Question bank
Oracle Cloud Infrastructure 2026 Security Associate
30 Oracle Cloud Infrastructure 2026 Security Associate questions with the correct answer and a written explanation, organised across 4 exam domains.
- 30 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Core OCI Services
6 questions in this domain
- Question 1Single Choice
A company wants to use Oracle Cloud Infrastructure together with Microsoft Azure for separate parts of its applications. Which architecture does this describe?
- AMulti-cloudCorrect answer
- BHybrid cloud
- CSingle cloud
- DOn-premises deployment
Why this is the answer
Using two or more public cloud providers is a multi-cloud model. A hybrid cloud includes a mix of private and public cloud environments, and a single cloud relies on only one public vendor.
- Question 2Multiple Select
An organization adopts a multi-cloud model and includes Oracle Cloud Infrastructure as one of the providers. Which two benefits are generally expected from this approach?
- AIt lowers dependence on a single provider.Correct answer
- BIt allows use of different providers' strengths.Correct answer
- CIt requires all workloads to use one provider.
- DIt prevents any possibility of network outages.
Why this is the answer
Multi-cloud reduces vendor lock-in and lets organizations use the strongest services from each provider. It does not require a single provider and does not eliminate the possibility of network outages.
- Question 3Interactive
An administrator runs the command shown in the code block. What is the expected output?
- AThe Object Storage namespace of the tenancyCorrect answer
- BA list of all buckets in the compartment
- CThe OCID of the root compartment
- DThe availability domain name
Why this is the answer
The command in the code block returns the Object Storage namespace for the current tenancy. It does not list buckets, return compartment OCIDs, or show availability domains.
- Question 4Single Choice
A cloud administrator needs to create a logically isolated private network for several OCI Compute instances. Which OCI core service should be used?
- AVirtual Cloud Network (VCN)Correct answer
- BObject Storage bucket
- CAutonomous Database
- DIdentity and Access Management (IAM)
Why this is the answer
A VCN is a software-defined private network in Oracle Cloud Infrastructure and is the core service used for isolated network environments. Object Storage stores data, Autonomous Database is a managed database, and IAM controls access.
- Question 5Multiple Select
Which two statements accurately describe how Oracle Cloud Infrastructure can participate in a multi-cloud environment?
- AOCI can connect to other clouds privately.Correct answer
- BAccess policies are usually provider-specific.Correct answer
- CSecurity is synchronized automatically by OCI.
- DAll workloads must remain inside OCI.
Why this is the answer
In a multi-cloud environment, OCI can connect to other clouds through private links or VPNs. Each provider has its own IAM model, so access policies are usually provider-specific; security is not synchronized automatically.
- Question 6Interactive
A security administrator reviews the OCI policy shown in the code block. Which two outcomes are allowed for the group named in the policy?
- AManage VCNs in the production compartment.Correct answer
- BManage route tables in the production compartment.Correct answer
- CLaunch compute instances in the production compartment.
- DView but not change VCNs in the production compartment.
Why this is the answer
The policy grants manage access to virtual-network-family in the production compartment. This includes VCNs and related networking resources such as route tables, but it does not include compute instances and is not read-only.
Introduction to Multi-cloud
3 questions in this domain
- Question 7Single Choice
Which statement best defines multi-cloud?
- AUsing at least two public cloud providersCorrect answer
- BUsing several regions of a single provider
- CCombining on-premises with one public provider
- DDeploying only within a private cloud
Why this is the answer
Multi-cloud is defined by the use of public cloud services from at least two different providers. A single provider, even across many regions, does not qualify as multi-cloud.
- Question 8Multiple Select
Which two options are recognized benefits of a multi-cloud strategy?
- AReduces dependency on a single cloud providerCorrect answer
- BAllows use of best-of-breed services from multiple providersCorrect answer
- CPrevents any workload from running in a private data center
- DForces all workloads into the same cloud region
Why this is the answer
Multi-cloud helps organizations avoid vendor lock-in and select the strongest available services from each provider. It does not require eliminating private data centers or consolidating everything into one region.
- Question 9Interactive
Refer to the configuration metadata in the code block. How should this environment be classified?
- AMulti-cloudCorrect answer
- BHybrid cloud
- CSingle cloud
- DOn-premises only
Why this is the answer
The descriptor lists two public cloud providers and does not indicate on-premises infrastructure. This environment is therefore a multi-cloud architecture rather than a hybrid cloud.
Multi-cloud Connection Options
9 questions in this domain
- Question 10Single Choice
What is the best definition of multi-cloud for an organization that combines Oracle Cloud Infrastructure with Microsoft Azure?
