Oracle · Free Practice Questions · Last reviewed May 2026
42 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?
Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.
Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.
Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.
Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.
Defined tags drive cost attribution to business units, Cost Analysis provides historical trends, Object Storage exports enable long-term retention, and Budgets with alert rules deliver anomaly detection. Together these satisfy both dynamic tagging-based attribution and trend analysis requirements.
A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?
Events Service
OCI Monitoring Service
OCI Monitoring Service exposes the PostMetricData API for ingesting custom metrics and the Metrics API for querying them, so OKE microservices can publish cart counts as custom namespace metrics. It satisfies the requirement for a native API to ingest and query application metrics.
OCI Logging Analytics
Application Performance Monitoring (APM)
An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?
OCI Logging Analytics
OCI Logging Analytics indexes ingested log data, enabling complex SQL-like queries through its query language and dashboards for visualisation. It satisfies the stem's requirement to analyse logs from various OCI resources, unlike OCI Logging, which only collects and stores logs without analytical querying or dashboard visualisation capabilities.
OCI Audit Service
OCI Health Checks
OCI Object Storage
An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?
OCI Application Performance Monitoring (APM) Distributed Tracing
OCI Application Performance Monitoring's distributed tracing propagates a trace context across service boundaries, stitching each microservice span into a single end-to-end transaction view. This directly satisfies the requirement to trace requests across regions, exposing which hop introduces the intermittent latency spikes that isolated per-service metrics cannot localise.
OCI Network Visualizer
OCI Logging Analytics with out-of-the-box system parsers
OCI Monitoring service anomaly detection
You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?
Set the alarm evaluation window to 30 minutes and enable metric smoothing.
Create an OCI Events rule with a batch window of 30 minutes.
Configure the 'Repeat Notification' setting in the OCI Monitoring alarm definition to 30 minutes.
The Repeat Notification interval suppresses duplicate alarm notifications, sending only one per 30 minutes while the metric stays in breach. This directly prevents the alert storms the stem describes, and notifications resume normally once the condition clears.
Configure a notification suppression window in the Notifications service topic settings.
An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?
OS Management Hub
OCI Service Connector Hub
OCI Logging Agent
The OCI Logging Agent runs on Compute instances and ships custom application log files to OCI Logging. It satisfies the requirement to collect logs from custom applications, since platform services cannot read application log files directly.
OCI Streaming Service
Want more Observability practice?
Practice this domainYou need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?
OCI Identity and Access Management (IAM) dynamic groups
Network Security Group (NSG) ingress rules on the API Gateway subnet
Authentication policy using JWT validation
A JWT authentication policy makes the gateway validate the token's signature, issuer, audience and expiry against the identity provider's keys before forwarding. Requests lacking a valid JWT are rejected at the gateway, so backend microservices never receive unauthenticated traffic.
OCI Web Application Firewall (WAF) rate limiting rule
Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?
Increase the memory allocation to automatically and proportionally increase the timeout limit.
Deploy the function behind an OCI Load Balancer to cache timeout requests.
Upgrade the underlying OCI Compute shape of the worker nodes in OKE.
Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.
Raising the function timeout via the Fn Project CLI or OCI Console directly addresses the exceeded execution limit, allowing the third-party REST API call to complete. OCI Functions permits timeouts up to 300 seconds, so increasing the configured value within that service ceiling resolves the failure without altering application logic.
You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?
OCI API Gateway route pointing to the OCI Function
An OCI API Gateway route can target an OCI Function as its backend, exposing a public HTTP URL that invokes the function directly. This lets you test the function's HTTP trigger without writing custom client code or managing authentication yourself.
OCI Object Storage pre-authenticated request (PAR)
OCI Cloud Guard trigger policy
OCI Streaming cursor initialization
Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?
Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits
OCI Autoscaling for OKE worker nodes
Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter
HPA scales pods, but custom metrics such as active queue length require the Prometheus Adapter to expose them through the custom metrics API. HPA then reads those metrics, satisfying the requirement for scaling on application metrics rather than CPU or memory.
OCI Instance Pool autoscaling configuration
You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?
