1Z0-997-26 Practice Exam 2 — 20 Questions

Question 1

An enterprise application running on Oracle Autonomous Transaction Processing (ATP) requires dedicated infrastructure isolation for compliance reasons. You need to provision an Autonomous Database on Dedicated Exadata Infrastructure. Which architectural step is mandatory before you can provision the database instance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Autonomous Exadata Infrastructure resource in your compartment and virtual cloud network.. Autonomous Database on Dedicated Exadata Infrastructure (ADB-D) requires a two-step provisioning model: first create the Autonomous Exadata Infrastructure (AEI) resource, which allocates the dedicated Exadata hardware in your compartment and VCN, then provision the Autonomous Container Database and finally the Autonomous Database on top of it. Without the AEI, there is no dedicated infrastructure to host the ADB, so this step is mandatory.

Answer

Contact Oracle Support to manually allocate physical rack boundaries in your tenancy region.

Answer

Create a Pluggable Database (PDB) manually via SQL*Plus on an existing multitenant container database.

Answer

Provision a standard Exadata Cloud Service cluster using the Database management service console.

Question 2

What is the primary function of an OCI Service Gateway?

Accepted Answer

To provide private access to Oracle public services without using public IP addresses or the internet. An OCI Service Gateway provides a private, secure path for resources in a VCN to access Oracle public services (such as Object Storage, Autonomous Database, and OCI Streaming) without traversing the internet or using public IP addresses. Traffic from the VCN to the service goes over the Oracle network fabric, staying private. This is the primary function of a Service Gateway in OCI networking.

Answer

To translate private IP addresses to public IP addresses for internet bound traffic

Answer

To connect on-premises datacenters to OCI via FastConnect

Answer

To load balance HTTP/HTTPS traffic across multiple backend servers

Question 3

When designing a high-availability and disaster recovery architecture for an enterprise Oracle Database on OCI, which THREE components or patterns are crucial for achieving optimal recovery and uptime? (Choose three.)

Accepted Answer

Automated and policy-driven backups to OCI Object Storage with cross-region replication. Option A is correct because automated, policy-driven backups written to OCI Object Storage and replicated across regions provide durable, off-site recovery points that survive regional failures and satisfy RPO/RTO objectives. Option C is correct because Oracle Data Guard maintains a synchronized standby database in a remote region, enabling fast failover and near-zero data loss for regional disaster recovery. Option E is correct because Oracle RAC spread across fault domains or availability domains provides local high availability by eliminating single points of failure and enabling instance-level failover within a region. Option B is incorrect because local ephemeral NVMe snapshots are tied to the compute instance and are lost if the host or region fails, so they cannot serve as a disaster recovery mechanism. Option D is incorrect because a single-node database VM cannot be stretched across regions, and unencrypted NFS mounts introduce security and latency problems that undermine both availability and compliance.

Answer

Relying solely on local ephemeral NVMe drive snapshots for disaster recovery

Answer

Stretching a single-node database VM across distinct cloud regions using unencrypted NFS mounts

Question 4

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

Accepted Answer

DRG attachments and DRG Route Tables. A Dynamic Routing Gateway (DRG) with attachments for each VCN and the on-premises FastConnect virtual circuit, combined with DRG Route Tables, enables centralized routing across multiple VCNs in different regions and the on-premises network. DRG Route Tables let you control which routes are imported and distributed per attachment.

Answer

Local Peering Gateway chaining

Answer

Internet Gateway route forwarding

Answer

Service Gateway cross-region peering

Question 5

When designing a multi-database architecture with Oracle GoldenGate for high availability and load distribution, which THREE architectural considerations are critical for success? (Choose three.)

