1Z0-997-26 Practice Test 20 — 15 Questions

Question 1

You are managing an Oracle Base Database Service instance configured with Data Guard in OCI. Due to a severe networking anomaly, the standby database falls significantly behind in applying redo. You decide to rebuild the standby database from an incremental backup taken on the primary. Which Recovery Manager (RMAN) command or process is used to synchronize the standby with the new incremental backup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an incremental backup from SCN on the primary database to the standby database using RMAN.. To synchronize a standby database with a new incremental backup taken on the primary, you use RMAN to apply an incremental backup from a specific SCN on the primary to the standby. This process involves taking an incremental backup on the primary, transferring it to the standby, and then using RMAN to recover the standby using that incremental backup. This is a standard method to roll forward a standby database that has fallen behind, without performing a full restore.

Answer

Execute a complete cold restore of all datafiles using FTP over port 21.

Answer

Reboot the OCI compute host using the OCI console 'Reset' button.

Answer

Run 'ALTER DATABASE CONVERT TO SNAPSHOT STANDBY' and drop all tablespaces.

Question 2

You are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?

Accepted Answer

Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.. The OCI Migration discovery agent needs SSH access to Linux VMs to inventory packages, services, and configurations. The secure best practice is to create a dedicated, least-privilege migration user, grant passwordless sudo only for the specific discovery commands (via a sudoers entry), and deploy the OCI Migration SSH key pair to that user. This avoids sharing root credentials, avoids plaintext passwords, and limits the blast radius if the key is compromised.

Answer

Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.

Answer

Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.

Answer

Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.

Question 3

When designing high availability for stateless web servers in OCI, which combination of services provides automatic scaling and load distribution across multiple Availability Domains?

Accepted Answer

OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer. The combination of OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer provides automatic scaling and load distribution across multiple Availability Domains for stateless web servers. Instance Pools allow you to manage a group of identical instances, Autoscaling Configurations automatically adjust the number of instances based on metrics, and a regional Load Balancer distributes traffic across those instances in multiple ADs, ensuring high availability.

Answer

OCI Streaming and OCI Notifications service

Answer

OCI Database Backup Policies and Local Peering Gateways

Answer

OCI Vaults and OCI Key Management service

Question 4

An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?

Accepted Answer

OCI Data Transfer Service using physical Data Transfer Appliances.. OCI Data Transfer Service using physical Data Transfer Appliances is designed for exactly this scenario: moving very large datasets (tens to hundreds of TB) when internet bandwidth is insufficient. You copy data to an encrypted appliance, ship it to Oracle, and Oracle uploads it to Object Storage, bypassing the 50 Mbps bottleneck entirely.

Answer

OCI FastConnect with a dedicated 1 Gbps partner circuit.

Answer

OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.

Answer

Parallelized multi-part uploads using the OCI CLI over public internet connections.

Question 5

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Accepted Answer

Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.. Option C is correct because OCI Object Storage Object Lock enforces WORM (Write Once, Read Many) retention policies: in Compliance mode, retention rules cannot be removed or shortened even by tenancy administrators until the retention period expires, directly preventing accidental or malicious deletion for strict compliance frameworks, while Governance mode offers similar protection with privileged override capability. Option E is correct because implementing least-privilege IAM policies ensures that only authorized security groups hold permissions such as BUCKET_DELETE or BUCKET_UPDATE, reducing the risk of accidental or malicious deletion by unauthorized or overly privileged users. Option A is incorrect because disabling versioning removes the ability to recover overwritten or deleted objects and does nothing to prevent deletion. Option B is incorrect because granting 'manage' permissions to all anonymous users exposes the bucket to anyone, enabling rather than preventing malicious deletion. Option D is incorrect because storing files without encryption weakens security and compliance and has no bearing on preventing deletion.

Answer

Disable versioning on all buckets to save storage space.

Answer

Grant 'manage' permissions on the bucket to all anonymous users.

Answer

Store all files without encryption to ensure faster deletion.

