1Z0-997-26 Practice Test 17 — 15 Questions

Question 1

Which TWO of the following statements are correct regarding the architecture and capabilities of OCI Application Performance Monitoring (APM)?

Accepted Answer

OCI APM supports ingestion of standard OpenTelemetry traces from applications running on-premises, in OCI, or in other clouds.. Option B is correct because OCI APM natively supports the OpenTelemetry protocol (OTLP) for trace ingestion, allowing instrumented applications running on-premises, in OCI, or in other clouds to send distributed tracing data to the APM domain via the public OTLP endpoint. Option D is correct because OCI APM includes Real User Monitoring (RUM), which uses a JavaScript agent injected into web pages to capture end-user metrics such as page load times, AJAX calls, and browser-side errors. Option A is incorrect because APM is not limited to OCI Compute: it can trace traffic from API Gateways, load balancers, functions, and external sources through OpenTelemetry instrumentation. Option C is incorrect because APM alarms integrate with OCI Notifications, which in turn can fan out to email, SMS, Slack, PagerDuty, and other HTTPS endpoints, so alerting is not restricted to SMS. Option E is incorrect because APM is a fully managed service; Oracle provisions and manages the underlying storage for trace spans, and no Autonomous Transaction Processing database needs to be created or maintained by the customer.

Answer

OCI APM can only monitor applications deployed inside OCI Compute instances and cannot trace traffic originating from API Gateways.

Answer

OCI APM alerting is strictly limited to SMS notifications and cannot integrate with external incident management systems like PagerDuty.

Answer

OCI APM requires the user to manually provision and manage an underlying Autonomous Transaction Processing database to store trace spans.

Question 2

An administrator wants to inspect the operational health and performance metrics of an OCI Exadata Database Service instance using the default platform metrics provided out-of-the-box by OCI. Where should the administrator navigate in the OCI Console to view these metrics?

Accepted Answer

Navigate to Observability and Management > Monitoring, then select the Database service namespace.. OCI Exadata Database Service emits default platform metrics (CPU utilization, storage utilization, node status, etc.) into the OCI Monitoring service under the 'oci_database' or Exadata-specific namespace. Administrators view these by navigating to Observability and Management > Monitoring in the OCI Console, then selecting the appropriate Database service namespace and filtering by the Exadata resource. This is the standard path for out-of-the-box platform metrics.

Answer

Navigate to Compute > Instances, select the Exadata VM cluster, and open the Performance tab.

Answer

Navigate to Governance and Administration > Audit, then select the Database compartment.

Answer

Navigate to Identity & Security > Policies to enable the DB telemetry poller.

Question 3

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

Accepted Answer

Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.. OCI IAM Workload Identity for OKE lets individual Kubernetes pods authenticate to OCI services using their Kubernetes service account (KSA) tokens, which OCI IAM maps to dynamic groups via a defined identity provider. This eliminates the need to embed long-lived API signing keys or user credentials inside the cluster, satisfying the security best practice of short-lived, pod-scoped credentials. The KSA token is exchanged for an OCI session token, and IAM policies attached to the dynamic group grant only the required Object Storage permissions.

Answer

Attach a broad administrative instance principal to the worker node pool.

Answer

Expose Object Storage via a public endpoint and permit anonymous read access.

Answer

Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.

Question 4

Your OCI Function needs to write audit logs or custom debugging information that can be easily searched and analyzed alongside other cloud logs. Which OCI service should your function log to?

Accepted Answer

OCI Logging Service. OCI Logging Service is the correct choice because it is a fully managed, scalable service that ingests, aggregates, and indexes log data from various OCI resources, including Functions. It allows you to search, analyze, and correlate logs across services, and supports custom logs from serverless functions. By logging to OCI Logging, the function's audit and debug information becomes part of the centralized logging platform, enabling easy querying and integration with other cloud logs.

