I85PREP
⌘ K
Oracle Cloud AR study materials
Oracle Cloud AR study resources

Oracle Cloud AR practice questions

One question at a time. Build your Oracle Cloud AR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security architect needs to give an application running on an OCI Compute instance temporary credentials to read objects from an Object Storage bucket without embedding long-lived keys. Which OCI capability should be used?

  1. Pre-authenticated requests stored in the instance metadata
  2. Instance principals with dynamic group policies Correct answer.
  3. Federated SSO with a local IDCS user per instance
  4. A customer secret key placed in an environment variable

Explanation

Instance principals let a compute instance authenticate to OCI services using certificates issued by the instance metadata service, and a dynamic group with matching rules plus an IAM policy grants the required Object Storage permissions. This removes the need to distribute static credentials.

Question 2Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI Vault feature allows an application to retrieve secrets programmatically at runtime while enforcing IAM policies on who can read them?

  1. Object Storage lifecycle rules
  2. Vault key versions
  3. Secrets in the Vault service Correct answer.
  4. File Storage snapshots

Explanation

OCI Vault stores both encryption keys and secrets; secrets are designed for credentials such as database passwords or API tokens and are protected by IAM policies and key-based encryption. Applications read them via the Vault API or CLI at runtime.

Question 3Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

In an OCI security zone, which action is blocked by default for resources inside the zone?

  1. Attaching a customer-managed key to a block volume
  2. Tagging a compute instance
  3. Enabling a service connector
  4. Creating a public Object Storage bucket Correct answer.

Explanation

Security zones enforce a set of maximum-security policies; by default they prohibit public buckets and public subnets, among other risky configurations. The other listed actions are permitted or unrelated to the zone's default restrictions.

Question 4Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect must ensure that a compromised compute instance cannot reach the internet directly. Which configuration achieves this?

  1. Disable the instance metadata service
  2. Place the instance in a private subnet with no NAT gateway or internet gateway route Correct answer.
  3. Use a regional NSG with a deny-all egress rule only
  4. Attach a public IP address but remove the security list egress rules

Explanation

A subnet is private when its route table has no route to an internet gateway or NAT gateway, so traffic to the internet has no path. Security lists and NSGs filter traffic but do not themselves remove routing reachability, so the routing decision is the decisive control.

Question 5Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI component provides a managed, regional firewall that inspects traffic entering and leaving a VCN at the VCN level?

  1. Web Application Firewall
  2. Network security groups
  3. Security lists
  4. OCI Network Firewall Correct answer.

Explanation

OCI Network Firewall is a managed layer 3/4 firewall with intrusion detection and prevention that is attached to a VCN and inspects traffic at the VCN boundary. NSGs and security lists are distributed packet filters, and WAF protects HTTP applications at layer 7.

Question 6Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A company wants to protect a public-facing web application on OCI from SQL injection and cross-site scripting. Which service should be placed in front of the load balancer?

  1. OCI Network Firewall
  2. OCI Bastion
  3. A security list with a deny rule
  4. OCI Web Application Firewall Correct answer.

Explanation

OCI WAF inspects HTTP/S requests and applies managed and custom rules to block injection and scripting attacks before they reach the origin. It is deployed in front of a load balancer or edge endpoint.

Question 7Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI IAM construct is used to group users and grant them a common set of permissions within a compartment?

  1. Federation trust
  2. Dynamic group
  3. Identity domain policy
  4. Group with an IAM policy Correct answer.

Explanation

IAM policies grant permissions to groups, and users inherit those permissions through group membership. Policies reference the group name and a compartment scope.

Question 8Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security team needs to detect anomalous API activity such as a spike in failed authentication attempts against OCI resources. Which service is designed for this?

  1. OCI Audit
  2. OCI Logging
  3. OCI Monitoring alarms
  4. OCI Cloud Guard Correct answer.

Explanation

Cloud Guard continuously evaluates the tenancy against detector recipes and identifies suspicious activity and misconfigurations, including identity and authentication anomalies. It produces problems that can trigger responder actions.

Question 9Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which practice best satisfies the requirement to recover from accidental deletion of a production Object Storage bucket's contents in OCI?

