Question bank
Oracle Cloud Infrastructure 2026 Architect Professional
42 Oracle Cloud Infrastructure 2026 Architect Professional questions with the correct answer and a written explanation, organised across 6 exam domains.
- 42 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cloud-Native Solutions
7 questions in this domain
- Question 1Single Choice
What is Oracle Cloud Guard's primary function?
- AConfiguration and activity monitorCorrect answer
- BWeb application firewall
- CNetwork firewall service
- DIdentity policy manager
Why this is the answer
Cloud Guard is a configuration and activity monitor, not a firewall or WAF.
- Question 2Multiple Select
Which two statements are correct about NSGs and Security Lists?
- AThey are mutually exclusive.
- BThey are additive.Correct answer
- CSecurity Lists are applied at the subnet level.Correct answer
- DNSGs are applied at the subnet level.
Why this is the answer
NSGs and Security Lists are additive. Security Lists apply to subnets, while NSG rules apply to VNICs.
- Question 3Interactive
The code block shows a Security Zone resource and a Cloud Guard target. What must be considered when choosing resources for a Security Zone?
- AOnly a specific set of resources is supported.Correct answer
- BAny OCI resource can be placed in a Security Zone.
- CSecurity Zones are attached directly to subnets.
- DSecurity Zones replace IAM policies.
Why this is the answer
Security Zones support a specific set of resources, and not every resource can be placed inside one.
- Question 4Single Choice
When a key is rotated in OCI Vault, what is created?
- AA new key versionCorrect answer
- BRe-encryption of all existing data
- CDeletion of the current key
- DCreation of a new Vault
Why this is the answer
Rotating a key in OCI Vault creates a new key version for new data encryption.
- Question 5Multiple Select
Which two practices prevent over-provisioning IAM permissions?
- AGrant manage permission to every application.
- BUse resource-specific permissions instead of broad manage.Correct answer
- CApply least privilege to IAM grants.Correct answer
- DStore IAM policies inside OCI Vault.
Why this is the answer
Over-provisioning IAM permissions is risky. Resource-specific policies and least privilege reduce access risk.
- Question 6Interactive
The code block references an OCI Vault resource. Which two statements describe the intended scope of OCI Vault?
- AStores encryption keys.Correct answer
- BStores secrets.Correct answer
- CStores large unstructured application data.
- DStores security list rules.
Why this is the answer
OCI Vault manages encryption keys and secrets. It is not an arbitrary data store or network configuration service.
- Question 7Single Choice
Why is a WAF different from a Security List or NSG?
- AWAF operates at the application layer.Correct answer
- BWAF operates only at the network layer.
- CWAF is attached directly to the VCN.
- DWAF replaces Cloud Guard monitoring.
Why this is the answer
WAF protects web application traffic at the application layer; Security Lists and NSGs filter network traffic.
Databases and Storage Operations
6 questions in this domain
- Question 8Single Choice
According to the playbook, which of the following statements best describes the primary role of Oracle Cloud Guard in OCI security?
- AA configuration and activity monitorCorrect answer
- BA firewall that filters VCN traffic
- CA Web Application Firewall for HTTP requests
- DA tool that patches database systems
Why this is the answer
Cloud Guard is a monitoring service that detects configuration risks and activity; it does not replace network-layer or application-layer protections.
- Question 9Multiple Select
According to the OCI security playbook, which of the following are common security traps that architects should avoid? Select all that apply.
- ACloud Guard can replace a WAFCorrect answer
- BSecurity Zones can protect every resourceCorrect answer
- CCloud Guard remediation is always safeCorrect answer
- DNSGs and Security Lists are additive
Why this is the answer
The playbook calls out Cloud Guard/WAF confusion, excessive Security Zone scope, and automated remediation as traps. NSGs and Security Lists can be used together.
- Question 10Interactive
Review the key rotation command shown in the exhibit. Which outcome will occur after the command is successfully executed in OCI Vault?
- AA new key version is createdCorrect answer
- BAll encrypted data is rewritten immediately
- CThe existing key is deleted before rotation
- DThe key is replicated to another region
Why this is the answer
Key rotation creates a new key version for future encryption and decryption operations; existing data remains usable without being rewritten.
- Question 11Single Choice
Based on the common traps in the OCI security playbook, which statement is accurate about the resources supported by Security Zones?
- AOnly a specific set of supported resourcesCorrect answer
- BEvery OCI resource can be included
- CSecurity Zones replace NSGs and Security Lists
- DSecurity Zones filter web traffic at Layer 7
Why this is the answer
Security Zones can be applied to a defined set of OCI resource types; they are not a substitute for network or web application security.
