1Z0-997-26 Practice Test 15 — 15 Questions

Question 1

During the post-migration validation phase of an application migration to OCI, your team needs to verify security compliance and resource configuration posture. Which TWO OCI services should you use to assess security posture and detect misconfigurations? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Vulnerability Scanning Service. OCI Vulnerability Scanning Service (A) is correct because it scans compute instances and container images for vulnerabilities and also checks host and application configurations against CIS benchmarks, directly supporting security-compliance verification and misconfiguration detection during post-migration validation. OCI Cloud Guard (D) is correct because it continuously monitors the tenancy for risky configurations and insecure activities, using detectors and responder recipes to identify misconfigured resources and security posture problems. Together these two services provide the vulnerability and configuration-posture assessment the scenario requires. OCI Cost Estimator (B) only estimates costs for planned resources and has no security-assessment capability. OCI Streaming Service (C) is a publish-subscribe messaging platform for real-time data ingestion, unrelated to security posture. OCI Resource Manager (E) is a Terraform-based infrastructure-as-code provisioning service, not a security or misconfiguration assessment tool.

Answer

OCI Cost Estimator

Answer

OCI Streaming Service

Answer

OCI Resource Manager

Question 2

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Accepted Answer

Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.. Option D is correct because the OCI Bastion service is purpose-built for this scenario: it creates a managed, time-limited SSH session to private compute instances in a target subnet without requiring any public IP or public exposure, and access is controlled through IAM policies and session types (e.g., managed SSH). Option E is correct because an OCI Site-to-Site VPN (IPSec) or FastConnect (private dedicated connectivity) extends the on-premises network into the VCN, so administrators can reach private instances over the private network path without exposing them to the internet. Option A is wrong because a public load balancer would expose port 22 to the internet and load balancers are not an administrative access mechanism for SSH. Option B is wrong because attaching ephemeral public IPs directly exposes the instances to the internet, contradicting the requirement. Option C is wrong because an unauthenticated public API Gateway endpoint does not provide secure administrative SSH access and would itself be an unsecured public exposure.

Answer

Configure a public load balancer pointing directly to port 22 of all backend private compute instances.

Answer

Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.

Answer

Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.

Question 3

An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?

Accepted Answer

Create two separate alarms and define an OCI Monitoring Composite Alarm using the logical AND operator.. OCI Monitoring Composite Alarms are designed to combine multiple underlying metric alarms using logical operators (AND, OR, etc.). To trigger only when both CPU > 90% and latency > 500ms occur simultaneously, you create two standard metric alarms and then a composite alarm that ANDs them together.

Answer

Configure an OCI Notifications service topic subscription with a logical filter rule.

Answer

Use OCI Events service with a custom JSON payload condition.

Answer

Create a single standard alarm with a compound mathematical metric expression joining CPU and latency.

Question 4

An auditor requests a complete historical record of all console sign-ins, IAM policy modifications, and compartment deletions across your OCI tenancy for the past 365 days. Which OCI service provides this data natively?

Accepted Answer

OCI Audit Service. OCI Audit Service automatically records all control plane API activities, including console sign-ins, IAM policy modifications, and compartment deletions, and retains these events for 365 days natively. This is the authoritative source for historical audit records across the tenancy, and it can be queried via the Console, API, or CLI.

Answer

OCI Events Service

Answer

OCI Cloud Guard Activity Tracking

Answer

OCI Logging Analytics

Question 5

Your organization is migrating a high-throughput transactional database to OCI. During peak business hours, the database experiences massive I/O bursts. You want to ensure the underlying storage configuration can scale its IOPS independently of storage capacity. Which OCI block volume feature should you enable?

Accepted Answer

OCI Block Volume Auto-Tune performance feature or manual VPU adjustment.. OCI Block Volume's Auto-Tune feature (or manual VPU adjustment) allows you to change performance independently of capacity, scaling IOPS and throughput up or down without resizing the volume. This directly addresses the requirement for independent IOPS scaling during I/O bursts. Auto-Tune can be set to monitor and adjust VPUs based on demand, or you can manually set a higher VPU.

Answer

OCI Object Storage Infrequent Access tier

Answer

OCI File Storage Service snapshot policies

Answer

OCI Local NVMe RAID striping

Question 6

Which OCI database service provides fully managed Oracle Database instances running on dedicated virtual machines with root access and granular control over operating system parameters?

Accepted Answer

Oracle Base Database service. Oracle Base Database service (formerly Bare Metal and VM DB systems) provisions fully managed Oracle Database instances on dedicated VMs or bare metal where you get SSH root access and can tune OS kernel parameters, huge pages, and network settings. It is the OCI offering that sits between fully autonomous (no OS access) and self-managed (you run everything). This matches the requirement for root access and granular OS control.