  1. Enable versioning on the bucket and retain noncurrent versions Correct answer.
  2. Enable a lifecycle rule to archive objects after 30 days
  3. Rely on the Object Storage service-level replication
  4. Restrict bucket access with a pre-authenticated request

Explanation

Object versioning keeps prior object versions when an object is overwritten or deleted, so the previous content can be restored. Retention of noncurrent versions must be configured so they are not immediately purged.

Question 10Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect is designing cross-region resilience for a database on OCI. Which OCI Database service feature provides an autonomous standby in a second region?

  1. Cross-region read replicas for Object Storage
  2. A local standby in the same availability domain
  3. Block volume replication
  4. Autonomous Data Guard Correct answer.

Explanation

Autonomous Data Guard maintains a standby Autonomous Database in another region and can switch over during a regional outage. It is the managed disaster recovery mechanism for Autonomous Database.

Question 11Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

What is the primary purpose of an OCI availability domain?

  1. To isolate a tenancy's network from other tenants
  2. To host the identity domain for federation
  3. To define the billing boundary for a compartment
  4. To provide physically separate data centers within a region for fault isolation Correct answer.

Explanation

Availability domains are independent data centers within a region with separate power, cooling, and network, so distributing resources across them increases resilience to a single facility failure.

Question 12Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A workload must survive the loss of an entire OCI region. Which design element is required?

  1. A fault-tolerant configuration across availability domains in one region
  2. A cross-region standby with replicated data and a tested failover procedure Correct answer.
  3. A backup stored in the same region as the primary database
  4. An autoscaling policy in the primary region

Explanation

Regional resilience requires resources and data in a second region plus a documented and tested failover process; availability domain redundancy alone cannot survive a regional outage.

Question 13Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI service should be used to provide time-limited, auditable SSH access to compute instances in a private subnet without exposing a public IP?

  1. OCI Bastion Correct answer.
  2. OCI Network Load Balancer
  3. OCI FastConnect
  4. OCI VPN Connect

Explanation

OCI Bastion provides managed, session-based SSH access to private targets with an audit trail and time-limited sessions, avoiding public IP exposure.

Question 14Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An application team wants to encrypt data at rest in Object Storage with a key that the security team controls and can rotate independently of other tenants. Which approach is correct?

  1. Use the Oracle-managed encryption keys and rely on the service
  2. Use a pre-authenticated request with an expiry date
  3. Encrypt objects client-side with a key stored in the bucket metadata
  4. Create a customer-managed master encryption key in OCI Vault and assign it to the bucket Correct answer.

Explanation

Customer-managed keys in OCI Vault give the tenant control over key lifecycle and rotation, and assigning the key to the bucket encrypts objects with that key.

Question 15Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which statement about OCI security lists is accurate?

  1. They are stateless and applied at the subnet level Correct answer.
  2. They are stateful and applied at the VNIC level
  3. They support layer 7 URL filtering
  4. They override IAM policies for the subnet

Explanation

Security lists are stateless rule sets applied to all VNICs in a subnet, so return traffic must be explicitly allowed. Statefulness and per-VNIC application are characteristics of network security groups.

Question 16Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A database must be reachable only from an application subnet and never from the internet. Which combination is the most direct control?

  1. Place the database in a private subnet and allow port 1521 only from the application subnet's NSG Correct answer.
  2. Enable a service gateway and allow all egress
  3. Put the database behind a public load balancer with TLS
  4. Assign a public IP and restrict access with a security list

Explanation

Keeping the database in a private subnet removes internet routing, and a narrow NSG rule that references the application subnet limits access to the intended source. This implements least privilege at the network layer.

Question 17Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

What does an OCI IAM policy statement with the verb 'manage' in a compartment grant?

  1. Only read access to resources in the compartment
  2. Full access to all resources of the specified type in the compartment Correct answer.
  3. Permission to modify IAM policies only
  4. Access limited to a single named resource

Explanation

The verb 'manage' is the broadest access level in OCI IAM and includes create, read, update, and delete operations on the resource type named in the statement, scoped to the given compartment.

Question 18Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect wants to prevent accidental public exposure of Object Storage buckets across an entire tenancy. Which control is most appropriate?

