Free 1Z0-1067-25 Practice Test

. Explanation: Task 1: Create a Bucket in Object Storage Create a bucket named CloudOpsBucket_ with the following properties: Storage tier: Standard Auto-tiering: Disabled Object versioning: Enabled Emit events: Disabled Keys: Oracle-managed Visibility: Private Task 2: Upload a Directory’s Contents to Object Storage Upload the contents of the directory ~/dir_to_upload and its subdirectories to the bucket CloudOpsBucket Task 3: Add a Lifecycle Policy to the Bucket Create a lifecycle policy rule that deletes all files from ~/dir_to_upload/temp after 30 days Task 1: Create a bucket in Object Storage 1. Open Cloud Shell in the console. Under Network along the top, select Ephemeral Private Network Setup. 2. Select the subnet of the compute instance. 3. SSH into the compute instance using the provided SSH key: ssh -i /path/to/key opc@ 4. In the compute instance, create the bucket with the following command (note that it’s one long line): oci os bucket create -c "" --name "CloudOpsBucket" --auth instance_principal -- versioning 'Enabled' Task 2: Upload a directory’s contents to Object Storage 1. Upload the contents of the specified directory and subdirectories with the following command (note that it’s one long line): oci os object bulk-upload -bn "CloudOpsBucket" --src-dir "~/dir_to_upload" --auth instance_principal Task 3: Add a lifecycle policy to the bucket 1. Create a file named rule.json 2. Add the following content to rule.json: {"items": [{"action": "DELETE","is-enabled": true,"name": "Delete-Rule","object-name-filter": {"exclusion-patterns": null,"inclusion-patterns": null,"inclusion-prefixes": ["temp/"]},"target": "objects","time-amount": 30,"time-unit": "DAYS"}]} 3. Add the lifecycle policy rule with the following command: oci os object-lifecycle-policy put -bn "CloudOpsBucket" --from-json file://rule.json –-auth instance_principal Top of Form

The statement that the replication policy creation also creates the destination bucket is incorrect. A fundamental prerequisite for creating an Object Storage replication policy is that the destination bucket must already exist in the target region. The administrator must create the destination bucket manually before configuring the replication policy on the source bucket. The policy creation process requires you to specify the pre-existing destination bucket, it does not provision one for you.

A. This statement is also incorrect as deletes are not replicated, but D is a more fundamental error in the setup process itself.
B. This is a correct statement. The destination bucket is made read-only to ensure data integrity and prevent conflicting writes.
C. This is a correct statement. Replication only applies to objects created or updated after the policy is activated, not pre-existing objects.

1. Oracle Cloud Infrastructure Documentation, "Using Replication," Section: Replication Requirements and Limitations. "You must create the destination bucket before you can enable replication." (https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/usingreplication.htm)

2. Oracle Cloud Infrastructure Documentation, "Object Storage FAQ," Section: Replication. "Does replication copy deletes? No. Deleting an object in a source bucket doesn't delete the object in the destination bucket." (https://www.oracle.com/cloud/storage/object-storage/faq/)

This question assesses practical skills in Infrastructure as Code (IaC) using Terraform and OCI Resource Manager. The candidate must demonstrate the ability to write a basic Terraform configuration for OCI networking resources (VCN, Subnet), manage the infrastructure lifecycle using the Terraform CLI (apply, destroy) within the OCI Code Editor, and then transition the same configuration to OCI's managed service, Resource Manager, by creating and running a stack to achieve the same outcome. This validates end-to-end IaC workflow competency on OCI.

This question is a hands-on simulation and does not have selectable options (A, B, C, D) to evaluate as incorrect. The evaluation is based on the successful execution of the required steps.

1. Oracle Cloud Infrastructure Documentation, "Overview of Resource Manager." (This document describes OCI Resource Manager as a managed Terraform service, which is the core component of the second half of the simulation.)

2. Oracle Cloud Infrastructure Documentation, "Getting Started with the Terraform OCI Provider." (This guide provides the foundational knowledge for writing the Terraform configuration file required in the first part of the simulation.)

3. Oracle Cloud Infrastructure Documentation, "Using Code Editor." (This document explains the features of the in-console tool where the candidate would perform the Terraform CLI commands.)

