1Z0-997-26 Practice Test 12 — 15 Questions

Question 1

You are tasked with migrating a mission-critical three-tier enterprise application from an on-premises environment to OCI. The database tier uses Oracle RAC, and the application tier consists of stateless Java applications running on JBoss. Which TWO strategies or tools should be incorporated into the migration plan to ensure high availability and minimal downtime during cutover? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Utilize Oracle Zero Downtime Migration (ZDM) to automate the database migration from on-premises RAC to OCI Exadata Database Service.. Option A is correct because Oracle Zero Downtime Migration (ZDM) is purpose-built to automate and orchestrate migrations of Oracle databases—including RAC sources—to OCI Database services such as Exadata Database Service, using techniques like Data Guard and GoldenGate to minimize downtime during cutover. Option C is correct because placing an OCI Load Balancer in front of stateless JBoss application instances spread across multiple fault domains enables seamless traffic redirection and rolling cutover, so users experience minimal disruption while instances are switched over. Options B, D, and E are not appropriate: manual SQL*Plus cold backup/restore across all tiers would cause significant downtime and lacks automation; physical block-level cloning of running JBoss memory states is not a supported or reliable migration method for stateless Java applications; and converting to MySQL HeatWave during cutover without schema validation is risky, unsupported for an Oracle RAC-based mission-critical system, and would introduce unacceptable downtime and data integrity issues.

Answer

Rely exclusively on manual Oracle SQL*Plus scripts to perform a cold backup and restore across all tiers simultaneously.

Answer

Migrate the application tier using physical block-level cloning of the running JBoss server memory states.

Answer

Convert the database architecture immediately to MySQL HeatWave during the cutover window without schema validation.

Question 2

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that runs containers directly without requiring you to manage the underlying host OS, kernel patching, or VM scaling. It is purpose-built for running single containers or small groups of tightly coupled containers, making it the ideal fit for migrating a standard Docker container with minimal operational overhead. Unlike OKE, it abstracts away the Kubernetes control plane and worker nodes, so you don't manage any cluster infrastructure. This directly satisfies the requirement to avoid OS management and VM scaling.

Answer

OCI Functions

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

OCI Compute Standard virtual machine instances

Question 3

You are tasked with migrating a large enterprise database to OCI Exadata Database Service. To ensure minimal downtime and high reliability during cutover, which TWO Oracle migration tools or features are specifically designed for this purpose? (Choose two.)

Accepted Answer

Oracle Zero Downtime Migration (ZDM). Oracle Zero Downtime Migration (ZDM) (C) is purpose-built for migrating Oracle databases to OCI with near-zero downtime, using Oracle Data Guard or logical/physical methods and automated orchestration to keep the source online until cutover. Oracle Data Guard (E) is the core Oracle high-availability and disaster-recovery feature that maintains a synchronized standby database, enabling a fast switchover with minimal downtime during the cutover to Exadata Database Service. The other options do not fit: Robocopy (A) is a Windows file-copy utility with no database awareness, the OCI File Storage CLI (B) only uploads files to a file system, and OCI Streaming Kafka APIs (D) are for event-streaming ingestion, none of which provide Oracle database migration or cutover reliability.

Answer

Windows Robocopy utility

Answer

OCI File Storage CLI upload utility

Answer

OCI Streaming Service Kafka producer APIs

Question 4

Your organization is implementing strict compliance requirements for log retention and auditing in OCI. Which THREE architectural implementations ensure secure, long-term log governance?

Accepted Answer

Encrypt log groups in OCI Logging using Customer-Managed Keys (CMK) from OCI Vault.. Option B is correct because encrypting OCI Logging log groups with Customer-Managed Keys (CMK) from OCI Vault gives the organization control over the encryption lifecycle, satisfies compliance mandates for data-at-rest protection, and allows key rotation and revocation independent of Oracle-managed keys. Option C is correct because IAM least-privilege policies ensure that only authorized principals can read, modify, or delete log groups and archival buckets, which is essential for tamper-resistant audit trails and separation of duties under compliance frameworks. Option D is correct because Service Connector Hub reliably moves logs from OCI Logging to Object Storage, and configuring the bucket with Object Lock (WORM) enforces immutability for the retention period, preventing deletion or alteration and meeting long-term log governance requirements. Option A is not appropriate because storing unencrypted log backups in public Object Storage buckets exposes sensitive audit data and violates encryption, access-control, and confidentiality requirements. Option E is not appropriate because disabling OCI Audit service logging destroys the API activity history needed for auditing and incident investigation, directly undermining compliance rather than improving security.