  1. A tenancy-level security zone that blocks public buckets Correct answer.
  2. A budget alert on Object Storage usage
  3. A lifecycle rule that deletes objects after one day
  4. A Cloud Guard detector recipe with a responder that deletes public buckets

Explanation

A security zone applied at the tenancy or compartment level enforces maximum-security policy and denies creation or update of public buckets, preventing the exposure rather than reacting to it.

Question 19Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI feature allows an administrator to require multi-factor authentication for a group of users?

  1. A sign-on policy in the identity domain Correct answer.
  2. A dynamic group rule
  3. A network security group rule
  4. An IAM policy with the 'manage' verb

Explanation

Sign-on policies in the identity domain define authentication conditions, including requiring MFA for specified users or groups. IAM policies govern authorization, not authentication strength.

Question 20Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A team needs to retain audit logs of all API activity for compliance review for at least one year. Which OCI service provides this record?

  1. OCI Monitoring metrics
  2. OCI Vault audit secrets
  3. OCI Audit with log retention in Object Storage Correct answer.
  4. OCI Logging agent on each instance

Explanation

OCI Audit records API calls made against tenancy resources and can be retained beyond the default window by exporting events to Object Storage with a lifecycle policy for the required period.

Question 21Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI construct allows a resource in one compartment to be accessed by a principal defined in a different compartment?

  1. A service gateway
  2. A local peering gateway
  3. A VCN peering connection
  4. A policy written in the tenancy root that references both compartments Correct answer.

Explanation

IAM policies can be written at the tenancy level and reference compartments and resources across the tenancy, allowing cross-compartment authorization. Network constructs such as peering do not grant IAM permissions.

Question 22Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

What is the recommended way to grant an OCI function access to a private subnet resource?

  1. Assign a public IP to the function's VNIC
  2. Disable the function's IAM policy
  3. Place the function in a public subnet and use a NAT gateway
  4. Configure the function to use a VCN with a private subnet and appropriate NSG rules Correct answer.

Explanation

OCI Functions can be attached to a VCN and private subnet, allowing outbound access to private resources through the customer's network controls while the function remains unreachable from the internet.

Question 23Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI service helps an architect identify whether a compute instance has an overly permissive security list attached to its subnet?

  1. OCI Block Volume
  2. OCI Data Science
  3. OCI Streaming
  4. OCI Cloud Guard Correct answer.

Explanation

Cloud Guard includes configuration detectors that flag insecure network configurations such as overly permissive security list rules, surfacing them as problems for remediation.

Question 24Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An organization must ensure that encryption keys used for production data cannot be exported from the HSM. Which OCI Vault key type meets this requirement?

  1. Imported key material
  2. Software-protected key
  3. Virtual private vault with software keys
  4. HSM-protected key Correct answer.

Explanation

HSM-protected keys are generated and stored in a hardware security module and cannot be exported, providing stronger key custody than software-protected keys.

Question 25Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which practice best reduces the blast radius if an IAM user's credentials are compromised in an OCI tenancy?

  1. Store credentials in a public Object Storage bucket
  2. Grant least-privilege policies scoped to specific compartments and enable MFA Correct answer.
  3. Share a single administrative account among the team
  4. Assign the user to a group with broad tenancy-level manage permissions

Explanation

Least-privilege policies limit what a compromised principal can do, and MFA adds a barrier to credential misuse. Scoping to specific compartments further reduces the impact.

Question 26Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect is designing a two-tier application in a single OCI region and wants the web tier and database tier to have separate routing and security rules that are evaluated independently. Which OCI construct provides this segmentation?

  1. A NAT gateway attached to the web subnet
  2. Virtual cloud network with separate subnets per tier Correct answer.
  3. An internet gateway attached to the database subnet
  4. A single flat subnet shared by both tiers

Explanation

A VCN is subdivided into subnets, and each subnet can carry its own route table and security rules, which lets the web and database tiers be governed independently. Sharing one flat subnet would couple their routing and rule evaluation and is not appropriate for tier isolation.

Question 27Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security architect needs to confirm that no security list in a compartment allows SSH from 0.0.0.0/0. Which OCI service provides a consolidated posture view that flags such risky configurations?

