OracleProfessional level1Z0-1067-25

1Z0-1067-25 exam dumps: 138 free OCI 2025 Cloud Operations Professional practice questions

Free 1Z0-1067-25 practice questions for the Oracle Cloud Infrastructure 2025 Cloud Ops Professional exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 138 by number, or take a timed practice exam.

Question bank last updated May 2025

Start timed practice exam Browse all 138 questions

Free 1Z0-1067-25 practice questions

Questions 1 to 10 of 138

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

1Z0-1067-25 Question 1

Single answer

Your organization manages three separate compartments in Oracle Cloud Infrastructure (OCI) for development, testing, and production. You need to ensure each new environment applies mandatory tags to resources and remains consistent across all compartments. Which approach best achieves this objective?

A
Use OCI Resource Manager with a single Terraform configuration. Leverage variables for environment-specific details and set up tag defaults in each compartment.
B
Use the OCI Console to manually deploy resources for each environment, applying tags by hand as needed.
C
Create environment-specific CLI scripts without referencing any tagging structure, relying on manual checks to ensure tagging compliance.
D
Maintain separate Resource Manager stacks for each environment, leaving tags optional for teams to apply.

Show answer and explanation

Correct answer: A

Explanation

Using OCI Resource Manager as an Infrastructure as Code (IaC) solution with Terraform is the recommended approach to create consistent, repeatable deployments across multiple environments. Employing variables for environment-specific values allows for easy scalability and maintainability, while configuring tag defaults in each compartment ensures that mandatory tags are automatically and uniformly applied to newly created resources. For further details on tag defaults and Terraform best practices, refer to Oracle� documentation on Resource Manager and managing tags in the OCI console.

A. Correct.
Option 1 is correct. By using a single Terraform configuration for multiple environments, you can parameterize environment-specific settings through variables, ensuring consistent deployment. Additionally, configuring tag defaults in each compartment guarantees that required tags are automatically applied to any new resource, reducing the risk of manual errors and ensuring uniformity.
B. Incorrect.
Option 2 is incorrect. While using the OCI Console can work for small environments, manual deployments and tagging often lead to inconsistent configurations and increased operational overhead. It also becomes more challenging to audit and version-control these changes.
C. Incorrect.
Option 3 is incorrect. Relying on custom CLI scripts without an automated tagging structure complicates compliance and consistency efforts. Human error in updates can result in missing mandatory tags and inconsistencies in deployed resources.
D. Incorrect.
Option 4 is incorrect. While having separate stacks can make sense for certain scaling or isolation requirements, keeping tags optional undermines the goal of consistent compliance. Mandatory tagging should be enforced through tag defaults or required attributes, not left to individual teams.

1Z0-1067-25 Question 2

Select 2

You are creating a new application environment in Oracle Cloud Infrastructure (OCI) using Resource Manager. The environment requires that all compute instances be provisioned in a dedicated compartment with the VM.Standard3.Flex shape, that each resource be tagged with a department cost-tracking key, and that you can easily re-deploy the entire environment if needed. Which two actions must you take to ensure your deployment meets these requirements?

A
A. Define Terraform variables for the compartment and shape in your configuration, then upload the configuration as a stack to Resource Manager.
B
B. Explicitly define the compartment and shape in the OCI Console before creating any instances, then import those resources into Resource Manager.
C
C. Configure a tag namespace with a key for department cost tracking, and reference that key in your Terraform resource definitions.
D
D. Use a manual workflow to add the department tag to each resource after the instances are provisioned.

Show answer and explanation

Correct answers: A, C

Explanation

To automate resource provisioning with consistent shapes, compartments, and tags, you should leverage Oracle Resource Manager's stack-based workflows. By defining Terraform variables and referencing tags within the Terraform configurations, you ensure each new resource follows your standards without manual intervention. This approach also allows for straightforward environment re-deployment. For more information, refer to the official Oracle Cloud Infrastructure Resource Manager documentation at https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm.

