Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) Practice Exam

What the Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) exam covers

• Getting Started with OCI96 questions
• Core OCI Services304 questions
• Security Services150 questions
• Governance and Administration96 questions

Free 1Z0-1085-25 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 646.

1. Question 1Core OCI Services

   In OCI Compute, what is the key difference between a Virtual Machine (VM) instance and a Bare Metal instance?

   • AA VM instance can only run Windows, while Bare Metal only runs Linux
   • BA VM instance runs on shared, virtualized hardware; Bare Metal is dedicatedCorrect
   • CA VM instance has no boot volume, while Bare Metal always includes one
   • DA VM instance cannot be stopped, while Bare Metal can be stopped anytime
   ✓ Correct answer: B

   The key difference is virtualization: a VM instance shares one physical server's CPU, memory, and network among several tenants through a hypervisor, whereas a Bare Metal instance dedicates the entire physical server to a single customer with no hypervisor in between. This distinction drives real decisions - Bare Metal removes virtualization overhead and eliminates any noisy-neighbor risk, which matters for licensing terms that forbid virtualization or workloads demanding maximum, isolated performance. Instance type has nothing to do with operating system - both VM and Bare Metal support the same platform and custom images - and boot volumes and stop/start behavior apply equally to both, so neither is a true differentiator.

   Why the other options are wrong

   • AOS choice does not separate VM from Bare Metal; both instance types support the same Linux and Windows platform and custom images equally.
   • CBoth VM and Bare Metal instances boot from a boot volume; the presence of one is not what distinguishes the two types.
   • DBoth instance types can be stopped and restarted through their lifecycle; stoppability is not a distinguishing trait between VM and Bare Metal.
2. Question 2Core OCI Services

   What is OCI Container Engine for Kubernetes (OKE)?

   • AA tool for encrypting container images at rest
   • BA fully managed Kubernetes service; Oracle runs the control planeCorrect
   • CA managed relational database for containerized applications
   • DA billing dashboard for tracking container usage
   ✓ Correct answer: B

   OCI Container Engine for Kubernetes is a managed service: Oracle provisions, patches, and operates the Kubernetes control plane, including the API server and etcd, so customers never have to run that infrastructure themselves. What stays with the customer is everything above that line, the worker nodes and the containerized workloads scheduled onto them. That split is the whole proposition of managed Kubernetes, standard upstream behaviour without the operational burden of the control plane.

   Why the other options are wrong

   • AEncrypting container images at rest is handled by underlying storage and key management services, not a defining feature of OKE.
   • CA managed relational database is part of the separate Database service family, unrelated to OKE's container orchestration role.
   • DOKE is a container orchestration service that runs Kubernetes workloads, not a billing dashboard for tracking usage.
3. Question 3Core OCI Services

   A company is migrating an existing on-premises Oracle Database and wants to keep the same OS-level control and database version compatibility it has today. Which OCI service best supports this lift-and-shift approach?

   • ANoSQL Database Cloud Service
   • BBase Database ServiceCorrect
   • CMySQL Database Service
   • DAutonomous Data Warehouse Serverless
   ✓ Correct answer: B

   Base Database Service runs VM and Bare Metal DB systems under a co-managed model: the customer keeps OS-level access and administers the Oracle Database software directly, which is the same level of control the team exercised on-premises. That is what makes it a genuine lift-and-shift target. The database engine and version stay the same, so the application does not have to be rewritten, and the operational habits built around OS access still apply. A fully automated service or a different engine would force a rewrite or surrender exactly the control the requirement protects.

   Why the other options are wrong

   • ANoSQL Database Cloud Service uses a different, schema-flexible data model, unsuitable for directly migrating an existing relational Oracle Database.
   • CMySQL Database Service runs an entirely different database engine, requiring application rewrites rather than a direct lift-and-shift of an Oracle Database.
   • DAutonomous Data Warehouse Serverless abstracts away OS-level control entirely, conflicting with the stated need to retain that control.
4. Question 4Core OCI Services

   What does it mean for a security rule in OCI to be stateful?

