CertArea
All Oracle exams

Free Oracle Cloud Infrastructure 2026 Foundations Associate practice test: 30 questions with answers

30 original questions for Oracle Cloud Infrastructure 2026 Foundations Associate, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
40 questions, 60 min
Passing score
65%

Oracle Cloud Infrastructure 2026 Foundations Associate exam guide: topics, cost and format

All 30 Oracle Cloud Infrastructure 2026 Foundations Associate questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security and Identity (5 questions)

  1. Question 1

    Which OCI service manages encryption keys and secrets for applications?

    1. ACompute, which runs the instances that execute the application workloads
    2. BEvents, which triggers actions when a resource in the tenancy changes state
    3. CLogging, which records the log entries that the services write during operation
    4. DVault, which manages encryption keys and secrets for applications
    Show answer and explanation
    Correct answer: D

    Vault manages encryption keys and secrets. Compute, Logging and Events serve other purposes.

  2. Question 2

    In OCI Identity and Access Management, what defines what a group is allowed to do with resources?

    1. APolicies, which grant the permissions that a group has on resources in a compartment
    2. BShapes, which define the hardware configuration of the compute instances in use
    3. CCompartments, which group resources but do not themselves grant any permissions
    4. DRegions, which determine where resources are located but not who may use them
    Show answer and explanation
    Correct answer: A

    Policies grant permissions to groups on resources in compartments. Compartments group resources, shapes define hardware and regions define location, so none of them grants permission.

  3. Question 3

    Which IAM construct allows compute instances to call OCI APIs without any user credentials being stored on them?

    1. AFederation, which lets external identity providers authenticate the users of the tenancy
    2. BDynamic groups, which group resources such as instances so that policies can grant them access
    3. CLocal users, which log in with a password that is stored on each instance for convenience
    4. DThe Administrators group, which holds the users who manage the tenancy's configuration
    Show answer and explanation
    Correct answer: B

    Dynamic groups group resources such as instances by matching rules, and policies can then grant them permission to call APIs without stored user credentials. The administrators group, local users and federation involve people rather than resources.

  4. Question 4

    Which OCI service records API calls and administrative actions for auditing?

    1. AAudit, which records API calls and administrative actions for compliance review
    2. BObject Storage, which stores objects that applications read and write each day
    3. CShapes, which define the hardware configuration of each compute instance in use
    4. DVolumes, which store the data that applications write to the block devices
    Show answer and explanation
    Correct answer: A

    The Audit service records API calls and administrative actions for compliance review. Object Storage, shapes and volumes do not record audit events.

  5. Question 5

    Under the OCI shared security model, what is the customer responsible for?

    1. ANothing, since Oracle manages the security of everything placed in the cloud
    2. BEverything, including the physical security of the data centres where OCI runs
    3. CSecuring the cloud infrastructure itself, such as the physical hosts and facilities
    4. DSecuring its own data, identities, configurations and the applications it deploys
    Show answer and explanation
    Correct answer: D

    Under the shared model, Oracle secures the cloud infrastructure while the customer secures its data, identities, configurations and applications. Physical facilities and infrastructure are Oracle's responsibility.

Networking (5 questions)

  1. Question 6

    Which gateway lets instances in a private subnet reach the internet for outbound traffic, without allowing inbound connections from the internet?

    1. AA dynamic routing gateway, which connects the virtual cloud network to other networks
    2. BAn internet gateway, which allows inbound and outbound traffic for public subnets
    3. CA NAT gateway, which allows outbound connections from private subnets only
    4. DA service gateway, which connects the virtual cloud network to Oracle services only
    Show answer and explanation
    Correct answer: C

    A NAT gateway allows outbound connections from private subnets without allowing unsolicited inbound traffic. An internet gateway allows inbound traffic to public subnets, and a dynamic routing gateway and a service gateway connect to other networks or to Oracle services.

  2. Question 7

    Which component connects a virtual cloud network privately to an on-premises network?

    1. AA NAT gateway, which translates the addresses of outbound traffic from private subnets
    2. BAn Object Storage bucket, which stores the files exchanged between the two networks
    3. CA dynamic routing gateway (DRG) used with FastConnect or a VPN connection
    4. DA Vault secret, which stores the connection credentials for the on-premises network
    Show answer and explanation
    Correct answer: C

    A dynamic routing gateway attached to the VCN, used with FastConnect or a site-to-site VPN, connects the network to on-premises sites. A NAT gateway, a bucket and a vault secret do not provide that connection.

  3. Question 8

    Which OCI feature acts as a virtual firewall at the subnet level, controlling the traffic allowed into and out of it?