A. Correct.
A. Correct. Defining Terraform variables for the compartment and shape allows you to systematically control your resource configuration. Uploading the configuration as a Resource Manager stack ensures that all subsequent deployments match these parameters.
B. Incorrect.
B. Incorrect. While you can provision resources via the console first and then import them into Resource Manager, this approach is more cumbersome and doesn't inherently guarantee that subsequent resources meet the shape and compartment requirements. It also complicates automation.
C. Correct.
C. Correct. Creating a tag namespace and tagging key helps enforce consistent cost-tracking. Including that tag reference in your Terraform resource blocks ensures the tag is automatically applied each time those resources are provisioned.
D. Incorrect.
D. Incorrect. Manually adding tags is error-prone and does not align with the automated approach that Resource Manager provides. To reliably ensure each resource is tagged, you should define the tags in your IaC (Infrastructure as Code) templates or a tagging policy.

1Z0-1067-25 Question 3

Single answer

You have a running Compute instance in Oracle Cloud Infrastructure (OCI) 2025 located in a 'Dev' compartment, but your organization now requires the instance to be managed under the 'Prod' compartment for compliance. You want to minimize downtime and avoid recreating resources. Which approach should you take?

A
Use the 'Move Resource to Another Compartment' functionality in the OCI Console or API, ensuring 'Prod' has the necessary IAM policies in place to host the instance.
B
Terminate the instance in 'Dev' and recreate it in 'Prod' using a custom image, ensuring you replicate all associated resources manually.
C
Open a service request with Oracle Support to export the instance configuration and then import it into the 'Prod' compartment.
D
Edit the instance's metadata to change the compartment attribute to 'Prod' and restart the instance to apply the change.

Show answer and explanation

Correct answer: A

Explanation

In OCI 2025, you can use the 'Move Resource to Another Compartment' feature to relocate resources such as Compute instances without terminating them. Before moving resources, ensure the target compartment has the correct IAM policies granting required permissions. Refer to the official Oracle Cloud Infrastructure documentation on moving resources between compartments for additional details and best practices.

A. Correct.
Correct. OCI supports moving many resource types, including Compute instances, between compartments without terminating them. You must ensure appropriate IAM policies exist in the target compartment. This approach minimizes resource downtime.
B. Incorrect.
Incorrect. While this method eventually places the instance in the 'Prod' compartment, it involves unnecessary downtime and manual replication of resources, which is not the recommended approach.
C. Incorrect.
Incorrect. Moving resources between compartments is an OCI feature you can perform directly in the Console or via the API. You do not need to open a service request for this task.
D. Incorrect.
Incorrect. Simply editing metadata is not a supported method for changing a resource� compartment. The correct procedure involves using the OCI Console or API to perform a compartment move.

1Z0-1067-25 Question 4

Single answer

You manage a multi-tier application on Oracle Cloud Infrastructure (OCI) and need to consistently deploy and manage the same set of resources (Compute instances, networking components, and autonomous database) across multiple environments (Dev, Test, and Production). Which approach provides the most efficient way to replicate and manage these resources in a standardized manner?

A
Manually create each environment through the OCI Console steps every time
B
Use Terraform-based stack definitions in Oracle Resource Manager to automate deployments
C
Rely on custom shell scripts exclusively to clone resources from one environment to another
D
Create a single large compartment containing all environments for easier administration

Show answer and explanation

Correct answer: B

Explanation

Terraform-based automation through Oracle Resource Manager is a recommended best practice for standardizing resource deployment. This infrastructure-as-code approach ensures consistent environments, easy updates, and clear version control. Refer to the Oracle Cloud Infrastructure Resource Manager documentation for guidelines on creating and managing stacks with Terraform for multi-environment deployments.

