1Z0-997-26 Practice Test 11 — 15 Questions

Question 1

Which THREE operational tasks should be included in a comprehensive disaster recovery runbook when utilizing OCI Full Stack Disaster Recovery for an enterprise application? (Choose three.)

Accepted Answer

Executing pre-checks in the target DR region to validate resource readiness and configurations. Option A is correct because OCI Full Stack Disaster Recovery (FSDR) runbooks should begin with pre-checks in the target DR region to confirm that compute, networking, storage, and configuration prerequisites are met before any switchover or failover is attempted. Option D is correct because for database-inclusive DR plans, the runbook must verify that the standby database has transitioned to the primary role and that redo/apply lag is resolved so no committed transactions are lost. Option E is correct because a complete DR runbook includes the client-facing cutover step, rerouting traffic through DNS (e.g., OCI DNS steering policies) or Load Balancer changes so users reach the DR region after the backend is promoted. Option B is wrong because deleting IAM policies in the primary region during normal operations would break authentication and authorization and is not a DR task. Option C is wrong because formatting primary database storage volumes would destroy production data and is never part of a disaster recovery runbook.

Answer

Manually deleting all IAM policies in the primary region during normal operations

Answer

Format-all commands on primary database storage volumes prior to initiating DR

Question 2

Which OCI storage service provides massively scalable, highly durable regional object storage that is ideal for storing database backups and disaster recovery artifacts?

Accepted Answer

OCI Object Storage. OCI Object Storage is a regional, internet-scale service designed for massive scalability and eleven-nines durability, making it the standard target for database backups, disaster recovery artifacts, and long-term retention. Its regional nature means data is redundantly stored across availability domains within a region, which is exactly what DR artifacts need.

Answer

OCI Block Volume

Answer

Local NVMe Scratch Disks

Answer

OCI Boot Volumes

Question 3

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

Accepted Answer

Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.. The essential prerequisite is private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect, with non-overlapping subnets and open firewall ports for control plane communication. A service mesh control plane (e.g., Istio) requires direct network reachability between the control plane components and the sidecar proxies across both clouds. This is achieved through the private interconnect, ensuring secure, low-latency communication without public internet exposure.

Answer

Configure an OCI Service Gateway to route traffic to Azure public endpoints.

Answer

Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.

Answer

Enable Oracle Autonomous Database cross-region data guard.

Question 4

During a database migration project using Oracle Zero Downtime Migration (ZDM), the pre-migration validation phase fails with an error indicating that the source database's time zone file version does not match the target OCI Database service time zone file version. How should you resolve this issue?

Accepted Answer

Use the DBMS_DST package on the source database to update the time zone file version to match the target database before restarting the ZDM workflow.. The DBMS_DST package is Oracle's supported mechanism for updating a database's time zone file version. When ZDM pre-migration validation detects a mismatch between source and target time zone file versions, the correct remediation is to upgrade the source database's DST version to match or exceed the target using DBMS_DST (typically via DBMS_DST.BEGIN_PREPARE, BEGIN_UPGRADE, and related procedures). This ensures data consistency for TIMESTAMP WITH TIME ZONE columns and allows the physical migration to proceed without errors.

Answer

Manually downgrade the OCI Database service time zone binaries using root OS access.

Answer

Modify the ZDM response file parameter `SKIP_DST_CHECK=TRUE` to bypass the validation check.

Answer

Restart the ZDM migration job using the logical migration workflow instead of the physical workflow.

Question 5

When configuring OCI API Gateway, which THREE types of backends are natively supported for routing incoming API requests?

Accepted Answer

OCI Functions backend. OCI API Gateway natively supports three backend types for routing API requests: OCI Functions backend (A), which lets a route invoke a serverless function in OCI Functions as the API's origin; HTTP/HTTPS URL backend (B), which forwards requests to an external or internal web server via a standard URL; and Stock Response (Mock) backend (C), which returns a predefined static response without contacting any origin, useful for testing or stubbing. These are the documented backend options available when creating a route in an API Gateway deployment. Option D is incorrect because Identity Domain SAML federation metadata XML is an identity/authentication artifact, not a routable API backend. Option E is incorrect because raw magnetic tape drive backup is not a supported API Gateway backend type and is unrelated to API request routing.

Answer

OCI Identity Domain SAML federation metadata XML file store

Answer

Direct raw magnetic tape drive backup backend

Question 6

You are configuring an OCI API Gateway deployment to route requests to backend microservices running on OKE. You need to ensure that if a backend microservice takes longer than 3 seconds to respond, the API Gateway cancels the request and returns a 504 Gateway Timeout error to the client. Where should you configure this timeout?