   • AIt applies only during scheduled maintenance windows
   • BIt must be re-entered after every instance restart
   • CPermitted return traffic is automatically allowedCorrect
   • DIt applies only to Object Storage endpoints
   ✓ Correct answer: C

   A stateful security rule tracks the connection when the initiating traffic is allowed, and automatically permits the corresponding return traffic without requiring a separate rule for the reverse direction, which is why most default security list and NSG rules in OCI are stateful. This connection-tracking behavior significantly reduces the number of rules an administrator must write and maintain, since only the direction that starts the conversation needs an explicit rule. It has nothing to do with maintenance windows, surviving instance restarts, or being limited to any single service such as Object Storage.

   Why the other options are wrong

   • AStatefulness describes automatic tracking of a connection's return traffic, not any behavior tied to scheduled maintenance windows.
   • BSecurity rules persist through instance restarts regardless of statefulness; needing re-entry after a restart is not what stateful describes.
   • DStateful behavior is a general property of security rules across all traffic types, not something limited to Object Storage endpoints.
5. Question 5Core OCI Services

   Without versioning enabled on a bucket, what happens when an object with the same name is uploaded again?

   • AOCI automatically renames the new object
   • BThe object is automatically moved to Infrequent Access
   • CThe upload is rejected until the old object is deleted
   • DThe new object overwrites the previous objectCorrect
   ✓ Correct answer: D

   A bucket without versioning has no mechanism for keeping more than one copy of a given object name, so a new upload with that name replaces the prior content outright and the previous bytes are gone. This is the default behaviour, and it is precisely what enabling versioning changes: with versioning on, the same upload would create a new version and leave the old one retrievable. Object Storage never renames, rejects, or re-tiers an upload on its own to resolve a name collision.

   Why the other options are wrong

   • AOCI does not automatically rename an incoming object to avoid a naming collision with an existing object of the same name.
   • BMoving an object into the Infrequent Access tier is an unrelated tier-transition action, not what happens on a same-name re-upload.
   • CAn upload is not blocked or rejected just because an object with that name already exists in the bucket.
6. Question 6Governance and Administration

   What must a customer do to keep using paid OCI resources after the Free Trial period expires?

   • AContact Oracle legal department
   • BRe-register for a new trial
   • CNo action is needed
   • DUpgrade to a paid accountCorrect
   ✓ Correct answer: D

   Oracle requires a deliberate action from the customer, upgrading the account to a paid, billed status, in order to keep any previously trial-funded paid resources running past the 30 day window. If the customer takes no action, those paid resources are stopped once trial credit runs out or expires, and only resources qualifying as Always Free continue operating. This explicit-upgrade requirement protects customers from being unexpectedly billed just because a trial period elapsed, while still giving them a clear, straightforward path, upgrading through the Console, to keep their environment running exactly as it was if they choose to continue.

   Why the other options are wrong

   • AContacting a legal department has no role in converting a trial account into a billed, paid OCI account.
   • BSimply re-registering for a new trial does not restore or continue resources that were running on the original, now-expired trial credit.
   • CContinuing to use paid resources is not automatic; an explicit upgrade action from the customer is required after the trial ends.
7. Question 7Governance and Administration

   An OCI Monitoring alarm triggered by a CPU utilization metric is typically used to notify an operator through which service?

   • ASecurity Zones
   • BNotificationsCorrect
   • CVault
   • DBastion
   ✓ Correct answer: B

   Monitoring is responsible for detecting that a metric, such as CPU utilization, has crossed the threshold defined on an alarm, but the actual delivery of that alert to a person or system is handled by Notifications. The alarm publishes a message to a Notifications topic, and any subscribers of that topic, whether an email address, an SMS number, or a function, then receive the alert. This division of responsibility, Monitoring detects and Notifications delivers, is a common pattern across OCI's operational services, letting each service focus on a distinct part of the alerting pipeline.