Configure each consumer instance to belong to a separate, unique consumer group.
Each OCI Streams consumer group maintains its own committed cursor offset, so separate unique groups give every consumer instance an independent position and a full copy of every message. Sharing a group would partition messages between instances instead.
Use the OCI Streaming default single-consumer mode with multithreaded polling.
Assign all consumer instances to the exact same consumer group and increase the number of partitions.
Publish events via OCI Notifications instead, as Streaming does not support consumer groups.
You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?
OCI File Storage Service mounted on all worker nodes
Kubernetes NodePort service directly pointing to every individual pod
OCI API Gateway without any OKE Ingress
OCI Native Ingress Controller configured with an OCI Load Balancer
The OCI Native Ingress Controller provisions an OCI Load Balancer with a single public IP and translates Kubernetes Ingress path rules into listener routing, satisfying both the single-IP and URL path-based routing constraints for the internal services.
Want more Cloud Native Architecture practice?
Practice this domainYou are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?
Local Peering Gateway
Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit
A Virtual Circuit attachment on the DRG terminates the FastConnect dedicated circuit and runs BGP with your on-premises routers, enabling automatic route propagation. The DRG itself cannot peer directly over the physical cross-connect; the Virtual Circuit provides the Layer 3 BGP session satisfying the dynamic routing requirement.
NAT Gateway
Internet Gateway
An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?
Deploy an OCI NAT Gateway inside the VCN.
Re-address one of the virtual networks to ensure non-overlapping IP address spaces.
The OCI-Azure Interconnect routes packets between VCN and VNet CIDRs, so identical 10.0.0.0/16 ranges create ambiguous destinations that routing cannot resolve. Re-addressing one network to non-overlapping space is therefore mandatory before any cross-cloud traffic can flow.
Configure a Dynamic Routing Gateway route table with static overriding rules.
Enable FastConnect MACsec encryption.
Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?
OCI Storage Gateway
OCI API Gateway
OCI Site-to-Site VPN
OCI Site-to-Site VPN terminates IPSec tunnels on the dynamic routing gateway, encrypting traffic between on-premises customer-premises equipment and the VCN over the public internet. This satisfies the stem's encrypted site-to-site requirement without dedicated private circuits.
OCI Bastion Service
You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?
8 tunnels
4 tunnels
1 tunnel
2 tunnels
OCI provisions two IPsec tunnels per Site-to-Site VPN connection by default, each terminating on a distinct VPN headend endpoint within the same availability domain. This satisfies the high-availability requirement in the stem, since a single headend failure leaves the second tunnel operational without manual reconfiguration.
An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?
Azure Application Gateway
Azure ExpressRoute Gateway
The ExpressRoute virtual network gateway terminates the Azure side of the ExpressRoute circuit provisioned by OCI-Azure Interconnect, providing the BGP peering endpoint required for private connectivity. It satisfies the Ashburn deployment's need for a directly associated Azure resource, unlike ExpressRoute circuits themselves, which are logical connectivity constructs rather than the gateway terminating traffic.
Azure Virtual Network NAT
Azure Traffic Manager
An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?
Enable OCI Database Vault on the compute instances.
Replace the OCI Dynamic Routing Gateway with an Internet Gateway.
Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.
MTU mismatches between OCI VCN, DRG, ExpressRoute gateway and Azure VNet cause fragmentation or silent drops, inflating latency for synchronous replication. Verifying consistent MTU (typically 1500 or jumbo) across every hop is the fastest first diagnostic before deeper path analysis.
Recreate the Azure ExpressRoute circuit in a different Azure subscription.
Want more Multicloud And Hybrid practice?
Practice this domainYou are deploying OCI Full Stack Disaster Recovery (FSDR) to orchestrate a cross-region DR plan for a multi-tier application stack. Which component acts as the primary grouping mechanism for all application assets (databases, compute, load balancers) within a compartment?
Backup Policy Group
Disaster Recovery Protection Group (DR Protection Group)
The DR Protection Group is the compartment-scoped container that groups all application assets, such as databases, compute and load balancers, into one recoverable unit. FSDR plans and failover operations act on this grouping, making it the primary orchestration mechanism.