A. Incorrect.
Manual creation through the OCI Console is error-prone and does not ensure consistent replication of environments, especially when the setup grows more complex.
B. Correct.
Using Terraform-based stack definitions in Oracle Resource Manager allows you to define and version your configurations as code, ensuring fast, repeatable, and error-free environments deployment across stages.
C. Incorrect.
Shell scripts might reduce some manual work, but they can become difficult to maintain, are less standardized than Terraform, and may not integrate as cleanly with Oracle Resource Manager.
D. Incorrect.
Combining all environments into a single compartment is discouraged because it mixes dev, test, and production resources, complicating security, billing, and access control.

1Z0-1067-25 Question 5

Select 2

Your organization is preparing to deploy a new microservices-based application in Oracle Cloud Infrastructure (OCI) across separate Development, Testing, and Production compartments. The team needs a consistent way to define and manage infrastructure for each environment, track and review all infrastructure changes, and quickly roll back if necessary. Which TWO approaches align with OCI best practices for deploying and managing these resources?

A
Use Infrastructure as Code with Terraform managed by OCI Resource Manager, store your Terraform files in a version control repository, and create separate stacks for each environment.
B
Use a single Terraform stack for all environments, specifying environment variables at runtime from the command line without version control integration.
C
Implement a CI/CD pipeline that automatically runs Terraform validation and plan steps in the Development and Testing compartments first, then applies changes to Production upon approval, storing all Terraform code in a Git repository.
D
Manually provision identical resources in each environment using the OCI Console and keep configuration details in an offline spreadsheet for tracking changes.
E
Use a locally stored custom script with the OCI CLI to generate resource definitions in YAML files, updated separately for each environment without a shared repository.

Show answer and explanation

Correct answers: A, C

Explanation

Oracle Cloud Infrastructure recommends using Infrastructure as Code (IaC) and a version control system to ensure consistency, repeatability, and traceability across your environments. By adopting Terraform with OCI Resource Manager and integrating with CI/CD pipelines, teams can validate changes in Development and Testing compartments before safely promoting them to Production. For additional guidance, consult the OCI Resource Manager documentation at https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resource-manager-overview.htm.

A. Correct.
Correct. Managing resources with Infrastructure as Code and using OCI Resource Manager for separate Terraform stacks in each environment is a recommended approach. Storing the Terraform files in a version control system (like Git) allows you to track, review, and roll back changes easily.
B. Incorrect.
Incorrect. Using a single Terraform stack without version control provides limited visibility into environment-specific changes and makes it challenging to audit or roll back configurations over time.
C. Correct.
Correct. A CI/CD pipeline that validates and plans Terraform changes in lower environments before applying them in Production follows best practices. Storing code in a Git repository ensures consistent tracking, review, and rollback capabilities.
D. Incorrect.
Incorrect. Manually replicating resources across multiple environments is prone to human error and does not provide a straightforward method for auditing or rolling back changes, which goes against recommended Infrastructure as Code practices.
E. Incorrect.
Incorrect. While the OCI CLI is useful, storing YAML definitions in a local directory without a centralized version control system or automation introduces complexity. It does not offer the same repeatability and traceability as Terraform-based Infrastructure as Code with proper version control.

1Z0-1067-25 Question 6

Select 2

Your organization is deploying a multi-tier application using Oracle Cloud Infrastructure (OCI) Resource Manager with Terraform. Different teams have created separate compartments for production and development resources. However, when you run your Resource Manager job, it fails with authorization errors indicating that required operations are not permitted in the target compartments. You need to fix these errors so you can deploy resources across multiple compartments in a single Terraform run. Which two actions should you take to resolve this issue?

A
1. Update or create appropriate IAM policies in the root compartment granting the Resource Manager service the ability to manage resources in the target compartments.
B
1. Configure your Resource Manager Stack to use separate tenancy IDs for each compartment to avoid permission conflicts.
C
1. Specify the compartment OCID for each resource in the Terraform configuration (e.g., using the 'compartment_id' attribute) to ensure resources are created in the intended compartments.
D
1. Add a local Terraform variable file that only includes the target_compartment IDs, so Resource Manager does not require cross-compartment access.

