1Z0-997-26 Practice Test 16 — 15 Questions

Question 1

You are managing a multi-tenancy OCI architecture where cost allocation is critical. Certain shared infrastructure resources (such as shared VCN NAT Gateways and Object Storage transfer buckets) generate shared costs. How can you allocate these shared costs across different child compartments using OCI Cost Analysis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use OCI Cost Analysis Cost Distribution Rules to proportionally allocate shared costs based on defined tags.. OCI Cost Analysis supports cost distribution rules (or proportional splitting based on defined tags or consumption metrics) to allocate shared costs across compartments.

Answer

Attach IAM permission tags to shared resources to automatically split charges at the bank level.

Answer

Write custom OCI Monitoring metric alarms that automatically credit compartments when shared resources are used.

Answer

Manually split CSV invoice files in Excel after downloading monthly Cost Reports.

Question 2

An administrator wants to set up automated remediation when an OCI Monitoring alarm is triggered for high CPU utilization on a database. Specifically, they want a serverless function to execute to scale up resources. Which OCI service acts as the bridge to trigger the function upon alarm firing?

Accepted Answer

OCI Notifications Service. OCI Notifications service can invoke OCI Functions as a subscriber to an alert topic, enabling serverless event-driven remediation.

Answer

OCI Service Connector Hub

Answer

OCI API Gateway

Answer

OCI Events Service

Question 3

Your security operations team wants to identify log anomalies, such as sudden spikes in failed SSH login attempts across your OCI Compute fleet, without manually writing complex regex queries. Which Logging Analytics feature leverages machine learning to automatically group and identify patterns in logs?

Accepted Answer

Logging Analytics Cluster and Link commands. OCI Logging Analytics features ML-driven cluster analysis, which automatically groups similar log records together to highlight patterns and anomalies.

Answer

OCI Service Connector Hub pattern matching

Answer

OCI Cloud Guard Threat Detector rules

Answer

OCI APM Anomaly Detection agent

Question 4

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

Accepted Answer

Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.. OCI Identity and Access Management (IAM) Workload Identity for OKE allows Kubernetes pods to assume OCI IAM roles securely using service account tokens, eliminating long-lived credentials.

Answer

Attach a broad administrative instance principal to the worker node pool.

Answer

Expose Object Storage via a public endpoint and permit anonymous read access.

Answer

Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.

Question 5

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

Accepted Answer

OCI Bastion service.. OCI Bastion provides restricted and secure transient access to target resources that do not have public endpoints, using SSH or Port Forwarding through a managed service.

Answer

OCI NAT Gateway.

Answer

OCI Load Balancer with TCP routing.

Answer

OCI API Gateway.

Question 6

An enterprise is migrating a cluster of microservices running on Kubernetes from an on-premises data center to OCI Container Engine for Kubernetes (OKE). The cluster uses custom CNI (Container Network Interface) plugins and persistent storage backed by an on-premises Ceph cluster. During migration planning, how should you architect the persistent storage layer in OCI to support OKE stateful workloads?

Accepted Answer

Install the OCI Block Volume and OCI File Storage CSI drivers in the OKE cluster to dynamically provision persistent storage volumes.. OCI Container Engine for Kubernetes (OKE) integrates natively with OCI Block Volume and OCI File Storage via Container Storage Interface (CSI) drivers, enabling dynamic provisioning of persistent volumes (PVs) and persistent volume claims (PVCs).

Answer

Use ephemeral container scratch space for all persistent state requirements in OKE.

Answer

Mount the on-premises Ceph cluster directly inside OKE worker nodes using public IP addresses over an internet gateway.

Answer

Store all database and application state inside OCI Object Storage bucket folders mounted via local loop devices.

Question 7

Your team is planning to migrate virtual machines from an on-premises hypervisor to OCI Compute. You want to generate an automated report detailing resource utilization (CPU, memory, storage IOPS) over the past 30 days to right-size the target OCI instance shapes. Which OCI tool supports this discovery phase?

Accepted Answer

OCI Migration Discovery and Assessment. OCI Migration service includes discovery and assessment capabilities that collect performance metrics and hardware inventories from on-premises VMware or physical servers to recommend right-sized OCI shapes.

Answer

OCI Cost Estimator

Answer

OCI Logging Analytics

Answer

OCI Database Migration Service

Question 8

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones enforce strict guardrails by automatically validating resource creation and configuration changes against a predefined set of security policies, preventing non-compliant actions.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.

Question 9

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Accepted Answer

OCI Vulnerability Scanning Service. OCI Vulnerability Scanning Service (VSS) routinely inspects host operating systems and container images for security vulnerabilities and missing patches.

Answer

OCI Cloud Guard

Answer

OCI Identity and Access Management

Answer

OCI Application Performance Monitoring

Question 10

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

Accepted Answer

OCI Audit Service. OCI Audit service automatically records calls to all supported Oracle Cloud Infrastructure public API endpoints as log events for security and compliance tracking.

Answer

OCI Events Service

Answer

OCI Logging Analytics

Answer

Database Audit Vault

Question 11

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

Accepted Answer

Object Storage Object Lock with Compliance mode.. Object Storage Object Lock enables WORM (Write Once, Read Many) storage, preventing objects from being deleted or modified until a retention period expires or indefinitely in compliance mode.

Answer

OCI Cloud Guard data protection detectors.

Answer

OCI Object Storage Pre-Authenticated Requests (PAR).

Answer

OCI Vault key rotation policies.

Question 12

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

Accepted Answer

Allow group Developers to manage compute-instances in compartment ParentCompartment. Policies can be scoped to compartments using the 'in compartment' clause. By targeting a parent compartment, permissions automatically flow down to all nested child compartments.

Answer

Allow group Developers to manage compute-instances in tenancy

Answer

Allow group Developers to manage compute-instances in root

Answer

Write individual policies for every single child compartment separately without referencing the parent.

Question 13

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Accepted Answer

Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.. Secure private access can be achieved via OCI Bastion service (which provides managed SSH/SFTP access) or through a site-to-site VPN / FastConnect hybrid connection combined with private subnets.

Answer

Configure a public load balancer pointing directly to port 22 of all backend private compute instances.

Answer

Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.

Answer

Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.

Question 14

Your company is executing a lift-and-shift migration of 50 physical servers running Red Hat Enterprise Linux (RHEL) to OCI. You want to ensure that the operating systems remain supported, patched, and entitled to Oracle Linux Premier Support without having to rebuild the servers. What conversion utility should you use?

Accepted Answer

Oracle Linux Upgrade and Conversion tool (using the `leapp` utility and Oracle Linux yum repositories). OCI provides the 'Canonical' or 'OS Management Hub' tools, and specifically the 'Linux Migration' utility or 'Leapp' framework supported by Oracle to convert RHEL or CentOS instances running in OCI to Oracle Linux in-place, retaining binary compatibility and gaining Oracle support.

Answer

VMware HCX OS conversion engine

Answer

OCI Database Migration service

Answer

OCI Instance Export/Import wizard

Question 15

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

Accepted Answer

OCI Audit Service. OCI Audit service records calls to all OCI API endpoints as log events, detailing who performed the action, when, and from what IP address.

Answer

OCI Cloud Guard Responder Logs

Answer

OCI Database Performance Hub

Answer

OCI Monitoring Service