1Z0-997-26 Practice Test 18 — 15 Questions

Question 1

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

Accepted Answer

Rate limiting to mitigate denial of service (DoS) and brute-force attacks.. OCI Web Application Firewall (WAF) includes rate limiting (Option B), which caps the number of requests from a client within a time window to mitigate DoS and brute-force attacks. It also provides protection against OWASP Top 10 vulnerabilities (Option C), using managed rule sets to detect and block threats such as SQL injection and cross-site scripting (XSS). Additionally, WAF supports access control rules (Option E) that allow or deny traffic based on geographic location, IP addresses, or HTTP headers, enabling granular filtering. Option A is incorrect because BGP routing for FastConnect is handled by OCI networking services, not WAF. Option D is incorrect because HSM key management for database volumes is provided by OCI Vault and Database services, not WAF.

Answer

Allocation of BGP routing tables for on-premises FastConnect circuits.

Answer

Management of hardware security module (HSM) crypto keys for database volumes.

Question 2

When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?

Accepted Answer

It is a regional service that automatically provisions endpoints across availability domains.. OCI Network Load Balancer is a regional, Layer 4 (TCP/UDP) load balancing service that automatically provisions endpoints across multiple Availability Domains within a region. It provides high availability by distributing traffic across healthy backend instances in different ADs without requiring manual failover scripts or keepalived. This regional, multi-AD design is a key architectural characteristic that differentiates it from a zonal load balancer.

Answer

It requires manual setup of keepalived and IP failover scripts on backend compute instances.

Answer

It terminates SSL/TLS connections before forwarding traffic to backend servers.

Answer

It can only route HTTP and HTTPS traffic.

Question 3

You are planning to migrate an Oracle Database to OCI using Zero Downtime Migration (ZDM). Which underlying Oracle migration technology does ZDM orchestrate behind the scenes for large databases requiring physical migration?

Accepted Answer

Oracle RMAN and Oracle Data Guard. Zero Downtime Migration (ZDM) orchestrates Oracle Recovery Manager (RMAN) for the initial physical backup and restore, and Oracle Data Guard for ongoing replication to minimize downtime during the migration to OCI. For large databases requiring physical migration, ZDM leverages these native Oracle technologies to ensure data consistency and near-zero downtime. RMAN handles the bulk data movement, while Data Guard keeps the target in sync until the cutover.

Answer

OCI Object Storage lifecycle policies exclusively

Answer

Third-party ETL pipelines and CSV flat file generation

Answer

MySQL Enterprise Backup and InnoDB replication

Question 4

You want to monitor the health and performance of your Oracle Autonomous Database in OCI. Which built-in metric namespace in OCI Monitoring should you query?

Accepted Answer

oci_database. OCI Monitoring organizes metrics into namespaces, and all Autonomous Database metrics (CPU utilization, session counts, transaction rates, storage usage, etc.) are published under the oci_database namespace. This namespace covers both Autonomous Transaction Processing (ATP) and Autonomous Data Warehouse (ADW) instances, so querying it returns the health and performance metrics needed for dashboards and alarms.

Answer

oci_autonomous_metrics

Answer

oci_apm_metrics

Answer

oci_compute_infra

Question 5

Which TWO destinations can receive messages dispatched from an OCI Notifications service topic?

Accepted Answer

HTTPS / Webhook endpoints (e.g., Slack, PagerDuty). Option C is correct because OCI Notifications topics support HTTPS subscriptions, which deliver the published message as a JSON POST to a webhook URL, enabling integrations such as Slack or PagerDuty. Option D is correct because OCI Notifications natively supports Email and SMS subscriptions, sending the message content directly to the subscribed address or phone number. The other options are incorrect because Internet Gateway route tables, Dynamic Routing Gateway (DRG), and Block Volume backup policies are networking and storage constructs, not subscription protocols or delivery destinations for a Notifications topic.

Answer

OCI Internet Gateway route tables

Answer

OCI Dynamic Routing Gateway (DRG)

Answer

OCI Block Volume backup policies

Question 6

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

Accepted Answer

OCI Vault service to create and manage Customer-Managed Keys (CMK).. OCI Vault is the service for creating and managing customer-managed encryption keys (CMKs). By using OCI Vault, the administrator can generate and manage keys with strict rotation schedules and use them to encrypt data in Object Storage. This satisfies the requirement for customer-managed keys with rotation.