Show answer and explanation

Correct answers: A, C

Explanation

To deploy and manage OCI resources across multiple compartments using Resource Manager, you must grant Resource Manager the appropriate IAM policies and specify the correct compartment IDs in your Terraform configuration. Refer to the Oracle Cloud Infrastructure documentation on Resource Manager and IAM policies (https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm and https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm) for detailed guidance on setting up cross-compartment access.

A. Correct.
Option 1: CORRECT. The Resource Manager service (or the user/group running it) must have explicit IAM permissions to create and manage resources in different compartments. Creating or updating a policy in the root compartment to allow these operations is essential. Without proper IAM policies, Resource Manager is blocked from acting within the target compartments.
B. Incorrect.
Option 2: INCORRECT. A single tenancy ID is used for your overall OCI tenancy. You do not configure multiple tenancy IDs for separate compartments. Compartments are logical subdivisions within the same tenancy. Thus, using separate tenancy IDs is not a valid approach.
C. Correct.
Option 3: CORRECT. In your Terraform configuration, each resource must specify the correct target compartment (for example, using 'compartment_id' = var.prod_compartment_ocid) to ensure that the resource is deployed where you intend. This step is crucial when deploying into multiple compartments.
D. Incorrect.
Option 4: INCORRECT. Simply storing compartment IDs in a local variable file does not eliminate the need for Resource Manager to have permissions to manage resources across compartments. It also does not replace the requirement to define the correct compartment for each resource in Terraform.

1Z0-1067-25 Question 7

Select 3

You are working as a Cloud Ops engineer for a SaaS provider that needs to stand up a new public-facing microservice in Oracle Cloud Infrastructure (OCI). You have created a custom VCN and a public subnet for your Compute instance. The microservice must be accessible from the public internet for incoming HTTP requests. Which three steps must you take (at a minimum) to ensure external clients can reach your instance?

A
Create and attach an Internet Gateway to your VCN
B
Assign a public IP address to your instance
C
Create a NAT Gateway for outbound traffic from your instance
D
Add a route rule in the route table to direct 0.0.0.0/0 to the Internet Gateway
E
Configure a Service Gateway for your instance
F
Launch the instance in a private subnet instead of a public subnet

Show answer and explanation

Correct answers: A, B, D

Explanation

To manually deploy a public-facing instance in OCI, you must attach an Internet Gateway to your VCN, assign a public IP to the instance, and create a route rule sending 0.0.0.0/0 traffic to the Internet Gateway. These are the fundamental steps for inbound and outbound internet connectivity. In addition, you must configure security rules (via Security Lists or Network Security Groups) to allow incoming traffic on the desired ports. Refer to Oracle Cloud Infrastructure Networking documentation for best practices on creating and configuring subnets, gateways, and route tables.

A. Correct.
Option 1: Create and attach an Internet Gateway to your VCN. Correct. The Internet Gateway is essential for allowing external internet traffic to enter your VCN. Without it, your instance cannot be reached directly from external networks.
B. Correct.
Option 2: Assign a public IP address to your instance. Correct. A public IP address is necessary if you want your instance to be directly addressable from the internet. Without a public IP or a Public Load Balancer in front, external clients cannot route traffic directly to your instance.
C. Incorrect.
Option 3: Create a NAT Gateway for outbound traffic from your instance. Incorrect. NAT Gateways allow private subnet hosts to initiate outbound connections to the internet. They do not enable inbound connections from the internet to your instance.
D. Correct.
Option 4: Add a route rule in the route table to direct 0.0.0.0/0 to the Internet Gateway. Correct. Even if you have an Internet Gateway attached, you must explicitly define in your route table that all external traffic (0.0.0.0/0) should be sent to that gateway. Without this route rule, the traffic will not be forwarded to the internet.
E. Incorrect.
Option 5: Configure a Service Gateway for your instance. Incorrect. A Service Gateway is used to enable private access to Oracle services (such as Object Storage) without traversing the public internet. It does not facilitate public internet connectivity to your instance.
F. Incorrect.
Option 6: Launch the instance in a private subnet instead of a public subnet. Incorrect. Using a private subnet prevents direct access from the internet, unless you use additional services such as a Public Load Balancer. For direct public connectivity, a public subnet is required.