Accepted Answer

Implementing Conflict Detection and Resolution (CDR) rules for active-active multi-master topologies. Option B is correct because in an active-active multi-master GoldenGate topology, the same rows can be modified on multiple nodes simultaneously, so Conflict Detection and Resolution (CDR) rules are essential to deterministically resolve update/delete conflicts and prevent data divergence. Option C is correct because each node must generate non-overlapping keys; using unique sequence offsets (or ranges) per node prevents primary key collisions when inserts from different replicas are applied to the same table. Option D is correct because DDL changes must be captured and replicated in a coordinated way (e.g., via DDL replication and synchronized apply order) so that table structures, columns, and indexes remain identical across nodes, avoiding extract/replicat failures and metadata mismatches. Option A is wrong because routing all writes to a single read-only replica without replication is not a GoldenGate HA/load-distribution design and would not propagate changes. Option E is wrong because disabling checkpointing removes recovery positioning, causing data loss and preventing reliable restart after failures.

Answer

Routing all write transactions through a single read-only replica without replication

Answer

Disabling all checkpointing to maximize real-time packet loss tolerance

Question 6

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

Accepted Answer

Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.. OCI and GCP do not have a native direct interconnect between them, so private low-latency connectivity requires a Layer 2 fabric provider. FastConnect on the OCI side and Cloud Interconnect on the GCP side both terminate at the same Equinix Fabric or Megaport switch, where a virtual cross-connect joins the two circuits. This keeps traffic off the public internet and gives deterministic latency.

Answer

Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.

Answer

Configure an OCI Internet Gateway to peer with GCP Cloud DNS.

Answer

Attach a GCP VPC as a secondary VCN in the OCI console.

Question 7

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

Accepted Answer

Allow group Developers to manage compute-instances in compartment ParentCompartment. OCI IAM policies are hierarchical: a policy statement that grants access at a parent compartment automatically applies to all child compartments within that hierarchy. By writing the policy at ParentCompartment, the developer group gets manage permissions on compute instances in all child compartments without granting tenancy-wide access. This follows the principle of least privilege while meeting the requirement.

Answer

Allow group Developers to manage compute-instances in tenancy

Answer

Allow group Developers to manage compute-instances in root

Answer

Write individual policies for every single child compartment separately without referencing the parent.

Question 8

Your OKE cluster has autoscaling enabled using the Kubernetes Cluster Autoscaler. However, during peak hours, new pods remain in 'Pending' state for 15 minutes before the cluster autoscaler provisions new worker nodes. How can you reduce this provisioning delay?

Accepted Answer

Deploy Kubernetes over-provisioning pods (pause pods) with lower priority to keep spare node capacity ready instantly.. Over-provisioning pods (low-priority pause pods) reserve spare capacity on existing nodes so that when a real workload pod is scheduled, it can immediately preempt the pause pod and start running without waiting for the Cluster Autoscaler to provision a new node. This eliminates the 15-minute node provisioning delay during peak hours.

Answer

Convert all worker nodes from virtual machines to bare metal shapes.

Answer

Increase the OCI Load Balancer bandwidth shape to maximum.

Answer

Disable OCI IAM token caching on worker nodes.

Question 9

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

Accepted Answer

Route inbound traffic from the Internet Gateway through a firewall appliance subnet before forwarding it to backend subnets via route tables.. To force all inbound internet traffic through a next-generation firewall before it reaches backend web servers, you place the firewall appliance in its own subnet and use route tables to steer traffic: the Internet Gateway routes inbound traffic to the firewall subnet, and the firewall subnet's route table forwards inspected traffic to the backend subnet. This is the standard hub-and-spoke or DMZ architecture in OCI, where the firewall is the next hop for the backend subnet's ingress path.

Answer

Attach public IP addresses directly to all backend web servers.

Answer

Rely entirely on default VCN Security Lists without route table modifications.

Answer

Use OCI Object Storage to filter incoming HTTP packets.

Question 10

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

Accepted Answer

Static Routing mode. OCI Site-to-Site VPN supports two routing modes: Dynamic Routing (BGP) and Static Routing. When the on-premises firewall requires static routing, you must select Static Routing mode and manually specify the on-premises and OCI CIDR prefixes that should be routed over the tunnel.

Answer

Local Peering mode

Answer

Dynamic Routing (BGP) mode

Answer

FastConnect Partner mode

Question 11

Which THREE features are provided by OCI Application Performance Monitoring (APM)?