The Network Security Group (NSG) for the bastion host contains two ingress rules for TCP port 22. The first rule correctly allows access from the specific IP address 140.19.2.140/32. The second rule, however, allows access from the source NSG-050504. This means any resource, such as a compute instance, that is associated with NSG-050504 is permitted to establish an SSH connection to the bastion host. This explains why IPs other than the intended one are seen in the logs.

A. Access is not unrestricted; it is restricted to the two sources defined in the NSG rules. The issue is that one of the sources is broader than intended.
C. While a Security List could also be a cause, the information provided points directly to a permissive rule within the bastion's own NSG, making it the most direct root cause.
D. A /32 netmask correctly specifies a single IP address. It does not allow access from any other IP address in the network. This statement is factually incorrect.

1. Oracle Cloud Infrastructure Documentation, "Network Security Groups". "Network security groups (NSGs) act as a virtual firewall for your compute instances and other kinds of resources... An NSG consists of a set of ingress and egress security rules that apply only to the resources in that group... For example: you can group together a set of compute instances that have the same security posture, and then use the NSG as the source or destination for security rules."

. Explanation: Task 1 Write a policy statement to enable Network-Admins to create and destroy network-related resources, such as VCNs, subnets, gateways, and so on in the Network compartment. Solution- Policy Statement: allow Network-Admins to manage virtual-network-family in compartment Common-Infra:Network Task 2 Write policy statements to enable E-Comm-Admins to provision and destroy compute instances in the E-Comm compartment by using networking resources in the Network compartment.[Write one policy per given text box] Solution- Policy Statement: allow E-Comm-Admins to manage instance-family in compartment Applications:E-Comm allow E- Comm-Admins to use virtual-network-family in compartment Common-Infra:Network Task 3 Write a policy statement to enable SCM-Admins to provision, destroy, and back up block volumes in the SCM compartment—but only in Phoenix and London. Solution- Policy Statement: allow SCM-Admins to manage volume-family in compartment Applications:SCM where any{request.region='phx',request.region='lhr'} Thank you for your visit.

The OCI Health Checks service returns specific, enumerated codes to describe the result of a probe. Possible values include HEALTHY, UNHEALTHY, TIMEDOUT, INVALIDSTATUSCODE, REGEXMISMATCH, and various error codes like IOERROR or CONNECTIONERROR. The term "UNREACHABLE" is a general description of a network state but is not one of the specific result codes returned by the service. Conditions that might be described as "unreachable" are reported by more granular codes such as TIMEDOUT or CONNECTIONERROR.

A. REGEXMISMATCH is a valid return value when the response body does not match the expected regular expression pattern.
B. UNKNOWN is also not an officially documented return value, making the question potentially flawed. However, UNREACHABLE is a network state covered by other specific codes.
D. INVALIDSTATUSCODE is a valid return value when the HTTP response code from the endpoint does not match the expected value.
E. TIMEDOUT is a valid return value when a probe does not receive a response within the configured timeout period.

1. Oracle Cloud Infrastructure Documentation, "Health Checks," Viewing Health Check Results. The page lists the possible results for HTTP and ping monitors, and "UNREACHABLE" is not included.

2. Oracle Cloud Infrastructure API Reference and Endpoints, "GetHttpProbeResults," ProbeResultSummary object. The result field enum does not include UNREACHABLE.

The Oracle Cloud Infrastructure (OCI) Ansible modules are built on top of the OCI SDK for Python. The SDK's default authentication mechanism is to look for a configuration file located at ~/.oci/config. This file contains the necessary credentials for API Key Authentication, including user and tenancy OCIDs, a key fingerprint, and the path to the private API key file. While other methods like instance principal are supported and are very useful when running on an OCI instance, the primary default method the SDK attempts first is API Key Authentication via the config file.

A. OAuth is a standard for authorization, but it is not the default authentication method used by the OCI Ansible modules for API requests.
B. Resource Principal Authentication is used by OCI services like Functions to authorize API calls, not the default for Ansible running on a compute instance.
C. Instance principal authentication is a valid method, but the SDK first checks for the API key config file by default before attempting to use instance principals.

