1Z0-997-26 Practice Test 14 — 15 Questions

Question 1

You are designing an active-active hybrid architecture between an on-premises datacenter and OCI using two separate FastConnect circuits connected to two different DRG attachments. How does OCI determine path selection when receiving identical BGP route advertisements from both circuits?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DRG uses standard BGP best path selection criteria, including AS Path length and Local Preference.. OCI DRG attachments for FastConnect behave like standard BGP peers. When identical prefixes are advertised over two circuits, the DRG runs the standard BGP best-path algorithm — comparing attributes such as Weight, Local Preference, AS Path length, Origin, MED, and finally router ID — to pick a single best path per prefix. Equal-cost multipath (ECMP) can occur only when the relevant attributes tie, otherwise one circuit becomes preferred for that prefix.

Answer

OCI automatically enforces round-robin load balancing regardless of BGP advertisements.

Answer

Active-active routing is not supported; OCI randomly drops packets on duplicate routes.

Answer

OCI always selects the circuit with the lower OCID alphabetically.

Question 2

You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?

Accepted Answer

Configure the 'Repeat Notification' setting in the OCI Monitoring alarm definition to 30 minutes.. OCI Monitoring alarms have a 'Repeat Notification' setting that controls how often the notification is re-sent while the alarm remains in the firing state. Setting it to 30 minutes ensures that if the metric stays above threshold, the notification is sent only once every 30 minutes, preventing alert storms. This is the correct mechanism for suppressing repeated notifications.

Answer

Set the alarm evaluation window to 30 minutes and enable metric smoothing.

Answer

Create an OCI Events rule with a batch window of 30 minutes.

Answer

Configure a notification suppression window in the Notifications service topic settings.

Question 3

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

Accepted Answer

Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.. OCI Web Application Firewall (WAF) is a cloud-native service that protects web applications from common exploits like SQL injection and XSS. By configuring a WAF policy with protection rules and attaching it to the Load Balancer, you can inspect incoming traffic at the edge and block malicious requests without modifying application code. This directly addresses the requirement.

Answer

Enable OCI Audit logs and configure automated notifications via OCI Notifications service.

Answer

Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.

Answer

Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.

Question 4

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

Accepted Answer

OCI Audit Service. OCI Audit Service automatically records all API calls and console actions across the tenancy, including administrative actions, logins, and resource modifications, and retains them for 365 days by default. It is the native auditing capability that satisfies compliance and forensic requirements without additional configuration. Auditors can access events via the Console, API, or CLI.

Answer

OCI Events Service

Answer

OCI Logging Analytics

Answer

Database Audit Vault

Question 5

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

Accepted Answer

In the DRG route table import/export distribution or static route configuration for the VPN attachment.. To restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN, you must control route propagation on the OCI side. This is done by configuring the DRG route table associated with the VPN attachment, specifically the import distribution and static route configuration, to filter which routes are accepted from on-premises.

Answer

On the OCI Bastion service configuration page.

Answer

Inside the OCI Identity and Access Management (IAM) policy console.

Answer

By modifying the VCN DHCP options.

Question 6

An enterprise is migrating a cluster of microservices running on Kubernetes from an on-premises data center to OCI Container Engine for Kubernetes (OKE). The cluster uses custom CNI (Container Network Interface) plugins and persistent storage backed by an on-premises Ceph cluster. During migration planning, how should you architect the persistent storage layer in OCI to support OKE stateful workloads?

Accepted Answer

Install the OCI Block Volume and OCI File Storage CSI drivers in the OKE cluster to dynamically provision persistent storage volumes.. OCI Block Volume and OCI File Storage CSI drivers integrate with OKE to dynamically provision PersistentVolumes backed by OCI Block Volume (for ReadWriteOnce block storage) and OCI File Storage (for ReadWriteMany NFS storage). This replaces the on-premises Ceph-backed persistent storage with native OCI storage that supports stateful workloads, snapshots, and dynamic provisioning. The CSI drivers are the supported mechanism for persistent storage in OKE and align with Kubernetes storage classes.