1Z0-1067-25 Question 8

Single answer

You are manually deploying a new VCN and subnets in Oracle Cloud Infrastructure for an application running on a compute instance in a private subnet. The application must periodically download security updates from the public internet without exposing the instance directly. Which manual configuration step must you implement to enable the instance to fetch updates from the internet while keeping it private?

A
Create an Internet Gateway and update the private subnet� route table to send all outbound traffic (0.0.0.0/0) to the Internet Gateway.
B
Create a NAT Gateway and update the private subnet� route table to send all outbound traffic (0.0.0.0/0) to the NAT Gateway.
C
Assign a public IP address to the instance in the private subnet to allow direct public internet access.
D
Create a service gateway for Internet-bound traffic on the private subnet.

Show answer and explanation

Correct answer: B

Explanation

When deploying core OCI services manually, a NAT Gateway is recommended for granting private instances outbound internet connectivity without exposing them to inbound traffic. You must create the NAT Gateway and update your private subnet's route table to direct 0.0.0.0/0 traffic to the NAT Gateway. This ensures instances remain private while still being able to download security patches or connect to other internet resources. Refer to the Oracle Cloud Infrastructure Networking documentation for best practices on creating and configuring NAT Gateways.

A. Incorrect.
Incorrect. While an Internet Gateway allows inbound and outbound internet connectivity, configuring a subnet route table to direct internet traffic through an Internet Gateway would expose resources publicly. This would defeat the privacy requirement.
B. Correct.
Correct. A NAT Gateway enables instances in a private subnet to access the public internet for outbound connections (e.g., for software updates), without allowing inbound connections from the internet, thus preserving the private nature of the subnet.
C. Incorrect.
Incorrect. Attaching a public IP addresses the need for internet access but violates the privacy requirement because the instance would be directly reachable from the internet.
D. Incorrect.
Incorrect. A service gateway provides private access to specific Oracle services (like Object Storage) without traversing the public internet. It does not enable general outbound internet traffic.

1Z0-1067-25 Question 9

Select 2

You have deployed an Oracle Cloud Infrastructure environment with multiple subnets in a single VCN. One of the subnets is private, where application servers need to retrieve configuration files from Object Storage without exposing them to the public Internet. What two manual steps must you take to enable outbound connectivity for the private instances to access Object Storage?

A
Create a Service Gateway in your VCN and add a route table entry for OCI services pointed to the Service Gateway.
B
Add an Internet Gateway and attach a public IP to the private subnet instances.
C
Establish a local peering gateway to link the private subnet with the Object Storage compartment.
D
Update the private subnet� security list or network security group to allow outbound HTTPS (TCP/443) to OCI regional services.

Show answer and explanation

Correct answers: A, D

Explanation

Enabling private subnet instances to reach Object Storage securely requires two key actions: deploying a Service Gateway and configuring the subnet route table to direct OCI service traffic to that gateway, and allowing outbound HTTPS traffic in the subnet� security rules. This ensures access to Object Storage remains private. Refer to OCI Networking documentation on Service Gateways, route tables, and security lists for best practices.

A. Correct.
Option 1 is correct. A Service Gateway allows private subnets to access OCI services like Object Storage without routing traffic over the public Internet. You also need a corresponding route table entry so the private subnet knows how to reach Object Storage through the Service Gateway.
B. Incorrect.
Option 2 is incorrect. Using an Internet Gateway with publicly routable IP addresses would expose the private subnet to the public Internet, contradicting the requirement to keep instances private.
C. Incorrect.
Option 3 is incorrect. A local peering gateway is used to connect two VCNs in the same region, not to connect a private subnet directly to Object Storage.
D. Correct.
Option 4 is correct. Even with a Service Gateway, the private subnet must allow outbound HTTPS (443) traffic in a security list or network security group to ensure the instances can communicate with Object Storage.