Accepted Answer

Distributed Tracing across microservices. OCI Application Performance Monitoring (APM) provides Distributed Tracing across microservices (A), which lets you follow a single request through multiple services and identify latency or errors in the call chain. It also provides Real User Monitoring (RUM) (C), which captures browser-side performance data from actual end users via a JavaScript agent. Additionally, APM offers Synthetic Monitoring (E) using browser and script-based tests to proactively simulate user interactions and measure availability and performance. Options B and D are incorrect because automatic bare metal database backups are a database service capability, and BGP routing table management for FastConnect belongs to OCI networking, not APM.

Answer

Automatic provisioning of bare metal database backups

Answer

Management of BGP routing tables for FastConnect

Question 12

You are provisioning an Autonomous Data Warehouse (ADW) instance and want to configure network access so that only specific corporate IP addresses can connect to the database. Which feature should you enable?

Accepted Answer

Autonomous Database Access Control Lists (ACLs).. Autonomous Database Access Control Lists (ACLs) are the native ADB feature that restricts connections to a defined set of public IP addresses or CIDR blocks, or to a private endpoint. Enabling an ACL on the ADW instance ensures only the specified corporate IP ranges can reach the database listener, satisfying the requirement directly.

Answer

Virtual Cloud Network (VCN) Security Lists only.

Answer

OCI Web Application Firewall (WAF) rule sets.

Answer

OCI Identity and Access Management (IAM) dynamic groups.

Question 13

You are configuring transparent data encryption (TDE) for an Oracle Database on Exadata Database Service using OCI Vault for master encryption key management. What happens if the database loses connectivity to the OCI Vault key management service?

Accepted Answer

The database continues to run using keys cached in memory for a period, but cannot be restarted until connectivity to OCI Vault is restored. When TDE uses OCI Vault as the external key management service, the database caches the master encryption key in memory after first retrieval. If connectivity to OCI Vault is lost, running instances continue to operate using the cached key, but any restart or new instance mount fails because the key cannot be fetched to open the TDE wallet. This is the documented behavior for external key management with TDE.

Answer

The database instantly crashes and forces an immediate failover to the standby database

Answer

The database automatically falls back to self-managed wallet storage without alerting administrators

Answer

All encrypted data files are automatically wiped to prevent security breaches

Question 14

Which TWO architectural best practices should you follow when designing cloud-native microservices on Oracle Container Engine for Kubernetes (OKE) to ensure high availability and resilience? (Choose two.)

Accepted Answer

Distribute OKE worker node pools across multiple Fault Domains or Availability Domains.. Option C is correct because spreading OKE worker node pools across multiple Fault Domains or Availability Domains ensures that a failure in one physical domain does not take down the entire cluster, which is a fundamental high-availability practice for cloud-native microservices. Option E is correct because Kubernetes Pod Disruption Budgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions such as node maintenance, upgrades, or scaling, directly supporting resilience and availability guarantees. Option A is not recommended because a single flat namespace does not improve communication speed and reduces isolation, making it harder to apply network policies, resource quotas, and RBAC for microservices. Option B is incorrect because storing state or sessions on the ephemeral container root filesystem means data is lost when the pod restarts or is rescheduled, breaking resilience; state should be externalized to a database or persistent volume. Option D is incorrect because exposing all microservices via NodePorts bypasses the OCI Load Balancer, lacks advanced traffic management, TLS termination, and health checks, and is not a best practice for production high availability.

Answer

Deploy all microservices into a single flat Kubernetes namespace to maximize intra-cluster communication speed.

Answer

Store all application state and user sessions locally on the ephemeral container root filesystem.

Answer

Use NodePorts for all external microservice access directly bypassing the OCI Load Balancer.

Question 15

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

Accepted Answer

OCI IAM token-based database authentication combined with Oracle Autonomous Database.. OCI IAM token-based database authentication, when combined with Oracle Autonomous Database, allows developers to authenticate using short-lived tokens issued by OCI IAM instead of long-term database passwords. This supports zero-trust principles by eliminating static credentials and enabling centralized identity management with token expiration and revocation.

Answer

Disabling all authentication to maximize application performance.