  1. Service Connector Hub
  2. Object Storage Lifecycle Policy
  3. Audit
  4. Cloud Guard Correct answer.

Explanation

Cloud Guard continuously evaluates tenancy configuration against detector recipes and surfaces problems such as overly open ingress rules as findings. Audit records API calls, and lifecycle policies and connectors move or transform data rather than assess security posture.

Question 28Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI capability lets an administrator enforce that users in a specific group must present a second authentication factor before signing in to the console?

  1. A sign-on policy applied to the identity domain Correct answer.
  2. A dynamic group matching rule
  3. A compartment quota policy
  4. An identity provider federation rule

Explanation

Sign-on policies in an OCI identity domain define the authentication requirements, including whether MFA is required, for the users the policy matches. Quotas limit resource consumption, dynamic groups match instances, and federation rules govern how external identities are trusted rather than MFA enforcement.

Question 29Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A team stores regulated data in Object Storage and must use encryption keys that the security team controls and can rotate independently of the data. Which OCI service should hold those keys?

  1. File Storage
  2. Logging
  3. Identity Domains
  4. Vault Correct answer.

Explanation

OCI Vault is the managed key management service that stores and rotates master encryption keys used for customer-managed encryption of services such as Object Storage. The other services do not provide key custody or rotation.

Question 30Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

What does an OCI IAM policy statement that uses the verb 'manage' in a compartment grant to the specified group?

  1. Access that expires after a fixed interval
  2. Full access, including create, update, and delete, to the resource type Correct answer.
  3. Read-only access to the listed resource type
  4. Access only to resources tagged with a specific namespace

Explanation

In OCI policy syntax, 'manage' is the broadest verb and covers all operations on the resource type, including create, read, update, and delete. 'Read' grants only inspection, and tag conditions must be expressed separately with a condition clause.

Question 31Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An application running on a compute instance in a private subnet needs to read objects from an Object Storage bucket without storing credentials on the instance. Which OCI mechanism should be used?

  1. A user account with an API key stored in a file
  2. An instance principal via a dynamic group and policy Correct answer.
  3. A bucket ACL granting public read
  4. A pre-authenticated request embedded in the code

Explanation

Instance principals let the instance authenticate to OCI APIs using its own identity, with authorization granted through a dynamic group and a policy. This removes the need for long-lived credentials on the instance and avoids exposing the bucket publicly.

Question 32Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

Which OCI service records API calls made against tenancy resources so that an auditor can review who deleted a bucket and when?

  1. Monitoring
  2. Notifications
  3. Audit Correct answer.
  4. Resource Manager

Explanation

The Audit service captures API activity in the tenancy and retains it for review, which supports investigations such as identifying who deleted a resource. Monitoring tracks metrics, Notifications delivers messages, and Resource Manager runs Terraform stacks.

Question 33Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect is placing a database in a private subnet that must never be reachable from the internet. Which OCI gateway configuration supports that requirement while still allowing the database to receive software updates from the internet?

  1. An internet gateway on the subnet route table
  2. A service gateway with a public route
  3. A NAT gateway on the subnet route table Correct answer.
  4. A local peering gateway to a public subnet

Explanation

A NAT gateway allows instances in a private subnet to initiate outbound internet connections while preventing inbound connections from the internet. An internet gateway would make the subnet routable from the internet, which contradicts the requirement.

Question 34Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A workload must remain available even if an entire OCI region becomes unavailable. Which design element is required?

  1. Deployment across at least two regions with data replication Correct answer.
  2. A single availability domain with a regional load balancer
  3. Deployment across multiple availability domains in one region
  4. Deployment across multiple fault domains in one availability domain

Explanation

Surviving the loss of a region requires resources in more than one region, with data replicated between them. Availability domains and fault domains protect against smaller failures within a region but cannot survive a regional outage.

Question 35Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security team wants to block traffic to a specific set of known malicious IP addresses for all subnets in a VCN without editing each subnet's security list. Which OCI feature is best suited?

  1. A route table rule dropping the addresses
  2. A network security group applied to each instance
  3. A security zone recipe
  4. A VCN firewall policy applied at the VCN level Correct answer.

