the optimal choice here. They operate at the VNIC level, allowing for granular, stateful firewall rules to be defined for a specific set of resources (like the application tier) regardless of the subnet they reside in. This application-centric model is more scalable and easier to audit than subnet-wide Security Lists when managing traffic between specific application tiers.

Correct answer: Create multiple mount targets in different Availability Domains and distribute the client connections across them.

OCI File Storage performance is primarily determined by the mount target, not the size of the file system. Creating multiple mount targets for the same file system (ideally in different Availability Domains for high availability) and distributing the compute instance connections among them is the standard method to scale out performance and overcome the throughput limits of a single mount target.

Correct answers: Allow group JuniorAdmins to manage instance-family in compartment Staging; Deny group JuniorAdmins to terminate instances in compartment Staging where target.resource.tag.Protection = 'Critical'

This statement grants the necessary broad permissions to manage instances (start, stop, create, etc.) within the specified compartment.

This statement explicitly denies the `terminate` permission specifically on instances that have the required tag. IAM `Deny` statements always override `Allow` statements, making this the correct way to create the exception.

Correct answer: OCI Block Volume Service

The OCI Block Volume service is the correct choice for providing persistent, network-attached block storage to Kubernetes pods via the CSI plugin. It allows a pod to mount a PersistentVolume that is backed by an OCI Block Volume. This ensures that the data persists even if the pod (or the preemptible instance it's running on) is terminated and rescheduled elsewhere.

Correct answer: Geolocation Steering

Geolocation Steering is the policy designed for this exact use case. It allows you to define rules that route DNS queries to different endpoints based on the geographic location of the request's source. It also incorporates health checks and allows for failover to other pools, ensuring that if the primary geographic endpoint is down, traffic is sent to the next most appropriate one.

Correct answer: Compartment Quotas

Compartment Quotas are specifically designed to control resource consumption. By setting a quota on the number of GPU instances (or a specific shape) within the 'development' compartment, you can prevent users from creating resources beyond that limit. This is a preventative control, whereas Budgets with alerts are a detective control (they notify you after the spend has occurred or is forecasted to occur).

Correct answer: True

This statement is true. A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet but prevents inbound connections. For this to work, the route table associated with the private subnet must have a rule with a destination of `0.0.0.0/0` and the target set to the NAT Gateway.

Correct answer: Deploy a single instance pool configured to place instances across multiple Availability Domains, coupled with an autoscaling policy.

This is the most effective solution. A single instance pool can be configured to span multiple ADs. This ensures that instances are automatically distributed for high availability. When combined with an autoscaling policy, if one AD fails and its instances become unhealthy, the autoscaling service will automatically launch new instances in the remaining healthy ADs to maintain the desired capacity, ensuring resilience and consistent performance.

Correct answer: Move objects to Infrequent Access tier after 30 days, then move them to Archive Storage after an additional 150 days.

This configuration correctly maps the requirements to OCI's storage tiers. The Infrequent Access tier is for data accessed less often but requires rapid retrieval (milliseconds to seconds), fitting the 30-day requirement. Archive Storage is for long-term retention with longer retrieval times (a few hours), fitting the 180-day requirement. The policy should move to Infrequent Access after 30 days, and then to Archive after a total of 180 days (30 + 150).

Correct answer: A route rule in the private subnet's route table directing traffic for 'All Services in Oracle Services Network' to the Service Gateway.

A Service Gateway provides a private path to OCI services, but it requires a corresponding route rule. The route table associated with the private subnet must have a rule that specifies the target as the Service Gateway and the destination as 'All Services in Oracle Services Network' (which includes Object Storage). Without this rule, the instance does not know how to route the traffic to the service endpoint over the private OCI backbone.