1Z0-997-26 Practice Test 19 — 15 Questions

Question 1

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Accepted Answer

Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.. Option B is correct because OCI IAM verbs are ordered from least to most permissive (inspect < read < use < manage), and granting only the minimum verb needed for a task enforces least privilege and limits blast radius at scale. Option C is correct because attaching policies to IAM groups mapped to job functions lets you manage entitlements centrally; adding or removing a user from a group changes their access without rewriting individual user policies, which is essential in large tenancies. Option E is correct because OCI policies are inherited down the compartment hierarchy, so a policy written at a parent compartment applies to all child compartments, drastically reducing the number of policies you must author and maintain. Option A is wrong because storing credentials in instance metadata exposes secrets and violates OCI security guidance; instances should use instance principals instead. Option D is wrong because assigning every human user to the Administrators group grants full tenancy-wide privileges, directly violating least privilege and defeating the purpose of groups and compartment-scoped policies.

Answer

Hardcode IAM user passwords directly in instance metadata.

Answer

Assign all human users directly to the Administrators group for operational simplicity.

Question 2

Which TWO of the following services are native components of the Oracle Cloud Infrastructure Observability and Management platform?

Accepted Answer

OCI Application Performance Monitoring (APM). OCI Application Performance Monitoring (APM) (option C) is a native Observability and Management service that provides distributed tracing, synthetic monitoring, and real-user monitoring to diagnose application performance issues. OCI Logging Analytics (option E) is also a native Observability and Management service that uses machine-learning-driven log indexing, correlation, and visualization to analyze log data across the environment. Both belong to the OCI Observability and Management platform, which also includes services such as Monitoring, Notifications, Events, and Operations Insights. In contrast, OCI Autonomous Database (A), OCI Container Engine for Kubernetes (B), and OCI File Storage Service (D) are core data and compute/storage services, not observability or management components, so they do not qualify.

Answer

OCI Autonomous Database

Answer

OCI Container Engine for Kubernetes

Answer

OCI File Storage Service

Question 3

An enterprise application uses an Oracle Exadata Database Service on Dedicated Infrastructure with Maximum Availability Architecture (MAA). A catastrophic regional disaster occurs, and you must initiate a failover to the standby region. What is the expected behavior of Active Data Guard during this process?

Accepted Answer

The standby database converts to the primary role, opens for read/write operations, and stops applying redo from the old primary.. During a Data Guard failover, the standby database transitions from the standby role to the primary role, opens for read/write operations, and stops applying redo from the former primary. This is the defining behavior of a role transition: the standby ends its redo apply process and becomes the new source of truth. Active Data Guard's read-only workload is replaced by full read/write capability once the failover completes.

Answer

The standby database automatically initiates a flashback database operation to sync with object storage backups before opening.

Answer

Active Data Guard remains in read-only mode until a manual database restore command is issued.

Answer

The database becomes inaccessible until Full Stack Disaster Recovery automatically reprovisions the storage cells.

Question 4

Which TWO OCI networking features help achieve high availability for applications accessing external services or on-premises datacenters? (Choose two.)

Accepted Answer

Redundant FastConnect virtual circuits terminating on separate DRG ports or diverse provider locations.. Option B is correct because redundant FastConnect virtual circuits that terminate on separate DRG ports or diverse provider locations eliminate single points of failure in the private dedicated connectivity between OCI and on-premises datacenters, allowing traffic to fail over and maintain high availability. Option C is correct because configuring redundant IPSec VPN tunnels on the Dynamic Routing Gateway provides multiple encrypted paths over the internet; if one tunnel or its underlying network path fails, BGP or static routing can shift traffic to the surviving tunnel, preserving connectivity to on-premises or external services. Option A is incorrect because disabling DRG route propagation removes learned routes and would break reachability rather than improve availability. Option D is incorrect because a single Internet Gateway with no backup routes is itself a single point of failure and does not provide redundancy. Option E is incorrect because local peering gateways connect VCNs within the same region and are not used for on-premises connections, which require FastConnect, IPSec VPN, or a DRG.

Answer

Disabling Dynamic Routing Gateway route propagation.

Answer

Single public Internet Gateway attached without backup routes.

Answer

Using local peering gateways for on-premises connections.

Question 5

An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?

Accepted Answer

OCI FastConnect. OCI FastConnect provides a dedicated, private physical connection between an on-premises data center and OCI, bypassing the public internet entirely. It offers high bandwidth (1 Gbps to 100 Gbps per connection), predictable low latency, and is the recommended service when the requirement is a private, high-performance link rather than an encrypted tunnel over the internet.