1. Oracle Cloud Infrastructure Ansible Collection Documentation, SDK and CLI Configuration, "If authtype is not specified, the SDK will default to using the API key from the config file. If the config file is not found, the SDK will try to use instance principal." This explicitly states API key from the config file is the default.

2. Oracle Cloud Infrastructure Documentation, SDK for Python - Configuration, "By default, the SDK looks for a configuration file named config in the ~/.oci directory." This confirms the default behavior of the underlying SDK.

The question requires a Monitoring Query Language (MQL) query to show the maximum read IOPS for all block volumes in a specific compartment at a one-minute interval. The correct metric is IopsRead. The interval is specified as [1m]. Filtering by compartment is done with {compartmentId = '...'}. To aggregate all results from the compartment into a single line showing the maximum value, the grouping() function (with no dimensions specified) is used, followed by the .max() aggregator. This combination correctly fulfills all requirements.

A. This query uses the mean() aggregator, which calculates the average, not the maximum as required by the question.
B. This query is missing the grouping() function. While some simple queries might work without it, the standard MQL syntax for aggregating multiple time series into one is to use grouping().
C. This query uses the IopsWrite metric, which tracks write operations, not the required read operations. It also incorrectly uses the mean() aggregator.

1. Oracle Cloud Infrastructure Documentation, "Monitoring Query Language (MQL) Reference", Section: Query Structure. (This section details the components of an MQL query: Metric[interval]{dimensionkey="dimensionvalue"}.grouping().statistic()).

2. Oracle Cloud Infrastructure Documentation, "Block Volume Metrics", Section: ociblockstorage Metrics. (This page lists IopsRead as the metric for "Read operations per second").

According to the "Oracle Cloud Services - Security Testing & Assessment Policy," customers are explicitly permitted to conduct security tests, including vulnerability and penetration tests, against their own IaaS and PaaS resources. The policy states that customers may use their own security testing and monitoring tools for this purpose. This allows customers to validate the security posture of their applications and configurations running on OCI, provided they adhere to the other rules outlined in the policy, such as not targeting shared infrastructure or other tenants.

A. While validating isolation is a security goal, the policy focuses on the actions permitted. This option is a desired outcome, not a specifically allowed testing action itself.
C. The policy explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, even if restricted to the customer's own environment, to protect the underlying shared platform.
D. The policy strictly forbids any testing that targets Oracle's underlying hardware, managed services, or any infrastructure not exclusively allocated to the customer's tenancy.

1. Oracle Cloud Infrastructure, "Oracle Cloud Services - Security Testing & Assessment Policy", Document Version 2.0, Section: "Permitted Security Tests". The policy states: "You may use your own security testing and monitoring tools to test the Oracle IaaS and PaaS services that are dedicated to your use."

2. Oracle Cloud Infrastructure, "Oracle Cloud Services - Security Testing & Assessment Policy", Document Version 2.0, Section: "Prohibited Activities". This section explicitly lists "Denial of Service (DoS)" and testing "any Oracle managed host or service" as prohibited.

The scenario describes a delay between when a metric crosses the alarm threshold (23:30) and when the alarm enters the "firing" state (23:33). This 3-minute delay is controlled by the "Trigger Delay Minutes" setting in the alarm definition. This setting specifies the duration for which the condition must be consistently met before the alarm fires and sends a notification. To reduce this delay from the observed 3 minutes to the desired 1 minute, you must change the "Trigger Delay Minutes" value to 1.

A. Changing the alarm condition (threshold) affects when the condition is met, not the delay after it is met.
C. The metric interval defines the data aggregation window. While related, the trigger delay is the specific setting that controls the wait time before firing.
D. Changing the notification topic alters where the notification is sent, not the timing of when the alarm fires.

1. Oracle Cloud Infrastructure Documentation, "Monitoring", "Alarms", "Concepts for Alarms", Section: "Trigger delay minutes: The number of minutes that the condition must be maintained before the alarm is in a firing state."

2. Oracle Cloud Infrastructure Documentation, "Creating an Alarm", Step 8: "Trigger Delay Minutes: Enter the number of minutes that the condition must be maintained before the alarm is in a firing state."