Answer

Store unencrypted log backups on public Object Storage buckets for easy developer access.

Answer

Disable OCI Audit service logging to prevent unauthorized users from viewing API history.

Question 5

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

Accepted Answer

Configure IPsec VPN tunnels with strong encryption algorithms (e.g., AES-256) for on-premises connectivity.. Option A is correct because IPsec VPN tunnels using strong encryption such as AES-256 protect data in transit between on-premises networks and OCI over untrusted paths like the internet. Option E is correct because TLS/HTTPS encrypts application-layer traffic between services and endpoints, preventing eavesdropping or tampering across OCI networking components. Option B is incorrect because sending database traffic unencrypted over the public internet exposes sensitive data to interception. Option C is incorrect because plain-text HTTP provides no confidentiality or integrity for inter-microservice communication within a VCN. Option D is incorrect because disabling security lists and enabling packet sniffing removes access controls and exposes traffic rather than securing it.

Answer

Transmit all database traffic over unencrypted public internet connections.

Answer

Rely on plain-text HTTP for all inter-microservice communication within a VCN.

Answer

Disable VCN security lists to allow unhindered packet sniffing.

Question 6

You are migrating a multi-tier web application to OCI. The web tier consists of Apache HTTP servers that need to be auto-scaled based on CPU utilization. Which combination of OCI services should you configure to achieve automated horizontal scaling?

Accepted Answer

OCI Instance Pools and OCI Auto-Scaling Configurations. OCI Instance Pools let you manage a group of identical compute instances as a single entity, and Auto-Scaling Configurations define scaling policies (e.g., CPU utilization thresholds) that automatically adjust the pool size. Together they provide horizontal auto-scaling for the web tier based on CPU metrics. This is the native OCI solution for automated horizontal scaling.

Answer

OCI Resource Manager and Terraform apply schedules

Answer

OCI Events Service and OCI Notifications triggered by Object Storage uploads

Answer

OCI Cloud Guard and OCI Vulnerability Scanning

Question 7

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

Accepted Answer

IAM Group. An IAM Group in OCI is a collection of users who share the same job function and require the same permissions. Policies are written against groups rather than individual users, so grouping users by role simplifies permission management and follows the principle of least privilege at scale. This is the standard identity construct for role-based access control in OCI.

Answer

Compartment

Answer

Federation Provider

Answer

Dynamic Group

Question 8

Which TWO characteristics distinguish OCI Container Engine for Kubernetes (OKE) as a managed Kubernetes service?

Accepted Answer

Users manage and control the worker node pools (compute shapes, scaling, OS patches).. Option D is correct because OKE is a managed Kubernetes service in which Oracle owns, runs, and patches the Kubernetes control plane (API server, etcd, scheduler, controller manager) and does not charge for those master nodes — customers pay only for the worker nodes and other resources they consume. Option C is correct because, while the control plane is managed by Oracle, the worker node pools remain the customer's responsibility: you choose compute shapes, node counts, autoscaling, and OS/image patching for the worker nodes. Option A is wrong because OKE does not grant users SSH administrative access to the Oracle-managed control plane master nodes; that access is restricted to Oracle. Option B is wrong because OKE does not automatically provision Oracle Autonomous Databases for pods; persistent storage must be configured explicitly (for example, via OCI Block Volume or File Storage CSI drivers). Option E is wrong because worker nodes are billed based on the actual compute shape and resources used, not a flat hourly rate independent of shape.

Answer

Users have full administrative SSH access to the underlying Kubernetes master control plane nodes.

Answer

OKE automatically provisions Oracle Autonomous Databases for every deployed pod.

Answer

Kubernetes worker nodes are billed at a flat hourly rate regardless of compute shape.

Question 9

An organization is preparing to migrate 500 virtual machines to OCI. To govern resource creation, budget allocation, and access control effectively, how should the OCI tenancy be structured prior to starting resource migrations?

Accepted Answer

Create a structured hierarchy of compartments (e.g., Prod, Non-Prod, Networking) beneath the root tenancy and apply least-privilege IAM policies to each compartment.. OCI governance is built on a compartment hierarchy under the tenancy root, with IAM policies attached at the compartment level to grant least-privilege access. Creating a structured hierarchy such as Prod, Non-Prod, and Networking before migration lets you apply budgets, quotas, and policies consistently as resources are onboarded. This is the foundational step for governing 500 VMs at scale.

