1Z0-997-26 Practice Exam 1 — 20 Questions

Question 1

An OCI architect is reviewing the disaster recovery plan for a mission-critical database. The business requires a recovery drill to be executed in production without interrupting ongoing primary database operations or impacting RPO. Which Data Guard feature allows this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Snapshot Standby mode, which converts the standby to a read-write database for testing and later converts it back to a physical standby, merging changes.. Active Data Guard allows the standby database to be open in read-only mode while applying redo, and Snapshot Standby allows converting a standby to a read-write testing mode temporarily before converting it back.

Answer

Manual database cloning from Object Storage snapshots.

Answer

Logical Standby mode with SQL Apply disabled permanently.

Answer

Primary database switchover executed during peak business hours.

Question 2

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Accepted Answer

OCI DevOps Service. OCI DevOps service provides fully managed CI/CD developer pipelines for building, testing, and deploying software applications.

Answer

OCI Events Service

Answer

OCI GoldenGate

Answer

OCI Resource Manager

Question 3

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

Accepted Answer

OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload. OCI Service Mesh integrates with OCI Certificates service (or external CAs) to automatically issue, distribute, and rotate workload certificates using sidecar proxies (Envoy) which hot-reload certificates without pod restarts.

Answer

OCI Certbot DaemonSet running on all worker nodes

Answer

OCI Vault automatic key version rotation

Answer

Kubernetes CronJob executing kubectl rollout restart every night

Question 4

When designing cloud-native architectures on OCI using OCI Events and OCI Notifications, which THREE delivery endpoints are natively supported by OCI Notifications for publishing alert or event messages?

Accepted Answer

OCI Queue / OCI Streaming (via service endpoints). OCI Notifications service supports endpoints such as Email, HTTPS/Custom Webhooks, and OCI Streaming or OCI Queue / PagerDuty / Slack integrations via HTTPS.

Answer

Direct SMS text messages to mobile phone numbers globally

Answer

Physical fax machine transmission over analog telephone lines

Question 5

Which THREE methods can be used to back up an Oracle Base Database Service instance in OCI? (Choose three.)

Accepted Answer

Automated backups managed by OCI to Oracle-managed Object Storage. Base DB supports automated backups to Object Storage, manual backups to Object Storage, and RMAN-based backups.

Answer

Copying database datafiles via Secure Copy (scp) while the database is in read-write mode without RMAN

Answer

Exporting database files directly to an OCI Block Volume attached as a swap file

Question 6

An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?

Accepted Answer

Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.. Maximum Availability (Maximum Availability Architecture - MAA) mode with synchronous transport provides zero data loss (RPO = 0) and fast automatic failover via Fast-Start Failover (FSFO).

Answer

Active Data Guard with snapshot standby mode and automated cron-based switchovers.

Answer

Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.

Answer

Maximum Protection mode with asynchronous redo transport and manual failover scripts.

Question 7

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

Accepted Answer

OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.. OCI Events Service allows filtering and routing of events, but to guarantee handling with a dead-letter queue and retry capabilities, routing events through OCI Streaming or OCI Queue with OCI Notifications/Events integration is required. Specifically, OCI Events can publish to OCI Streaming, or OCI Queue can be integrated with Functions and a DLQ.

Answer

OCI API Gateway configured with a mock backend routing to OCI Functions.

Answer

OCI Notifications Service publishing directly to an OCI Object Storage bucket.

Answer

OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

Question 8

You are deploying an application on OKE using Helm charts. You need to ensure that Helm release secrets and deployment state are stored securely and persistently within the cluster so that failed tiller/helm operations do not corrupt deployment tracking. Where does Helm v3 store its release state in OKE by default?

Accepted Answer

Kubernetes Secrets within the respective namespace. Helm v3 stores release state and history directly inside Kubernetes Secrets located within the respective namespace.

Answer

OCI Object Storage bucket managed by Helm

Answer

OCI Registry chart annotations

Answer

Local SQLite database on the master control plane node

Question 9

You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?

Accepted Answer

Configure each consumer instance to belong to a separate, unique consumer group.. In OCI Streaming, to have multiple independent applications process the exact same stream concurrently, each application must use a unique consumer group. Messages are distributed among instances within the same consumer group, but separate consumer groups each get their own copy of the message stream.

Answer

Use the OCI Streaming default single-consumer mode with multithreaded polling.

Answer

Assign all consumer instances to the exact same consumer group and increase the number of partitions.

Answer

Publish events via OCI Notifications instead, as Streaming does not support consumer groups.

Question 10

You are designing a serverless data ingestion pipeline where OCI Functions are triggered by messages arriving in an OCI Stream. Under peak load, messages arrive faster than the functions can process them, causing invocation failures due to concurrency limits. How can you reliably buffer and throttle the event flow before invoking the functions?

Accepted Answer

Use OCI Queue between the stream and the functions, leveraging queue message visibility timeouts and batch polling.. Using OCI Queue or configuring OCI Streaming with a controlled polling mechanism/batching allows managing ingestion rates. Alternatively, OCI Queue natively supports batching and message locking, preventing concurrency overloads on OCI Functions.