Answer

OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).

Answer

OCI Database Management service.

Answer

OCI Identity and Access Management (IAM) password policies.

Question 7

You are designing a disaster recovery strategy for a stateful microservices application running on OKE across two OCI regions. Persistent data is stored on OCI Block Volumes. What is the recommended approach to replicate persistent storage data across regions for stateful workloads?

Accepted Answer

Configure cross-region block volume asynchronous replication to the secondary region.. Cross-region asynchronous block volume replication is the native OCI feature designed to copy Block Volume data from a primary region to a secondary region for DR. It continuously replicates volume data at the block level, so stateful workloads on OKE can fail over and reattach replicated volumes in the secondary region. This is the recommended, supported approach for cross-region persistence in OCI.

Answer

Rely on Kubernetes Persistent Volume snapshots stored locally on worker node local NVMe drives.

Answer

Attach the same Block Volume simultaneously to worker nodes in both regions across the VCN peering.

Answer

Use OCI Streaming to replicate raw block storage disk sectors.

Question 8

When designing a high-performance hybrid architecture integrating an on-premises data center with OCI, which THREE key factors should be evaluated to optimize network throughput and reliability?

Accepted Answer

BGP timer tuning for faster convergence and failover detection. Option A is correct because tuning BGP timers (e.g., reducing Keepalive and Hold-time values) on the FastConnect virtual circuit and on-premises CPE accelerates route convergence and failover detection, which directly improves reliability and recovery time during path failures. Option B is correct because configuring MTU consistently across the hybrid path—supporting Jumbo Frames up to 9000 bytes on FastConnect and the on-premises network—reduces packet fragmentation and per-packet overhead, thereby increasing effective throughput for bulk data transfers. Option E is correct because physical path diversity and carrier redundancy for FastConnect circuits (e.g., multiple diverse physical connections or redundant providers) eliminate single points of failure and ensure continued connectivity if one circuit or path degrades. Option C does not belong because exposing internal database nodes with public IP addresses weakens security and has no bearing on throughput or reliability optimization. Option D does not belong because Local Peering Gateways connect VCNs within the same OCI region, not on-premises networks, so they are irrelevant to hybrid on-premises-to-OCI connectivity.

Answer

Enabling public IP addresses on all internal database nodes

Answer

Configuring Local Peering Gateways for on-premises connectivity

Question 9

Your organization is performing a zero-downtime database migration from an Oracle Database on-premises to OCI Exadata Database Service using Oracle Zero Downtime Migration (ZDM). During the migration job execution, the workflow pauses during the dataguard broker configuration step. Reviewing the ZDM logs, you find a network timeout error communicating between the ZDM service host and the OCI database listener. What is the most likely cause?

Accepted Answer

OCI VCN Security Lists or Network Security Groups block incoming TCP port 1521 or SSH port 22 from the ZDM client subnet.. The ZDM workflow pauses at Data Guard broker configuration because the ZDM service host cannot reach the OCI database listener. This is almost always caused by network security rules (Security Lists or NSGs) blocking inbound TCP 1521 (database listener) or SSH port 22 from the ZDM client subnet to the Exadata Database Service.

Answer

OCI Object Storage bucket policies prevent ZDM from reading temporary backup files.

Answer

The Exadata database service requires Autonomous Database credentials to establish connection.

Answer

OCI IAM quotas restrict the creation of more than 10 Data Guard associations per tenancy.

Question 10

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

Accepted Answer

OCI Bastion service.. OCI Bastion service provides secure, time-limited, and audited SSH access to private subnet compute instances without exposing any public IP or opening inbound SSH ports. It creates a bastion session that tunnels SSH traffic through the OCI service, and access is controlled by IAM policies and session TTLs. This directly meets the requirement of performing maintenance on private database instances without internet or corporate network exposure.

Answer

OCI NAT Gateway.

Answer

OCI Load Balancer with TCP routing.

Answer

OCI API Gateway.

Question 11

An application deployed across two OCI regions uses a DNS-based traffic management steering policy. A database failure occurs in the primary region, and the application must failover to the secondary region. What is the primary limitation of relying solely on DNS Traffic Management for disaster recovery failover?

