1Z0-997-26 Practice Exam 3 — 20 Questions

Question 1

Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Notifications Service. OCI Notifications Service is the correct intermediary because it natively supports publishing messages to external endpoints such as PagerDuty and Slack via HTTPS subscriptions. When an OCI Monitoring alarm fires, it can publish to a Notifications topic, and the service delivers the message to all subscribed endpoints. This is the standard OCI pattern for alert fan-out to third-party incident management and chat tools.

Answer

OCI API Gateway

Answer

OCI Streaming Service

Answer

OCI Events Service

Question 2

Your organization is preparing to migrate several large Oracle databases to OCI using Oracle Data Pump. Which THREE best practices should you follow to optimize the export and import performance over network connections? (Choose three.)

Accepted Answer

Use the `PARALLEL` parameter during both export and import operations to utilize multiple worker processes.. Option A is correct because the PARALLEL parameter in Oracle Data Pump starts multiple worker processes for both export (expdp) and import (impdp), allowing the job to read and write multiple data files concurrently and thereby maximizing throughput over the network. Option C is correct because the COMPRESS parameter (e.g., COMPRESS=DATA_ONLY or ALL) reduces the size of the dump file set, which directly lowers the volume of bytes transferred across the network and shortens transfer time, especially for large Oracle databases. Option E is correct because NETWORK_LINK lets Data Pump read directly from the source database over a database link and write into the target database, eliminating the intermediate dump file on disk and the associated file transfer step, which is ideal for network-based migrations. Option B is not appropriate because running Data Pump jobs from a laptop on public Wi-Fi is unreliable and insecure, and omitting compression increases transfer volume. Option D is not appropriate because undo tablespaces are required for read consistency and transaction rollback during import; disabling them would break the import and is not a supported performance practice.

Answer

Execute all Data Pump jobs from a local laptop connected via public Wi-Fi without compression.

Answer

Disable database undo tablespaces entirely during the Data Pump import phase.

Question 3

You need to migrate an on-premises Oracle Database to OCI Exadata Database Service using Oracle GoldenGate for zero-downtime migration with bi-directional replication. Which critical design consideration must be addressed regarding table design on both databases?

Accepted Answer

Tables must have primary keys or unique identifiers, and Conflict Detection and Resolution (CDR) must be configured. For bi-directional replication with Oracle GoldenGate, tables must have primary keys or unique identifiers to ensure that each row can be uniquely identified for conflict detection and resolution. Conflict Detection and Resolution (CDR) must be configured to handle conflicts that arise when the same row is modified on both databases. This is critical for zero-downtime migration with bi-directional replication.

Answer

Primary keys must be omitted to allow duplicate row insertion across databases

Answer

Tables must not contain any indexes, triggers, or constraints

Answer

All tables must be converted to temporary unlogged tables

Question 4

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

Accepted Answer

BGP (Border Gateway Protocol). Both OCI FastConnect and Site-to-Site VPN use BGP to dynamically exchange routes between the on-premises customer edge router and the OCI Dynamic Routing Gateway. BGP is the standard exterior gateway protocol for hybrid cloud routing and supports dynamic failover and prefix advertisement.

Answer

RIP (Routing Information Protocol)

Answer

EIGRP (Enhanced Interior Gateway Routing Protocol)

Answer

OSPF (Open Shortest Path First)

Question 5

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

Accepted Answer

OCI Security Zones. OCI Security Zones are a feature of Cloud Guard that enforce a set of security policies on compartments, preventing actions that violate the policies. When you create a security zone, you specify a security zone policy that includes restrictions such as blocking public buckets and disallowing open security list rules. Any attempt to create or modify resources in the compartment that violates the policy is denied. This enforces guardrails at creation time.

Answer

IAM Policy Condition statements with 'request.time'

Answer

OCI Audit Log Service with Event-Driven Automation

Answer

OCI Tag Defaults with validation rules

Question 6

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

Accepted Answer

Worker nodes utilizing Kata Containers runtime for hardware-level isolation. Kata Containers provide hardware-level isolation by running each container inside a lightweight virtual machine with its own kernel, so a container breakout affects only that VM and cannot compromise other tenants. This is the correct choice when strict kernel-level isolation is required on OKE.