1Z0-1067-25 Question 10

Select 2

You recently created a compute instance with a public IP address in a newly created Virtual Cloud Network (VCN) that has only default components. However, you are unable to SSH into that instance from the public internet. Which three steps must you manually verify or perform to allow inbound SSH traffic?

A
Manually create an Internet Gateway in your VCN.
B
Set up a NAT Gateway to handle inbound SSH connections from the public internet.
C
Add a route rule for 0.0.0.0/0 to the Internet Gateway in your VCN� route table.
D
Create an ingress rule for TCP port 22 in the security list or network security group associated with the instance.

Show answer and explanation

Correct answers: B, C

Explanation

When deploying core services manually, allowing external access to your newly created instances requires ensuring an Internet Gateway is present, creating a route rule for traffic destined for the public internet (0.0.0.0/0) to point to the Internet Gateway, and configuring your security lists or network security groups to allow inbound SSH on port 22. A NAT Gateway is used for outbound connections, not inbound. For detailed guidance, refer to Oracle Cloud Infrastructure networking documentation at https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm.

A. Incorrect.
Correct: You must create an Internet Gateway to enable external inbound traffic into your VCN. By default, a newly created VCN does not include an Internet Gateway.
B. Correct.
Incorrect: A NAT Gateway supports outbound internet access for resources in private subnets, not inbound connections from the public internet.
C. Correct.
Correct: You must explicitly route all internet-bound traffic (0.0.0.0/0) to the Internet Gateway in your route table. Without this route, inbound traffic is dropped.
D. Incorrect.
Correct: Security lists or network security groups need an ingress rule for port 22 (SSH). By default, the security list does not permit arbitrary inbound SSH traffic.

Timed practice exam

Take a 1Z0-1067-25 practice test under exam conditions

60 questions in 90 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the 1Z0-1067-25 exam covers

Official Oracle Cloud Infrastructure 2025 Cloud Ops Professional exam domains and weightings.

Managing and Monitoring OCI Resources
30% of exam
Cost Management and Optimization
25% of exam
Operations and Automation
25% of exam
Governance and Compliance
20% of exam

All 138 1Z0-1067-25 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

1Z0-1067-25 exam dumps FAQ

Are these 1Z0-1067-25 dumps real exam questions?

No. These are original practice questions written to the Oracle Cloud Infrastructure 2025 Cloud Ops Professional exam objectives, not questions copied from a live exam. Memorising leaked questions violates Oracle's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many 1Z0-1067-25 practice questions are there?

138 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the 1Z0-1067-25 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed 1Z0-1067-25 practice test?

Sign in and start the Oracle Cloud Infrastructure 2025 Cloud Ops Professional exam on HydraNode. A session gives you 60 questions drawn from this bank in 90 minutes, then a score report with a per-question review.

What topics does the 1Z0-1067-25 exam cover?

The official exam domains are: Managing and Monitoring OCI Resources; Cost Management and Optimization; Operations and Automation; Governance and Compliance.

More Oracle exam dumps

All Oracle exams

1Z0-1123-25150 questions

OCI 2025 Migration Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Migration Architect Professional

1Z0-184-25182 questions

Oracle AI Vector Search Professional exam dumps

Oracle AI Vector Search Professional

1Z0-1072-25318 questions

OCI 2025 Architect Associate exam dumps

Oracle Cloud Infrastructure 2025 Architect Associate

1Z0-997-25175 questions

OCI 2025 Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Architect Professional

1Z0-1151-25133 questions

OCI 2025 Multicloud Architect Professional exam dumps

Oracle Cloud Infrastructure 2025 Multicloud Architect Professional

1Z0-1104-25174 questions

OCI 2025 Security Professional exam dumps

Oracle Cloud Infrastructure 2025 Security Professional