Oracle

Oracle Cloud Infrastructure Architect Associate (1Z0-1072-26) practice questions

★★★★★★ 4.4 64 reviews — aggregated from community votes by visitors who practiced this bank

Questions: 62
Exam length: 90 min
Passing score: 68

Instant feedback per question
Explanation for every option
Free, no signup

Exam overview 1Z0-1072-26

1Z0-1072-26 is where OCI's associate-level design judgement gets tested, and the two heaviest domains prove it: Networking at 24% and Storage at 20% together account for nearly half the paper, while Identity and Access Management adds 18%. Oracle University lists 55 questions in 90 minutes with a 68% passing score and a USD 245 fee, and the credential is valid for 24 months. The 2026 release replaced 1Z0-1072-25, which retired on May 29, 2026, and Oracle dropped the calendar year from the credential name — so the badge reads Oracle Cloud Infrastructure Architect Associate even though the code ends in -26.

The remaining weight sits in Compute at 14%, Database at 14%, and Observability and Management at 10%. Notice what that distribution implies: you cannot pass on console familiarity alone. A candidate who can launch an instance but cannot explain why a retired pool member is replaced without breaching the autoscaling maximum, or why a cross-region block volume replica has to be activated before use, will drop marks in the very domains that carry half the paper.

Oracle recommends OCI fundamentals plus hands-on work in IAM, networking, compute, and storage before sitting the exam; in practice the scenario stems read like tickets from a real tenancy — a load balancer timing out because the backend security list never allowed the load balancer subnet, a DRG that must let one VCN reach on-premises and another not, pods failing to schedule because worker boot volumes filled. Distractors are usually plausible service names applied to the wrong layer, which is why the explanations here weigh each option rather than just naming the winner.

Practice mirrors the blueprint. Networking items run from gateway selection and stateful versus stateless rules through DRG transit routing and FastConnect BGP; storage items cover Object Storage lifecycle chains, block volume replication and performance levels, and File Storage mount behaviour; compute items cover flexible and burstable shapes, instance configurations and rolling replacement, OKE upgrades, Container Instances, and Functions packaging; IAM items cover policy verbs, dynamic-group matching variables, instance principals, and cross-tenancy endorsement. Every question carries a full explanation, and the PDF packages the same bank for offline review or a timed 55-question run at 90 minutes.

Take one timed pass to see which of the six domains is costing you the pass, then drill that domain before the next full run.

Official Exam Domains & Weighting

To successfully pass the 1Z0-1072-26 exam, candidates must master the following core domains:

Domain 1: Identity and Access Management (18%)

Identity domains with users, groups, and federation, compartments and quotas, the inspect/read/use/manage policy verb ladder and conditional or tag-based statements, dynamic groups with instance and resource principals, cross-tenancy endorse-and-commit policies, and tagging for access and cost control.

Domain 2: Networking (24%)

VCN and subnet design with route tables, internet, NAT, service and dynamic routing gateways, security lists versus NSGs and stateful versus stateless rules, local and remote peering, DRG route tables with import and export distribution, Site-to-Site VPN and FastConnect virtual circuits with BGP, load balancer and network load balancer placement, DNS with traffic management steering, WAF, and Network Command Center flow logs and VTAP capture filters.

Domain 3: Compute (14%)

VM, bare metal, dedicated host and flexible or burstable shapes, custom images and image export preparation with cloud-init and QCOW2/RAW, instance configurations and pools with autoscaling policies and cooldowns, capacity types and reservations, OKE control plane and node pool upgrades, Container Instances, Functions deployment with the Fn CLI and OCIR, shielded instances, and serial console troubleshooting.

Domain 4: Storage (20%)

Block Volume performance levels in VPUs, backups, clones, volume groups and cross-region replication with replica activation, Object Storage tiers with lifecycle rules, versioning, retention rules, pre-authenticated requests and replication, and File Storage mount targets, snapshots, elastic capacity, and file system replication.

Domain 5: Database (14%)

Autonomous Database on shared versus dedicated Exadata infrastructure with cloning and wallets, Base Database Service and Exadata Cloud Service with Smart Scan, HCC, ASM and multi-VM clusters, Data Guard and RAC for HA and DR, MySQL HeatWave, and database migration options.