- Question 12Multiple Select
According to the OCI network security guidance, which two statements are correct about NSGs and NSG rules? Select two.
- ANSG and Security List rules are additiveCorrect answer
- BNSGs can be rule sources and destinationsCorrect answer
- CSecurity List rules disable NSG rules
- DNSG rules apply at the subnet level
Why this is the answer
NSGs and Security Lists can be used together, and NSG rules may reference other NSGs. Security Lists are subnet-level, while NSGs apply to VNIC-level resources.
- Question 13Interactive
Inspect the Cloud Guard responder rule in the exhibit. Which two statements represent safe handling for a production compartment? Select two.
- AReview the rule for unintended production impactCorrect answer
- BMonitor responder activity after enabling the ruleCorrect answer
- CAssume automatic remediation is completely safe
- DRemove all approval mechanisms from the rule
Why this is the answer
Automated responder rules in production can have unintended consequences, so organizations should review actions, use approval flows, and monitor responder execution.
High Availability and Disaster Recovery
8 questions in this domain
- Question 14Single Choice
What is the primary function of Oracle Cloud Infrastructure Cloud Guard when monitoring resource configuration and account activity?
- AConfiguration and activity monitorCorrect answer
- BPerimeter firewall
- CWeb application firewall
- DDDoS mitigation service
Why this is the answer
Cloud Guard is a security posture management service that monitors resource configuration and account activity. It is not a network firewall or WAF.
- Question 15Multiple Select
Which statements are true about OCI Security Zones and their supported resource types? Select all that apply.
- ASupport only certain resource typesCorrect answer
- BApply to every resource automatically
- CEnforce policies on contained resourcesCorrect answer
- DAct as a Cloud Guard replacement
Why this is the answer
Security Zones include selected compartments and protect supported resources with security policies. They cannot be applied to every resource and do not replace Cloud Guard.
- Question 16Interactive
Review the Cloud Guard responder configuration in the code block. What should the team consider before enabling automated response in production?
- AUnexpected changes to live resourcesCorrect answer
- BImproved performance for all workloads
- CPermanent deletion of security policies
- DElimination of human security reviews
Why this is the answer
Automated responder actions can modify live resources. You should validate responder rules and understand production impact before enabling automation.
- Question 17Single Choice
In OCI Vault, what is the direct effect of rotating an encryption key instead of re-encrypting data?
- ACreates a new key versionCorrect answer
- BRe-encrypts all stored objects
- CDeletes the current key version
- DRequires a new Vault endpoint
Why this is the answer
Rotating a key creates another version of the key. Existing data encrypted with older versions remains readable and is not automatically re-encrypted.
- Question 18Multiple Select
Which practices help prevent over-provisioning of IAM permissions in Oracle Cloud Infrastructure? Select all that apply.
- AGrant manage only when neededCorrect answer
- BUse broad manage for every app
- CScope policies to resource typesCorrect answer
- DAssign maximum privilege roles
Why this is the answer
Avoid granting manage by default. Scope policies to required resources and lifecycles, reducing blast radius and accidental changes.
- Question 19Interactive
Examine the code snippet that defines a subnet security list and a VNIC NSG. How do these two constructs work together?
- ATheir rules are additiveCorrect answer
- BOnly the NSG rules apply
- COnly the security list rules apply
- DThey cannot be combined
Why this is the answer
Security lists and NSGs are not mutually exclusive. When both apply, their security rules are evaluated together in an additive manner.
- Question 20Single Choice
In OCI networking, where is a Network Security Group applied to enforce its security rules?
- AIndividual VNICsCorrect answer
- BThe whole VCN
- CEach subnet
- DRoute tables
Why this is the answer
NSGs are applied to selected VNICs, while security lists are applied at the subnet level. Applying an NSG to a subnet is a common misconception.
- Question 21Multiple Select
Which statements are correct about NSG-to-NSG rules in Oracle Cloud Infrastructure? Select all that apply.
- AAn NSG can be a rule sourceCorrect answer
- BAn NSG can be a rule destinationCorrect answer
- CRules accept only CIDR sources
- DNSGs remove need for security lists
Why this is the answer
NSG rules can use NSGs as source or destination to allow traffic between groups of VNICs. This does not eliminate the need for security lists.
Hybrid, Multicloud, and Migration
6 questions in this domain
- Question 22Single Choice
What is the primary role of Cloud Guard in Oracle Cloud Infrastructure?