   Why the other options are wrong

   • ASecurity Zones enforces policy compliance against resources placed in a zone; it plays no part in delivering alert messages.
   • CVault manages encryption keys and secrets and has no mechanism for delivering operational alerts to subscribers.
   • DBastion provides temporary secure access to hosts without public exposure, unrelated to alert delivery.
8. Question 8Getting Started with OCI

   A multinational company serves customers in both North America and Europe. Which deployment gives users on both continents the lowest network latency to the application?

   • ADeploy in a single region and rely only on Fault Domains
   • BDeploy everything in one Availability Domain worldwide
   • CServe all customers from a Roving Edge device
   • DDeploy identical stacks in a region near each customer groupCorrect
   ✓ Correct answer: D

   When users are spread across widely separated geographies, latency is dominated by physical distance, so the only way to reduce it for both groups is to run the application in more than one region, each near a concentration of users, with traffic steered to the closer deployment. Every in-region resilience construct operates below the scale of this problem. Fault Domains and Availability Domains protect against hardware and data-center failures inside one region; neither shortens the path from Europe to a stack running in North America.

   Why the other options are wrong

   • AFault Domains address hardware resilience within one region, they do nothing to reduce the physical network distance to users on another continent.
   • BThere is no such thing as a single Availability Domain covering the whole world, and it would not solve the latency problem regardless.
   • CRoving Edge devices are meant for disconnected or portable field scenarios, not for reducing latency for a distributed customer base.
9. Question 9Security Services

   An employee leaves and console access must be revoked immediately for their local account. What should be done?

   • ADisable or delete the user accountCorrect
   • BDelete the compartment they used
   • CRotate the tenancy's root key
   • DCreate a new dynamic group
   ✓ Correct answer: A

   Disable or delete the user account is correct because access in OCI IAM is tied directly to the specific user identity, so the fastest and most precise way to cut off a departed employee's console and API access is to act on that individual account, either disabling it immediately or deleting it outright, without touching any shared resources or other users' access. Deleting the compartment they happened to use would instead destroy or orphan resources that may be shared by the whole team, rotating a nonexistent tenancy root key is not a real action, and creating a new dynamic group has no bearing on a specific person's access at all.

   Why the other options are wrong

   • BDeleting the compartment could destroy or disrupt resources shared with other team members, not just cut off this one person's access.
   • CThere is no such thing as a tenancy root key to rotate; that is not a real OCI IAM construct or action.
   • DCreating a new dynamic group has no effect whatsoever on an existing, departed employee's console or API access.
10. Question 10Security Services

    Which term describes a predefined condition Cloud Guard uses to flag a resource as noncompliant, such as a security list open to 0.0.0.0/0?

    • AA responder condition
    • BA vault key policy
    • CA detector ruleCorrect
    • DA bastion session policy
    ✓ Correct answer: C

    A detector rule is the specific, predefined condition Cloud Guard evaluates against a resource to decide whether it is noncompliant, such as checking whether a security list permits inbound traffic from every source address. Individual rules are grouped into a detector recipe, and that recipe is applied to a target, which sets the compartment scope Cloud Guard monitors. When a rule matches, Cloud Guard opens a problem, and responders are the separate half of the service that acts on problems once they exist.

    Why the other options are wrong

    • AThere is no standard Cloud Guard concept called a responder condition; responders act on problems already found rather than defining detection criteria.
    • BA vault key policy governs how an encryption key may be used within Vault, an entirely separate identity-and-encryption concern from detection.
    • DA bastion session policy governs who can open a temporary access session to a private host, unrelated to flagging noncompliant resources.

Who this Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) practice exam is for

This practice set is for anyone preparing for the Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) exam at the foundational level - from first-time candidates building a foundation to experienced Oracle Cloud practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) exam.

Related Oracle Cloud resources

• Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) study guideKey concepts
• Oracle Cloud practice examsAll Oracle Cloud
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Oracle Cloud Infrastructure 2025 Generative AI Professional (1Z0-1127-25) practice examRelated
• Oracle Cloud Infrastructure 2025 Architect Associate (1Z0-1072-25) practice examRelated

Oracle Cloud Infrastructure 2025 Foundations Associate (1Z0-1085-25) practice exam FAQ