    1. AAn IAM policy, which grants users permission to manage the resources of a compartment
    2. BA storage bucket, which holds the objects that applications read and write each day
    3. CA compartment, which groups resources so that access policies and costs can be applied
    4. DA security list, which defines the ingress and egress rules for a subnet
    Show answer and explanation
    Correct answer: B

    A security list defines ingress and egress rules for a subnet, which makes it a subnet-level virtual firewall. IAM policies control access to resources, compartments group them, and buckets store objects.

  4. Question 9

    Which service distributes incoming traffic across a pool of backend servers?

    1. AVault, which stores encryption keys and secrets for the applications that use them
    2. BNAT gateway, which translates the addresses of outbound connections from private subnets
    3. CLoad Balancer, which spreads requests across healthy backend servers
    4. DObject Storage, which stores objects that can be retrieved through HTTP requests
    Show answer and explanation
    Correct answer: C

    Load Balancer spreads incoming requests across healthy backend servers. NAT gateways handle outbound address translation, and Object Storage and Vault do not distribute traffic.

  5. Question 10

    A private subnet's instances must reach Object Storage without sending traffic over the internet. Which gateway should be used?

    1. AA NAT gateway, which sends the traffic to Object Storage through the public internet
    2. BAn internet gateway, which connects the private subnet directly to the public internet
    3. CA service gateway, which connects the subnet to Oracle services without using the internet
    4. DA dynamic routing gateway, which connects the subnet to the company's on-premises network
    Show answer and explanation
    Correct answer: B

    A service gateway connects a subnet to Oracle services such as Object Storage without using the internet. A NAT gateway and an internet gateway both use the internet, and a dynamic routing gateway connects to on-premises networks.

Storage and Databases (5 questions)

  1. Question 11

    Which Object Storage tier is designed for rarely accessed data, at the lowest storage cost, with a retrieval delay?

    1. AStandard, which is designed for frequently accessed data with immediate retrieval
    2. BArchive, which is designed for rarely accessed data at lower cost with a retrieval delay
    3. CBlock, which provides persistent disks attached to compute instances
    4. DFile, which provides shared network file systems mounted by compute instances
    Show answer and explanation
    Correct answer: B

    Archive storage is designed for data that is rarely accessed, at a lower cost, with a retrieval delay. Standard suits frequent access, and Block and File are different storage services.

  2. Question 12

    Which service provides shared network file storage that clients mount over NFS?

    1. AObject Storage, which stores objects that are accessed through HTTP APIs and URLs
    2. BBlock Volume, which provides disks attached to a single compute instance at a time
    3. CFile Storage, which provides shared network file systems that clients mount over NFS
    4. DArchive Storage, which holds rarely accessed data at lower cost with retrieval delays
    Show answer and explanation
    Correct answer: C

    File Storage provides shared network file systems mounted over NFS. Object Storage uses API access, Block Volume attaches to instances, and Archive is a storage tier rather than a file system.

  3. Question 13

    Which managed database service runs Oracle Database with automated provisioning, patching and tuning?

    1. ALoad Balancer, which distributes incoming requests across a pool of backend servers
    2. BObject Storage, which stores objects that applications can read and write over HTTP
    3. CAutonomous Database, which automates provisioning, patching and tuning of Oracle Database
    4. DBlock Volume, which provides persistent disks that can be attached to compute instances
    Show answer and explanation
    Correct answer: C

    Autonomous Database automates provisioning, patching and tuning for Oracle Database workloads. Object Storage, Block Volume and Load Balancer do not run databases.

  4. Question 14

    Which volume type attaches persistent block storage to a compute instance?

    1. AA File Storage export, which is mounted by clients over the NFS network protocol
    2. BAn Object Storage bucket, which holds objects and is accessed through APIs
    3. CA Block Volume, which attaches persistent disk storage to a compute instance
    4. DAn Archive bucket, which holds rarely accessed objects at a lower cost per gigabyte
    Show answer and explanation
    Correct answer: C

    A Block Volume is persistent block storage attached to a compute instance. Buckets and exports are object and file storage, which are accessed differently.

  5. Question 15

    Which two statements about Object Storage are correct? (Choose two.)

    1. AData is stored in buckets, which are containers for objects within a compartment
    2. BObject Storage provides block volumes that serve as the boot disks of compute instances
    3. CObject Storage is designed to be mounted as a shared file system on compute instances
    4. DStorage tiers exist only for Block Volume, and Object Storage has a single fixed tier
    5. EObjects are accessed through APIs and URLs, and standard and archive tiers are available
    Show answer and explanation
    Correct answer: A, E

    Objects are stored in buckets within compartments and accessed through APIs and URLs, with standard and archive tiers available. Object Storage does not provide block boot volumes or mountable file systems, and it has more than one tier.

