Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) Practice Exam

What the Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) exam covers

• Identity and Access Management100 questions
• Networking188 questions
• Compute156 questions
• Storage172 questions

Free 1Z0-1072-25 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 616.

1. Question 1Compute

   A retail analytics team runs a Java service that is memory-bound (needs about 256 GB RAM) but uses only 8 OCPUs. Which shape lets them size OCPU count and memory independently to match this ratio without paying for unused cores?

   • AVM.Standard.E4.Flex, custom sizedCorrect
   • BBM.Standard.E4.128 bare metal
   • CVM.DenseIO.E4.Flex
   • DVM.Standard2.16 fixed shape
   ✓ Correct answer: A

   VM.Standard.E4.Flex is correct because flexible shapes decouple OCPU count from memory allocation, letting the team provision exactly 8 OCPUs while independently sizing memory toward 256 GB to match this memory-bound Java service. Flexible shapes bill only for the OCPU and memory actually selected within a supported per-OCPU range, instead of forcing a preset bundle, so no core capacity goes unused.

   Why the other options are wrong

   • BBM.Standard.E4.128 bare metal is a fixed 128-OCPU physical server with a locked memory ratio, far more cores than the 8 needed and not billed per core.
   • CVM.DenseIO.E4.Flex adds physically attached NVMe SSD for local storage IO, which this CPU-and-memory-bound service does not use or need.
   • DVM.Standard2.16 is a rigid, non-flexible fixed shape whose preset OCPU-to-memory ratio cannot be retuned to fit this workload.
2. Question 2Compute

   A team created an Instance Pool but instances are all landing in the same fault domain, creating a single point of failure within the availability domain. What should the architect check or adjust?

   • AThe boot volume performance tier of each instance
   • BThe Instance Pool's fault domain distribution settingCorrect
   • CThe Object Storage tier used by the custom image
   • DThe IAM policy attached to the compartment
   ✓ Correct answer: B

   The correct fix is the Instance Pool's fault domain distribution setting, because when a pool's placement configuration is left unconfigured to spread, every new instance can land in the same fault domain, creating exactly the single point of failure described. Fault domains are logical hardware groupings within an availability domain that do not share power or hardware failure points, so distributing pool instances across all three available fault domains lets a rack-level hardware issue affect only some members instead of the whole fleet. Boot volume tier, image storage tier, and IAM policy are all unrelated configuration areas that would not explain or fix this placement problem.

   Why the other options are wrong

   • ABoot volume performance tier affects storage I/O speed and has no bearing on which fault domain an instance lands in.
   • CThe Object Storage tier used by a custom image affects storage cost and access, not fault domain placement of instances.
   • DIAM policy attached to a compartment governs permissions and access, not the physical fault domain placement of instances.
3. Question 3Compute

   A high-frequency trading workload running on OKE needs near bare-metal CPU performance with no hypervisor overhead on the worker nodes. What should the architect choose?

   • AVirtual node pool
   • BManaged node pool using bare metal shapesCorrect
   • COCI Functions
   • DOCI Container Instances
   ✓ Correct answer: B

   Managed node pools can use bare metal Compute shapes as worker nodes, giving the trading workload dedicated physical CPU cores, memory, and network bandwidth with no hypervisor layer scheduling or stealing cycles between tenants, which is exactly the near-bare-metal performance and latency consistency a high-frequency trading engine needs.

   Why the other options are wrong

   • AVirtual node pools run pods on Oracle-managed shared infrastructure rather than customer-dedicated bare metal hardware, so they cannot guarantee the same latency consistency.
   • COCI Functions is a serverless FaaS model built for short, event-driven invocations, not a persistent, low-latency trading process needing dedicated CPU.
   • DContainer Instances run on shared virtualized infrastructure and do not offer the dedicated, hypervisor-free performance guarantees bare metal shapes provide.
4. Question 4Identity and Access Management

   A company's architecture calls for StorageAdmins to fully manage Block Volumes and Volume Groups, but not Object Storage buckets, scoped to compartment Data. Complete the policy: Allow group StorageAdmins to manage ___ in compartment Data

   • Aobject-family
   • Ball-resources
   • Cbuckets
   • Dvolume-familyCorrect
   ✓ Correct answer: D

   volume-family is correct because it is the OCI aggregate resource-type that bundles Block Volumes, boot volumes, and volume groups together, letting StorageAdmins fully manage block storage with a single statement scoped to compartment Data.

