Question bank
Oracle Cloud Infrastructure 2026 Security Professional
42 Oracle Cloud Infrastructure 2026 Security Professional questions with the correct answer and a written explanation, organised across 6 exam domains.
- 42 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Improving Cloud Security Posture
8 questions in this domain
- Question 1Single Choice
Why is learning about OCI security services important for professionals who want to improve their cloud security posture?
- AThey provide capabilities for protecting cloud resources.Correct answer
- BThey entirely remove cloud security risks.
- CThey only increase OCI workload costs.
- DThey are used only after an incident occurs.
Why this is the answer
Understanding OCI security services is foundational because these services are the capabilities used to secure Oracle Cloud Infrastructure resources.
- Question 2Multiple Select
Which statements about OCI security services are true? Select all that apply.
- AThey help secure OCI resources.Correct answer
- BThey can improve cloud security posture.Correct answer
- CThey are the focus of the playbook title.Correct answer
- DThey are designed for payroll management.
Why this is the answer
OCI security services support securing cloud resources, improving cloud security posture, and are the main topic indicated by the source title.
- Question 3Interactive
Refer to the source heading in the code block. What is the primary subject introduced by that heading?
- AOracle Cloud Infrastructure security servicesCorrect answer
- BOracle Cloud Infrastructure billing processes
- COracle Cloud Infrastructure compute pricing
- DOracle Cloud Infrastructure network cabling specifications
Why this is the answer
The heading explicitly introduces OCI security services as the document subject, which aligns with the playbook title.
- Question 4Single Choice
What would a new OCI learner most reasonably expect from a guide called Understanding OCI Security Services?
- AAn introduction to Oracle Cloud Infrastructure security servicesCorrect answer
- BInstructions for configuring Oracle Cloud billing groups
- CGuidance for choosing OCI data center locations
- DProcedures for applying on-premises firewall patches
Why this is the answer
The title clearly signals an introduction to OCI security services; the other choices refer to unrelated operational or billing topics.
- Question 5Multiple Select
Which purposes are indicated by the document title Understanding OCI Security Services? Select all that apply.
- AExplain available OCI security servicesCorrect answer
- BSupport foundational security posture learningCorrect answer
- CIntroduce controls for protecting cloud workloadsCorrect answer
- DRemove security controls from OCI environments
Why this is the answer
The source title and target domain indicate learning about OCI security services and improving security posture, not eliminating security controls.
- Question 6Interactive
Review the code block containing the document title. What does the leading symbol in that title indicate?
- AIt marks the line as the main document heading.Correct answer
- BIt marks the line as a private database column.
- CIt marks the line as a multi-line comment.
- DIt marks the line as an unformatted command.
Why this is the answer
In documentation formatting, a single # at the start of a line denotes a main heading, and here it introduces the document title.
- Question 7Single Choice
How does understanding OCI security services directly support an improved cloud security posture?
- AIt helps select and apply appropriate protections.Correct answer
- BIt guarantees successful compliance audits every time.
- CIt removes the need for any OCI risk assessment.
- DIt makes cloud security controls unnecessary.
Why this is the answer
Knowing available security services allows professionals to identify and apply relevant protections, which improves overall cloud security posture.
- Question 8Multiple Select
Which foundational concepts are likely covered in the OCI security services playbook? Select all that apply.
- ACore OCI security servicesCorrect answer
- BWays to improve cloud security postureCorrect answer
- CSecurity basics for Oracle Cloud InfrastructureCorrect answer
- DDebugging unrelated business applications
Why this is the answer
The content title and target domain focus on OCI security services and cloud security posture; unrelated application debugging is outside that scope.
Managing Identity and Access
9 questions in this domain
- Question 9Single Choice
Which Oracle Cloud Infrastructure service is responsible for controlling access to OCI resources?
- AIdentity and Access ManagementCorrect answer
- BCloud Guard
- COCI Vault
- DWeb Application Firewall
Why this is the answer
Identity and Access Management (IAM) is the OCI service used to control access to cloud resources through users, groups, and policies.
- Question 10Multiple Select
Which of the following are core elements managed by OCI Identity and Access Management? Select all that apply.