Cloud Concepts and OCI Architecture (5 questions)

  1. Question 16

    A company must keep its data inside one country for legal reasons. Which OCI concept should it use to meet this requirement?

    1. AChoose a region located in that country for the resources that hold the data
    2. BChoose the largest compute shape so that all data stays on one physical server
    3. CEnable a site-to-site VPN only, since the VPN keeps traffic inside the company network
    4. DPlace every resource in a single compartment, which keeps data inside one boundary
    Show answer and explanation
    Correct answer: A

    A region is the geographic location where resources are deployed, so choosing one in the required country keeps the data there. Shape size, VPN use and compartments do not control where data is physically stored.

  2. Question 17

    What is an availability domain in Oracle Cloud Infrastructure?

    1. AA virtual cloud network that groups subnets, route tables and gateways together
    2. BA billing unit that groups usage charges for a set of resources during a month
    3. CAn IAM policy that grants a group permission to manage compute instances in a region
    4. DOne or more isolated data centres within a region, with independent power and cooling
    Show answer and explanation
    Correct answer: D

    An availability domain is one or more isolated data centres within a region that do not share power or cooling, which supports resilience. A VCN, an IAM policy and a billing unit are different constructs.

  3. Question 18

    Which OCI construct groups resources for access control and cost tracking within a tenancy?

    1. ACompartments, which group resources for access policies and cost tracking
    2. BShapes, which define the CPU and memory configuration of compute instances
    3. CSubnets, which divide a virtual cloud network into smaller address ranges
    4. DBuckets, which hold objects in Object Storage and carry their own access rules
    Show answer and explanation
    Correct answer: A

    Compartments group resources so that access policies and cost reports can be applied to them. Subnets, shapes and buckets serve networking, compute and storage respectively.

  4. Question 19

    What is a tenancy in Oracle Cloud Infrastructure?

    1. AA single virtual machine that runs an application for one customer team
    2. BThe root container for an organisation's OCI resources, compartments and identities
    3. CA user group that contains the people who administer one application
    4. DA storage bucket that holds the objects that one customer team uploads
    Show answer and explanation
    Correct answer: B

    A tenancy is the root container for an organisation's resources, compartments and identities. A VM, a bucket and a user group are individual resources or identity constructs within it.

  5. Question 20

    Which two statements about OCI regions are correct? (Choose two.)

    1. AA region contains one or more availability domains
    2. BRegions are shared by all customers and cannot be selected for resources
    3. CResources are deployed into a chosen home region of the tenancy
    4. DEach region has exactly one availability domain, so there is no redundancy inside a region
    5. EFault domains span across regions, so that one fault domain covers several regions at once
    Show answer and explanation
    Correct answer: A, C

    A region contains one or more availability domains, and a tenancy has a home region where resources are chosen to be deployed. Customers select regions, regions do not have exactly one availability domain, and fault domains exist inside availability domains rather than spanning regions.

Compute (5 questions)

  1. Question 21

    Which compute shape lets the number of OCPUs and the amount of memory be chosen independently?

    1. AObject Storage tiers, which set the performance of the storage the instance uses
    2. BFixed shapes only, whose CPU and memory are set by the shape name and cannot change
    3. CBare metal shapes with a fixed core count, which cannot be resized after launch
    4. DFlexible shapes, such as VM.Standard.E4.Flex
    Show answer and explanation
    Correct answer: D

    Flexible shapes let the OCPU count and memory be selected independently within limits. Fixed and bare metal shapes have set configurations, and Object Storage tiers are storage options rather than compute shapes.

  2. Question 22

    Which OCI service runs managed Kubernetes clusters?

    1. AContainer Engine for Kubernetes (OKE), which provides managed Kubernetes clusters
    2. BObject Storage, which stores the container images that the clusters pull from
    3. CLoad Balancer, which distributes traffic across the backend servers of an application
    4. DVault, which stores the secrets and encryption keys used by the containerised applications
    Show answer and explanation
    Correct answer: A

    Container Engine for Kubernetes (OKE) is OCI's managed Kubernetes service. Object Storage, Load Balancer and Vault support workloads but do not run Kubernetes clusters.

  3. Question 23

    Which feature spreads compute instances across isolated hardware groups within one availability domain, to reduce the impact of hardware failure?

