Oracle · Free Practice Questions · Last reviewed May 2026
42real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?
OCI Identity and Access Management (IAM) dynamic groups
Network Security Group (NSG) ingress rules on the API Gateway subnet
Authentication policy using JWT validation
Correct. API Gateway supports JWT validation policies to verify incoming authorization tokens before passing requests to backends.
OCI Web Application Firewall (WAF) rate limiting rule
Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?
Increase the memory allocation to automatically and proportionally increase the timeout limit.
Deploy the function behind an OCI Load Balancer to cache timeout requests.
Upgrade the underlying OCI Compute shape of the worker nodes in OKE.
Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.
Correct. OCI Functions allow configuration of execution timeouts to accommodate longer-running processing tasks.
You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?
OCI API Gateway configured with a mock backend routing to OCI Functions.
OCI Notifications Service publishing directly to an OCI Object Storage bucket.
OCI Events Service rule triggering OCI Functions directly without any intermediate queue.
OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.
Correct. OCI Streaming provides offset management, at-least-once delivery, and custom consumer logic allowing implementation of dead-letter handling.
You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?
OCI API Gateway route pointing to the OCI Function
Correct. API Gateway integrates natively with OCI Functions, allowing them to be invoked via HTTP requests.
OCI Object Storage pre-authenticated request (PAR)
OCI Cloud Guard trigger policy
OCI Streaming cursor initialization
Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?
Kubernetes Persistent Volume Claims with Block Storage
OCI Vault Master Encryption Key rotation
OCI IAM Workload Identity for OKE
Correct. Workload Identity allows OKE pods to assume OCI IAM roles securely using Kubernetes service account tokens.
OCI Bastion Service port forwarding
Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?
Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits
OCI Autoscaling for OKE worker nodes
Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter
Correct. Prometheus Adapter exposes custom metrics to the Kubernetes API server, enabling HPA to scale based on application-specific metrics.
OCI Instance Pool autoscaling configuration
Want more Cloud Native Architecture practice?
Practice this domainYou are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?
Local Peering Gateway
Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit
FastConnect virtual circuits terminate at the DRG, enabling BGP session establishment.
NAT Gateway
Internet Gateway
An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?
Deploy an OCI NAT Gateway inside the VCN.
Re-address one of the virtual networks to ensure non-overlapping IP address spaces.
Overlapping IP spaces cannot be routed directly across an ExpressRoute/FastConnect interconnect without re-addressing or complex NAT appliances.
Configure a Dynamic Routing Gateway route table with static overriding rules.
Enable FastConnect MACsec encryption.
Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?
OCI Storage Gateway
OCI API Gateway
OCI Site-to-Site VPN
OCI Site-to-Site VPN provides secure IPsec tunnels to on-premises networks.
OCI Bastion Service
You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?
8 tunnels
4 tunnels
1 tunnel
2 tunnels
OCI provisions two tunnels by default for redundancy and high availability.
What is the maximum supported MTU (Maximum Transmission Unit) size for traffic passing through an OCI FastConnect virtual circuit by default?
9000 bytes
OCI FastConnect supports Jumbo Frames up to 9000 bytes.
1500 bytes
576 bytes
65535 bytes
An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?
Azure Application Gateway
Azure ExpressRoute Gateway
An ExpressRoute Gateway is required on the Azure side to terminate the ExpressRoute circuit.
Azure Virtual Network NAT
Azure Traffic Manager
Want more Multicloud And Hybrid practice?
Practice this domainAn enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?
Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.
Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.
Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.
Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.
Correct. Defined tags allow cost grouping in Cost Analysis, Cost Reports offer deep historical exports, and Budgets provide proactive alerting.
A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?
Events Service
OCI Monitoring Service
Correct. The Monitoring service allows publishing and querying custom time-series metrics via its published APIs.
OCI Logging Analytics
Application Performance Monitoring (APM)
Your company requires all logs generated within the root compartment to be automatically archived to a centralized OCI Object Storage bucket in a different security tenancy for compliance purposes. Which OCI feature facilitates this serverless data pipeline?