- AUsing at least two cloud providersCorrect answer
- BUsing one cloud provider worldwide
- CConnecting one cloud to on-premises
- DUsing regions in a single provider
Why this is the answer
Multi-cloud refers to the use of services from at least two different public cloud providers, for example OCI for compute and Azure for machine learning, instead of relying on a single provider.
- Question 11Multiple Select
A startup chooses OCI for database workloads and Microsoft Azure for machine learning. Which two benefits does this multi-cloud approach provide?
- AAvoiding vendor lock-inCorrect answer
- BChoosing best-fit servicesCorrect answer
- CUsing one private cloud
- DRemoving access controls
Why this is the answer
A multi-cloud strategy helps an organization avoid vendor lock-in and select best-of-breed services, although it often introduces extra management and security complexity.
- Question 12Interactive
Review the network requirement shown in the code block. Which OCI connection option should be selected to satisfy this multi-cloud requirement?
- AOracle Interconnect for Microsoft AzureCorrect answer
- BOCI Site-to-Site VPN
- COCI Internet Gateway
- DOCI Object Storage bucket
Why this is the answer
This scenario describes Oracle Interconnect for Microsoft Azure, which creates a private, high-bandwidth path between OCI and Azure. VPNs use the public internet; storage cannot create network linkage.
- Question 13Single Choice
When a consumer application runs on OCI and Microsoft Azure, which party is ultimately responsible for classifying and protecting the data?
- AThe customer organizationCorrect answer
- BOracle only
- CMicrosoft only
- DNo one, because cloud providers manage security
Why this is the answer
Under the shared responsibility model, the cloud provider secures the infrastructure it controls, but the customer must protect workloads, classify data, and meet compliance obligations across all clouds.
- Question 14Multiple Select
A network architect compares an internet-based VPN with a dedicated private interconnect in a multi-cloud topology. Which two conditions favor the dedicated interconnect?
- ALatency-sensitive application trafficCorrect answer
- BLarge, steady data transfer volumesCorrect answer
- CShort-term testing without high bandwidth
- DMinimal monthly network expenditure
Why this is the answer
Direct private interconnects provide more consistent latency and throughput than IPsec VPNs. Temporary workloads and cost-limited projects are normally better served by a VPN or public internet path.
- Question 15Interactive
Inspect the connectivity properties shown in the code block. Which two statements are true about the type of connection represented?
- AIt establishes an IPsec-secured tunnelCorrect answer
- BIt uses the public internet as transportCorrect answer
- CIt is a dedicated physical connection
- DIt provides no confidentiality protection
Why this is the answer
A site-to-site VPN uses IPsec encryption and sends packets over the public internet. It is not a dedicated physical circuit, and IPsec protects the tunnel from eavesdropping and tampering.
- Question 16Single Choice
A Site-to-Site VPN connects a remote network to an OCI VCN. Which component must be set up on the customer side?
- ACustomer premises equipmentCorrect answer
- BOCI Cloud Shell
- COCI compute instance
- DPublic API gateway
Why this is the answer
A Site-to-Site VPN requires a customer premises equipment (CPE) object that represents the customer-side router or firewall used as the IPsec endpoint.
- Question 17Multiple Select
A company must connect an OCI VCN to a remote office network. Which two OCI methods are valid for establishing external network connectivity?
- AOCI FastConnectCorrect answer
- BOCI Site-to-Site VPNCorrect answer
- COCI Resource Manager
- DOCI Cloud Shell
Why this is the answer
FastConnect provides dedicated private connectivity, and Site-to-Site VPN uses encrypted tunnels over the internet. Resource Manager and Cloud Shell are management tools, not network links.
- Question 18Interactive
Read the connection profile in the code block. Which statement correctly describes how the configured link is routed?
- AUses a dedicated, non-public pathCorrect answer
- BUses an IPsec tunnel over the internet
- CUses DNS resolution for routing
- DUses the public internet as transport
Why this is the answer
FastConnect provisions a dedicated private path between OCI and a customer or partner location. Its traffic does not travel over the public internet, unlike a VPN or internet gateway.
Oracle Database Service for Azure (ODSA)
12 questions in this domain
- Question 19Single Choice
What is the primary definition of a multi-cloud strategy?
- AUsing services from more than one cloud providerCorrect answer
- BUsing only one cloud provider for all workloads
- CHosting applications only in on-premises data centers
- DDeploying a single service across multiple regions of one provider
Why this is the answer
A multi-cloud strategy involves using services from multiple cloud providers, helping organizations avoid dependency on a single vendor and enabling workload placement across providers.
- Question 20Multiple Select
Which of the following are common reasons for adopting a multi-cloud architecture? Select all that apply.