- AMonitors configuration and user activity.Correct answer
- BFilters traffic between subnets.
- CReplaces IAM for access management.
- DEncrypts data in object storage.
Why this is the answer
Cloud Guard is a security monitoring service in OCI; it detects configuration risks and activity anomalies. It is not a firewall, IAM service, or encryption service.
- Question 23Multiple Select
Which statements about OCI Security Zones and resource support are accurate?
- AThey can be applied to any OCI resource.
- BThey support a specific set of OCI resource types.Correct answer
- CThey can be extended to non-OCI resources.
- DThey enforce stricter policies on the resources they support.Correct answer
Why this is the answer
Security Zones are not blanket protections for all resources. They have a defined supported resource set and do not extend to non-OCI resources.
- Question 24Interactive
A Vault key is processed with the command in the code block. What is the effect on the key?
- ACreates a new key version for future encryption.Correct answer
- BRe-encrypts all data using a new key.
- CPermanently deletes the old key.
- DDisables the key for all future use.
Why this is the answer
OCI Vault key rotation creates a new key version. Existing data is not re-encrypted, and the previous key is not deleted; re-encryption is a separate operation.
- Question 25Single Choice
An application receives the Manage permission but only needs to read objects. Why should this be corrected?
- AIt prevents the workload from reading objects.
- BIt violates least privilege and grants excessive control.Correct answer
- CIt creates a new Vault key automatically.
- DIt disables encryption on the bucket.
Why this is the answer
Manage permission grants full control over the service. Read-only workloads should receive only read permissions. Over-provisioning increases risk of accidental or malicious changes.
- Question 26Multiple Select
Which statements about OCI Security Lists and Network Security Groups are correct?
- ASecurity Lists and NSGs are mutually exclusive.
- BSecurity Lists are associated with a subnet.Correct answer
- CNSGs are associated with VNICs.Correct answer
- DNSG rules can reference another NSG as source or destination.Correct answer
Why this is the answer
Security Lists apply at the subnet level while NSGs apply to VNICs. NSG-to-NSG rules are supported, and both mechanisms are additive rather than mutually exclusive.
- Question 27Interactive
The code block shows an inbound traffic path. Which statement about WAF is correct?
- AIt is inserted directly into a VCN subnet.
- BIt is attached along the edge path before the load balancer.Correct answer
- CIt replaces the VCN Security Lists and NSGs.
- DIt filters all network traffic inside the VCN.
Why this is the answer
OCI WAF is deployed at an edge, such as a load balancer, not directly inside the VCN. It complements rather than replaces Security Lists and NSGs.
Observability and Management
4 questions in this domain
- Question 28Single Choice
Which statement most accurately describes Oracle Cloud Infrastructure Cloud Guard?
- AA network firewall that filters traffic between VCNs.
- BA configuration and activity monitor that identifies insecure configurations and suspicious activity.Correct answer
- CA web application firewall that protects HTTP endpoints.
- DA service that stores secrets and rotates keys.
Why this is the answer
Cloud Guard is a configuration and activity monitoring service, not a firewall, WAF, or key management service.
- Question 29Multiple Select
Which two statements are true about OCI Cloud Guard and Security Zones?
- ACloud Guard is an activity and configuration monitoring service.Correct answer
- BA Security Zone can be applied to any OCI resource, including unsupported services.
- CEnabling an automated Cloud Guard responder is always safe in production.
- DA Security Zone supports only a specific set of OCI resources.Correct answer
Why this is the answer
Cloud Guard monitors configuration and activity, while Security Zones support a defined set of resources. Automated remediation is not always safe in production.
- Question 30Interactive
The code block shows a command used by an administrator. What is the result of running this command?
- AIt deletes the current key and all data encrypted with it.
- BIt re-encrypts existing ciphertext with a new cryptographic key.
- CIt creates a new version of the existing key for future encryption and decryption.Correct answer
- DIt permanently disables the key for all future use.
Why this is the answer
Rotating a key in OCI Vault creates a new version of the key. It does not immediately re-encrypt existing data or delete the previous version.
- Question 31Single Choice
Which statement about Network Security Groups (NSGs) and Security Lists in OCI is correct?
- AThey are mutually exclusive and cannot be used together.
- BThey are additive; both can contribute to the security posture of a VCN.Correct answer
- CNSGs are applied at the subnet level, while Security Lists are applied at the instance VNIC level.
- DAn NSG rule and a Security List rule cannot both apply to the same traffic.