Answer

Standard OKE worker nodes with Kubernetes LimitRanges

Answer

Standard worker nodes with Network Security Groups (NSGs) applied per pod

Answer

Worker nodes running Docker Engine with privileged containers enabled

Question 7

An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?

Accepted Answer

OCI Logging Agent. The OCI Logging Agent is a lightweight agent installed on Compute instances that collects custom application logs (and system logs) from the instance and ships them to the OCI Logging service via the Unified Monitoring Agent framework. It is the designated mechanism for ingesting instance-originated custom logs into OCI Logging.

Answer

OS Management Hub

Answer

OCI Service Connector Hub

Answer

OCI Streaming Service

Question 8

An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?

Accepted Answer

Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.. OCI Cost Analysis supports filtering and grouping by defined tags, enabling dynamic attribution of spend to business units based on resource metadata. Exporting Cost Reports to Object Storage provides durable historical data for trend analysis, and Budgets with alert rules deliver anomaly detection and threshold-based notifications. This combination directly satisfies the requirements for tag-based attribution, historical trends, and anomaly detection.

Answer

Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.

Answer

Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.

Answer

Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.

Question 9

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

Accepted Answer

Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.. A 'Tunnel Up' status only confirms that IKE Phase 1 and Phase 2 completed and the IPSec SA is established; it does not guarantee that traffic is permitted or routed. The most common cause of ping failure with an up tunnel is that Security Lists, NSGs, or the instance's OS firewall are dropping ICMP or the relevant traffic.

Answer

The FastConnect virtual circuit is disabled.

Answer

The OCI VCN does not have an Internet Gateway attached.

Answer

The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.

Question 10

Your organization has completed migrating a database to OCI Base Database Service. To ensure compliance with corporate data protection policies, you must verify that all database backups stored in OCI Object Storage are automatically encrypted using customer-managed encryption keys. Where should you configure this key management integration?

Accepted Answer

OCI Vault service (Key Management). OCI Base Database Service integrates with OCI Vault (Key Management) to allow customer-managed encryption keys (CMKs) for backups stored in Object Storage. When you configure the database's backup destination to use a customer-managed key, the service automatically encrypts backups with that key. This ensures compliance with policies requiring customer-controlled encryption rather than Oracle-managed keys.

Answer

OCI Database Migration service connection profiles

Answer

OCI Audit log configuration

Answer

OCI Identity and Access Management (IAM) password policies

Question 11

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication policies that can validate JSON Web Tokens (JWT) issued by an identity provider before forwarding requests to backend services. Configuring a JWT validation authentication policy ensures only requests with a valid, unexpired token from the trusted issuer reach the microservices. This is the native, purpose-built feature for token-based API authentication.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 12

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Accepted Answer

Using route distributions to control which routes are imported into or exported from a DRG route table.. Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering. Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Answer

Automatically peering AWS VPC route tables directly from the DRG console.

Answer

Enabling Ophaned route garbage collection on Internet Gateways.

Answer

Converting OCI VCN subnets into Azure Subnets via DRG translation rules.

Question 13

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

Accepted Answer

IKEv2 with AES-256 encryption and SHA-2 hashing. OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, which meets robust compliance requirements for encrypted tunnel traffic. IKEv2 is the recommended key exchange protocol, and AES-256 with SHA-2 provides strong confidentiality and integrity for IPsec tunnels. This combination is the standard supported configuration for OCI VPN.

Answer

SSL/TLS v1.3 with RSA key exchange

Answer

SSH tunneling with Blowfish cipher

Answer

PPTP with MPPE 128-bit encryption

Question 14

Which TWO tools or interfaces can administrators use to manage Oracle Autonomous Database instances in OCI? (Choose two.)

Accepted Answer

OCI Command Line Interface (CLI) and REST APIs. Option D is correct because Oracle Autonomous Database is a fully managed OCI service whose lifecycle and management operations (such as scaling, starting/stopping, cloning, and viewing details) are exposed through the OCI Command Line Interface and the OCI REST APIs, which administrators can script and automate. Option E is correct because the OCI Console provides the web-based graphical interface where administrators can create, monitor, and manage Autonomous Database instances without writing code. The other options do not belong: A (floppy disk image uploads) is an obsolete local media method with no role in OCI cloud management, B (RDP to the Autonomous database hypervisor) is impossible because Oracle manages the infrastructure and customers have no hypervisor access, and C (physical serial console cable to Exadata rack blades) is not a customer-accessible management path in a managed cloud service.