- AAvoiding vendor lock-inCorrect answer
- BChoosing best-of-breed servicesCorrect answer
- CImproving resilience and disaster recoveryCorrect answer
- DGuaranteeing a single pricing model
Why this is the answer
Multi-cloud adoption often enables vendor independence, best-of-breed service selection, and stronger resilience. It does not guarantee a single pricing model across providers.
- Question 21Interactive
Review the code block and identify the cloud service it represents in the context of multi-cloud Oracle database workloads.
- AAzure Database for PostgreSQL
- BOracle Database Service for AzureCorrect answer
- COCI Object Storage
- DAzure Event Hubs
Why this is the answer
The code block describes a multi-cloud offering that connects Oracle databases with Azure services. Oracle Database Service for Azure matches this description.
- Question 22Single Choice
What distinguishes Oracle Database Service for Azure?
- AIt provides Oracle database services through Microsoft AzureCorrect answer
- BIt runs exclusively in customer on-premises data centers
- CIt is available only to healthcare organizations
- DIt replaces all IAM policies in Azure Active Directory
Why this is the answer
Oracle Database Service for Azure is designed to make Oracle database services available to Azure users while automating interconnectivity between the Oracle Cloud and Microsoft Azure environments.
- Question 23Multiple Select
Which requirements are typically addressed by interconnecting OCI and Microsoft Azure in a multi-cloud deployment? Select all that apply.
- ARunning Oracle Database workloads close to Azure applicationsCorrect answer
- BMinimizing network latency for integrated workloadsCorrect answer
- CUsing consistent identity and access controls across cloudsCorrect answer
- DReplacing every cloud workload with physical servers
Why this is the answer
Interconnecting OCI and Azure supports low-latency workloads, consistent management, and shared control strategies. Physical server replacement is not a cloud integration goal.
- Question 24Interactive
Using the code block as a hint, choose the correct security control for protecting database resources in a multi-cloud environment.
- AOCI IAM compartments and policiesCorrect answer
- BAzure Blob Storage tiers
- CDNS name resolution
- DLoad balancer health checks
Why this is the answer
The code block refers to boundary-based access and resource organization. OCI Identity and Access Management uses compartments and policies for that purpose.
- Question 25Single Choice
Which service is used in OCI to define user access and permissions?
- AIdentity and Access ManagementCorrect answer
- BObject Storage
- CVCN Flow Logs
- DAutonomous Data Warehouse
Why this is the answer
OCI Identity and Access Management, commonly called IAM, is the service responsible for managing users, groups, compartments, and resource access policies.
- Question 26Multiple Select
Which options are considered security best practices for database resources in a multi-cloud architecture? Select all that apply.
- AEncrypting data in transit and at restCorrect answer
- BApplying least-privilege access policiesCorrect answer
- CAuditing user and system activityCorrect answer
- DDisabling all network security lists and firewalls
Why this is the answer
Encryption, least-privilege access, and auditing are essential security controls. Removing network protections would increase the risk of unauthorized access.
- Question 27Interactive
Match the code block to the correct cloud concept for managing logical isolation of OCI resources.
- ACompartmentCorrect answer
- BObject lifecycle policy
- CAutonomous Database backup
- DAzure Virtual WAN hub
Why this is the answer
A compartment is a logical container in OCI used to isolate and organize cloud resources while providing a boundary for IAM policies.
- Question 28Single Choice
What is the main purpose of using OCI Vault in a database deployment?
- ASecure storage and management of encryption keysCorrect answer
- BGlobal DNS routing
- CManaged website content delivery
- DAutomated application UI testing
Why this is the answer
OCI Vault is designed for securely storing and managing keys and secrets, which protects database data and supports encryption strategies.
- Question 29Multiple Select
Which network-level controls can be used to restrict traffic to Oracle databases hosted in OCI? Select all that apply.
- AVirtual Cloud Network security listsCorrect answer
- BNetwork Security GroupsCorrect answer
- CVCN traffic rulesCorrect answer
- DOracle Cloud billing reports
Why this is the answer
OCI network security relies on VCN security lists, Network Security Groups, and related traffic rules. Billing reports do not restrict database network traffic.
- Question 30Interactive
Use the code block to identify which security monitoring service records OCI resource operations.
- AOCI AuditCorrect answer
- BOCI Notifications
- COracle GoldenGate
- DAzure DevOps
Why this is the answer
OCI Audit records API calls and operational events, providing a history of actions performed on OCI resources.
Frequently asked questions
Everything about the Oracle Cloud Infrastructure 2026 Security Associate question bank and how to use it.