1Z0-1072-23 Sample Questions & Answers

Compartment Quotas are specifically designed to control resource consumption. By setting a quota on the number of GPU instances (or a specific shape) within the 'development' compartment, you can prevent users from creating resources beyond that limit. This is a preventative control, whereas Budgets with alerts are a detective control (they notify you after the spend has occurred or is forecasted to occur).

This statement is true. A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet but prevents inbound connections. For this to work, the route table associated with the private subnet must have a rule with a destination of 0.0.0.0/0 and the target set to the NAT Gateway.

This is the most effective solution. A single instance pool can be configured to span multiple ADs. This ensures that instances are automatically distributed for high availability. When combined with an autoscaling policy, if one AD fails and its instances become unhealthy, the autoscaling service will automatically launch new instances in the remaining healthy ADs to maintain the desired capacity, ensuring resilience and consistent performance.

This configuration correctly maps the requirements to OCI's storage tiers. The Infrequent Access tier is for data accessed less often but requires rapid retrieval (milliseconds to seconds), fitting the 30-day requirement. Archive Storage is for long-term retention with longer retrieval times (a few hours), fitting the 180-day requirement. The policy should move to Infrequent Access after 30 days, and then to Archive after a total of 180 days (30 + 150).

A Service Gateway provides a private path to OCI services, but it requires a corresponding route rule. The route table associated with the private subnet must have a rule that specifies the target as the Service Gateway and the destination as 'All Services in Oracle Services Network' (which includes Object Storage). Without this rule, the instance does not know how to route the traffic to the service endpoint over the private OCI backbone.

This requirement is a classic use case for tag-based access control, which is implemented using conditions within an IAM policy. A policy can be written to Allow group DevOpsTeam to manage instance-family where target.resource.tag.CostCenter = 'ProjectX'. This condition ensures the policy only applies to actions where the target resource (the instance) has the specified tag.

The Instance Console Connection feature is designed specifically for this purpose. It provides a secure, web-based VNC or serial console connection directly to the instance from the OCI Console. This works for instances in private subnets and does not require a public IP, bastion host, or any changes to the VCN's security rules.

OCI Vault provides the Key Management Service (KMS) that allows customers to create and manage their own encryption keys. When creating a block volume, you can specify a custom master encryption key from a Vault that you control. This gives you full authority over the key's lifecycle, satisfying strict compliance requirements for customer-managed encryption.

This scenario describes a classic use case for transit routing. By default, VCN peering is not transitive. To allow spokes to communicate with the on-premises network through the hub, you must use a Dynamic Routing Gateway (DRG) in the hub. The DRG acts as the central router, and you must configure its route tables to direct traffic between the FastConnect connection, the hub VCN, and the peered spoke VCNs.

Emulated mode is the correct choice for images that require legacy drivers or have custom kernel configurations that are not compatible with OCI's native paravirtualized drivers. Emulation provides a more traditional virtual hardware environment, which increases compatibility for older or highly customized operating systems, even though it may come with a slight performance penalty compared to paravirtualized mode.