Explanation

Firewall policies in OCI are applied at the VCN level and evaluate traffic for the VCN, which allows a centralized block for all subnets. Security lists and NSGs are per-subnet or per-resource and would require repeated edits.

Question 36Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect must ensure that a compromised application instance cannot enumerate or modify resources in other compartments. Which combination best limits the blast radius?

  1. A user account with tenancy administrator privileges stored on the instance
  2. A dynamic group scoped to the instance with a policy granting only the required actions in its own compartment Correct answer.
  3. A dynamic group covering all instances with 'manage all-resources' in the tenancy
  4. A pre-authenticated request with write access to every bucket

Explanation

Least privilege means the instance principal should be granted only the actions it needs, scoped to the compartment where those resources live. Broad tenancy-wide grants or administrator credentials would let a compromise spread across the tenancy.

Question 37Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A company wants to guarantee that deleting a production Object Storage bucket requires a second approver and cannot be done by a single administrator. Which OCI capability supports this?

  1. Object versioning on the bucket
  2. An identity domain sign-on policy
  3. A retention rule with a lock Correct answer.
  4. A service-level agreement with OCI support

Explanation

Retention rules, once locked, prevent deletion or modification of objects until the retention period ends, providing an immutable safeguard. Versioning preserves prior object versions but does not block a determined administrator from deleting the bucket.

Question 38Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect wants to connect an on-premises data center to a VCN with a dedicated private circuit that does not traverse the public internet. Which OCI service should be used?

  1. Internet gateway
  2. Site-to-Site VPN
  3. FastConnect Correct answer.
  4. Service gateway

Explanation

FastConnect provides a dedicated private connection between on-premises networks and OCI. Site-to-Site VPN also connects on-premises but runs over the public internet with encryption, and gateways serve different purposes.

Question 39Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A team needs a compute instance in a private subnet to reach an OCI Object Storage endpoint without using the internet or a NAT gateway. Which OCI construct should be configured?

  1. A service gateway with a route rule for the OCI services CIDR Correct answer.
  2. An internet gateway with a security list rule
  3. A dynamic routing gateway with a VPN
  4. A local peering gateway to another VCN

Explanation

A service gateway provides private access from a VCN to supported OCI services such as Object Storage using the service CIDR in the route table. This avoids internet egress and does not require a NAT gateway.

Question 40Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security architect needs to know whether a compute instance's VNIC is associated with a network security group that permits unrestricted inbound traffic. Which OCI feature provides this visibility?

  1. The instance's boot volume metrics
  2. The identity domain's sign-in activity
  3. Cloud Guard findings and the VCN flow logs Correct answer.
  4. The Object Storage inventory report

Explanation

Cloud Guard surfaces misconfiguration findings, and VCN flow logs record traffic so an architect can see whether unrestricted ingress is actually being permitted. The other options report on storage, identity, or compute metrics rather than network exposure.

Question 41Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect is designing a resilient web tier and wants traffic distributed across instances in two availability domains with health checks removing failed instances. Which OCI service should be used?

  1. A local peering gateway between the two availability domains
  2. A public load balancer with a regional subnet spanning two availability domains Correct answer.
  3. A NAT gateway with a route rule per availability domain
  4. A single compute instance with a reserved public IP

Explanation

A load balancer placed on regional subnets distributes traffic across availability domains and uses health checks to stop sending traffic to failed instances. A single instance provides no redundancy, and gateways do not balance traffic.

Question 42Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A company must ensure that only approved instance shapes can be launched in a production compartment. Which OCI control enforces this?

  1. A security list rule
  2. A compartment quota on the shape family Correct answer.
  3. A dynamic group matching rule
  4. A bucket lifecycle policy

Explanation

Compartment quotas limit the quantity and type of resources that can be created, including shape families, which enforces the approved set. Security lists, dynamic groups, and lifecycle policies do not constrain resource creation.

Question 43Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An administrator wants to grant a partner team read access to a specific bucket in another compartment without granting access to the rest of the tenancy. Which OCI mechanism should be used?