Answer

Increase the OCI VCN bandwidth limit to maximum.

Answer

Enable public access on the OCI Functions application endpoint.

Answer

Configure OCI Object Storage lifecycle rules to delete excess messages.

Question 11

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication and authorization policies, including JWT validation to verify tokens issued by third-party identity providers.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 12

Your OKE cluster has autoscaling enabled using the Kubernetes Cluster Autoscaler. However, during peak hours, new pods remain in 'Pending' state for 15 minutes before the cluster autoscaler provisions new worker nodes. How can you reduce this provisioning delay?

Accepted Answer

Deploy Kubernetes over-provisioning pods (pause pods) with lower priority to keep spare node capacity ready instantly.. Optimizing node pool initialization settings, using pre-warmed node pools, or adjusting cluster autoscaler polling interval / over-provisioning (pause pods) can speed up scaling.

Answer

Convert all worker nodes from virtual machines to bare metal shapes.

Answer

Increase the OCI Load Balancer bandwidth shape to maximum.

Answer

Disable OCI IAM token caching on worker nodes.

Question 13

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions have a configurable timeout limit. You can update the function's timeout configuration either via the Fn Project CLI or the OCI Console.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 14

Your organization wants to deploy an ephemeral, event-driven data processing task that runs for less than 3 minutes whenever a new object is uploaded to an OCI Object Storage bucket. Which serverless combination is the most cost-effective and operationally efficient solution?

Accepted Answer

Configure an OCI Events rule to trigger an OCI Function upon object creation in Object Storage.. OCI Events service can listen to Object Storage bucket creation events and directly trigger an OCI Function without requiring dedicated virtual machines to run continuously.

Answer

Use an OCI Database with PL/SQL triggers to download files from Object Storage.

Answer

Deploy a Kubernetes deployment with 10 replicas on an OKE cluster to monitor bucket logs.

Answer

Provision an Always Free Compute VM running a cron job that polls Object Storage every minute.

Question 15

An OCI Function in your serverless architecture needs to process large files (up to 5GB) uploaded to an OCI Object Storage bucket. Due to ephemeral storage limits inside the function container (/tmp), the function crashes when attempting to download the entire file locally. How should you redesign this function processing flow?

Accepted Answer

Stream the file contents in chunks using Object Storage API range requests and process data iteratively without full local storage.. Instead of downloading the entire file into local ephemeral storage, the function should process the file using Object Storage multi-part upload/download streaming or range requests to process the file in chunks.

Answer

Attach an OCI Block Volume directly to the OCI Function container instance.

Answer

Increase the OCI Function memory allocation to automatically provision a larger /tmp filesystem.

Answer

Mount an OCI File Storage Service (FSS) target over the internet inside the function code.

Question 16

You need to trigger an OCI Function asynchronously whenever an object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the event router between Object Storage and the Function?

Accepted Answer

OCI Events Service. OCI Events service captures changes to OCI resources (like Object Storage uploads) and routes them to destinations such as OCI Functions.

Answer

OCI DNS

Answer

OCI File Storage Service

Answer

OCI Data Transfer Service

Question 17

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

Accepted Answer

W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.. OCI API Gateway, OCI Service Mesh (Envoy proxies), and application OpenTelemetry (OTel) SDKs can be configured to propagate W3C trace context headers and export traces to an OTel-compatible collector.

Answer

Kubernetes Liveness probes configured with HTTP GET request headers.

Answer

OCI Audit log queries combined with Object Storage bucket lifecycle rules.

Answer

OCI Notifications service broadcast topics configured with JSON log forwarding.

Question 18

When configuring OCI DNS Traffic Management Steering Policies for disaster recovery, which THREE steering methods are commonly used to route traffic between primary and secondary regions? (Choose three.)

Accepted Answer

Geolocation steering (routing traffic based on the geographic location of the client). OCI Traffic Management supports Failover, Load Balancer, and Geolocation/Round Robin steering policies to manage multi-region traffic.

Answer

Round-robin routing through a single static IP address without health checks

Answer

Manual BGP hijacking between VCN subnets

Question 19

You have deployed an API on OCI API Gateway and want to protect it from common web attacks such as SQL injection, cross-site scripting (XSS), and bad bots. Which OCI service should you integrate with API Gateway?

Accepted Answer

OCI Web Application Firewall (WAF). OCI Web Application Firewall (WAF) integrates with OCI API Gateway to protect web applications and APIs from malicious attacks and unwanted traffic.

Answer

OCI Vulnerability Scanning Service

Answer

OCI Bastion Service

Answer

OCI Cloud Guard

Question 20

Which TWO characteristics distinguish OCI Container Engine for Kubernetes (OKE) as a managed Kubernetes service?

Accepted Answer

Users manage and control the worker node pools (compute shapes, scaling, OS patches).. Oracle manages the Kubernetes control plane (master nodes) free of charge, while users manage worker nodes.

Answer

Users have full administrative SSH access to the underlying Kubernetes master control plane nodes.

Answer

OKE automatically provisions Oracle Autonomous Databases for every deployed pod.

Answer

Kubernetes worker nodes are billed at a flat hourly rate regardless of compute shape.