OCI IAM Dynamic Group
Load Balancer Backend Set Group
An enterprise application uses an Oracle Exadata Database Service on Dedicated Infrastructure with Maximum Availability Architecture (MAA). A catastrophic regional disaster occurs, and you must initiate a failover to the standby region. What is the expected behavior of Active Data Guard during this process?
The standby database converts to the primary role, opens for read/write operations, and stops applying redo from the old primary.
Active Data Guard failover transitions the standby to primary, opening it read/write and halting redo apply from the former primary. This restores service in the standby region, matching the MAA disaster-recovery requirement in the stem.
The standby database automatically initiates a flashback database operation to sync with object storage backups before opening.
Active Data Guard remains in read-only mode until a manual database restore command is issued.
The database becomes inaccessible until Full Stack Disaster Recovery automatically reprovisions the storage cells.
Your company requires automated daily backups of block volumes attached to critical production compute instances in OCI. Which OCI service feature should you configure?
Custom Oracle Autonomous Linux scripts cron-scheduled to push to Object Storage.
OCI File Storage service snapshot schedules.
OCI Block Volume Vaults with automated cross-region replication policies.
OCI Volume Backup Policies attached to the block volumes.
Volume backup policies bind a schedule directly to the block volume, so OCI automatically creates incremental backups at the defined frequency and retention. This satisfies the daily automated backup requirement without custom scripting or manual intervention.
When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?
It requires manual setup of keepalived and IP failover scripts on backend compute instances.
It is a regional service that automatically provisions endpoints across availability domains.
The Network Load Balancer is a regional construct that automatically provisions endpoints across availability domains, providing inherent high availability without manual per-AD configuration. This satisfies the requirement for availability domain redundancy in the NLB architecture.
It terminates SSL/TLS connections before forwarding traffic to backend servers.
It can only route HTTP and HTTPS traffic.
You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?
OCI Block Volume cross-region replication
Cross-Region Autonomous Data Guard
Cross-Region Autonomous Data Guard maintains a standby database in a remote region, continuously replicating changes to deliver minimal RPO during regional failover. This directly satisfies the stem's requirement for remote-region failover with minimal data loss, unlike backup-based approaches that incur higher RPO.
Manual RMAN incremental backups copied to Object Storage in the remote region
Database Express Export/Import scheduled via cron
An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?
Active Data Guard with snapshot standby mode and automated cron-based switchovers.
Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.
Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.
Synchronous redo transport guarantees zero data loss, delivering the required RPO of zero, while Fast-Start Failover automatically redirects the primary within seconds, meeting the sub-two-minute RTO. Maximum Availability mode permits synchronous transport without halting the primary when a standby is unavailable.
Maximum Protection mode with asynchronous redo transport and manual failover scripts.
Want more High Availability And Disaster Recovery practice?
Practice this domainAn organization is designing a disaster recovery strategy using Exadata Database Service on Dedicated Infrastructure. They require an Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of zero for an enterprise database handling mission-critical workloads. Which Data Guard configuration should be implemented?
Oracle Active Data Guard configured in Maximum Protection mode with synchronous transport
Maximum Protection with synchronous transport guarantees zero data loss (RPO zero) because commits are acknowledged only after redo reaches the standby. Synchronous redo transport also enables fast failover, meeting the sub-30-second RTO required for mission-critical workloads.
Manual RMAN backup replication via OCI Object Storage every 15 minutes
Oracle Data Guard configured in Maximum Performance mode with asynchronous transport
Oracle GoldenGate real-time replication with asynchronous extract configurations
Which OCI tool should a cloud architect recommend for automating the lifecycle management, patching, and backing up of a fleet of Oracle Base Database systems across multiple compartments?
OCI Compute Instance Scheduler
Oracle Cloud Infrastructure GoldenGate deployment console
OCI Identity and Access Management (IAM) policies
OCI Database Management service
OCI Database Management provides fleet-level lifecycle, patching and backup automation across compartments for Base Database systems. It is the service scoped to that administrative task, unlike infrastructure or monitoring tools that do not orchestrate patching.