Domain 6: Observability and Management (10%)

Monitoring metrics and alarms with notifications and HTTPS subscriptions, Logging and Logging Analytics with log groups, sources and entities, Application Performance Monitoring, Events rules and Service Connector Hub, and Cloud Guard for security posture.

Domain coverage 6 domains

Identity and Access Management (18%)
Networking (24%)
Compute (14%)
Storage (20%)
Database (14%)
Observability and Management (10%)

Sample questions 7 of 62 shown

Q1
What is the purpose of the 'Tags' feature in OCI resource management?
1. To apply cost tracking and logical grouping
2. To define IAM policies
3. To manage network traffic
4. To automate patch management
Tags attach metadata key-value pairs to resources, which is how Cost Analysis slices spend by cost center and how you filter long resource lists across compartments. Free-form tags accept any key and value, while defined tags drawn from a tag namespace enforce an approved vocabulary. Option B is wrong because policies are authored in IAM, not in tags — although tags can appear as a condition inside a policy. Option C is a security-list or NSG concern. Option D is OS Management Hub's role.
Q2
Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)
1. Scope policies to specific compartments rather than the tenancy root whenever feasible
2. Hardcode API signing keys directly into public source code repositories
3. Grant the minimum permissions necessary for users to perform their jobs
4. Always assign 'manage all-resources' to every user to simplify troubleshooting
5. Use tenancy-wide administrative policies for all standard developers
A policy written at the tenancy root applies to every compartment beneath it, so scoping to the narrowest compartment limits the blast radius of a compromised credential — and pairing that with the least-privilege verb ladder (inspect, read, use, manage) satisfies Option C. Option B is a credential leak waiting to happen; keys belong in Vault or instance principals. Options D and E both grant tenancy-wide power to people who do not need it, which is the exact anti-pattern the exam expects you to reject.
Q3
Your company uses compute instances across departments to access Object Storage buckets, and you want to avoid storing API keys on the instances. Which component is NOT required to configure instance principals for this workflow?
1. An individual IAM user account created for each compute instance to authenticate API calls
2. Compute instances launched within OCI that support the instance metadata service
3. An IAM policy that grants the dynamic group permission to access the Object Storage bucket
4. A dynamic group that includes the target compute instances based on matching rules
Instance principals work precisely because no per-instance user exists: the instance authenticates through the metadata service and receives short-lived certificates from the OCI security token service. A dynamic group (Option D) supplies the identity membership, and a policy (Option C) supplies the authorization, with the metadata service (Option B) as the transport. Option A is the component that must not exist — creating a user per instance reintroduces the long-lived credentials the design removes.
Q4
Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)
1. Instance principals only function when connected to an on-premises Active Directory domain controller
2. Dynamic groups require human users to manually approve every API call made by the instance
3. Compute instances must have static username and password credentials configured in their environment variables
4. Instance principals allow compute instances to make API calls to OCI services securely without storing credentials on the instance
5. Dynamic groups are used to group instances together so IAM policies can grant them permissions
A dynamic group is a container whose membership is computed from matching rules on resource metadata, and policies written against that group authorize the resources — that pairing is Options D and E. Option A is false; instance principals are an OCI-native mechanism with no directory dependency. Option B describes a manual approval gate that does not exist. Option C is the static-credential model that instance principals replace.
Q5
Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)
1. The operating system user password hash
2. Compartment OCID (instance.compartment.id)
3. Instance OCID (instance.id)
4. Tags applied to the instance (tag.namespace.tagkey)
5. The public IP address of the user launching the instance
Matching rules only see OCI resource metadata: the compartment OCID (B), the instance's own OCID (C), and defined or free-form tag values (D) are all documented variables, which is why tag-based rules are the standard way to grant a whole fleet access. Option A is guest-OS data that the control plane never sees. Option E refers to the caller, not the resource, and is not part of the matching grammar.
Q6
What is the function of the OCI IAM 'inspect' verb?
1. It allows users to inspect security vulnerabilities on compute instances
2. It allows users to create, update, and delete resources
3. It allows users to list resources of a given type without viewing their contents or configuration details
4. It allows users to download object storage bucket files
'inspect' is the lowest verb on the ladder: it enumerates resources so you know they exist, but it does not expose configuration or content — 'read' does that. Option A confuses an authorization verb with Vulnerability Scanning Service. Option B is 'manage'. Option D requires read or use on the objects resource type, which sits above inspect.
Q7
An administrator needs a policy granting read-only access to all databases across the tenancy. Which resource type should be specified?
1. database-family
2. db-resources
3. sql-databases
4. databases
'database-family' is the aggregate resource type covering Autonomous Database, DB systems, and the related database services, so a single statement with 'read' on it covers everything in the family. Options B, C, and D are invented names; writing a policy against a non-existent resource type produces a statement that silently grants nothing, which is a classic exam trap.