Answer

OCI Site-to-Site VPN

Answer

OCI Internet Gateway

Answer

Oracle Database Gateway

Question 6

An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)

Accepted Answer

MACsec encryption on FastConnect dedicated circuits. Option A is correct because MACsec (IEEE 802.1AE) can be enabled on OCI FastConnect dedicated circuits, providing Layer 2 point-to-point encryption of traffic between the on-premises edge and the OCI edge without requiring IPsec. Option B is correct because OCI Site-to-Site IPSec VPN uses IKE/IPsec to encrypt traffic over the public internet (or over FastConnect private virtual circuits), securing data in transit between the on-premises CPE and the OCI VPN headend. Option C is correct because application-level encryption such as TLS 1.3 or HTTPS encrypts the payload end-to-end at Layer 7, protecting data in transit regardless of the underlying transport path. Option D is not correct because an Internet Gateway simply provides public connectivity and does not perform packet inspection or encryption; security inspection would require a firewall or NGFW, not the gateway itself. Option E is not correct because Local Peering Gateways connect VCNs within the same region and do not provide encryption by default, nor do they secure on-premises-to-OCI transit.

Answer

OCI Internet Gateway packet inspection

Answer

OCI Local Peering Gateways with default encryption

Question 7

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

Accepted Answer

Configure a Network Security Group (NSG) for the database tier with an ingress rule allowing traffic solely from the application tier's NSG.. NSGs in OCI allow ingress rules to reference another NSG as the source, so the database tier's NSG can permit traffic only from the application tier's NSG. This provides VNIC-level micro-segmentation that is independent of subnet CIDRs and ensures no external traffic can reach the database even if routing changes. This is the canonical OCI pattern for tiered application isolation.

Answer

Use OCI Cloud Guard to block any unauthorized IP connection attempts to the database.

Answer

Attach a public IP to the database servers and use a public load balancer to filter database ports.

Answer

Deploy a DRG with a firewall ruleset between the app subnet and DB subnet.

Question 8

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

Accepted Answer

OCI Audit Service. OCI Audit Service automatically records all API calls made against OCI resources, including who made the call, when, from which source IP, and the request/response details. Deleting a database instance is an API operation (e.g., TerminateDbSystem), so the exact event history — actor, timestamp, and resource — is captured in Audit logs and can be queried in the Console or via the Audit API/CLI. This makes it the authoritative source for forensic investigations of resource changes.

Answer

OCI Cloud Guard Responder Logs

Answer

OCI Database Performance Hub

Answer

OCI Monitoring Service

Question 9

You are migrating a 50 TB Oracle Database from an on-premises Sun Solaris SPARC server to OCI Exadata Database Service on X9M hardware (Linux x86-64 architecture). Because the source and target platforms have different endianness and operating system architectures, standard RMAN backup restoration is not possible. Which migration strategy should you implement?

Accepted Answer

Use Transportable Tablespaces with RMAN `CONVERT DATAFILE` or Oracle Data Pump to transfer and convert data between different endian architectures.. Transportable Tablespaces (TTS) with RMAN CONVERT DATAFILE or Data Pump is the standard Oracle-supported method for cross-platform, cross-endian migration because it performs the required byte-order conversion of datafiles during transport. It moves only the tablespace data plus metadata rather than the entire database, and it is explicitly designed for heterogeneous source/target platforms such as Solaris SPARC (big-endian) to Linux x86-64 (little-endian).

Answer

Perform a cold OS-level tar/gzip copy of the Oracle home and data directories from Solaris to Linux.

Answer

Use OCI Zero Downtime Migration (ZDM) physical offline migration mode without endian conversion parameters.

Answer

Take an RMAN incremental backup on Solaris SPARC, copy the backup pieces to OCI Object Storage, and restore them directly onto the Exadata target.

Question 10

Your company requires automated daily backups of block volumes attached to critical production compute instances in OCI. Which OCI service feature should you configure?

Accepted Answer

OCI Volume Backup Policies attached to the block volumes.. OCI Block Volume Backup Policies are the native, automated mechanism for scheduling backups of block volumes. You create a backup policy (e.g., Bronze/Silver/Gold or a custom policy) defining backup frequency and retention, then attach it to the block volume or its compartment. OCI then automatically creates volume backups on the defined schedule, which can be restored to new volumes or used for cloning.

Answer

Custom Oracle Autonomous Linux scripts cron-scheduled to push to Object Storage.

Answer

OCI File Storage service snapshot schedules.

Answer

OCI Block Volume Vaults with automated cross-region replication policies.

Question 11

Which TWO methods are valid for protecting OCI Compute instance boot volumes against data loss or corruption? (Choose two.)