Answer

Use ephemeral container scratch space for all persistent state requirements in OKE.

Answer

Mount the on-premises Ceph cluster directly inside OKE worker nodes using public IP addresses over an internet gateway.

Answer

Store all database and application state inside OCI Object Storage bucket folders mounted via local loop devices.

Question 7

An enterprise application hosted on OCI requires high availability across multiple fault domains within a single availability domain. Which resource placement strategy should you use for your application compute instances?

Accepted Answer

Distribute instances evenly across three different Fault Domains.. Within a single availability domain, fault domains are independent groupings of hardware with separate power and network. Distributing compute instances evenly across the three fault domains ensures that a hardware failure in one fault domain does not take down the entire application, which is the correct HA strategy at the AD-internal level.

Answer

Configure a dedicated virtual cloud network for each fault domain.

Answer

Attach all instances to separate Internet Gateways.

Answer

Place all instances in Fault Domain 1 to optimize network latency.

Question 8

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

Accepted Answer

Automated or manual key rotation policies.. Option B is correct because OCI Vault lets you define key rotation policies that rotate master encryption keys either automatically on a schedule or manually on demand. Option D is correct because OCI Vault is the service used to create and manage customer-managed master encryption keys (CMKs) in key vaults, which can then be used to encrypt data across OCI services. Option E is correct because OCI Vault keys are protected by Hardware Security Modules validated to FIPS 140-2 Level 3, providing strong hardware-backed key protection. Option A is not a Vault capability; BGP peering for on-premises routers is handled by OCI networking services such as FastConnect and dynamic routing gateways. Option C is not provided by Vault, since Vault manages encryption keys and secrets, not free unlimited public storage of plaintext database files.

Answer

Direct routing of BGP peering sessions for on-premises routers.

Answer

Unlimited free public storage of plaintext database files.

Question 9

You are designing a cross-region disaster recovery strategy for an Oracle Exadata Database Service on Dedicated Infrastructure deployment. Which TWO steps or configurations are required to establish an Active Data Guard standby database in a remote OCI region?

Accepted Answer

Configure Standby Redo Logs (SRLs) on both the primary and standby databases sized identically to the online redo logs.. Option C is correct because Oracle Data Guard requires standby redo logs (SRLs) on both the primary and standby databases to receive redo from the primary and to support role transitions; best practice is to size them identically to the online redo logs and add one extra SRL group per thread. Option E is correct because an Active Data Guard standby in a remote OCI region needs network connectivity between the primary and standby VCNs, which in OCI is achieved with a Dynamic Routing Gateway (DRG) plus local or remote VCN peering (or equivalent DRG-based routing). Option A is not required because Data Guard transports redo over Oracle Net (TCP), not by mounting shared NFS block storage across regions, which is neither supported nor how Data Guard works. Option B is not required because automatic backups on the standby are optional and independent of establishing the standby; Data Guard configuration does not depend on matching backup retention. Option D is not required because GoldenGate is a logical replication product, whereas Active Data Guard uses redo transport and apply, not GoldenGate, as its transport mechanism.

Answer

Mount a shared block storage volume across both OCI regions using Network File System (NFS).

Answer

Enable automatic backups on the standby database using the same retention period as the primary.

Answer

Configure Oracle GoldenGate bidirectional replication as the underlying transport mechanism.

Question 10

You are using Fn Project CLI to deploy an OCI Function. Which command is used to build, push, and deploy the function to your application in OCI in a single streamlined step?

Accepted Answer

fn deploy --app . The Fn Project CLI command 'fn deploy --app ' performs the full lifecycle in one step: it builds the function image from the func.yaml, pushes it to the configured Docker registry (such as OCIR), and creates or updates the function and its route in the specified OCI Functions application. This is the canonical streamlined deployment command used with OCI Functions.

Answer

oci functions function create

Answer

kubectl apply -f function.yaml

Answer

docker build and docker push only

Question 11

When creating an Oracle Base Database system, which database edition options are available for licensing on OCI?

Accepted Answer

Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance. Oracle Base Database Service on OCI offers the same commercial editions as on-premises Oracle Database: Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance. These are the licensing options available when provisioning a Base Database system.