Answer

Local floppy disk drive image uploads

Answer

Windows Remote Desktop Connection (RDP) to the Autonomous database hypervisor

Answer

Direct physical serial console cable attached to Exadata rack blades

Question 15

Which Autonomous Database workload type is specifically optimized for running complex analytical queries, machine learning, and data warehousing workloads?

Accepted Answer

Autonomous Data Warehouse (ADW). Autonomous Data Warehouse (ADW) is the Autonomous Database workload type specifically tuned for analytical workloads: it uses columnar compression, automatic indexing for analytics, materialized view refresh, and parallel execution optimized for complex queries, machine learning, and data warehousing. ATP is tuned for high-concurrency transactional workloads, and AJD is optimized for JSON document workloads.

Answer

Autonomous JSON Database (AJD)

Answer

Autonomous Transaction Processing (ATP)

Answer

Autonomous Apex Application Development (APEX)

Question 16

You are designing a hybrid cloud architecture during a phased workload migration to OCI. On-premises applications must securely communicate with migrated OCI workloads over a private, dedicated connection with high throughput and encryption. Which OCI networking service combination provides this capability?

Accepted Answer

OCI FastConnect with MACsec encryption or an IPsec VPN tunnel over FastConnect. OCI FastConnect provides a dedicated private connection from on-premises to OCI, and pairing it with MACsec (Layer 2 encryption) or running an IPsec VPN over the FastConnect virtual circuit delivers the required encryption and high throughput. This is the standard hybrid pattern for private, dedicated, encrypted connectivity.

Answer

OCI Local Peering Gateway with public IP addressing

Answer

OCI NAT Gateway combined with Service Gateway

Answer

OCI Internet Gateway with SSL/TLS certificates

Question 17

You are designing an automated backup strategy for an Exadata Database Service on Dedicated Infrastructure. You want to ensure that incremental backups are taken daily and full backups weekly, with long-term retention stored in OCI Object Storage. Where are these backup schedules configured?

Accepted Answer

In the OCI Console under the database system backup configuration settings or via API/CLI. Backup schedules for Exadata Database Service on Dedicated Infrastructure are configured through the OCI Console under the database system's backup configuration, or via the OCI API/CLI. These settings define the retention period, backup window, and whether backups are stored in OCI Object Storage, and they control the automated incremental and full backup cadence.

Answer

By modifying the crontab configuration file as root on the dom0 hypervisor node

Answer

By editing the initialization parameter file (spfile) using SQL*Plus

Answer

Via Oracle Enterprise Manager Cloud Control deployed exclusively on-premises

Question 18

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions allow you to configure the function timeout up to the service limit (default 30 seconds, maximum 300 seconds) via the Fn Project CLI or OCI Console. Increasing the timeout directly addresses the failure when calling a slow third-party REST API, and is the recommended best practice for long-running calls.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 19

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

Accepted Answer

Dynamic Routing Gateway (DRG) with Remote VCN Peering. Remote VCN Peering in OCI uses a Dynamic Routing Gateway (DRG) attached to each VCN, with the two DRGs connected over OCI's private backbone to link VCNs in different regions. This provides private, encrypted-in-transit connectivity suitable for cross-region Data Guard redo transport without traversing the public internet. The DRG is the required routing anchor for any inter-VCN or on-premises connectivity in OCI.

Answer

Internet Gateway (IGW)

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Question 20

You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?

Accepted Answer

Cross-Region Autonomous Data Guard. Cross-Region Autonomous Data Guard is the native OCI feature that creates a standby Autonomous Database in a remote region and provides automatic or manual failover with low RPO (typically seconds) and low RTO. It is purpose-built for ADB Serverless disaster recovery and requires no manual backup shipping.

Answer

OCI Block Volume cross-region replication

Answer

Manual RMAN incremental backups copied to Object Storage in the remote region

Answer

Database Express Export/Import scheduled via cron