- AIAM usersCorrect answer
- BIAM groupsCorrect answer
- CIAM policiesCorrect answer
- DVirtual cloud networks
Why this is the answer
IAM manages users, groups, policies, dynamic groups, and compartments. VCNs are network resources handled by OCI Networking.
- Question 11Interactive
Refer to the command shown in the code block. What action will the command perform?
- ALists users in a compartmentCorrect answer
- BCreates a new IAM user
- CDeletes an existing IAM group
- DAssigns a policy to a group
Why this is the answer
The CLI command uses the list action for IAM users and a compartment ID, so it returns user records for that compartment.
- Question 12Single Choice
In OCI, what is the main purpose of an IAM policy?
- AThey define access to resourcesCorrect answer
- BThey store encryption keys
- CThey collect security events
- DThey isolate network traffic
Why this is the answer
IAM policies state who may perform which actions on which OCI resources, making them the main access-control mechanism.
- Question 13Multiple Select
Which statements accurately describe compartments in OCI IAM? Select all that apply.
- AThey organize and isolate resourcesCorrect answer
- BThey help control resource accessCorrect answer
- CThey can be nested hierarchicallyCorrect answer
- DThey are equivalent to regions
Why this is the answer
OCI compartments are logical containers for organizing resources and applying access policies. They can be nested and are not the same as regions.
- Question 14Interactive
Review the IAM policy statement shown in the code block. What access does it grant?
- AEngineers can manage compute resources in ProjectACorrect answer
- BEngineers can manage resources in all compartments
- CAll users can manage ProjectA resources
- DEngineers can delete IAM policies
Why this is the answer
The policy allows only members of the Engineers group to manage instance resources inside ProjectA, matching the group, action, and location.
- Question 15Single Choice
In OCI, to whom should an IAM policy statement normally grant access?
- AIAM groupsCorrect answer
- BAPI keys
- CSubnet CIDR blocks
- DUser email lists
Why this is the answer
Applying policies to groups is an IAM best practice because permissions are easier to manage as users join or leave the group.
- Question 16Multiple Select
Which actions improve security for OCI user accounts? Select all that apply.
- AEnable multi-factor authenticationCorrect answer
- BRotate credentials regularlyCorrect answer
- CAvoid sharing user secretsCorrect answer
- DPost passwords in shared team spaces
Why this is the answer
MFA, credential rotation, and avoiding shared secrets reduce account risk. Storing secrets in a shared location violates security best practices.
- Question 17Interactive
After running the OCI CLI command in the code block, what output should be returned?
- AA list of IAM policiesCorrect answer
- BA list of IAM users
- CA list of subnets in OCI
- DA list of API keys
Why this is the answer
The policy list command is used with the OCI CLI to display IAM policies in the stated compartment.
Managing Security Operations
4 questions in this domain
- Question 18Single Choice
What is the primary purpose of Oracle Cloud Infrastructure (OCI) Security Services?
- ATo protect OCI resources and workloadsCorrect answer
- BTo increase network latency
- CTo manage database indexes
- DTo create compute instances
Why this is the answer
OCI Security Services exist to protect resources and workloads running in Oracle Cloud Infrastructure.
- Question 19Multiple Select
Which of the following are typical capabilities included in OCI Security Services? (Select all that apply.)
- AIdentity and access managementCorrect answer
- BThreat monitoring and detectionCorrect answer
- CEncryption and key managementCorrect answer
- DPredictive data mining
Why this is the answer
OCI Security Services include identity and access management, threat monitoring, and encryption and key management. Predictive data mining is not a core security service capability.
- Question 20Interactive
Complete the list of OCI security services by selecting the missing element.
- AVulnerability Scanning ServiceCorrect answer
- BLoad Balancer
- CAutonomous Database
- DObject Storage
Why this is the answer
Vulnerability Scanning Service is a recognized OCI security service that helps identify security vulnerabilities in cloud resources.
- Question 21Single Choice
Which of the following is an example of an OCI security service?
- AIdentity and Access ManagementCorrect answer
- BContent Delivery Network
- CData Integration
- DQueue
Why this is the answer
Identity and Access Management is an OCI security service used to manage users, groups, and access permissions.