Answer

Oracle Exadata Database Service on Dedicated Infrastructure

Answer

OCI NoSQL Database service

Answer

Oracle Autonomous Database Serverless

Question 7

You are migrating an Oracle Database 19c on-premises to OCI Exadata Database Service on Dedicated Infrastructure using Oracle Zero Downtime Migration (ZDM) in offline mode. The target database is already provisioned. Which ZDM migration phase configures the target database and initiates the data transfer via Oracle Data Pump?

Accepted Answer

MIGRATE. In ZDM's workflow, the MIGRATE phase is where the target database is configured and data transfer is initiated via Oracle Data Pump. It follows PRE-MIGRATE (validation and setup) and precedes POST-MIGRATE (cleanup and validation), making it the phase that actually moves the data.

Answer

DEPLOY

Answer

POST-MIGRATE

Answer

PRE-MIGRATE

Question 8

Which OCI tool should a cloud architect recommend for automating the lifecycle management, patching, and backing up of a fleet of Oracle Base Database systems across multiple compartments?

Accepted Answer

OCI Database Management service. OCI Database Management service is purpose-built for fleet-level lifecycle operations on Base Database and Exadata systems: it provides patching, backup management, performance monitoring, and compliance reporting across compartments from a single console. It integrates with OCI IAM for compartment-scoped access and supports both autonomous and non-autonomous databases. This is the only option that directly addresses patching and backup automation for a fleet of Base Database systems.

Answer

OCI Compute Instance Scheduler

Answer

Oracle Cloud Infrastructure GoldenGate deployment console

Answer

OCI Identity and Access Management (IAM) policies

Question 9

You want to quickly visualize CPU utilization across 50 Compute instances on a single pane of glass without creating complex custom dashboards. Which OCI Monitoring feature allows you to view pre-packaged metrics grouped by resource?

Accepted Answer

OCI Metrics Explorer. OCI Metrics Explorer lets you query and visualize any OCI Monitoring metric (e.g., CpuUtilization) across many resources at once, with grouping by resource or dimension, giving a single-pane view without building a custom dashboard. It is the fastest way to chart 50 instances' CPU on one graph.

Answer

OCI Logging Analytics Dashboards

Answer

OCI APM Dashboards

Answer

OCI Stack Monitoring

Question 10

Which OCI service can be used to monitor the health and performance of your load balancers and backend compute instances across multiple availability domains, triggering alarms if health checks fail?

Accepted Answer

OCI Monitoring service with Alarm definitions. The OCI Monitoring service ingests metrics from load balancers, compute instances, and other resources, and lets you define alarms on those metrics that fire when thresholds (such as unhealthy backend count or health check failures) are breached. Alarms can trigger notifications via OCI Notifications and can drive autoscaling or Functions. This is the native OCI service for health and performance monitoring with alarm definitions.

Answer

OCI DNS Traffic Management

Answer

OCI Audit service

Answer

OCI Vault service

Question 11

You are migrating a legacy application that relies on hardcoded IP addresses for inter-service communication. During the migration to OCI VCNs, you need to ensure that virtual machines can resolve each other's hostnames dynamically without maintaining manual /etc/hosts files. What OCI networking feature should you configure?

Accepted Answer

OCI Default VCN Resolver with assigned hostname prefixes. OCI's Default VCN Resolver (part of the VCN's built-in DNS) automatically resolves instance hostnames when you assign a DNS hostname prefix to the subnet and enable hostname assignment on each VNIC. This eliminates manual /etc/hosts maintenance and lets instances resolve each other by FQDN such as ..oraclevcn.com. It is the native, zero-cost DNS service provided per VCN.

Answer

OCI API Gateway DNS forwarding rules

Answer

OCI Streaming service message brokers

Answer

OCI Network Load Balancer hostname rewriting

Question 12

You are designing a high-performance computing (HPC) workload migration to OCI. The application consists of tightly coupled MPI (Message Passing Interface) jobs that require extreme low latency and high throughput. Which THREE OCI architecture components must you deploy to satisfy these HPC requirements? (Choose three.)