Question 6

Which TWO of the following are key architectural benefits of adopting serverless OCI Functions compared to managing traditional container clusters for event-driven tasks?

Accepted Answer

Automatic scaling from zero to thousands of executions based on incoming events without managing servers. Option D is correct because OCI Functions is a fully managed FaaS platform that automatically scales the function fleet from zero to thousands of concurrent executions in response to incoming events, eliminating the need to provision, patch, or manage any servers or worker nodes. Option E is correct because OCI Functions bills on a pay-as-you-go model based on actual execution time measured in milliseconds (plus invocation counts and provisioned resources), so you pay only for the compute actually consumed rather than for idle cluster capacity. Option A is incorrect because manual Kubernetes Horizontal Pod Autoscalers are a container-cluster concern; serverless functions abstract away pod and HPA management entirely. Option B is incorrect because no serverless platform guarantees permanent warm containers or zero cold starts; cold starts can still occur when scaling from zero. Option C is incorrect because serverless platforms deliberately hide the underlying hypervisor and host OS kernel, providing no root administrative access to that infrastructure.

Answer

Built-in requirement to configure manual Kubernetes Horizontal Pod Autoscalers

Answer

Guaranteed permanent container warm-start memory caching with zero cold starts ever

Answer

Full administrative root access to the underlying hypervisor and host operating system kernel

Question 7

Your organization uses OCI Full Stack Disaster Recovery to manage failovers between Region A and Region B. During a DR drill, you notice that a custom user-defined step failed because the dependent compute instance in Region B was not yet fully running. How should you resolve this dependency issue in the FSDR plan?

Accepted Answer

Edit the DR plan group and add a dependency or adjust the sequence order so that the start compute step completes before the custom script step.. OCI Full Stack Disaster Recovery (FSDR) plans are built from ordered groups of steps. When a custom user-defined step depends on a compute instance being fully running, the correct fix is to place the 'Start Compute' step in an earlier group or add an explicit dependency so the custom script executes only after the instance reaches the RUNNING state. This is the native sequencing mechanism FSDR provides.

Answer

Manually SSH into each instance during the drill to run the script.

Answer

Increase the OCI Compute instance shape size in Region B to boot faster.

Answer

Disable all pre-checks in the FSDR plan settings.

Question 8

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

Accepted Answer

Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.. OCI Logging Analytics provides a native Object Storage source type that allows you to configure a bucket as a log source. Once configured, Logging Analytics automatically discovers new log files, parses them using built-in or custom parsers, and ingests them for indexing and search. This eliminates the need for custom code or agents, and is the documented best practice for ingesting logs from Object Storage.

Answer

Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

Answer

Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

Answer

Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

Question 9

An application running on OCI compute instances requires disaster recovery protection. You want to replicate boot volumes and block volumes to a secondary region. Which OCI Block Volume feature facilitates this?

Accepted Answer

Asynchronous cross-region block volume replication. OCI Block Volume supports asynchronous cross-region replication, which continuously replicates block volumes (and their boot volumes) from a primary region to a secondary region for DR purposes. This is the native OCI feature designed for cross-region block volume DR. It operates at the block level and is configured per volume or volume group.

Answer

OCI File Storage cross-mount replication policies

Answer

Manual Object Storage export of raw volume blocks using dd commands

Answer

Real-time synchronous block volume mirroring via software RAID

Question 10

An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?

Accepted Answer

Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.. An RPO of zero requires synchronous redo transport so no committed transaction is lost, and an RTO under two minutes requires automated fast failover. Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled satisfies both: it guarantees zero data loss while the primary is available and enables automatic failover within seconds.

Answer

Active Data Guard with snapshot standby mode and automated cron-based switchovers.

Answer

Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.

Answer

Maximum Protection mode with asynchronous redo transport and manual failover scripts.