Why this is the answer
NSGs and Security Lists can be used together. Security Lists are subnet-level, while NSGs are applied to VNICs, and both can apply to the same traffic.
Security
11 questions in this domain
- Question 32Single Choice
Which statement best describes Oracle Cloud Infrastructure Cloud Guard?
- AMonitors configuration and activity for security risks.Correct answer
- BFilters network traffic as a stateful firewall.
- CBlocks SQL injection at the application layer.
- DProvides DNS resolution for private zones.
Why this is the answer
Cloud Guard is a security monitoring service for configuration and activity. It is not a firewall, WAF, or DNS service.
- Question 33Multiple Select
Which two statements about Security Zones and supported resources are true?
- AAny OCI resource can be added.
- BOnly specific resource types are supported.Correct answer
- CEvery resource is in a zone by default.
- DResource type support must be verified first.Correct answer
Why this is the answer
Security Zones do not apply to every OCI resource; only supported resource types can be members. Compatibility should be verified first.
- Question 34Interactive
A Cloud Guard responder in a production environment completes successfully. What should the security team conclude?
- ANo further action is required.
- BManual validation and monitoring are still required.Correct answer
- CRun the same responder in every compartment.
- DRemove the responder execution rules.
Why this is the answer
Even a successful automated remediation can have unintended effects, especially in production. Review and monitor the result before closing the issue.
- Question 35Single Choice
What occurs when an OCI Vault key is rotated?
- AOld key deleted immediately after rotation.
- BNew key version created; old versions still available.Correct answer
- CAll existing data is automatically re-encrypted.
- DRotation changes the key algorithm to AES.
Why this is the answer
Key rotation creates a new key version and does not replace re-encryption. Previous versions are retained so existing data can still be decrypted.
- Question 36Multiple Select
Which two actions avoid over-provisioning OCI IAM permissions?
- AGrant manage access to all users.
- BGrant the minimum access required.Correct answer
- CAdd broad permissions by default.
- DGroup users and policies by job function.Correct answer
Why this is the answer
Least privilege and job-based groups prevent over-broad grants. A default of manage-level access is an over-provisioning risk.
- Question 37Interactive
A compute instance is protected by both the NSG and the security list in the code block. How should their rules be applied?
- AThey are mutually exclusive; only one can apply.
- BThey are additive; both rule sets apply.Correct answer
- CThe NSG overrides the security list.
- DThe security list makes the NSG unnecessary.
Why this is the answer
NSGs and security lists are additive, not mutually exclusive. Both sets of rules can apply, so effective access is a combination.
- Question 38Single Choice
What is the correct attachment model for network security groups and security lists?
- ANSGs target subnets, security lists target VNICs.
- BNSGs target VNICs, security lists target subnets.Correct answer
- CBoth target route tables.
- DBoth target internet gateways.
Why this is the answer
NSG rules are applied to VNICs while security list rules apply at the subnet level. Confusing these attachment points is common.
- Question 39Multiple Select
Which statements about NSG-to-NSG rules are correct?
- AAnother NSG can be a source or destination.Correct answer
- BReferences must cross to another VCN.
- CNSG membership defines traffic scope in these rules.Correct answer
- DNSG references are disabled by default.
Why this is the answer
An NSG rule can use another NSG as source or destination, and the referenced resources are those in that NSG. It is not restricted to a single subnet.
- Question 40Interactive
Review the WAF resource relationship in the code block. Where is this OCI WAF policy being applied?
- AThe VCN itself
- BA load balancer endpointCorrect answer
- CThe subnet route table
- DThe internet gateway
Why this is the answer
OCI WAF is associated with load balancers or public endpoints, not with the VCN itself. The code shows a load balancer target.
- Question 41Single Choice
What must be verified before placing an OCI resource into a Security Zone?
- AResource type is supported by Security Zones.Correct answer
- BResource has a public IP address.
- CResource is in a separate compartment.
- DResponder is attached to the resource.
Why this is the answer
Security Zones support a defined set of resource types. Always validate resource compatibility first.
- Question 42Multiple Select
When a new security policy is deployed, which tasks belong to the monitor phase?
- AReview logs and alerts for policy violations.Correct answer
- BEnable dashboards and notifications for the policy.Correct answer
- CTurn off auditing after implementation.
- DWait for an incident before monitoring.
Why this is the answer
The monitor phase is essential after deployment. It includes reviewing logs and setting up alerts so policy violations become visible.
Frequently asked questions
Everything about the Oracle Cloud Infrastructure 2026 Architect Professional question bank and how to use it.