Accepted Answer

OCI Cluster Networks with RDMA (Remote Direct Memory Access) capable bare metal compute shapes. Option C is correct because OCI Cluster Networks with RDMA-capable bare metal shapes (e.g., BM.HPC2.36 or GPU HPC shapes) provide the low-latency, high-bandwidth, kernel-bypass interconnect that tightly coupled MPI jobs require for collective operations like MPI_Allreduce. Option D is correct because a Compute Placement Group with the cluster strategy packs instances into the same low-latency, high-bandwidth network proximity within an availability domain, minimizing inter-node hop latency for MPI traffic. Option E is correct because directly attached high-performance local NVMe storage delivers the very high IOPS and throughput needed for HPC scratch/checkpoint data without network storage overhead. Option A is not appropriate because Archive Storage is a cold, low-cost archival tier with retrieval latency measured in hours, unsuitable for runtime application data. Option B is not appropriate because micro-tenant burstable VMs are CPU-credit-limited, non-RDMA, and public internet gateways add latency, jitter, and security exposure that violate HPC requirements.

Answer

Standard OCI Archive Storage for runtime application data files

Answer

OCI Shared micro-tenant burstable VM instances connected via public internet gateways

Question 13

An enterprise is executing a large-scale database migration to OCI using Oracle Data Pump. To ensure optimal performance and minimize the duration of the data load phase, which THREE best practices should the database administrator implement? (Choose three.)

Accepted Answer

Disable secondary indexes, foreign key constraints, and database triggers on target tables before import, and rebuild them afterward.. Option A is correct because disabling secondary indexes, foreign key constraints, and triggers on the target tables before import eliminates the overhead of maintaining those objects row-by-row during the load, and rebuilding/re-enabling them afterward is far faster than incremental maintenance during a bulk insert. Option B is correct because Data Pump performance is heavily I/O-bound, so placing the database staging directories (DATA_PUMP_DIR and the datafile destinations) on high-performance OCI Block Volume tiers such as Higher Performance, or on temporary NVMe scratch space, increases throughput and reduces the data load window. Option C is correct because setting the Data Pump PARALLEL parameter spawns multiple worker processes that read and write in parallel, which is the primary mechanism for scaling a large import and shortening the load phase. Option D does not belong because routing Data Pump links over the public internet without compression adds latency and exposes traffic unnecessarily; private endpoints or FastConnect with compression are preferred. Option E does not belong because setting COMPATIBLE to a legacy 10g value disables modern optimizer and feature capabilities and does not improve Data Pump load performance.

Answer

Route all Data Pump network links strictly through the public internet without compression to maximize packet inspection.

Answer

Set the database compatibility parameter to a legacy version from 10g to disable modern optimizer features.

Question 14

Which TWO methods can developers use to interact with OCI Registry (OCIR) for pushing and pulling container images?

Accepted Answer

Docker CLI authenticated with an OCI Auth Token. Option A is correct because the Docker CLI is a standard, supported client for OCIR: after running `docker login .ocir.io` with the OCI username (tenancy namespace/username) and an OCI Auth Token as the password, developers can `docker push` and `docker pull` images against OCIR repositories. Option B is correct because Podman is also a fully supported OCI-compliant container client; authenticating with OCI credentials (username plus Auth Token) via `podman login .ocir.io` allows the same push and pull operations against OCIR. The remaining options do not belong: RDP is a remote desktop protocol for GUI sessions, not an image registry transport; kubelet raw disk mounting is not a registry interaction method and kubelet pulls images via container runtime credentials rather than mounting disks; and FTP over port 21 is a legacy file-transfer protocol that OCIR does not expose for container image push/pull operations.

Answer

Windows Remote Desktop (RDP) file transfer

Answer

Kubernetes kubelet raw disk mounting

Answer

Direct FTP client over port 21

Question 15

You are implementing zero-trust network security for an OKE microservices application using OCI Service Mesh. Which THREE capabilities does OCI Service Mesh provide to secure service-to-service communication?

Accepted Answer

Telemetry data collection including latency, error rates, and request volume metrics. OCI Service Mesh is built on an Istio-based sidecar architecture and provides three core zero-trust capabilities for service-to-service communication. Option A is correct because the mesh's sidecar proxies emit telemetry such as latency, error rates, and request volume metrics (via Prometheus/OCI Monitoring), giving observability into microservice traffic. Option B is correct because OCI Service Mesh enforces access control policies (AuthorizationPolicy) that define which service identities may communicate with which services, supporting least-privilege zero-trust segmentation. Option C is correct because the mesh automatically provisions and rotates mutual TLS (mTLS) certificates for pod-to-pod traffic, encrypting all in-transit service communication without application changes. Option D is incorrect because OCI Service Mesh operates at the Kubernetes/Istio layer and does not program physical Exadata rack switch ACLs. Option E is incorrect because translating PL/SQL stored procedures into REST APIs is not a Service Mesh function; that would require a separate API gateway or ORDS-style tooling.

Answer

Direct hardware firewall ACL programming on physical Oracle Exadata rack switches

Answer

Automatic translation of Oracle Database PL/SQL stored procedures into REST APIs