Oracle Cloud Infrastructure Architect Associate Exam Practice Test
Oracle Cloud Infrastructure architecture combines resource organization, networking, identity controls, storage, and operational visibility. Practice scenarios on this page involve choosing OCI services for concrete design needs, such as private connectivity, secure access to secrets, cost categorization, and retaining data independently of compute instances.
Exam overview
About the Oracle Cloud Infrastructure Architect Associate Exam
Architects must match workload requirements to OCI’s control and infrastructure options. This includes distinguishing Site-to-Site VPN from FastConnect, placing resources in suitable compartments, and applying tenancy-level controls to limit deployments by region. Security decisions involve granting instance workloads access to Vault secrets without embedding credentials, while network designs may use a NAT gateway for outbound access from private subnets. Other practical tasks include sharing files with access and integrity controls, reviewing API activity in Audit, and keeping block volume data beyond an instance’s lifetime. The practice bank also touches on tracking infrastructure configuration changes declaratively. These scenarios call for identifying the requirement that matters most—such as isolation, predictable connectivity, governance, or persistence—and selecting an OCI capability that addresses it.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
An architect wants to organize and track cloud costs by application across resources that reside in different compartments. Which OCI feature is designed to support this categorization?
Show answer
Correct answer: ADefined tags provide centrally managed keys and values that can be applied to resources for consistent categorization, including cost tracking and reporting across compartments. The other options address networking or infrastructure placement.
A company connects its on-premises network to an OCI VCN using Site-to-Site VPN. Which statement best describes the VPN connection?
Show answer
Correct answer: AOCI Site-to-Site VPN uses IPsec tunnels over the internet to provide encrypted connectivity between an on-premises network and a VCN. A dedicated private connection is the purpose of FastConnect, not the VPN.
A workload needs a private, dedicated connection from an on-premises data center to OCI that can support predictable network performance. Which OCI connectivity option is designed for this?
Show answer
Correct answer: AFastConnect provides a private, dedicated connection between an on-premises network and OCI. The gateways listed serve different VCN traffic-routing purposes and do not provide that dedicated connection.
An application on an OCI compute instance must retrieve a secret from OCI Vault without storing a user password or API key on the instance. Which OCI capability is the best fit?
Show answer
Correct answer: BAn instance principal lets an OCI compute instance authenticate to supported OCI services without embedding user credentials. An IAM policy must authorize the instance's dynamic group to access the required secret. A Vault encryption key protects data but does not by itself authenticate the instance.
A company needs to provide a large dataset to another organization while preserving integrity and controlling access to the shared files. Which OCI storage approach is appropriate for file-based sharing?
Show answer
Correct answer: AA pre-authenticated request can grant time-limited access to specified Object Storage objects without requiring the recipient to have an OCI account. The organization should scope the request carefully and use an appropriate expiration time.
A private subnet contains instances that need to download software updates from public internet repositories, but those instances must not accept unsolicited inbound internet connections. Which network component is commonly used?
Show answer
Correct answer: AA NAT gateway allows resources in private subnets to initiate outbound connections to the internet while preventing unsolicited inbound connections from the internet. A service gateway is for supported Oracle services, and a local peering gateway connects VCNs within a region.
A company needs to prevent newly created OCI resources from being deployed in an unapproved region. Which tenancy-level control can enforce this restriction?
Show answer
Correct answer: BRegion subscriptions determine which OCI regions a tenancy can use. Restricting subscriptions to approved regions helps prevent resource deployment in other regions; network controls and identity groups serve different purposes.
How to use this practice test
Access the practice questions for free. Each session presents up to 20 randomly selected questions from the 50-question bank, then shows your results. Use missed or uncertain items to identify which OCI service distinctions—such as VPN versus FastConnect, NAT access, Vault integration, or resource retention—need another pass.
Preparation tips
- Compare Site-to-Site VPN and FastConnect by connection type, performance characteristics, and typical use case.
- Trace traffic from a private subnet to public repositories, and distinguish NAT gateway behavior from inbound internet access.
- Review how instance principals and Vault policies can grant workloads secret access without stored user credentials.
- Practice mapping governance tasks to OCI features, including compartments for organization, cost tracking, region restrictions, and Audit events.
- Check which storage resources persist independently of compute instances, and distinguish file sharing needs from block volume retention.