Question 11

An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)

Accepted Answer

Dynamic Routing Gateway (DRG) for hybrid ingress/egress. Option A is correct because the Dynamic Routing Gateway (DRG) is the OCI edge router that terminates the FastConnect or Site-to-Site VPN from on-premises and exchanges routes with the VCN, enabling private hybrid ingress/egress without traversing the public internet. Option D is correct because the Virtual Cloud Network (VCN) is the foundational software-defined network that hosts the subnets, route tables, and gateways through which the private traffic transits to reach the Autonomous Database. Option E is correct because a private endpoint (using a private IP in a VCN subnet) is what allows the Autonomous Database to be reached privately rather than through its public endpoint, and it is the target of the on-premises traffic. Option B is not part of this design because an Internet Gateway only enables public IP connectivity to and from the internet, which contradicts the requirement for a private connection. Option C is unrelated because OCI Email Delivery is a messaging service for sending email notifications, not a networking component involved in private database connectivity.

Answer

OCI Internet Gateway for public IP resolution

Answer

OCI Email Delivery service for database alert routing

Question 12

An enterprise is implementing a multi-database architecture utilizing Oracle GoldenGate microservices on OCI Compute instances to replicate data between an operational Exadata database and an analytical Autonomous Data Warehouse. Which network security construct must be configured to allow communication between the GoldenGate deployment and the Autonomous Database instance?

Accepted Answer

Configure VCN security lists or Network Security Groups (NSGs) allowing outbound TCP port 1522 and inbound mTLS traffic, and supply the ADB wallet. GoldenGate microservices on OCI Compute connect to Autonomous Database using the ADB wallet for mTLS authentication and the ADB's TCPS listener on port 1522. The VCN security lists or NSGs must allow outbound TCP 1522 from the GoldenGate host and inbound mTLS traffic to the ADB, and the wallet must be supplied to GoldenGate for the connection to succeed. This is the standard secure connectivity pattern for ADB.

Answer

Expose an API Gateway with public IP routing directly to the database undo tablespace

Answer

Configure a Local Peering Gateway with remote VCN route tables pointing to port 22

Answer

Attach an Internet Gateway directly to the Autonomous Database private IP address

Question 13

Which TWO of the following are valid methods to trigger an OCI Function execution?

Accepted Answer

OCI Events Service rule reacting to object storage or compute state changes. Option B is correct because the OCI Events Service can publish events (for example, Object Storage object-create or Compute instance state-change events) that match a rule and invoke a Function as the rule's action, making event-driven invocation a valid trigger method. Option D is correct because OCI Functions can be exposed as HTTP endpoints, and OCI API Gateway can route incoming HTTP requests to a Function, so client HTTP calls through the gateway trigger function execution. Option A is not a trigger: IAM password rotation policy is an identity/security governance setting and does not invoke Functions. Option C is not a trigger: physically inserting a USB drive into Exadata infrastructure is not an OCI control-plane or event mechanism for Functions. Option E is not a trigger: Block Volume defragmentation scheduling is a storage maintenance operation and does not invoke Functions.

Answer

OCI Identity and Access Management password rotation policy

Answer

Direct physical USB drive insertion into OCI Exadata infrastructure

Answer

OCI Block Volume disk defragmentation schedule

Question 14

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

Accepted Answer

Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.. To isolate a compromised instance while preserving storage, the best action is to update its Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic. This revokes network access without terminating the instance or deleting volumes, allowing forensic analysis. This can be automated with OCI Events (triggered by a security alert) and Functions.

Answer

Delete the VCN containing the instance to stop all routing.

Answer

Terminate the compute instance and delete all attached block volumes immediately.

Answer

Revoke the IAM user credentials of the administrator who launched the instance.

Question 15

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

Accepted Answer

Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter. The Kubernetes Horizontal Pod Autoscaler (HPA) can scale pods based on custom metrics when integrated with Prometheus and the Prometheus Adapter. The adapter exposes custom metrics from Prometheus to the Kubernetes metrics API, allowing HPA to query metrics like active queue length and scale accordingly. This is the standard approach for custom metric-based autoscaling in OKE.

Answer

Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits

Answer

OCI Autoscaling for OKE worker nodes

Answer

OCI Instance Pool autoscaling configuration