Accepted Answer

In the API Gateway deployment specification under the route backend configuration timeout parameter.. The API Gateway deployment specification includes a route backend configuration where you can set a timeout parameter that controls how long the gateway waits for a backend response before returning a 504 Gateway Timeout. Configuring the timeout there ensures the gateway cancels the request after 3 seconds as required.

Answer

In the OCI WAF protection ruleset configuration.

Answer

In the OCI Load Balancer idle timeout setting associated with the subnet.

Answer

In the OKE Kubernetes Ingress resource annotations.

Question 7

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Accepted Answer

Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.. Option A is correct because cross-cloud DR commonly relies on database-level replication such as Oracle Data Guard, which can ship redo from an OCI Autonomous Database to a standby database running in AWS, giving a low-RPO failover target for the data tier. Option B is correct because OCI Traffic Management Steering policies (health-check-based failover, weighted, or geolocation steering) can direct DNS resolution to OCI or AWS endpoints and automatically shift traffic when health checks fail, which is a standard cross-cloud traffic-failover mechanism. Option E is correct because private cross-cloud connectivity for DR is typically built with redundant IPsec VPN tunnels between an OCI Dynamic Routing Gateway (DRG) and an AWS Virtual Private Gateway (VGW), providing encrypted, resilient transport that survives a single tunnel failure. Option C is not valid because AWS VPCs are logical software-defined networks; there are no physical VPC switches to place in OCI Meet-Me-Rooms, and Meet-Me-Rooms are for physical network/carrier interconnects, not VPC hardware. Option D is not valid because OCI IAM identity domains cannot be natively replicated into AWS IAM; cross-cloud identity is achieved through federation (SAML/OIDC) or identity brokering, not native replication between the two proprietary IAM systems.

Answer

Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.

Answer

Replicating OCI IAM identity domains natively inside AWS IAM without federation.

Question 8

You are designing a secure network architecture for migrating production workloads into an OCI Virtual Cloud Network (VCN). Compliance standards require strict traffic inspection, isolation, and secure administrative access. Which THREE OCI networking and security features should you incorporate into your design? (Choose three.)

Accepted Answer

Implement stateful Security Lists and Network Security Groups (NSGs) to enforce least-privilege traffic filtering at the subnet and VNIC levels.. Option A is correct because OCI Security Lists provide stateful, subnet-level filtering while Network Security Groups (NSGs) apply stateful rules at the VNIC level, together enabling least-privilege micro-segmentation required for strict isolation and compliance. Option C is correct because the OCI Bastion service creates ephemeral, time-limited SSH/RDP sessions to private instances that have no public IP, with all sessions audited, satisfying the secure administrative access requirement. Option E is correct because OCI Network Firewall is a managed next-generation firewall that inspects inter-subnet (east-west) traffic inside the VCN, providing the traffic inspection layer the compliance standards demand. Option B is wrong because removing route tables and allowing free public broadcast destroys network segmentation, routing control, and isolation. Option D is wrong because exposing database and backend servers with public IPs violates least privilege and isolation, and direct public administrative access is exactly what the Bastion service is meant to avoid.

Answer

Disable all VCN route tables and allow all subnets to broadcast traffic freely across the public internet.

Answer

Attach public IP addresses to all database and application backend servers to ensure direct administrator troubleshooting capability.

Question 9

An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?

Accepted Answer

An Autonomous Exadata Infrastructure resource. To deploy an Autonomous Database on Dedicated Infrastructure, the foundational resource is the Autonomous Exadata Infrastructure (AEI). This is a dedicated Exadata system in OCI that provides the hardware and infrastructure for hosting Autonomous Container Databases (ACDs). The AEI must be provisioned first because it supplies the compute, storage, and network resources that the ACDs and subsequent Autonomous Databases will use. Without an AEI, you cannot create an ACD or any dedicated autonomous databases.

Answer

An Autonomous Database on Shared Infrastructure instance

Answer

A standard Oracle Base Database system

Answer

A Virtual Cloud Network with a default database subnet only

Question 10

An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?