   Why the other options are wrong

   • Aobject-family is the Object Storage aggregate resource-type; granting manage on it is the opposite of the block-storage-only requirement.
   • Ball-resources would also hand StorageAdmins control over Object Storage buckets and every other resource type in the compartment.
   • Cbuckets is a narrower Object Storage resource-type, still unrelated to Block Volumes and outside what StorageAdmins should manage.
5. Question 5Identity and Access Management

   Why is periodic IAM policy review and optimization considered an architectural best practice rather than a one-time task?

   • AOCI automatically deletes unused policies every 90 days
   • BPolicies expire automatically after one year
   • CPolicy optimization is only relevant during initial setup
   • DAccess needs evolve, causing policies to drift from least privilegeCorrect
   ✓ Correct answer: D

   Policy review is ongoing rather than one-time because the answer correctly identifies the real driver: access needs evolve as teams reorganize, projects end, and workloads change shape, so a policy scoped correctly at launch accumulates unused grants or becomes too broad over months and years. Only a recurring audit cadence, the kind IAM Policy Optimization is built to support, catches that drift and pulls the tenancy back toward least privilege. The other options describe automatic OCI behaviors, expiring policies or auto-deleted grants, that simply do not exist; policies persist unchanged until someone explicitly modifies or removes them, which is precisely why human-driven review remains necessary.

   Why the other options are wrong

   • AOCI does not automatically delete unused policies on any schedule; they remain in effect until explicitly changed or removed.
   • BPolicies carry no built-in expiration date; they stay active indefinitely until someone modifies or deletes them.
   • CAccess needs keep evolving long after initial setup, which is exactly why ongoing review remains valuable throughout the tenancy's life.
6. Question 6Networking

   Two private subnets in the same VCN both need the exact same routing: a NAT Gateway route and a Service Gateway route, nothing else. What is the simplest route table design?

   • ACreate a separate identical route table for each
   • BAssociate both subnets with one shared route tableCorrect
   • CMerge the two subnets into a single subnet
   • DLeave one subnet without any route table
   ✓ Correct answer: B

   Because both subnets require identical routing, one rule to a NAT Gateway and one to a Service Gateway, the simplest design is to create a single route table containing exactly those two rules and associate it with both subnets. OCI does not require a one-to-one relationship between subnets and route tables; any number of subnets within the same VCN can share one route table as long as their needs are the same. This avoids duplicated configuration that would otherwise need to be kept in sync manually every time a rule changes, reducing both setup effort and the chance of the two tables drifting apart over time.

   Why the other options are wrong

   • ACreating two separate but identical route tables adds ongoing maintenance overhead, requiring every future change to be applied twice, with no functional benefit.
   • CMerging the subnets into one changes the network design and address boundaries unnecessarily just to satisfy a routing convenience.
   • DEvery subnet in OCI must have an associated route table; leaving one subnet without any is not a valid configuration.
7. Question 7Networking

   A company already has FastConnect established for accessing OCI Object Storage over public peering, and now also needs private connectivity into their VCN's compute instances over the same physical cross-connect. What should the architect add?

   • AA second physical cross-connect only
   • BA NAT Gateway in the VCN
   • CA private peering virtual circuitCorrect
   • DA Local Peering Gateway
   ✓ Correct answer: C

   A private peering virtual circuit is correct because OCI allows multiple virtual circuits, both public peering and private peering, to be provisioned over the same physical FastConnect cross-connect. The company already has the physical connection in place for public peering to Object Storage, so rather than building new physical infrastructure, the architect simply requests a second virtual circuit configured for private peering, which attaches to the DRG and enables routing directly into the VCN's compute instances.

   Why the other options are wrong

   • AA new physical cross-connect is unnecessary; a new virtual circuit can be provisioned on the existing physical connection to add private peering.
   • BA NAT Gateway supports outbound internet access for private subnets and plays no role in inbound FastConnect routing to compute instances.
   • DA Local Peering Gateway connects VCNs within the same region to each other; it does not provide on-premises-to-VCN connectivity.
8. Question 8Networking

   A troubleshooting engineer runs Network Path Analyzer between a client on-premises and an OCI load balancer's private IP, and the tool reports the path is reachable through the DRG, route tables, and security rules, yet users still report connection failures. What should the engineer check next, since Path Analyzer only evaluates configuration, not live traffic?

