1Z0-997-26 Practice Test 16 — 15 Questions

Question 1

When designing a container build and deployment pipeline using OCI DevOps and OCI Registry (OCIR), which THREE tasks can be automated within the CI/CD build pipeline stage?

Accepted Answer

Push newly built container images securely to OCI Registry (OCIR). Option A is correct because an OCI DevOps build pipeline can authenticate to OCIR and push newly built container images to it, typically using the DevOps build runner's auth token or instance principal, so the artifact is stored in the registry for later deployment. Option B is correct because the build stage executes commands defined in the build specification, allowing automated unit tests and linting/scanning tools to run as part of the build step before an image is published. Option D is correct because OCI DevOps build pipelines use a build_spec.yaml to define the build steps, and those steps commonly invoke Docker to build container images from a Dockerfile. Option C is not correct because provisioning a new tenancy root compartment is an identity/tenancy administration task, not a CI/CD build pipeline action. Option E is not correct because physical data center HVAC cooling is facilities infrastructure and is not managed by OCI DevOps pipelines.

Answer

Automatically provision a brand new OCI Tenancy root compartment

Answer

Directly modify physical OCI data center HVAC cooling temperatures

Question 2

Which TWO of the following statements are correct regarding OCI Load Balancer features for high availability? (Choose two.)

Accepted Answer

An OCI Load Balancer can be deployed as either public (internet-facing) or private (internal).. Option B is correct because OCI Load Balancer supports two deployment types: a public (internet-facing) load balancer with a public IP for external traffic, and a private (internal) load balancer with only private IPs for internal traffic within a VCN. Option C is correct because the OCI Load Balancer is a regional service: when you create it, you select a region and it can span multiple Availability Domains, with the service provisioning the load balancer across the ADs you choose for high availability. Option A is incorrect because the load balancer is not restricted to a single AD; it is regional and can be deployed across multiple ADs. Option D is incorrect because OCI Load Balancer operates at Layer 4 (TCP) and Layer 7 (HTTP/HTTPS), not only Layer 3 packet routing. Option E is incorrect because OCI Load Balancer is a fully managed service that handles failover automatically, so no customer-managed keepalived clustering is required.

Answer

OCI Load Balancers are restricted to a single Availability Domain and cannot cross AD boundaries.

Answer

OCI Load Balancers only support Layer 3 packet routing.

Answer

OCI Load Balancers require manual customer-managed keepalived failover clustering.

Question 3

Your organization is implementing a multicloud strategy where workloads in OCI must securely communicate with workloads in AWS over a private connection. You decide to set up a third-party software virtual appliance (VPN gateway) inside an OCI VCN. What specific VCN configuration change is required to ensure that return traffic from OCI compute instances correctly routes back through the virtual appliance instance?

Accepted Answer

Disable 'Source/Destination Check' on the virtual appliance's VNIC and update the VCN route table to point traffic to the appliance's private IP.. A third-party virtual appliance (e.g., a VPN gateway VM) that forwards traffic not destined for itself must have Source/Destination Check disabled on its VNIC, otherwise OCI drops packets whose source/destination IPs don't match the VNIC. You must also update the VCN route table to steer traffic to the appliance's private IP so return traffic is symmetric.

Answer

Configure a Local Peering Gateway on the appliance subnet.

Answer

Enable 'Source/Destination Check' on the virtual appliance's VNIC.

Answer

Attach an Internet Gateway to the virtual appliance instance to route packets to AWS.

Question 4

Your engineering team is troubleshooting an issue where migrated Linux virtual machines in OCI are experiencing severe disk I/O performance bottlenecks. The instances were migrated using raw block-level cloning from on-premises SAN storage. The volumes in OCI are provisioned as Lower Cost (Balanced) block volumes. What action should you take to resolve the performance bottleneck while maintaining data integrity?

Accepted Answer

Modify the OCI block volume performance tier or increase the assigned Volume Performance Units (VPUs) per GB.. Lower Cost (Balanced) block volumes deliver a baseline of 10 VPUs per GB, which caps IOPS and throughput well below what a migrated SAN-backed workload typically expects. OCI lets you change a volume's performance tier or increase its VPUs per GB online without detaching or reformatting, so the data and file system remain intact while I/O limits rise. This directly resolves the bottleneck while preserving data integrity.

Answer

Format the attached block volumes with ext3 file systems instead of ext4.

Answer

Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.

Answer

Attach an OCI File Storage Service (FSS) mount target as the primary root volume.

Question 5

Your organization is planning a phased workload migration to OCI. To minimize risk, you decide to use a canary deployment and traffic splitting strategy for web applications. Which TWO OCI services or features can assist in routing fractional traffic percentages between on-premises and OCI environments during migration? (Choose two.)