Accepted Answer

Deploy APM Dedicated Vantage Points (DVPs) on Compute instances inside the private OCI VCN.. Option B is correct because APM Dedicated Vantage Points (DVPs) are the mechanism for running synthetic monitoring scripts from inside a private OCI VCN, allowing tests against resources that are not reachable from the public internet. Option D is correct because DVPs must be able to reach the APM service endpoint to upload results and receive configuration, which requires appropriate egress connectivity such as a service gateway or NAT gateway in the VCN. Option E is correct because synthetic monitors must be explicitly configured to use the DVP as their execution location rather than the default public vantage points, otherwise the scripts would still run from the internet. Option A is incorrect because attaching a public load balancer to an internal database would expose the database and is not how synthetic monitoring reaches private targets. Option C is incorrect because disabling VCN security lists and allowing inbound SSH from public APM nodes is insecure and unnecessary; DVPs run locally inside the VCN and do not require inbound SSH from public APM infrastructure.

Answer

Attach a public load balancer directly to the internal database to route synthetic traffic.

Answer

Disable all VCN security lists to allow inbound SSH from public APM nodes.

Question 11

An architect is designing a lift-and-shift migration strategy for an enterprise running diverse workloads on-premises. Which TWO of the following factors should be evaluated when deciding whether to choose a lift-and-shift (rehost) approach versus a re-architect approach? (Choose two.)

Accepted Answer

Migration timeline urgency and available project budget. Option A is correct because rehost (lift-and-shift) migrations are typically chosen when time-to-migration is short and budget is limited, since they avoid the cost and duration of rewriting code; re-architecting demands significantly more time, skilled staff, and investment. Option E is correct because re-architecting requires access to the application's source code and sufficient developer resources to refactor it into a cloud-native design (e.g., microservices, managed services); if source code is unavailable or developers are scarce, rehosting becomes the practical choice. The remaining options (B, C, and D) are irrelevant to migration strategy decisions, as carpeted floors, server bezel colors, and coffee machine brands have no bearing on whether to rehost or re-architect a workload.

Answer

Whether the on-premises facility uses carpeted floors

Answer

The physical color of the server bezels in the on-premises rack

Answer

The brand of office coffee machine currently installed in the data center

Question 12

An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?

Accepted Answer

Associate the newly created custom parser with a custom Log Source in Logging Analytics.. Option A is correct because a custom parser in OCI Logging Analytics must be attached to a custom Log Source so that the service knows which parser to apply when ingesting that log type. Option B is correct because the parser creation workflow requires supplying sample log messages to test and validate that the pattern matching and field extraction work against real data. Option C is correct because the core of a custom parser is defining extraction rules, typically via regular expressions or the parser builder, to map fields such as timestamp, severity, and message. Option D is incorrect because hypervisor kernel parameters are unrelated to Logging Analytics parsing and cannot influence log field extraction. Option E is incorrect because Logging Analytics parsers are configured declaratively in the service, not by compiling and deploying C++ binaries to OCI Functions.

Answer

Modify the hypervisor kernel parameters on all compute instances.

Answer

Compile a C++ binary package and upload it to an OCI Function.

Question 13

An OCI architect is setting up a disaster recovery environment where compute instances in the DR region need identical network configurations (private IPs, VNICs, security lists) to the primary region. Which OCI capability assists in deploying reproducible network topologies across regions?

Accepted Answer

OCI Resource Manager with Terraform configurations. OCI Resource Manager is a managed Terraform service that lets architects define network topologies (VCNs, subnets, security lists, VNICs, private IP assignments) as code and deploy them repeatedly across regions. Because the same Terraform configuration can be applied to a DR region, it guarantees identical, reproducible network configurations without manual drift. This is the canonical OCI answer for infrastructure-as-code and cross-region DR topology replication.

Answer

OCI File Storage Network File System (NFS) exports

Answer

OCI IAM Domain Federation wizard

Answer

OCI Streaming service partition replication

Question 14

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Accepted Answer

OCI DevOps Service. OCI DevOps Service is Oracle Cloud Infrastructure's native CI/CD platform, providing build pipelines, deployment pipelines, and artifact repositories that integrate directly with Git repositories. It automates the build, test, and deployment phases triggered by code pushes, making it the correct choice for native CI/CD on OCI. The other services serve different purposes such as event handling, data replication, or infrastructure-as-code.

Answer

OCI Events Service

Answer

OCI GoldenGate

Answer

OCI Resource Manager

Question 15

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

Accepted Answer

Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.. OCI Vault is a regional service, and customer-managed keys are stored in the region where the vault is created. To ensure encryption keys never leave their home regions, you must provision separate OCI Vaults and keys in each region where workloads reside. This design keeps keys within their respective regions and complies with data residency requirements.

Answer

Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

Answer

Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

Answer

Store all keys in the home region and use the OCI Service Gateway for remote decryption.