Accepted Answer

Creating manual or scheduled boot volume backups.. Option B is correct because OCI Block Volume service supports both manual and policy-driven scheduled backups of boot volumes, which create point-in-time copies stored in Object Storage that can be used to restore or clone the boot volume after data loss or corruption. Option C is correct because cross-region boot volume replication asynchronously copies the boot volume to a volume in another OCI region, providing protection against region-level failures and enabling recovery or disaster-recovery failover. Option A is wrong because an Internet Gateway is a VCN networking component for public connectivity, not a data-protection mechanism for boot volumes. Option D is wrong because OCI Streaming is a Kafka-compatible messaging service for streaming data, not a storage or backup target for OS boot volumes. Option E is wrong because local NVMe scratch disks are ephemeral, non-persistent instance storage that is wiped on reboot or termination, so they cannot provide OS persistence or protection.

Answer

Attaching the boot volume to an Internet Gateway.

Answer

Storing OS files in an OCI Streaming queue.

Answer

Using local NVMe scratch disks for OS persistence.

Question 12

You are designing a high-availability architecture for an Oracle Base Database system across two Availability Domains (ADs) within a single OCI region. Which multi-database HA pattern ensures automatic failover with minimal data loss?

Accepted Answer

Oracle Data Guard configured between primary and standby database instances across ADs. Oracle Data Guard is Oracle's native disaster-recovery and HA solution that maintains a synchronized standby database in a different Availability Domain. With Data Guard in Maximum Availability or Maximum Performance mode using asynchronous or synchronous redo transport, failover can be automated via Fast-Start Failover (FSFO) with the Data Guard broker, achieving minimal data loss (zero with SYNC, near-zero with ASYNC) and automatic role transition. This is the standard multi-AD HA pattern for Oracle Base Database on OCI.

Answer

Periodic RMAN duplication scripts executed via cron jobs every hour

Answer

Active-Active Oracle RAC cluster spanning multiple Availability Domains over long-distance synchronous interconnects

Answer

Shared OCI Block Volumes mounted simultaneously by database nodes in different ADs

Question 13

What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?

Accepted Answer

To uniquely identify routing domains and enable dynamic exchange of network routes between OCI and on-premises routers.. BGP ASNs are used to uniquely identify routing domains and enable the dynamic exchange of network routes between OCI and on-premises routers. When establishing FastConnect, each side is assigned an ASN, and BGP peering uses these ASNs to exchange reachability information, allowing automatic route propagation.

Answer

To authenticate OCI console users via single sign-on.

Answer

To encrypt all payloads traversing the FastConnect physical fiber.

Answer

To assign public IP addresses to OCI compute instances.

Question 14

Your organization is designing a disaster recovery strategy as part of a workload migration project to OCI. The business requirement states that in the event of a regional outage in OCI region A, workloads must fail over to OCI region B with a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of less than 15 minutes. Which OCI networking feature should you deploy to interconnect the two regions for database replication?

Accepted Answer

OCI Dynamic Routing Gateway (DRG) with Remote Peering Connection (RPC). A DRG attached to VCNs in both regions, connected via a Remote Peering Connection (RPC), provides private, low-latency, high-bandwidth interconnect between OCI regions over Oracle's backbone. This is the standard OCI mechanism for cross-region database replication (e.g., Data Guard, GoldenGate) needed to achieve RPO=0 and RTO<15 minutes. RPC traffic stays on Oracle's private network, avoiding public internet variability that would jeopardize the aggressive RTO.

Answer

OCI Local Peering Gateway (LPG)

Answer

OCI Service Gateway

Answer

OCI Internet Gateway with IPsec VPN tunnels over the public internet

Question 15

When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?

Accepted Answer

Evaluation window (time interval and period). Option A is correct because an OCI Monitoring alarm requires an evaluation window, defined by the interval (for example, 1m, 5m, 1h) and the period over which the metric is aggregated, so OCI knows how often and over what span to evaluate the metric. Option B is correct because every alarm must reference the metric to monitor, which is identified by its metric namespace (such as oci_computeagent) and metric name (such as CpuUtilization). Option E is correct because an alarm must define the trigger condition, consisting of the threshold value and the operator (for example, greater than, less than, or equal to) that determines when the alarm fires. Option C is not required because a Vault Master Encryption Key OCID is used for encrypting data at rest, not for defining alarm evaluation logic. Option D is not required because a VCN CIDR block is a networking construct unrelated to specifying which metric and threshold an alarm should evaluate.

Answer

OCI Vault Master Encryption Key OCID

Answer

Virtual Cloud Network (VCN) CIDR block