Answer

Deploy all migrated virtual machines into the tenancy root compartment with a single administrator policy.

Answer

Create a separate OCI tenancy for every single virtual machine being migrated.

Answer

Rely entirely on tags without creating compartments or IAM policies.

Question 10

A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?

Accepted Answer

OCI Monitoring Service. The OCI Monitoring Service provides the API (PostMetricData) to ingest custom metrics and the QueryMetrics API to retrieve them. It is the native service for storing and querying both built-in and custom metrics emitted by OKE workloads.

Answer

Events Service

Answer

OCI Logging Analytics

Answer

Application Performance Monitoring (APM)

Question 11

An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?

Accepted Answer

Re-address one of the virtual networks to ensure non-overlapping IP address spaces.. OCI-Azure Interconnect (via FastConnect and ExpressRoute) requires that the OCI VCN CIDR and Azure VNet CIDR do not overlap, because routing between the two environments relies on standard IP routing tables that cannot distinguish between identical prefixes. When both sides use 10.0.0.0/16, the DRG and Azure route tables would have ambiguous next-hop decisions, causing traffic to be dropped or misrouted. Re-addressing one of the virtual networks to a unique, non-overlapping CIDR is the only way to ensure deterministic routing across the interconnect.

Answer

Deploy an OCI NAT Gateway inside the VCN.

Answer

Configure a Dynamic Routing Gateway route table with static overriding rules.

Answer

Enable FastConnect MACsec encryption.

Question 12

Your OKE cluster uses Calico for Kubernetes network policy enforcement. You need to write a network policy that allows Pod A in namespace 'frontend' to communicate with Pod B in namespace 'backend', while blocking all other ingress traffic to Pod B. How should you implement this?

Accepted Answer

Create a Kubernetes NetworkPolicy in the 'backend' namespace selecting Pod B and allowing ingress exclusively from namespace 'frontend'.. A Kubernetes NetworkPolicy in the 'backend' namespace that selects Pod B and allows ingress only from namespace 'frontend' is the correct Calico-enforced approach. NetworkPolicies are namespace-scoped, select pods by labels, and define allowed ingress/egress, which is exactly what is needed to permit frontend-to-backend while blocking all other ingress.

Answer

Apply an OCI Identity and Access Management (IAM) policy restricting pod access.

Answer

Configure an OCI Load Balancer listener rule for namespace ports.

Answer

Modify the VCN Security List for the worker node subnet to filter traffic by pod name.

Question 13

You are planning the backup retention strategy for critical Oracle Base Database Service instances in OCI. You want to retain weekly backups for 12 months and daily backups for 30 days. Where are these automated backups stored by default?

Accepted Answer

In an Oracle-managed Object Storage bucket inaccessible to direct user manipulation.. Automated backups for Oracle Base Database Service in OCI are stored in an Oracle-managed Object Storage bucket that is not directly accessible to customers. This design ensures backup integrity, security, and lifecycle management without requiring user intervention. The retention policies (weekly for 12 months, daily for 30 days) are applied to these backups automatically.

Answer

In an OCI File Storage Service (FSS) mount target.

Answer

In a customer-managed Block Volume attached to the database compute instance.

Answer

In local temporary NVMe drives on the database node.

Question 14

Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?

Accepted Answer

OCI Site-to-Site VPN. OCI Site-to-Site VPN is the managed service that creates an IPSec VPN connection between an on-premises customer-premises equipment (CPE) device and a Dynamic Routing Gateway attached to a VCN. It supports IKEv1 and IKEv2 with AES encryption and SHA-2 hashing, providing encrypted tunnels over the public internet. This is the native OCI service for encrypted site-to-site connectivity.

Answer

OCI Storage Gateway

Answer

OCI API Gateway

Answer

OCI Bastion Service

Question 15

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

Accepted Answer

OCI VCN Flow Logs. OCI VCN Flow Logs capture metadata about traffic flowing through VNICs, including source/destination IPs, ports, protocol, and whether the packet was accepted or rejected by security rules. Enabling flow logs on the subnet or VNIC lets you verify if security lists or NSGs are dropping packets to the external endpoint.

Answer

OCI Health Checks ping monitors

Answer

OCI Monitoring service VNIC packet counters

Answer

OCI Network Firewall system logs