Answer

OCI DNS Service

Answer

OCI Vault

Answer

OCI Email Delivery Service

Question 5

You are planning the network cutover for a large-scale migration to OCI. The on-premises data center is connected to OCI via an OCI FastConnect circuit configured with private virtual circuits. During cutover, DNS records must be updated so that client traffic resolves to OCI load balancers. Which OCI service should you use to manage internal and external DNS authoritative resolution smoothly?

Accepted Answer

OCI DNS (Public and Private Zones). OCI DNS provides both public and private authoritative zones, allowing you to manage internal and external name resolution from a single service during cutover. It integrates with the VCN resolver so private zones resolve inside OCI while public zones serve external clients, making it the right tool for updating DNS records to point at OCI load balancers.

Answer

OCI API Gateway

Answer

OCI Traffic Management Steering

Answer

OCI Network Firewall

Question 6

An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?

Accepted Answer

Configure APM Data Masking rules or agent configuration properties to exclude or scrub sensitive attributes.. OCI APM provides data masking rules that can be configured at the APM domain level to scrub or exclude sensitive attributes from trace spans before they are stored. Additionally, the APM Java agent supports configuration properties that allow developers to exclude specific headers, parameters, or payload fields from being captured. Using these built-in masking and exclusion mechanisms is the correct way to prevent PII from entering APM trace data.

Answer

Set up an OCI Vault encryption key to automatically encrypt span attribute strings in transit.

Answer

Configure IAM policies to redact payload strings at the APM domain boundary.

Answer

Modify the OCI Monitoring alarm expression to filter out PII strings.

Question 7

You are troubleshooting an OCI Functions application that fails to pull container images from a private Oracle Cloud Infrastructure Registry (OCIR) repository during deployment. The function application is configured correctly, but the build/invoke fails with authentication errors. What is the most likely missing configuration?

Accepted Answer

Missing IAM policy granting the Functions service or dynamic group read access to the OCIR repository compartment.. OCI Functions pulls container images from OCIR using the function's resource principal, which is derived from the dynamic group membership of the function application. Without an IAM policy that grants this dynamic group (or the Functions service) permission to read the OCIR repository compartment, the pull fails with an authentication error. The policy must explicitly allow the dynamic group to read repos in the compartment where the OCIR repository resides.

Answer

The OCI VCN Security List lacks an egress rule for port 22 to connect to GitHub.

Answer

The API Gateway deployment lacks a public IP address.

Answer

The OCI Vault master encryption key is disabled.

Question 8

An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?

Accepted Answer

OCI Cost Analysis Scheduled Reports. OCI Cost Analysis Scheduled Reports allow you to define a recurring schedule (daily, weekly, monthly) that emails a cost breakdown — including top spending services — directly to specified recipients. This is purpose-built for automated spend trend monitoring without requiring console login, unlike alarms or event rules which are not designed for cost reporting.

Answer

OCI Events service scheduled triggers

Answer

OCI Audit log exports

Answer

OCI Monitoring service billing alarms

Question 9

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

Accepted Answer

Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.. When latency across an OCI-Azure Interconnect exceeds thresholds, the first diagnostic step within OCI is to verify MTU settings end to end — OCI VCN, DRG, Azure VNet, and the ExpressRoute gateway. MTU mismatches cause fragmentation or dropped large packets, which manifest as high latency and retransmissions rather than outright connectivity loss. Checking MTU is a low-cost, high-value first step before touching circuits or subscriptions.

Answer

Enable OCI Database Vault on the compute instances.

Answer

Replace the OCI Dynamic Routing Gateway with an Internet Gateway.

Answer

Recreate the Azure ExpressRoute circuit in a different Azure subscription.

Question 10

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

Accepted Answer

Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.. A Remote Peering Connection (RPC) between two DRGs in different OCI regions is the native OCI mechanism for private, secure inter-region VCN connectivity. Once the RPC is established and the DRGs are attached to their respective VCNs, you must configure route tables in each VCN to direct traffic destined for the other VCN's CIDR to the DRG, and ensure security lists or NSGs allow the required traffic. This creates a private, encrypted connection over Oracle's backbone network without traversing the public internet.

Answer

Configure public IP addresses on all participating compute instances.