    1. AFault domains, which isolate instances from common hardware failures within an availability domain
    2. BShapes, which define the CPU and memory configuration available for each instance
    3. CCompartments, which group resources for access policies and for cost reporting
    4. DRegions, which are the geographic locations where the resources of the tenancy are deployed
    Show answer and explanation
    Correct answer: A

    Fault domains are isolated groups of hardware within an availability domain, and placing instances across them reduces the impact of a hardware failure. Compartments, shapes and regions serve other purposes.

  4. Question 24

    A team wants to run short pieces of code on demand, without managing any servers. Which OCI service fits this requirement?

    1. ACompute bare metal, where the team manages the operating system on dedicated hardware
    2. BBlock Volume, which provides persistent disks that can be attached to compute instances
    3. CLoad Balancer, which distributes incoming requests across a pool of backend servers
    4. DOCI Functions, a serverless platform that runs code in response to requests or events
    Show answer and explanation
    Correct answer: D

    OCI Functions is a serverless service that runs code on demand without managing servers. Bare metal and virtual machines require server management, and block volumes and load balancers are not compute services.

  5. Question 25

    Which image type provides a prebuilt operating system that can be used to launch compute instances?

    1. AA policy, which grants permissions to a group on the resources in a compartment
    2. BA bucket, which stores objects that are accessed through APIs and URLs
    3. CA platform image, which provides a prebuilt operating system from Oracle or a partner
    4. DA route table, which directs traffic from a subnet to the gateways that it uses
    Show answer and explanation
    Correct answer: C

    A platform image provides a prebuilt operating system for launching instances. Buckets, policies and route tables are not image types.

Pricing, Cost Management and Support (5 questions)

  1. Question 26

    Which two statements about OCI pricing and cost management are correct? (Choose two.)

    1. APay-as-you-go billing charges for the full month, even after resources have been stopped
    2. BCompute and storage are billed based on the usage that is consumed, with flexible options
    3. CSupport is always free, regardless of the support plan that the customer chooses to buy
    4. DBudgets cannot send alerts when spending reaches a threshold that the customer has set
    5. ECost Analysis shows spend broken down by compartment and by tags applied to resources
    Show answer and explanation
    Correct answer: B, E

    Compute and storage are billed on the usage consumed, and Cost Analysis breaks spend down by compartment and tag. Billing for stopped resources, free support regardless of plan and budgets without alerts are all incorrect.

  2. Question 27

    Which OCI purchasing model commits the customer to a spending level over a term, in return for a lower price?

    1. AUniversal Credits with a committed term, which provides a discount for a set spend commitment
    2. BThe Free Tier only, which offers a limited set of resources at no cost to the customer
    3. CSpot instances, which are priced at a discount but can be reclaimed at short notice
    4. DPay as you go, which charges for usage at the list price with no commitment to a term
    Show answer and explanation
    Correct answer: A

    Universal Credits with a committed term give a discount in return for a spend commitment over the term. Pay as you go has no commitment, the Free Tier is limited, and spot instances can be reclaimed.

  3. Question 28

    Which two are benefits of tagging resources in OCI? (Choose two.)

    1. ATags change the CPU speed of the instances to which they are applied
    2. BTags allow cost reports to be grouped by team or project
    3. CTags are required before any compartment can be created in the tenancy
    4. DTags help identify owners and apply governance to resources
    5. ETags remove the need for IAM policies, since the tag itself grants access
    Show answer and explanation
    Correct answer: B, D

    Tags allow cost reports to be grouped by team or project, and they help identify owners and apply governance. Tags do not change CPU speed, are not required for compartments, and do not replace IAM policies.

  4. Question 29

    Which cost element is typically still charged for an instance that has been stopped?

    1. AAttached block storage that still exists, which continues to be billed while it is kept
    2. BEgress traffic from the instance, which is charged only when the instance sends data out
    3. CRunning OCPU hours, which are charged only while the instance is actively running
    4. DAutoscaling actions, which are charged for each time an instance is added to a pool
    Show answer and explanation
    Correct answer: A

    Attached block storage that still exists continues to be billed while stopped, while the running compute hours stop. Egress and autoscaling charges depend on activity, not on storage that is kept.

  5. Question 30

    Which tool estimates the cost of planned resources before they are deployed?

    1. AObject Storage, which stores the objects that applications read and write each day
    2. BVault, which stores the encryption keys and secrets that the applications use
    3. CAudit, which records the API calls that have been made to the resources in the tenancy
    4. DThe cost estimator, which calculates the expected monthly cost of planned resources
    Show answer and explanation
    Correct answer: D

    The cost estimator calculates the expected monthly cost of planned resources before deployment. Object Storage, Vault and Audit do not estimate cost.