An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?
An Autonomous Database on Shared Infrastructure instance
A standard Oracle Base Database system
A Virtual Cloud Network with a default database subnet only
An Autonomous Exadata Infrastructure resource
Autonomous Exadata Infrastructure provisions the dedicated Exadata hardware and networking that hosts the container database, delivering the physical isolation the security mandate demands. It is the prerequisite layer: no Autonomous Container Database can be created until this infrastructure exists in the tenancy.
Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?
Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host
Mutual TLS requires the client to present the database's trusted certificates and private key. These reside in the connection wallet zip, downloadable from the OCI Console or CLI, which must be extracted on the client host so the application can reference its contents.
Generate a Kerberos ticket granting service token via the IAM security console
Retrieve the master encryption key directly from OCI Vault using an API key
Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings
An architect is designing an Oracle Autonomous JSON Database instance to store flexible document workloads. Which feature is automatically enabled on Autonomous JSON Database that distinguishes it from general-purpose Autonomous Transaction Processing instances regarding storage management?
Automatic conversion of all JSON documents into relational third-normal-form tables upon ingestion
Mandatory requirement to define fixed database schemas via JSON Schema validators before inserting data
Storage and indexing are specifically optimized for JSON collections with restrictions on non-JSON relational tables
Autonomous JSON Database automatically applies JSON-centric storage and indexing optimisations to collections, and restricts non-JSON relational tables. This storage-management distinction separates it from general-purpose Autonomous Transaction Processing, which permits full relational schemas without that JSON-specific tuning.
Exclusion of automated backups to reduce operational overhead
What is the primary architectural advantage of using Exadata Database Service on Dedicated Infrastructure compared to Exadata Database Service on Cloud@Customer?
It requires the customer to manage physical rack power, cooling, and hardware replacement
It exclusively supports non-relational database formats unlike Cloud@Customer
It eliminates the need for Virtual Cloud Networks (VCNs)
The physical Exadata hardware resides and operates entirely within an OCI data center managed by Oracle
Dedicated Infrastructure runs the Exadata hardware inside an Oracle-managed OCI data centre, so Oracle owns the physical environment. Cloud@Customer instead places that same hardware in the customer's own data centre, which is the architectural axis the question contrasts.
Want more Databases practice?
Practice this domainYou are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?
Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.
Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.
Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.
Passwordless sudo scoped to the specific discovery commands satisfies the root-privilege constraint without granting full root or embedding credentials, while the dedicated account and OCI Migration SSH key pair resolve the SSH authentication failures securely.
Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.
Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?
Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.
Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.
Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.
OCVS runs the native vSphere hypervisor on bare metal, so guest OS configurations, custom kernel modules and security policies remain untouched. HCX performs live migration with minimal downtime, satisfying the requirement to preserve exact OS configurations and network consistency without re-platforming.
Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.
An enterprise is planning to migrate a large on-premises Oracle Database of 15 TB to Oracle Cloud Infrastructure (OCI) Exadata Database Service. The maintenance window for the final cutover is extremely short (less than 2 hours). Which migration method should you recommend to minimize application downtime?
Set up an Oracle Data Guard standby database in OCI from an on-premises primary database using RMAN duplication over FastConnect, then perform a switchover during the maintenance window.
Data Guard maintains a synchronised standby via redo transport, so the on-premises primary keeps serving until cutover. RMAN duplication over FastConnect seeds the standby without shipping tapes, and switchover completes in minutes, satisfying the sub-two-hour maintenance window.
Use Oracle Database Actions to export all schemas to a local staging server and import them into the new database.
Migrate the database using OCI Database Migration service with a standard full database backup without incremental backups.
Perform a cold backup on-premises, upload it to OCI Object Storage, and restore it using RMAN during the maintenance window.
An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?
OCI Data Transfer Service using physical Data Transfer Appliances.
Data Transfer Service ships physical appliances to your site, you load the 80 TB, and Oracle uploads it to Object Storage. This bypasses the 50 Mbps internet link entirely, satisfying the bandwidth constraint that would otherwise take months.