Answer

Route all inter-region traffic through public Internet Gateways with IPsec tunneling.

Answer

Deploy an OCI NAT Gateway in each region.

Question 11

Your organization runs a multi-tier microservices application deployed across multiple OCI regions. You are tasked with implementing OCI Application Performance Monitoring (APM) to trace distributed transactions across different API gateways and containerized services. To correlate user browser sessions with backend database queries, what is the required configuration step on the client-facing application tier?

Accepted Answer

Inject the APM Browser Agent (JavaScript tracer) into the web pages and ensure trace context propagation headers are enabled.. To correlate user browser sessions with backend database queries, the client-facing application tier must inject the APM Browser Agent (JavaScript tracer) into web pages and ensure trace context propagation headers are enabled. The Browser Agent captures browser-side performance and injects trace context into requests, which backend services then propagate to database calls, enabling end-to-end correlation.

Answer

Deploy the APM Java asynchronous agent to the client browser using a browser extension.

Answer

Enable OCI Audit logs on the client subnets and stream the audit records into the APM Data Domain.

Answer

Configure the OCI API Gateway to natively intercept and inject synthetic monitoring payloads into the user cookies.

Question 12

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

Accepted Answer

OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload. OCI Service Mesh uses an Envoy sidecar proxy injected into each pod, and its control plane (based on Istio) performs automated certificate management — issuing, rotating, and hot-reloading X.509 certificates via the Envoy SDS (Secret Discovery Service) API without restarting the pod or the proxy. This eliminates the connection drops caused by stale certificates, since the sidecar picks up the new cert in-memory.

Answer

OCI Certbot DaemonSet running on all worker nodes

Answer

OCI Vault automatic key version rotation

Answer

Kubernetes CronJob executing kubectl rollout restart every night

Question 13

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

Accepted Answer

Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.. OCI Audit captures all API activity in a tenancy automatically, and OCI Logging can export those Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode, providing tamper-proof, WORM retention that satisfies auditor evidence requirements. Object Lock in Compliance mode prevents any user, including tenancy administrators, from deleting or altering the retained audit objects until the retention period expires. This combination delivers capture, immutability, and long-term retention in one architecture.

Answer

Enable OCI Cloud Guard with default responder rules.

Answer

Deploy OCI Network Firewall to inspect all control plane traffic.

Answer

Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

Question 14

Your company is migrating a large PostgreSQL database from AWS RDS to OCI Database with PostgreSQL. The database is 4 TB in size, and write operations continue 24/7. To ensure zero data loss and minimal downtime during cutover, which migration strategy should you employ?

Accepted Answer

Configure PostgreSQL logical replication (or use OCI GoldenGate / DMS equivalents) to stream ongoing transaction logs after performing an initial consistent dump and restore.. Logical replication (or OCI GoldenGate/DMS) performs an initial consistent dump and restore, then continuously streams transaction logs from the source to the target, keeping the OCI database in sync with near-zero data loss. At cutover, you stop writes briefly, apply remaining changes, and redirect the application — achieving zero data loss and minimal downtime. This is the standard approach for large, continuously written databases.

Answer

Establish AWS Direct Connect to OCI FastConnect and mount an AWS EBS volume directly to an OCI VM running PostgreSQL.

Answer

Take an AWS RDS snapshot, download the snapshot files via AWS CLI, and restore them onto an OCI Compute instance running PostgreSQL.

Answer

Stop the application writes, take a pg_dump file, transfer it via SCP, and restore it into OCI during a scheduled 12-hour outage window.

Question 15

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

Accepted Answer

Allow group Auditors to read all-resources in compartment Production. The policy statement 'Allow group Auditors to read all-resources in compartment Production' grants read-only access to all resources within the Production compartment, without allowing modifications or access to other compartments. This precisely meets the requirement for a third-party auditor to view resources in a specific compartment.

Answer

Allow group Auditors to use database-families in root

Answer

Allow group Auditors to read compartments in tenancy

Answer

Allow group Auditors to manage all-resources in tenancy