Accepted Answer

OCI Load Balancer backend set weight configurations. Option B is correct because an OCI Load Balancer backend set can contain multiple backends (for example, an on-premises web server and an OCI web server) and each backend is assigned a weight; the load balancer distributes incoming requests proportionally to those weights, so setting weights like 90/10 or 95/5 lets you route fractional traffic percentages between on-premises and OCI during a canary migration. Option E is correct because OCI Traffic Management Steering supports Weighted traffic steering policies, which answer DNS queries with different answers according to assigned weights, and Load Limiting policies, which can direct a controlled fraction of users to a target; both enable fractional traffic splitting across on-premises and OCI endpoints. Option A is not relevant because OCI Vault master encryption keys provide key management and encryption for data at rest, not traffic routing. Option C is not relevant because IAM dynamic groups grant permissions to compute instances based on matching rules, which is authorization, not traffic distribution. Option D is not relevant because Block Volume backup policies define scheduled backups of block volumes, which has nothing to do with routing fractional web traffic.

Answer

OCI Vault master encryption keys

Answer

OCI IAM dynamic groups

Answer

OCI Block Volume backup policies

Question 6

Your organization has deployed an enterprise workload on OCI Exadata Database Service. You are configuring Data Guard with Fast-Start Failover (FSFO). To prevent split-brain scenarios where both primary and standby databases assume primary roles simultaneously, where must the Data Guard Observer be placed?

Accepted Answer

In a separate fault domain or external location independent of both the primary and standby database nodes.. The Data Guard Observer must run on a host that is independent of both the primary and standby database systems so it can act as an impartial third-party arbitrator during Fast-Start Failover. Placing it in a separate fault domain or external location ensures that a failure affecting either database node does not also take down the Observer, allowing it to reliably detect failures and issue the failover command without risking split-brain.

Answer

Directly on the primary database compute node to ensure low-latency communication.

Answer

Inside an OCI Object Storage bucket as a serverless function.

Answer

Inside the same Oracle Grid Infrastructure clusterware home on the standby database.

Question 7

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

Accepted Answer

Azure ExpressRoute Gateway. The Azure ExpressRoute Gateway is the specific Azure-side resource that terminates the ExpressRoute circuit and connects it to the Azure Virtual Network. During OCI-Azure Interconnect onboarding, the ExpressRoute circuit is created and then associated with an ExpressRoute Gateway in the designated Azure subscription and VNet. This gateway provides the private connectivity endpoint for traffic coming from OCI via the ExpressRoute peering.

Answer

Azure Application Gateway

Answer

Azure Virtual Network NAT

Answer

Azure Traffic Manager

Question 8

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

Accepted Answer

W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.. Distributed tracing across API Gateway, service mesh sidecars, and application pods requires a common trace context propagated end-to-end. The W3C Trace Context standard (traceparent/tracestate headers) is the open standard that API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs all understand, allowing spans to be correlated and exported to any OpenTelemetry-compatible backend. This is the only option that describes an actual tracing architecture.

Answer

Kubernetes Liveness probes configured with HTTP GET request headers.

Answer

OCI Audit log queries combined with Object Storage bucket lifecycle rules.

Answer

OCI Notifications service broadcast topics configured with JSON log forwarding.

Question 9

What is the primary architectural advantage of using Exadata Database Service on Dedicated Infrastructure compared to Exadata Database Service on Cloud@Customer?

Accepted Answer

The physical Exadata hardware resides and operates entirely within an OCI data center managed by Oracle. Exadata Database Service on Dedicated Infrastructure runs the Exadata hardware inside an OCI data center fully managed by Oracle, so the customer does not own or operate the physical infrastructure. This is the primary architectural advantage over Cloud@Customer, where the Exadata rack sits in the customer's own data center and the customer is responsible for power, cooling, and physical security.

Answer

It requires the customer to manage physical rack power, cooling, and hardware replacement

Answer

It exclusively supports non-relational database formats unlike Cloud@Customer

Answer

It eliminates the need for Virtual Cloud Networks (VCNs)

Question 10

When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?

Accepted Answer

Install OCI Management Agent on the host running the WebLogic Server.. Option B is correct because Stack Monitoring relies on the OCI Management Agent installed on the WebLogic host to collect metrics and communicate with the OCI Monitoring service. Option D is correct because discovery requires valid WebLogic administrator credentials plus JMX connection details (host, port, protocol) so the agent can query the WebLogic MBeans. Option E is correct because the Stack Monitoring discovery wizard, run from the OCI Console or CLI, is the mechanism that creates the WebLogic resource and associates it with the agent. Option A is not required, as the administration console does not need a public IP and exposing it would be a security risk. Option C is not required, since BGP peering is a networking concept unrelated to WebLogic discovery and monitoring.

