1Z0-1072-25 Question 35
Select 2You have multiple Oracle Linux compute instances running in a private subnet, and you want to manage their operating system patches using the OS Management service in Oracle Cloud Infrastructure (OCI). Which two steps must you perform to ensure these private instances can be patched automatically through the OS Management console?
- A
Create a dynamic group that includes the target instances, then write an IAM policy granting OS Management operations on that dynamic group
- B
Enable the OS Management plugin by selecting the instance in the OCI console and toggling the 'OS Management' service on
- C
Install the OS Management agent from an external GitHub repository maintained by Oracle Cloud Infrastructure contributors
- D
Set up a Service Gateway in the private subnet and update the route table so that OS Management traffic can reach OCI service endpoints
- E
Disable the instance metadata service to avoid conflicts with OS Management agent requests
Show answer and explanation
Correct answers: A, D
Explanation
To manage OS patches on private Oracle Linux compute instances with OCI's OS Management service, you must first allow the service to reach the appropriate resources (through a Service Gateway or NAT Gateway) and configure IAM so that OS Management is permitted to manage those instances. The official OS Management documentation (see Oracle Cloud Infrastructure OS Management Docs) outlines creating dynamic groups for targeting the correct instances and then writing IAM policies, as well as ensuring network connectivity so that the OS Management agent can access Oracle's update repositories and services.
- A. Correct.
Correct. You must define a dynamic group that includes the instances you want to manage (often based on compartment or instance tags), and then grant the OS Management service the ability to manage these instances through an IAM policy (e.g., allowing 'use' or 'manage' OS Management resources). Without these policies, the OS Management service cannot patch or manage your compute resources.
- B. Incorrect.
Incorrect. Although you might enable or verify the OS Management plugin if disabled, it is typically delivered and updated through Oracle Linux package repositories. Merely toggling a setting in the console might help, but it is not mandatory in every case. The question specifically focuses on essential steps for connectivity and permissions for private instances.
- C. Incorrect.
Incorrect. For Oracle Linux instances, the OS Management service agent is usually installed from Oracle's repositories, not from a GitHub repository. The official documentation advises installing or updating the agent from Oracle's yum repositories if needed.
- D. Correct.
Correct. Because your instances are in a private subnet, they need a path to communicate with OCI's OS Management endpoints. A Service Gateway provides private access to OCI services without exposing your instances to the public internet. Configuring correct route rules ensures the traffic is routed properly.
- E. Incorrect.
Incorrect. The instance metadata service allows retrieval of instance-specific data and does not interfere with OS Management. Disabling it is neither recommended nor required to use OS Management in OCI.