Accepted Answer

Client-side caching and DNS TTL expiration delays can cause continued traffic routing to the failed region.. DNS-based traffic management only influences which endpoint a client resolves to; it cannot force clients to stop using an address they have already cached. When the primary region fails, clients and recursive resolvers that cached the old record continue sending traffic to the failed region until the TTL expires and they re-query, so failover is inherently delayed and not instantaneous.

Answer

DNS steering policies cannot route traffic across different geographic regions.

Answer

DNS records are permanently immutable once created in OCI.

Answer

DNS routing requires public IP addresses to be configured on the database backends.

Question 12

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

Accepted Answer

Isolate workloads into private subnets whenever public access is not required.. Option B is correct because placing workloads in private subnets when they don't need inbound internet access removes their exposure to the public internet, and OCI private subnets have no route to an Internet Gateway, so they can only be reached via controlled paths such as a NAT Gateway, Service Gateway, or bastion. Option C is correct because OCI security rules are stateful by default, meaning return traffic for an established connection is automatically permitted, which reduces the need for wide inbound rules and lowers the risk of misconfiguration. Option D is correct because Network Security Groups (NSGs) apply at the VNIC level and let you write granular rules that reference other NSGs as sources or destinations, enabling least-privilege, application-tier-based filtering rather than broad subnet-level CIDR rules. Option A is not recommended because exposing database management ports (e.g., 1521, 3306, 5432) to 0.0.0.0/0 makes them reachable from the entire internet and invites brute-force and exploitation attempts. Option E is not recommended because attaching an Internet Gateway to a private subnet would make it public and defeat the purpose of isolation; private subnets should instead use a NAT Gateway for outbound traffic and a Service Gateway for OCI services.

Answer

Expose all database management ports to the 0.0.0.0/0 CIDR block.

Answer

Attach an Internet Gateway to every private subnet by default.

Question 13

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

Accepted Answer

Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.. Network Security Groups (NSGs) in OCI are virtual firewalls applied directly to the VNICs of instances, and they support stateful ingress/egress rules. By attaching an NSG with a default-deny posture (no allow rules for unwanted traffic) plus explicit allow rules for administrative ports (e.g., SSH 22 from a bastion CIDR), all other inbound traffic is dropped at the VNIC level. This is the granular, instance-scoped enforcement point OCI provides for subnet-level or VNIC-level traffic control.

Answer

Disable the OCI Internet Gateway on the VCN route table.

Answer

Enable OCI Bastion service on the database subnet.

Answer

Configure OCI IAM policies to block network ingress at the user level.

Question 14

An Oracle Cloud Infrastructure (OCI) architect is designing a high-availability web tier across multiple Availability Domains (ADs) within a single region. Which component should be used to distribute incoming client traffic evenly across web server instances residing in different ADs?

Accepted Answer

An OCI Public Load Balancer configured with backend sets spanning multiple ADs.. An OCI Public Load Balancer can be configured with backend sets that include web server instances in multiple Availability Domains within a region, distributing traffic evenly and providing high availability. It operates at Layer 7 (HTTP/HTTPS) and supports health checks to route traffic only to healthy instances. This design ensures that if one AD fails, traffic is automatically routed to instances in other ADs, meeting the high-availability requirement.

Answer

An OCI Dynamic Routing Gateway (DRG) configured with equal-cost multi-path routing.

Answer

A Network Load Balancer restricted to a single Availability Domain subnet.

Answer

A primary Local Peering Gateway (LPG) connected to multiple VCNs.

Question 15

When designing high availability across multiple Availability Domains in an OCI region, how should database or application subnets be configured to ensure fault tolerance?

Accepted Answer

Create regional subnets so that instances can be placed across multiple Availability Domains.. Regional subnets in OCI are not scoped to a single availability domain, so instances launched in them can be placed in any AD within the region. This allows you to spread database and application instances across multiple ADs for fault tolerance while keeping them in the same subnet and VCN.

Answer

Restrict all subnets to a single Availability Domain to prevent cross-AD latency.

Answer

Disable security lists on subnets to allow uninterrupted cross-AD replication traffic.

Answer

Attach all VNICs directly to the Dynamic Routing Gateway without using subnets.