OCI Service Connector Hub
Correct. Service Connector Hub orchestrates data movement between OCI services like Logging and Object Storage.
OCI Data Flow
OCI GoldenGate
OCI Archive Storage lifecycle rules
An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?
OCI Logging Analytics
Correct. Logging Analytics enables searching, parsing, and running advanced analytics queries on log data.
OCI Audit Service
OCI Health Checks
OCI Object Storage
An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?
OCI Application Performance Monitoring (APM) Distributed Tracing
Correct. APM Distributed Tracing tracks transactions across microservices and regions using trace context propagation.
OCI Network Visualizer
OCI Logging Analytics with out-of-the-box system parsers
OCI Monitoring service anomaly detection
You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?
Set the alarm evaluation window to 30 minutes and enable metric smoothing.
Create an OCI Events rule with a batch window of 30 minutes.
Configure the 'Repeat Notification' setting in the OCI Monitoring alarm definition to 30 minutes.
Correct. The repeat notification feature in OCI alarms allows specifying how often to resend notifications while an alarm remains in the firing state.
Configure a notification suppression window in the Notifications service topic settings.
Want more Observability practice?
Practice this domainYou are deploying OCI Full Stack Disaster Recovery (FSDR) to orchestrate a cross-region DR plan for a multi-tier application stack. Which component acts as the primary grouping mechanism for all application assets (databases, compute, load balancers) within a compartment?
Backup Policy Group
Disaster Recovery Protection Group (DR Protection Group)
A DR Protection Group contains the list of OCI resources (compute, databases, load balancers) that are part of the DR topology.
OCI IAM Dynamic Group
Load Balancer Backend Set Group
An enterprise application uses an Oracle Exadata Database Service on Dedicated Infrastructure with Maximum Availability Architecture (MAA). A catastrophic regional disaster occurs, and you must initiate a failover to the standby region. What is the expected behavior of Active Data Guard during this process?
The standby database converts to the primary role, opens for read/write operations, and stops applying redo from the old primary.
A failover promotes the standby to primary, making it writable and terminating the previous primary link.
The standby database automatically initiates a flashback database operation to sync with object storage backups before opening.
Active Data Guard remains in read-only mode until a manual database restore command is issued.
The database becomes inaccessible until Full Stack Disaster Recovery automatically reprovisions the storage cells.
You are managing an Oracle Base Database Service instance and need to configure Data Guard to provide disaster recovery in another OCI region. Which prerequisite must be met before creating the Data Guard association?
Establish network connectivity between the primary and standby VCNs using a DRG and remote VCN peering.
Cross-region database replication requires established network connectivity between the respective Virtual Cloud Networks.
Ensure the standby database has a larger shape than the primary database.
Manually install the Oracle Data Guard binaries on the standby database compute instance prior to association.
Convert the primary database to an Autonomous Database instance.
Your company requires automated daily backups of block volumes attached to critical production compute instances in OCI. Which OCI service feature should you configure?
Custom Oracle Autonomous Linux scripts cron-scheduled to push to Object Storage.
OCI File Storage service snapshot schedules.
OCI Block Volume Vaults with automated cross-region replication policies.
OCI Volume Backup Policies attached to the block volumes.
OCI provides predefined and user-defined backup policies to automate daily, weekly, and monthly block volume backups.
When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?
It requires manual setup of keepalived and IP failover scripts on backend compute instances.
It is a regional service that automatically provisions endpoints across availability domains.
Network Load Balancers are regional and handle multi-AD resilience natively.
It terminates SSL/TLS connections before forwarding traffic to backend servers.
It can only route HTTP and HTTPS traffic.
You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?
OCI Block Volume cross-region replication
Cross-Region Autonomous Data Guard
Autonomous Data Guard provides automated disaster recovery for Autonomous Database across regions with zero or near-zero RPO/RTO.