OCI FastConnect with a dedicated 1 Gbps partner circuit.
OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.
Parallelized multi-part uploads using the OCI CLI over public internet connections.
You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?
OCI Container Instances
Container Instances runs containers directly without exposing or requiring you to manage the host operating system, so kernel patching and VM scaling are handled by OCI. That serverless container execution satisfies the stated constraint of avoiding OS administration for a standard Docker image.
OCI Functions
Oracle Container Engine for Kubernetes (OKE)
OCI Compute Standard virtual machine instances
Your organization is designing a disaster recovery strategy as part of a workload migration project to OCI. The business requirement states that in the event of a regional outage in OCI region A, workloads must fail over to OCI region B with a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of less than 15 minutes. Which OCI networking feature should you deploy to interconnect the two regions for database replication?
OCI Local Peering Gateway (LPG)
OCI Dynamic Routing Gateway (DRG) with Remote Peering Connection (RPC)
A DRG with a Remote Peering Connection links two VCNs across regions over Oracle's private backbone, providing the low-latency, high-bandwidth path needed for synchronous database replication. This satisfies the zero-RPO and sub-15-minute RTO targets, which internet-based connectivity cannot reliably meet.
OCI Service Gateway
OCI Internet Gateway with IPsec VPN tunnels over the public internet
Want more Workload Migration practice?
Practice this domainYour security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?
Enable OCI Audit logs and configure automated notifications via OCI Notifications service.
Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.
Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.
WAF protection rules inspect inbound HTTP traffic at the edge, blocking XSS and SQL injection payloads before they reach the application, and attaching the policy to the Load Balancer enforces this without modifying application code.
Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.
An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?
OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).
OCI Database Management service.
OCI Identity and Access Management (IAM) password policies.
OCI Vault service to create and manage Customer-Managed Keys (CMK).
OCI Vault provides Customer-Managed Keys (CMK) with configurable rotation schedules, satisfying the policy's strict rotation requirement. Object Storage encrypts data with AES-256; using a Vault master key gives the administrator full control over key lifecycle and rotation, unlike Oracle-managed keys.
Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?
Local VCN Peering.
Local VCN peering connects two VCNs within the same region over Oracle's private backbone, so development microservices reach the production database without any internet exposure. It satisfies the segregation constraint because each VCN retains its own route tables, security lists and CIDR blocks, keeping workloads logically distinct while permitting the required private east-west traffic.
Dynamic Routing Gateway (DRG) with internet breakout enabled.
Internet Gateway with strict Security List rules.
OCI Bastion service.
An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?
A NAT Gateway combined with a public IP address on the database.
An OCI Service Gateway.
A Service Gateway gives private subnet resources access to Oracle services over the OCI backbone, never touching the internet. Traffic to Autonomous Database stays on Oracle's network, avoiding NAT and internet gateways while delivering the lowest latency.
A Site-to-Site VPN connection back to the corporate data center.
An Internet Gateway attached to the VCN route table.
An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?
Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.
Object Lock in Compliance mode makes exported Audit log objects immutable and undeletable for the retention period, even by administrators. This satisfies the tamper-proofing and retention evidence the auditor demands, which standard Logging retention alone cannot provide.
Enable OCI Cloud Guard with default responder rules.
Deploy OCI Network Firewall to inspect all control plane traffic.
Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.
Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?
OCI Audit.
OCI Web Application Firewall.
OCI Vulnerability Scanning Service.
OCI Cloud Guard.
OCI Cloud Guard continuously assesses tenancy resources against security zones and detector recipes, flagging misconfigurations and risky operational behaviours. It aggregates these findings into a unified security score, directly satisfying the stem's requirement for continuous monitoring with a single tenancy-wide risk metric.
Want more Security practice?
Practice this domainThe vendor does not publish an exact question count for the 1Z0-997-26. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 7 domains: Observability, Cloud Native Architecture, Multicloud And Hybrid, High Availability And Disaster Recovery, Databases, Workload Migration, Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Oracle 1Z0-997-26 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.