Home / artificial-intelligence-machine-learning / Oracle Cloud Infrastructure Enterprise AI Professional (1Z0-1158-26) / Cheat Sheet
Oracle Cloud Infrastructure Enterprise AI Professional (1Z0-1158-26)

1Z0-1158-26 Cheat Sheet

1Z0-1158 Tests Building Governed Agents on 1Z0-1158-26 — Not Chatbot Prompting

For engineers shipping LLM and agent workloads on OCI. Oracle's certification index now lists 1Z0-1158-26 and no longer lists OCI Generative AI Professional (1Z0-1127), so expect the Responses API, hosted agents and guardrails, not just fine-tuning.

Check Your Readiness →
Among the harder certs
Avg: Not published by Oracle
Pass: 750 / 1000
Most candidates understand Oracle Cloud Infrastructure Enterprise AI Professional (1Z0-1158-26) concepts — and still fail. This exam tests how you apply knowledge under pressure.

1Z0-1158-26 Section Map

Section names come from a secondary source and Oracle publishes no weights, so prepare evenly. Many items show a goal plus a fragment of a Responses API request or a cluster configuration and ask which tool type, mode, setting or OCID completes it.

  1. 01
    Applying LLM Concepts (weight not published) — sampling parameters, penalties, few-shot, embeddings, prompting vs. RAG vs. fine-tuning
  2. 02
    Applying Agentic AI Concepts (weight not published) — agent loop and stop conditions, ReAct, function calling, MCP, memory, orchestration
  3. 03
    Configuring OCI Enterprise AI Models (weight not published) — on-demand vs. dedicated clusters, endpoints, T-Few vs. LoRA, model import
  4. 04
    Building OCI Enterprise AI Agents (weight not published) — Responses API tools, Vector Stores, Conversations, compaction, NL2SQL
  5. 05
    Building and Deploying Hosted Agents (weight not published) — applications vs. deployments, Container Registry, auth options, sandboxes
  6. 06
    Governing and Optimizing OCI Enterprise AI (weight not published) — IAM model policies, guardrail modes, OCI Audit, cost levers

Wrong instinct vs correct approach

A regulated endpoint must reject prompts containing injection attempts, and behaviour must not shift silently
✕ Wrong instinct

Call ApplyGuardrails and log any violations it reports

✓ Correct approach

ApplyGuardrails only reports; the caller decides, and Inform mode lets requests continue. Configure endpoint guardrails in Block mode and pin the version with guardrailVersionConfig. OCI Audit records API calls but not prompt text.

An agent must answer questions over a large set of uploaded policy PDFs
✕ Wrong instinct

Upload the files and call file_search directly

✓ Correct approach

Uploads are not searchable automatically. Index them through the Vector Stores API, then attach file_search, which OCI executes. For structured database data, use NL2SQL with GenerateSqlFromNl, which only generates SQL; DBTools MCP Server executes it under database permissions.

A multi-turn assistant resends its full history on every call and token costs keep climbing
✕ Wrong instinct

Raise max output tokens and keep client-side history

✓ Correct approach

Use the Conversations API and pass the conversation ID so OCI manages state, and enable compaction, whose automatic threshold is at least 1000 tokens. Compaction consumes tokens itself and loses some detail.

An existing agent codebase must run on OCI, reachable only by internal users with SSO
✕ Wrong instinct

Use a public endpoint with no platform-managed authentication

✓ Correct approach

Push the image to OCI Container Registry, create a hosted application with a private endpoint, and register an identity domain application for bearer token or browser session auth. Persist state in managed storage, not container memory.

Know these cold

  • ▸ Top-k is a fixed token count; top-p adapts the candidate set to cumulative probability
  • ▸ Frequency penalty scales with repeat count; presence penalty applies once per token
  • ▸ Max output tokens truncates a reply; it never makes the model condense
  • ▸ Agent loops need explicit stop conditions such as a maximum iteration count
  • ▸ Place human approval before irreversible or external actions, not every read-only step
  • ▸ Application holds scaling, networking and auth; each deployment runs one container image
  • ▸ Pushing a new image tag does not update a deployment; create or activate a new one
  • ▸ Sandboxes are temporary workspaces with an expiry; snapshots seed new sandboxes
  • ▸ Pass the project OCID on OpenAI-compatible calls, and use a routing profile where no local model runs
  • ▸ Perfect fine-tuning accuracy can signal overfitting; watch validation loss instead

Can you answer these without checking your notes?

In this scenario: "A regulated endpoint must reject prompts containing injection attempts, and behaviour must not shift silently" — what should you do first?
ApplyGuardrails only reports; the caller decides, and Inform mode lets requests continue. Configure endpoint guardrails in Block mode and pin the version with guardrailVersionConfig. OCI Audit records API calls but not prompt text.
In this scenario: "An agent must answer questions over a large set of uploaded policy PDFs" — what should you do first?
Uploads are not searchable automatically. Index them through the Vector Stores API, then attach file_search, which OCI executes. For structured database data, use NL2SQL with GenerateSqlFromNl, which only generates SQL; DBTools MCP Server executes it under database permissions.
In this scenario: "A multi-turn assistant resends its full history on every call and token costs keep climbing" — what should you do first?
Use the Conversations API and pass the conversation ID so OCI manages state, and enable compaction, whose automatic threshold is at least 1000 tokens. Compaction consumes tokens itself and loses some detail.

Common Exam Mistakes — What candidates get wrong

Calling a fine-tuned custom model by its base model ID right after training

A custom model is not live until it is hosted on a dedicated hosting cluster with an endpoint, and the endpoint OCID goes in the model field. Training data is JSONL prompt and completion pairs, at least 32, split 80/20 automatically.

Pairing T-Few with Llama models or LoRA with Cohere models

On OCI, T-Few is the parameter-efficient method for supported Cohere models and LoRA, with frozen base weights, is for supported Llama models. Imported open-weight models run on a dedicated cluster but are not fine-tuned by OCI.

Expecting OCI to execute a function tool in the Responses API

file_search and code_interpreter run inside OCI, and mcp calls a remote MCP server by URL. A function tool only returns a structured call; your application executes it and sends the result back in a follow-up request.

Treating a dedicated hosting cluster like pay-per-request on-demand usage

Dedicated clusters bill in unit-hours, and hosting carries a 744 unit-hour minimum commitment whether or not traffic arrives. Fine-tuning clusters bill per job with a one unit-hour minimum. Light or bursty load usually belongs on on-demand models.

Using guardrails to stop teams calling unapproved models

Model access is controlled by IAM policies that allow or exclude model IDs per group. Guardrails inspect content: moderation, prompt injection and English-only PII detection. Use API keys for testing and IAM authentication in production.

Resources to help you pass OCI Enterprise AI Professional on your first attempt

1Z0-1158 rewards knowing which OCI tool, cluster and control fits. Test your Enterprise AI readiness.