Manual RMAN incremental backups copied to Object Storage in the remote region
Database Express Export/Import scheduled via cron
Want more High Availability And Disaster Recovery practice?
Practice this domainYou are migrating an on-premises Oracle Database (version 19c) to Oracle Autonomous Database (Serverless) using Oracle Data Pump. Which action is mandatory to ensure compatibility before generating the Data Pump export dump file?
Disable Automatic Workload Repository (AWR) collection on the source database
Convert the source database into an Oracle Multitenant Container Database with a single pluggable database
Run the DBMS_CLOUD.PREPARE_FOR_AUTONOMOUS PL/SQL package on the source database
Correct. This package performs necessary pre-checks and transformations to ensure compatibility with Autonomous Database.
Manually drop all custom triggers and indexes to prevent import failures
An organization is designing a disaster recovery strategy using Exadata Database Service on Dedicated Infrastructure. They require an Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of zero for an enterprise database handling mission-critical workloads. Which Data Guard configuration should be implemented?
Oracle Active Data Guard configured in Maximum Protection mode with synchronous transport
Correct. Maximum Protection mode ensures zero data loss (RPO = 0) by syncing redo to the standby before committing transactions on the primary.
Manual RMAN backup replication via OCI Object Storage every 15 minutes
Oracle Data Guard configured in Maximum Performance mode with asynchronous transport
Oracle GoldenGate real-time replication with asynchronous extract configurations
You need to migrate a 50 TB Oracle Database from on-premises to Exadata Database Service on Dedicated Infrastructure with minimal downtime. The source database is operating on AIX and uses big-endian architecture, while OCI Exadata runs on little-endian Linux. Which migration method handles cross-platform endian conversion most efficiently?
Direct database clone via SQL*Developer migration wizard
Oracle GoldenGate initial load using SQL direct paths
RMAN Transportable Tablespaces with cross-platform data file conversion
Correct. RMAN CONVERT DATAFILE handles endian format conversion natively during transportable tablespace migrations.
Standard Oracle Data Pump export and import over direct database links
Which OCI tool should a cloud architect recommend for automating the lifecycle management, patching, and backing up of a fleet of Oracle Base Database systems across multiple compartments?
OCI Compute Instance Scheduler
Oracle Cloud Infrastructure GoldenGate deployment console
OCI Identity and Access Management (IAM) policies
OCI Database Management service
Correct. Database Management provides fleet-wide observability, monitoring, and lifecycle administration for Oracle databases.
An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?
An Autonomous Database on Shared Infrastructure instance
A standard Oracle Base Database system
A Virtual Cloud Network with a default database subnet only
An Autonomous Exadata Infrastructure resource
Correct. The Autonomous Exadata Infrastructure must be created first as the foundational appliance layer.
Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?
Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host
Correct. The mTLS wallet contains the necessary keystores, truststores, and tnsnames.ora configuration files.
Generate a Kerberos ticket granting service token via the IAM security console
Retrieve the master encryption key directly from OCI Vault using an API key
Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings
Want more Databases practice?
Practice this domainYou are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?
Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.
Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.
Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.
Using a dedicated service account with granular sudoers permissions adheres to the principle of least privilege while enabling successful data collection.
Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.
Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?
Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.
Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.
Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.
OCVS retains the existing VMware tooling, network policies, and guest OS configurations, ensuring zero changes to custom kernel modules.
Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.
An architect is planning the migration of a large enterprise application repository stored in an on-premises NFS filer to OCI. The application requires POSIX-compliant shared file storage accessible by multiple compute instances simultaneously across different availability domains. Which OCI storage service should be deployed?
OCI Archive Storage
OCI Object Storage standard tier
OCI File Storage Service (FSS)
FSS is a shared, POSIX-compliant network file system accessible simultaneously by multiple instances.
OCI Block Volume service
You are migrating a mission-critical multi-tier application from an on-premises data center to OCI. During the migration assessment phase, you identify that the application relies heavily on low-latency network communication (< 1ms round trip time) between the web tier and database tier. Which OCI architectural feature should you implement to satisfy this latency requirement?