   • ARecreate the DRG entirely
   • BApplication or backend health statusCorrect
   • CDelete the Network Visualizer diagram
   • DReduce the VTAP capture filter scope
   ✓ Correct answer: B

   Since Network Path Analyzer already confirmed the configuration path, the DRG, route tables, and security rules, is reachable, the root cause of the reported failures must lie outside what a static configuration tool can evaluate. Path Analyzer never generates or observes live traffic, so it cannot detect problems like an unhealthy backend, an application that is not listening, or a failing health check at the load balancer. The next logical step is to check the application's or backend set's actual live health status, which reflects real runtime behavior rather than configuration correctness. Recreating the DRG or touching the Visualizer diagram would not help, since neither addresses a live, application-layer problem.

   Why the other options are wrong

   • AThe DRG path was already confirmed reachable by the tool, recreating it does not address an application-level issue.
   • CDeleting or examining the Network Visualizer diagram has no bearing on a live connectivity failure, it is purely a static topology rendering.
   • DVTAP filter scope adjustments affect mirroring, not the root cause of a live failure the analyzer cannot detect.
9. Question 9Storage

   A bare metal database server needs several additional data volumes attached. Which attachment type must be used?

   • AParavirtualized, for the simplest ongoing management
   • BEither type, chosen at random by the platform
   • CiSCSI, since bare metal instances require itCorrect
   • DAn NFS-based attachment through a mount target
   ✓ Correct answer: C

   Paravirtualized attachment relies on the hypervisor to present the volume as a virtual device, but bare metal instances run directly on physical hardware with no hypervisor layer for OCI to insert that abstraction into, so bare metal shapes can only attach Block Volumes using the iSCSI protocol, configured through the guest OS's iSCSI initiator. This is a hard platform constraint tied to the shape type, not a preference or a random assignment made by the platform. NFS-based mount targets belong to File Storage Service and are a completely separate concept from attaching block-level storage to a compute instance, so they do not apply here at all.

   Why the other options are wrong

   • AParavirtualized attachment depends on a hypervisor abstraction layer that bare metal shapes do not have, so it is simply not available on bare metal.
   • BThe attachment type available to a shape is a hard platform constraint tied to hardware, not a random choice made by the platform.
   • DNFS-based mount targets are a File Storage Service concept for network file shares, entirely separate from attaching block-level storage to a compute instance.
10. Question 10Storage

    A software vendor's build-artifact bucket has highly unpredictable access patterns: some artifacts are pulled daily for months, others go cold within days. The vendor wants to minimize storage cost without building custom automation to track per-object access recency. What is the most operationally simple solution?

    • AWrite a nightly CLI script to move objects
    • BSet a fixed 10-day lifecycle rule
    • CEnable Auto-Tiering on the bucketCorrect
    • DEnable cross-region replication
    ✓ Correct answer: C

    Enabling Auto-Tiering is the most operationally simple solution because it tracks each object's actual access recency automatically at the bucket level, moving hot artifacts to Standard and cold ones to Infrequent Access without the vendor writing or maintaining any custom scripts or fixed-age rules.

    Why the other options are wrong

    • AA custom nightly CLI script can work, but it requires ongoing engineering effort to build and maintain when a built-in OCI feature already solves the same problem natively.
    • BA fixed 10-day lifecycle rule ignores actual access recency and can mis-tier artifacts that are still being pulled daily well past the tenth day.
    • DCross-region replication copies data to another region for redundancy or disaster recovery; it does not change an object's storage tier or reduce cost based on access.

Who this Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) practice exam is for

This practice set is for anyone preparing for the Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) exam at the intermediate level - from first-time candidates building a foundation to experienced Oracle Cloud practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) exam.

Related Oracle Cloud resources

• Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) study guideKey concepts
• Oracle Cloud practice examsAll Oracle Cloud
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) practice examRelated
• Oracle Cloud Infrastructure 2025 Generative AI Professional (1Z0-1127-25) practice examRelated

Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) practice exam FAQ