Answer

Attach a public IP address directly to the WebLogic administration console port.

Answer

Configure a BGP peering session between WebLogic and the OCI Control Plane.

Question 11

When designing an API Gateway implementation on OCI to expose backend microservices running on OKE, which THREE features or capabilities can you configure directly within the API Gateway deployment? (Choose three.)

Accepted Answer

Request throttling and rate-limiting to protect backend microservices from traffic surges.. Option A is correct because OCI API Gateway lets you define usage plans with request throttling and rate-limiting policies per deployment, protecting backend microservices on OKE from traffic surges. Option C is correct because API Gateway supports configuring CORS policies at the deployment level, allowing you to control which web frontend origins can make browser-based cross-origin requests to the API. Option D is correct because API Gateway can be configured with JWT authentication to validate bearer tokens issued by identity providers before forwarding requests to backend services. Option B is not part of API Gateway's capabilities; Autonomous Database multi-region failover is handled by Data Guard and database-level services, not the gateway. Option E is also unrelated, since OKE worker node pool provisioning and scaling are managed through OKE node pools and the cluster autoscaler, not through API Gateway.

Answer

Automatic multi-region database failover orchestration for Oracle Autonomous Database.

Answer

Automatic provisioning and scaling of Kubernetes worker node pools inside OKE.

Question 12

When designing high availability for an Oracle RAC (Real Application Clusters) database deployed on OCI Exadata Database Service, which THREE architectural characteristics ensure fault tolerance and uptime? (Choose three.)

Accepted Answer

Multi-node database clustering across distinct Fault Domains or Availability Domains. Option C is correct because Oracle RAC achieves fault tolerance by distributing cluster nodes across distinct Fault Domains or Availability Domains, so the failure of one domain does not take down the entire database. Option D is correct because Application Continuity and Transparent Application Failover (TAF) mask instance or node failures by replaying or failing over in-flight sessions, preserving application uptime during outages. Option E is correct because Exadata Storage Cells use Exadata Smart Flash Cache and ASM redundancy across multiple Storage Servers, so a failed cell does not cause data loss or database downtime. Option A is wrong because a single Oracle Linux instance without Grid Infrastructure cannot form a RAC cluster and provides no node-level redundancy. Option B is wrong because a single local NVMe drive on one node is a single point of failure and is not shared clustered storage, which RAC requires.

Answer

Running the entire cluster on a single Oracle Linux compute instance without Grid Infrastructure

Answer

Storing all database data on a single local NVMe drive on node 1

Question 13

You are configuring an Autonomous Database instance and need to restrict incoming database traffic so that only specific corporate subnet CIDR blocks can access the database service endpoints. Which feature should you configure?

Accepted Answer

Autonomous Database Access Control Lists (ACLs) specifying allowed IP CIDR blocks. Autonomous Database supports Access Control Lists (ACLs) that specify allowed IP CIDR blocks for database service endpoints. This is the native, supported mechanism to restrict incoming traffic to specific corporate subnets without deploying additional network appliances.

Answer

OCI Web Application Firewall (WAF) attached directly to the database listener port

Answer

OCI Identity and Access Management dynamic groups

Answer

Database Vault realm restrictions

Question 14

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

Accepted Answer

Object Storage Object Lock with Compliance mode.. Object Lock with Compliance mode enforces a WORM (Write Once, Read Many) retention policy that cannot be removed or shortened by any user — including tenancy administrators — until the retention period expires. This directly protects backups against accidental deletion and ransomware encryption because objects cannot be overwritten or deleted during the retention window. Compliance mode is the strictest of the two Object Lock modes (the other being Governance mode, which privileged users can bypass).

Answer

OCI Cloud Guard data protection detectors.

Answer

OCI Object Storage Pre-Authenticated Requests (PAR).

Answer

OCI Vault key rotation policies.

Question 15

You are configuring disaster recovery for an Oracle Base Database system using Oracle Data Guard with Data Guard Broker. You need to perform a role transition where the primary database becomes the standby and the standby becomes the primary with zero data loss. Which Data Guard Broker command should you execute?

Accepted Answer

SWITCHOVER TO ;. In Data Guard Broker, a switchover is a planned role transition where the primary becomes the standby and the standby becomes the primary with zero data loss. The command to perform a switchover is 'SWITCHOVER TO ;' executed via DGMGRL. This ensures no data loss because the primary is synchronized with the standby before the transition.

Answer

ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;

Answer

CONVERT DATABASE TO PHYSICAL STANDBY;

Answer

FAILOVER TO <standby_database_name>;