1Z0-1072 Practice Test

1Z0-1072 practice test: what's covered

• IAM & Security
• VCN/Networking
• Compute
• Storage
• Databases & HA-DR
• Observability

Free 1Z0-1072 sample questions

1. An architect must let a fleet of compute instances in the 'Analytics' compartment read objects from a bucket WITHOUT embedding API keys or user credentials on the instances. Which IAM construct should the policy be written against?

   • A. A dynamic group that matches the instances by compartment OCID, granted 'read objects'
   • B. A regular IAM group containing the instances
   • C. An auth token attached to each instance
   • D. A network source listing the instance private IPs
   Show answer

   Correct: A. Dynamic groups let resources (instances, functions) be principals via matching rules (e.g. instance.compartment.id). Policies grant the dynamic group access using instance principals — no stored credentials. Regular groups only hold users; network sources restrict, not authenticate; auth tokens are credentials you want to avoid.

2. Review this policy: 'Allow group NetworkAdmins to manage virtual-network-family in compartment Shared'. A NetworkAdmin reports they cannot create a route table in a sibling compartment 'AppA'. What is the correct explanation?

   • A. Policy scope is the 'Shared' compartment only; access does not extend to sibling compartments
   • B. manage virtual-network-family excludes route tables
   • C. Route tables require a separate 'use' verb
   • D. The group needs a dynamic group instead
   Show answer

   Correct: A. Permissions granted on a compartment apply to that compartment and its children, not to siblings. To act in 'AppA' the policy must target 'AppA' (or a common parent/tenancy). 'virtual-network-family' does include route tables, and 'manage' already implies 'use'.

3. A company wants its users to sign in to OCI using their existing Microsoft Entra ID (Azure AD) credentials with SAML SSO. Which TWO actions does the architect take to implement federation? (Choose TWO)

   • A. Federate the OCI identity domain with the external SAML 2.0 identity provider
   • B. Configure identity provider group mappings so IdP groups map to OCI groups
   • C. Create local IAM users that mirror the Entra ID usernames
   • D. Enable instance principals for the SSO endpoint
   • E. Add a network source listing the IdP's IP range
   Show answer

   Correct: A and B. Federation trusts an external SAML 2.0 IdP (e.g. Entra ID) for SSO, and IdP group mappings translate IdP groups into OCI groups so policies apply. Mirroring users locally defeats SSO; instance principals authenticate resources, not users; network sources restrict by IP, they don't establish SSO.

4. An architect wants to grant access based on a free-form 'CostCenter' value applied to resources and groups, rather than maintaining many compartment-scoped policies. Which OCI feature enables this?

   • A. Tag-based access control using defined tags in policy conditions
   • B. Network sources
   • C. Compartment quotas
   • D. Service gateway policies
   Show answer

   Correct: A. Tag-based access control writes policies with conditions like 'where target.resource.tag.Operations.CostCenter = ...', enabling attribute-based authorization that scales without per-compartment rules. Network sources restrict by IP, quotas cap consumption, and service gateways are a networking construct.

5. Which TWO statements correctly describe OCI compartments? (Choose TWO)

   • A. A compartment is a logical container for resources and can be nested up to six levels deep
   • B. Policies attached to a compartment cascade to its child compartments
   • C. Compartments provide network-level isolation equivalent to a separate VCN
   • D. Each compartment is bound to exactly one availability domain
   • E. A resource can belong to two compartments simultaneously
   Show answer

   Correct: A and B. Compartments are logical, region-wide containers (nesting up to six levels) and policies inherit down the tree. They are NOT network isolation (that's VCN/subnet), are not AD-bound, and a resource lives in exactly one compartment at a time.

Last updated: 2026-10-19

1Z0-1072 practice test FAQ