Network, Platform, and Infrastructure Security
9 questions in this domain
- Question 22Single Choice
Which statement accurately describes a Network Security Group (NSG) in Oracle Cloud Infrastructure?
- AVirtual firewall for a set of VNICsCorrect answer
- BPhysical appliance in the data center
- CDNS resolver for all OCI domains
- DBackup scheduler for block volumes
Why this is the answer
An NSG is a virtual firewall applied to selected VNICs, providing stateful security rules for the associated resources in a VCN.
- Question 23Multiple Select
Which statements about OCI Security Lists and Network Security Groups are true?
- ASecurity Lists apply to all VNICs in the associated subnet.Correct answer
- BNSGs can be scoped to one resource or a selected group of VNICs.Correct answer
- CSecurity Lists replace the IAM policy engine.
- DNSGs block outbound traffic only.
Why this is the answer
Security Lists filter traffic for every VNIC in a subnet, while NSGs provide more granular rules for specific resources or VNICs. Neither replaces OCI IAM.
- Question 24Interactive
After the OCI CLI command shown in the code block is executed, what type of resource is listed?
- ANetwork Security Groups in the specified VCNCorrect answer
- BSecurity Lists assigned to the VCN subnets
- CRoute tables for the VCN
- DVirtual Cloud Networks in the tenancy
Why this is the answer
The oci network nsg list command lists the Network Security Groups that exist in the specified compartment and VCN.
- Question 25Single Choice
Which OCI service continuously monitors cloud resources for misconfigurations, threats, and suspicious activity?
- ACloud GuardCorrect answer
- BBastion
- CVault
- DNetwork Security Group
Why this is the answer
Cloud Guard continuously monitors OCI resources and workloads for security misconfigurations, suspicious activities, and threat indicators.
- Question 26Multiple Select
Which OCI network components can act as virtual firewalls inside a VCN?
- ASecurity ListsCorrect answer
- BNetwork Security GroupsCorrect answer
- CInternet Gateway
- DRoute Table
Why this is the answer
Security Lists and Network Security Groups are virtual firewall components. Route tables and internet gateways direct or extend network connectivity but do not act as firewalls.
- Question 27Interactive
What is the result of running the OCI CLI command shown in the code block?
- ANew security list in the target VCNCorrect answer
- BNew public subnet in the target VCN
- CNew VCN with no subnets
- DNew IAM group for network administrators
Why this is the answer
The oci network security-list create command creates a new Security List in the specified VCN and compartment.
- Question 28Single Choice
Which OCI service provides a managed, private SSH path to compute resources that do not have public endpoints?
- ABastion serviceCorrect answer
- BVault service
- CObject Storage service
- DCloud Guard
Why this is the answer
OCI Bastion is a managed service that provides secure and monitored access to private compute resources without requiring a public endpoint.
- Question 29Multiple Select
Which statements are correct about OCI Security Zones?
- ASecurity zones can prevent creation of resources that violate security policies.Correct answer
- BA security zone uses a compartment with enforced security policies.Correct answer
- CSecurity zones are used to delete unused VCNs.
- DSecurity zones cannot restrict any resource creation.
Why this is the answer
OCI Security Zones create compartments that enforce maximum-security policies. Noncompliant resource creation is denied or restricted by those zone policies.
- Question 30Interactive
The command shown in the code block updates a Security List. Which statements about the resulting traffic policy are correct?
- AAllows inbound TCP traffic on port 443Correct answer
- BApplies the rule to all resources using that Security ListCorrect answer
- CBlocks all HTTP traffic on port 80
- DDeletes the VCN after the update
Why this is the answer
The rule permits inbound TCP traffic to port 443 from all sources. A Security List rule is enforced at the subnet level for all VNICs associated with that subnet.
Securing Applications and Data
8 questions in this domain
- Question 31Single Choice
Which Oracle Cloud Infrastructure service controls who can sign in to and use cloud resources?
- AOCI Identity and Access ManagementCorrect answer
- BOCI Compute
- COCI Object Storage
- DOCI Virtual Cloud Network
Why this is the answer
OCI IAM manages users, groups, and policies and defines who can access OCI resources and how.