Use OCI Local Peering Gateways (LPGs) to connect different Virtual Cloud Networks (VCNs) containing the tiers.
Utilize OCI Compute Placement Groups with a 'Cluster' strategy or deploy instances within the same Fault Domain with a strict locality policy.
Cluster placement groups or strict proximity rules in placement groups place instances physically close together on the same underlying network fabric to achieve ultra-low latency.
Deploy the instances across different Availability Domains within the same OCI region.
Utilize OCI Compute Placement Groups with a 'Spread' strategy.
Your company is executing a lift-and-shift migration of 50 physical servers running Red Hat Enterprise Linux (RHEL) to OCI. You want to ensure that the operating systems remain supported, patched, and entitled to Oracle Linux Premier Support without having to rebuild the servers. What conversion utility should you use?
VMware HCX OS conversion engine
OCI Database Migration service
OCI Instance Export/Import wizard
Oracle Linux Upgrade and Conversion tool (using the `leapp` utility and Oracle Linux yum repositories)
The `leapp` utility combined with Oracle support packages allows seamless in-place conversion from RHEL/CentOS to Oracle Linux.
An enterprise is planning to migrate a large on-premises Oracle Database of 15 TB to Oracle Cloud Infrastructure (OCI) Exadata Database Service. The maintenance window for the final cutover is extremely short (less than 2 hours). Which migration method should you recommend to minimize application downtime?
Set up an Oracle Data Guard standby database in OCI from an on-premises primary database using RMAN duplication over FastConnect, then perform a switchover during the maintenance window.
Data Guard physical standby allows continuous replication and reduces final cutover time to mere seconds or minutes.
Use Oracle Database Actions to export all schemas to a local staging server and import them into the new database.
Migrate the database using OCI Database Migration service with a standard full database backup without incremental backups.
Perform a cold backup on-premises, upload it to OCI Object Storage, and restore it using RMAN during the maintenance window.
Want more Workload Migration practice?
Practice this domainYour security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?
Enable OCI Audit logs and configure automated notifications via OCI Notifications service.
Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.
Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.
OCI WAF integrates directly with OCI Load Balancers or can run edge enforcement to protect applications against web vulnerabilities.
Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.
An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?
OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).
OCI Database Management service.
OCI Identity and Access Management (IAM) password policies.
OCI Vault service to create and manage Customer-Managed Keys (CMK).
OCI Vault provides customer-managed encryption keys stored in hardware security modules (HSM) for high security.
Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?
Local VCN Peering.
Local VCN Peering connects two VCNs in the same region privately, enabling secure inter-VCN traffic without internet exposure.
Dynamic Routing Gateway (DRG) with internet breakout enabled.
Internet Gateway with strict Security List rules.
OCI Bastion service.
An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?
A NAT Gateway combined with a public IP address on the database.
An OCI Service Gateway.
Service Gateways enable secure, private communication from VCN subnets to Oracle public services within the Oracle network.
A Site-to-Site VPN connection back to the corporate data center.
An Internet Gateway attached to the VCN route table.
An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?
Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.
Object Storage Object Lock in Compliance mode ensures that logs cannot be deleted or modified by anyone, even root users, fulfilling strict audit requirements.
Enable OCI Cloud Guard with default responder rules.
Deploy OCI Network Firewall to inspect all control plane traffic.
Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.
Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?
OCI Audit.
OCI Web Application Firewall.
OCI Vulnerability Scanning Service.
OCI Cloud Guard.
Cloud Guard aggregates security findings across the tenancy and computes a security score to help assess posture.
Want more Security practice?
Practice this domainThe 1Z0-997-26 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 7 domains: Cloud Native Architecture, Multicloud And Hybrid, Observability, High Availability And Disaster Recovery, Databases, Workload Migration, Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Oracle 1Z0-997-26 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.