  1. A tenancy-wide policy granting 'manage all-resources'
  2. A policy statement granting 'read objects' in the bucket's compartment to the partner group Correct answer.
  3. A pre-authenticated request with full control
  4. A public bucket ACL

Explanation

A policy statement scoped to the bucket's compartment and limited to the object read verb grants exactly the required access. Tenancy-wide grants and public ACLs exceed the requirement and increase exposure.

Question 44Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A team wants to detect when an IAM user's API key is used from an unexpected location. Which OCI capability provides this signal?

  1. A file system snapshot schedule
  2. Audit log events analyzed with Cloud Guard threat detectors Correct answer.
  3. Object Storage replication metrics
  4. A load balancer access log

Explanation

Audit events record authentication and API activity, and Cloud Guard threat detectors can raise findings for anomalous behavior such as unusual API usage patterns. The other options report on storage, traffic, and file systems rather than identity anomalies.

Question 45Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect must ensure that data written to a block volume is encrypted with a customer-managed key that can be rotated without recreating the volume. Which OCI capability supports this?

  1. An instance principal policy
  2. A bucket lifecycle rule
  3. Vault master encryption keys used for block volume encryption Correct answer.
  4. A file system snapshot policy

Explanation

Block volumes can be encrypted with customer-managed keys held in Vault, and rotating the key version does not require recreating the volume. Snapshots, lifecycle rules, and instance principals do not manage encryption keys.

Question 46Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security architect needs to prove that a production database's encryption keys cannot be exported from the hardware security module. Which OCI Vault key configuration satisfies this?

  1. A key stored in Object Storage with a bucket policy
  2. A key managed by the database administrator
  3. A key created in a virtual private vault backed by an HSM Correct answer.
  4. A key imported from an external source

Explanation

Keys created in a virtual private vault are generated and held in the HSM, and the key material is non-exportable by design. Imported keys and keys stored outside the vault do not provide that guarantee.

Question 47Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect is designing a multi-region active-passive architecture with a recovery point objective of five minutes for a database. Which combination best meets the requirement?

  1. Cross-region data replication with automated failover to a standby region Correct answer.
  2. A single region with multiple availability domains
  3. A read replica in the same region only
  4. Nightly backups copied to the second region

Explanation

A five-minute RPO requires continuous cross-region replication so the standby is never far behind, combined with a tested failover process. Nightly backups would leave up to a day of data loss, and single-region designs cannot survive regional loss.

Question 48Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A company wants to enforce that all new Object Storage buckets in a tenancy are private and encrypted with customer-managed keys, blocking creation otherwise. Which OCI control should be used?

  1. A Cloud Guard detector that only reports findings
  2. A security zone with a recipe that denies public buckets and requires customer-managed keys Correct answer.
  3. An identity domain sign-on policy
  4. A bucket lifecycle policy

Explanation

Security zones enforce recipes that deny noncompliant actions such as creating a public bucket, rather than merely reporting them. Cloud Guard detectors report findings but do not block the action, and the other options are unrelated to bucket policy.

Question 49Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

An architect must design a VCN so that a database subnet cannot reach the internet in either direction while an application subnet can initiate outbound internet connections. Which configuration achieves this?

  1. An internet gateway route on both subnets with security lists blocking inbound
  2. A route table for the database subnet with no internet route and a NAT gateway route for the application subnet Correct answer.
  3. A local peering gateway between the two subnets
  4. A service gateway route on the database subnet and an internet gateway on the application subnet

Explanation

Routing determines reachability, so the database subnet needs a route table without an internet path while the application subnet uses a NAT gateway for outbound-only access. Security lists alone do not remove the route, and peering between subnets does not control internet reachability.

Question 50Architecting secure and resilient cloud infrastructure on Oracle Cloud Infrastructure

A security team wants to ensure that a compromised IAM user cannot escalate privileges by attaching a more permissive policy to its own group. Which OCI design principle should be applied?

  1. Store API keys in Object Storage for shared use
  2. Separate policy administration into a dedicated compartment and group with tightly restricted membership Correct answer.
  3. Disable Audit to reduce log volume
  4. Grant all users 'manage all-resources' to simplify administration

Explanation

Privilege escalation is limited by isolating policy administration to a small, controlled group and compartment so ordinary users cannot change their own effective permissions. Broad grants, shared keys, and disabling audit all increase risk.