- Question 32Multiple Select
Which two options are core OCI Identity and Access Management building blocks? Select two.
- AIAM usersCorrect answer
- BIAM groupsCorrect answer
- COCI Compute instances
- DOCI Object Storage buckets
Why this is the answer
IAM users and groups are basic identity constructs; compute instances and storage buckets are infrastructure resources that IAM policies protect.
- Question 33Interactive
An administrator runs the OCI CLI command shown in the code block. What resource is being retrieved?
- AIAM userCorrect answer
- BIAM group
- CDynamic group
- DIdentity provider
Why this is the answer
The command uses oci iam user get with a user OCID, so it retrieves details for a specific IAM user.
- Question 34Single Choice
What is the main purpose of a security list in an OCI VCN?
- AIt controls network traffic at the subnet levelCorrect answer
- BIt provides authentication for API access
- CIt encrypts data at rest
- DIt manages IAM user passwords
Why this is the answer
A security list applies allow and deny rules to network traffic entering and leaving subnets.
- Question 35Multiple Select
Which two services help detect security threats and vulnerabilities across OCI? Select two.
- AOCI Cloud GuardCorrect answer
- BOCI Vulnerability Scanning ServiceCorrect answer
- COCI Compute
- DOCI Object Storage
Why this is the answer
Cloud Guard detects risky configurations, and Vulnerability Scanning Service reports vulnerabilities in hosts and containers.
- Question 36Interactive
The OCI CLI command in the code block requests a key operation on a customer-managed key. What is the operation?
- AEncryptCorrect answer
- BDecrypt
- CGenerate a data encryption key
- DCreate a vault
Why this is the answer
The oci kms crypto encrypt command encrypts the supplied plaintext with a customer-managed key in OCI Vault.
- Question 37Single Choice
What is the primary use of OCI Vault?
- ASecure storage and lifecycle management of secrets and encryption keysCorrect answer
- BVirtual network isolation for compute resources
- CDatabase vulnerability assessment
- DUser authentication at the cloud console
Why this is the answer
OCI Vault stores secrets such as database credentials and manages customer-managed encryption keys.
- Question 38Multiple Select
Which three elements can be included in an OCI IAM policy statement? Select three.
- AGroupCorrect answer
- BVerbCorrect answer
- CTarget resource typeCorrect answer
- DRegion
Why this is the answer
An IAM policy statement follows a pattern such as allow group to verb resource-type in location; region is not one of these required components.
Understanding OCI Security Services
4 questions in this domain
- Question 39Single Choice
Which Oracle Cloud Infrastructure (OCI) service centrally manages users, groups, and authorization rules?
- AOCI Identity and Access Management (IAM)Correct answer
- BOCI Vault
- COCI Cloud Guard
- DOCI Security Zones
Why this is the answer
OCI Identity and Access Management (IAM) is the central service for managing identities, groups, roles, and policies.
- Question 40Multiple Select
Which of the following are OCI services that provide security capabilities? Select all that apply.
- ACloud GuardCorrect answer
- BVaultCorrect answer
- CSecurity ZonesCorrect answer
- DOCI Object Storage
Why this is the answer
Cloud Guard, Vault, and Security Zones represent OCI security services. Object Storage is a storage service, although it supports encryption.
- Question 41Interactive
The command displayed in the code block is intended to configure a resource to be monitored by a cloud-native security service. Which OCI security service is being configured?
- AOCI Cloud GuardCorrect answer
- BOCI Vault
- COCI Identity and Access Management
- DOCI Audit
Why this is the answer
Cloud Guard targets determine the resources that Cloud Guard monitors and analyzes for security threats. The provided command creates a Cloud Guard target.
- Question 42Single Choice
Which OCI service is a centralized, secure store for master encryption keys and confidential secrets?
- AOCI VaultCorrect answer
- BOCI Audit
- COCI Security Zones
- DOCI Cloud Guard
Why this is the answer
OCI Vault stores and controls access to master encryption keys and secrets, helping protect data in OCI.
Frequently asked questions
Everything about the Oracle Cloud Infrastructure 2026 Security Professional question bank and how to use it.