Answer

Oracle Database Express Edition (XE) exclusively

Answer

Microsoft SQL Server Enterprise Edition

Answer

MySQL Enterprise Edition and PostgreSQL Community Edition only

Question 12

You are designing an OKE-based cloud-native microservices architecture and want to ensure high availability and robust security isolation. Which THREE architectural best practices should you implement?

Accepted Answer

Enable private Kubernetes API server endpoint access so the control plane is not exposed publicly.. Option A is correct because enabling a private Kubernetes API server endpoint in OKE ensures the control plane is only reachable through the VCN (via private IPs, VPN, FastConnect, or bastion), removing public internet exposure and reducing the attack surface for the cluster's management plane. Option B is correct because placing worker nodes in private subnets with no public IPs prevents direct inbound internet access to nodes, forcing traffic through controlled ingress (load balancers, NAT gateway for egress), which enforces network isolation and least-privilege connectivity. Option C is correct because spreading worker node pools across multiple Fault Domains or Availability Domains within the region provides fault tolerance against AD/FD-level failures, so the loss of one domain does not take down all worker capacity and preserves high availability. Option D is incorrect because disabling Kubernetes RBAC removes authorization controls, granting unrestricted access and violating the security isolation requirement rather than improving it. Option E is incorrect because running all system pods and workloads in the default namespace as root eliminates namespace-based isolation and least-privilege execution, which are core security best practices for multi-tenant or microservices architectures.

Answer

Disable all Kubernetes RBAC authorization to allow unrestricted developer deployments.

Answer

Run all Kubernetes system pods and application workloads in the 'default' namespace as root user.

Question 13

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

Accepted Answer

Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.. OCI Vault is the managed secrets service designed to store and rotate sensitive values such as database credentials, and OCI Functions can retrieve them at runtime using the OCI SDK. Authentication to Vault is achieved through a dynamic group that matches the function's resource principal, so no long-lived credentials are embedded anywhere. This eliminates the insecure environment-variable pattern while providing auditability and centralized rotation.

Answer

Hardcode the credentials inside the function source code repository.

Answer

Store secrets in OCI Object Storage with public read access.

Answer

Encode the credentials in Base64 and store them in IAM policy descriptions.

Question 14

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Accepted Answer

An IAM policy granting the dynamic group permission to read secrets in the OCI Vault.. Option A is correct because the dynamic group itself only identifies the instances; authorization to call the OCI Vault secret-read API (e.g., `ReadSecretBundle` / `ReadSecrets`) must be granted through an IAM policy that names the dynamic group as principal and the vault or secrets as resource. Option B is correct because a dynamic group must be created with matching rules (for example, `instance.compartment.id = 'ocid1.compartment...'` or `instance.id = 'ocid1.instance...'`) so that the compute instances are recognized as members and can receive the policy permissions. Option C is wrong because a public internet gateway is a VPC networking component for internet traffic and has no role in authenticating instances to OCI Vault. Option D is wrong because disabling IAM policy enforcement would remove the very authorization mechanism needed and is not a supported or sensible configuration. Option E is wrong because hardcoded passwords in /etc/passwd are insecure and unrelated to OCI instance principals, which use instance identity certificates rather than static credentials.

Answer

A public internet gateway attached to the vault storage endpoint.

Answer

Disabling all IAM policy enforcement across the tenancy.

Answer

Hardcoded passwords placed in the instance /etc/passwd file.

Question 15

What is the primary function of OCI Network Security Groups (NSGs)?

Accepted Answer

To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.. OCI Network Security Groups (NSGs) act as virtual firewalls that control inbound and outbound traffic for a specific set of VNICs. Unlike security lists, which apply to all VNICs in a subnet, NSGs allow you to apply security rules to a group of VNICs that you explicitly choose, enabling fine-grained, instance-level micro-segmentation.

Answer

To balance HTTP/HTTPS traffic across multiple backend web servers.

Answer

To encrypt data at rest in block storage volumes.

Answer

To manage human user passwords and multi-factor authentication.