Answer

Hardcoded administrator passwords stored in plain text configuration files.

Answer

Using static API signing keys for database connection strings.

Question 16

You are migrating a monolithic application to microservices on OKE and implementing resilient design patterns. Which THREE resiliency patterns should you implement to handle transient failures gracefully?

Accepted Answer

Circuit Breaker pattern to prevent cascading failures when downstream services are struggling. Option A (Circuit Breaker) is correct because it detects repeated failures to a downstream service and trips open, failing fast instead of letting threads pile up waiting on a struggling dependency, which prevents cascading failures across the microservice mesh. Option B (Bulkhead) is correct because it partitions resources such as thread pools or connection pools per dependency, so a single slow or failing service cannot exhaust all shared resources and starve healthy services. Option D (Retries with Exponential Backoff and Jitter) is correct because transient network blips, brief DNS hiccups, or momentary 503s are often resolved by retrying, and exponential backoff with jitter avoids synchronized retry storms that would otherwise overwhelm the recovering service. Option C is not a resiliency pattern but an anti-pattern: a single shared monolithic database without connection pooling creates a shared point of contention and failure, coupling all microservices and amplifying outages. Option E is wrong because disabling health checks and liveness probes removes Kubernetes' ability to detect and restart unhealthy containers, degrading rather than improving resilience.

Answer

Single large monolithic database instance shared by all microservices without connection pooling

Answer

Disabling all health checks and liveness probes to prevent container restarts

Question 17

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

Accepted Answer

Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.. OCI Security Zones are hardened compartments that enforce a set of immutable security policies, one of which is that resources inside cannot have public IP addresses or public-facing endpoints. Because the policy is enforced at the platform level, the create-instance call fails regardless of IAM permissions or network configuration. This is by design to prevent external exposure of workloads in the zone.

Answer

The VCN lacks an Internet Gateway.

Answer

The OCI Vault service is offline.

Answer

The team lacks IAM permissions to create compute instances.

Question 18

Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?

Accepted Answer

Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host. For mTLS connections to Autonomous Database Serverless, the client must download the connection wallet zip from the OCI Console or CLI (or via the ADB API) and extract it on the client host. The wallet contains the client credentials (e.g., cwallet.sso, tnsnames.ora, sqlnet.ora) required to authenticate the client to the database over TLS. Without the wallet, mTLS cannot be established.

Answer

Generate a Kerberos ticket granting service token via the IAM security console

Answer

Retrieve the master encryption key directly from OCI Vault using an API key

Answer

Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings

Question 19

What is the primary purpose of OCI Database Actions (SQL Developer Web) when working with an Oracle Autonomous Database?

Accepted Answer

To provide a web-based development and management interface for executing SQL, querying data, and managing database users. OCI Database Actions (SQL Developer Web) is a web-based tool that provides a development and management interface for Autonomous Database, allowing users to execute SQL, query data, manage database users, and perform other administrative tasks. It is the primary browser-based interface for interacting with Autonomous Database.

Answer

To configure physical Exadata storage cell disks and flash cache parameters

Answer

To monitor physical VCN packet drops and firewall logs

Answer

To manage OCI IAM user groups and federation settings across enterprise identity providers

Question 20

You are configuring a Data Guard association between two Oracle Base Database Systems in different OCI regions. The primary database encounters an unplanned outage, and you perform a manual failover. What action must you take afterward if you wish to restore the original architecture with the old primary as the new standby?

Accepted Answer

Recreate or reinstate the former primary database (using Flashback Database or backup restoration) to convert it into a valid standby.. After a manual failover, the old primary is no longer a valid standby because its data files and control file reflect a different point in time. To restore the original architecture, you must reinstate or recreate the former primary as a standby, typically using Flashback Database to the point of the last redo it transmitted, or by restoring from backup and re-establishing the Data Guard association. Only then can redo transport resume in the reverse direction.

Answer

Run a simple 'SWITCHOVER' command to reverse roles without any data synchronization checks.

Answer

Modify the listener.ora file manually via SSH and restart the clusterware.

Answer

Delete the standby database and provision a brand-new VCN in the primary region.