Answer all 62 questions with instant feedback →

Reader reviews 64 ratings

4.4 ★★★★★★ Based on 64 ratings

Really well-structured 1Z0-1072-26 practice set. I like that you can attempt questions multiple times and it tracks your progress.

★★★★★★ Lucas W.
Covered all five domains of the 1Z0-1072-26 exam thoroughly. I especially appreciated the detailed breakdowns for the tricky questions.

★★★★★★ Natalie R.
Straight to the point. No filler, just good 1Z0-1072-26 practice questions with clear explanations. Exactly what I needed.

★★★★★★ Paisley K.
The 1Z0-1072-26 exam was brutal, but these practice questions prepared me for the worst. Came out with a solid pass.

★★★★★★ Carter H.
Quick shipping? LOL jk — instant access was great. Started studying 1Z0-1072-26 questions right after purchase, no delays.

★★★★★★ Colton W.
Passed 1Z0-1072-26 with 912/1000. The practice questions cover the exam objectives thoroughly and the explanations are clear.

★★★★★ Ella M.

Frequently asked questions

Is 1Z0-1072-26 the current Architect Associate exam?

Yes. Oracle retired 1Z0-1072-25 on May 29, 2026 and released 1Z0-1072-26 in June 2026. Oracle also removed the calendar year from the credential title in the same release, so the official name is Oracle Cloud Infrastructure Architect Associate while the exam code keeps the -26 suffix. Any material still labelled 1Z0-1072-25 maps to a retired blueprint.

How many questions, how long, and what score passes?

55 multiple-choice questions in 90 minutes, with 68% required to pass. Question types include single answer and multiple answer, and a Scenario-based item can ask you to select two or three correct statements — read the parenthetical carefully, since partially correct multi-selects score as wrong. Budget roughly 95 seconds per question and leave time to revisit flagged multi-selects.

What does the exam cost, and how long is the credential valid?

The standard fee is USD 245 per attempt, delivered through Oracle MyLearn or at a testing centre depending on your region. Oracle Cloud Infrastructure certifications are valid for 24 months from the date earned, and recertification means passing the then-current exam release rather than completing continuing education credits.

Which domains carry the most weight on 1Z0-1072-26?

Networking at 24% and Storage at 20% account for 44% of the paper, followed by Identity and Access Management at 18%, Compute and Database at 14% each, and Observability and Management at 10%. If your practice scores are flat across domains, the fastest gain comes from networking first, because gateway and peering decisions also appear inside compute and database scenarios.

Does the exam require hands-on OCI experience?

There is no formal prerequisite, but Oracle positions the exam for architects who have designed and implemented OCI solutions. The scenario items assume you know how a route table, a security list, and an instance pool interact under failure; candidates who have only read documentation tend to lose points on the failover and replacement questions, which is where the explanations in this bank do the most work.

How does 1Z0-1072-26 differ from the OCI Foundations exam?

1Z0-1085-26 is a 40-question, 60-minute, 65%-to-pass conceptual exam covering what the services are. 1Z0-1072-26 is a 55-question, 90-minute, 68%-to-pass design exam that asks you to choose and justify a configuration — DRG route distribution for selective on-premises access, NSGs for cross-subnet instance targeting, Data Guard maximum availability for zero-data-loss failover. Foundations first, Architect Associate second is the intended order.

Is there a 1Z0-1072-26 practice test in the real 55-question format?

Yes. The bank here is numbered for flat exam-style drilling, and the downloadable PDF carries the same items with answers and explanations for offline review. Run at least one timed 55-question set at 90 minutes before booking, then review every wrong answer by domain so you can see whether the gap is networking design or service-specific detail.