Oracle's Security Professional certification checks that you can secure workloads on Oracle Cloud Infrastructure (OCI): identity domains and policies, network segmentation, Vault and Data Safe, Cloud Guard and the logging that ties them together. Oracle's 2026 release went live in August and brought a new exam, 1Z0-1104-26, and a credential name without a year in it. Read the format line on the exam page carefully. Oracle lists five multiple-choice questions and one "challenge," each with its own pass mark.
Who it suits, and who should pick another cloud
It fits engineers and architects who already run OCI and now own the tenancy's security controls, including consultants at Oracle partners. Oracle describes the credential as proving you can design and implement defense-in-depth controls with current OCI security services. Oracle's exam page doesn't list a prerequisite certification or a required amount of experience.
If OCI is a minor part of your estate, your time is better spent on the main provider's exam: AWS Certified Security - Specialty, Google Cloud Professional Cloud Security Engineer or SC-500 for Azure. CCSP covers cloud security without tying you to one console.
The exam at a glance
| 1Z0-1104-26 | |
|---|---|
| Exam title | Oracle Cloud Infrastructure Security Professional (listed as NEW) |
| Certification earned | Oracle Cloud Infrastructure Certified Security Professional |
| Format | Listed as multiple choice; 5 multiple-choice questions and 1 challenge |
| Time | 90 minutes |
| Passing score | 20% on the multiple-choice part, 60% on the challenge |
| Delivery | Proctored online, booked through Oracle MyLearn |
| Prerequisites | None listed |
| Validity | 24 months; OCI certifications fall under Oracle's cloud recertification policy |
The question count and pass marks are as Oracle's exam page shows them on the day we checked. They're unlike any earlier OCI exam we know of, so confirm them on the exam page when you book. Oracle's August 2026 announcement says its courses now use live OCI lab environments and Hands-on Performance Exams, which suggests the challenge is a practical task in a real tenancy. Oracle's exam page doesn't show a price unless you're signed in to MyLearn, so check it there before you budget.
What the six domains cover
- OCI Security Introduction: 8%
- Manage Identity and Access: 22%
- Implement Network, Platform, and Infrastructure Security: 22%
- Secure Your Applications and Data: 20%
- Improve Cloud Security Posture: 18%
- Manage Security Operations: 10%
Identity is joint largest and the place most candidates from other clouds stumble, because OCI policies are written statements, not JSON documents. The objectives ask you to write policies with the correct syntax and verb hierarchy, explain how evaluation, inheritance and compartment scope produce a given result, use dynamic groups with instance and resource principals, and design deny policies, conditional policies and tag-based access control.
Network security covers security lists against network security groups, gateways, route tables, private endpoints and Private Service Access, Zero Trust Packet Routing and OCI Network Firewall, plus security patterns for hybrid and multi-VCN connectivity. Applications and data covers Web Application Firewall regional and edge policies, bot management and rate limiting, Vault for keys and secrets, encryption models including bring-your-own-key and HSM protection, the Certificates service with your own certificate authority, and Data Safe for database security.
Posture covers Cloud Guard detector and responder recipes, Security Zones, the Vulnerability Scanning Service, Bastion, the Threat Intelligence service and prioritizing findings. Operations is the smallest domain: Logging and Audit, Events and Notifications for automated response, VCN Flow Logs, Network Path Analyzer, and incident response and forensics on OCI.
How to prepare
Start from the objectives on the MyLearn exam page, since they're the only official outline. Oracle University's Security Professional course is the official preparation. Since the August 2026 release, Oracle has made professional-level courses paid, while the Foundations and OCI Architect Associate courses stay free. If you're new to OCI, the free Architect Associate course covers the identity, networking, compute and storage basics the security exam assumes.
Practise in a tenancy you control. Oracle's Free Tier gives a US$300 credit for 30 days on all OCI services, then continues with Always Free services. Plan your lab work to fit inside that month:
- Build compartments for two teams and write policies that let one team manage networks in its own compartment only. Then add a deny policy and a tag-based condition, and predict the result before you test it.
- Create a dynamic group for compute instances and let them read one Vault secret through an instance principal.
- Segment a VCN with network security groups, add a Network Firewall, and use Network Path Analyzer to explain a blocked path.
- Turn on Cloud Guard with a responder recipe and a Security Zone, then try to create a public bucket inside the zone.
- Route Audit events through Events and Notifications to an alert.
If the challenge does turn out to be a live task, speed in the console matters more than recall. We'd put a third of your time into IAM policies, because they appear in nearly every other domain, and most of the rest into doing the lab steps until you can do them without notes.
After you pass
OCI certifications are valid for 24 months from the day you earn them, and the exam page lists Oracle's cloud recertification policy. Oracle releases a new OCI exam version each year, and from 2026 the credential name stays the same across versions. Oracle doesn't let you retake an exam you've already passed. Results appear on screen at the end, with a detailed score report in Oracle CertView.
Next steps:
- CCSP to put your cloud security experience in vendor-neutral terms.
- AWS Certified Security - Specialty if your organization also runs workloads on AWS.
- Google Cloud Professional Cloud Security Engineer for a Google Cloud estate.
Our view
The certification matters most inside the Oracle ecosystem: partners, consultancies and customers with Oracle workloads on OCI. Outside it, hiring managers are less likely to know it than the AWS, Azure or Google exams. The 2026 objectives are current and specific, and a practical challenge, if that's what it is, makes it a better test of real skill than a pure multiple-choice exam. You have to sign in to see the price, and the course now costs money, so get your employer to pay if OCI is part of your job. If it isn't, skip it.
Sources
- Oracle MyLearn: Exam 1Z0-1104-26: delivery, format, 90 minutes, question counts, pass marks, objectives and weights, associated certification, score report, checked October 2026
- OCI Certification Learning Paths and Exams: 2026 Updates Now Available: August 2026 release, names without a year, 24-month validity, paid professional courses, free Architect Associate, Hands-on Performance Exams, checked October 2026
- Oracle Certification Program Guidelines: 24-month validity, no retake of a passed exam, per-version passing scores, checked October 2026
- Oracle Certification: current link to the Security Professional exam, checked October 2026
- Oracle Cloud Free Tier: US$300 credit for 30 days and Always Free services, checked October 2026