1Z0-997-26 Practice Exam 4 — 20 Questions

Question 1

Your company is planning to migrate 50 TB of unstructured file data from an on-premises Network Attached Storage (NAS) appliance to OCI File Storage Service (FSS). The target RTO/RPO allows for a phased baseline copy followed by incremental syncs. Which tool should you use to transfer the data efficiently over your dedicated OCI FastConnect link?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Parallelized rsync or custom multithreaded copy scripts via an OCI Compute instance acting as a migration gateway mounted to the FSS target. For migrating large unstructured file data to OCI File Storage Service (FSS) over a dedicated FastConnect link, the recommended approach is to mount the FSS target on an OCI Compute instance acting as a migration gateway and use parallelized rsync or multithreaded copy scripts. This leverages the high bandwidth of FastConnect and the parallelism needed for 50 TB, while supporting incremental syncs for phased cutover.

Answer

OCI Streaming Service

Answer

OCI Data Transfer Appliance

Answer

Oracle Data Pump

Question 2

You are planning the final cutover for a critical production database migrating from an on-premises Oracle Real Application Clusters (RAC) database to OCI Base Database Service using Oracle Data Guard for replication. To minimize application downtime during the cutover window, which sequence of steps must be executed?

Accepted Answer

Ensure zero data lag on the Data Guard standby, perform a switchover/failover to promote the OCI standby database to primary, and update application connection strings to point to the new OCI primary listener.. The correct cutover sequence for a Data Guard-based migration is to first confirm the standby has zero (or near-zero) data lag, then promote the OCI standby to primary via switchover (preferred) or failover, and finally repoint the application connection strings to the new OCI primary listener. This minimizes downtime because the standby is already synchronized and only the connection endpoint needs to change.

Answer

Stop source application, shut down source database immediately, open standby database in read-write mode, and update DNS.

Answer

Delete the source database home, re-run ZDM pre-migration checks, and deploy a fresh Autonomous Database instance.

Answer

Take an offline Data Pump export on premises, ship the dump via FastConnect, import it into OCI, and keep the source running indefinitely.

Question 3

Your organization has a strict Recovery Point Objective (RPO) of 5 minutes and Recovery Time Objective (RTO) of 15 minutes for a multi-tier application. The database tier uses Oracle Data Guard. During a test drill, you notice that redo transport lag spikes to 8 minutes. What is the most likely architectural bottleneck causing this issue?

Accepted Answer

Inadequate cross-region network bandwidth or high latency causing redo transport congestion.. A redo transport lag spike to 8 minutes most likely indicates a network bottleneck between the primary and standby regions. Data Guard redo transport depends on sufficient cross-region bandwidth and low latency; if bandwidth is constrained or latency is high, the standby cannot receive and apply redo fast enough, causing the lag to exceed the 5-minute RPO. This is an architectural issue, not a database or application configuration issue.

Answer

Exceeded OCI Block Volume IOPS limits on the standby database's local NVMe scratchpad.

Answer

Misconfigured OCI IAM policy allowing read-only access to database backups.

Answer

Incorrect OCI Load Balancer SSL certificate configuration on the web tier.

Question 4

An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?

Accepted Answer

OCI Stack Monitoring. OCI Stack Monitoring is purpose-built to monitor enterprise application stacks such as WebLogic Server and Oracle Database, providing deep internal health metrics, resource utilization, and dependency topology discovery. It is the only OCI service specifically designed for full-stack enterprise application monitoring.

Answer

OCI Application Performance Monitoring (APM)

Answer

OCI Logging Analytics

Answer

OCI Monitoring Service

Question 5

You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?

Accepted Answer

OCI API Gateway route pointing to the OCI Function. OCI API Gateway can be configured with a route that points to an OCI Function as its backend, exposing the function via a public HTTP URL. This lets you invoke the function directly with a browser or curl without writing custom client code or dealing with OCI's native signed-request authentication.

Answer

OCI Object Storage pre-authenticated request (PAR)

Answer

OCI Cloud Guard trigger policy

Answer

OCI Streaming cursor initialization

Question 6

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Accepted Answer

OCI Audit service to capture all control plane API activities and resource modifications.. Option B is correct because the OCI Audit service automatically records all control plane API calls and resource modifications across the tenancy, providing an immutable, tamper-evident audit trail that is essential for security investigations and compliance. Option E is correct because the OCI Logging service ingests, stores, and analyzes log data from sources such as VCN flow logs and compute instances, enabling centralized visibility and threat detection across the environment. Option A is wrong because routing log data to unencrypted public FTP servers exposes sensitive audit information to interception and tampering, violating security best practices. Option C is wrong because disabling logging eliminates the audit trail entirely, making threat detection and compliance impossible. Option D is wrong because relying on user memory dumps is not a reliable or comprehensive audit mechanism and does not provide the continuous, structured logging required for security monitoring.

Answer

Routing all log data to unencrypted public FTP servers.

Answer

Disabling all logging services to save storage costs.

Answer

Relying solely on user memory dumps for audit compliance.

Question 7

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

Accepted Answer

Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.. To achieve high availability across availability domains, the SD-WAN instances in OCI should be deployed in different Availability Domains (or Fault Domains) within the region and configured with BGP or clustering for failover. This ensures that a single AD or fault domain failure does not take down the SD-WAN overlay connecting OCI to AWS. BGP provides dynamic route failover between the instances.

Answer

In the same subnet, pinned to a single physical host.

Answer

Inside the OCI Control Plane root compartment.

Answer

On bare metal instances without any virtual cloud networks.

Question 8

An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?

Accepted Answer

APM Synthetic Monitoring Browser Monitors using Dedicated Vantage Points. OCI APM Synthetic Monitoring Browser Monitors execute scripted browser workflows (e.g., login flows) from multiple geographic locations using Dedicated Vantage Points, which are managed vantage points that run the scripts. This directly matches the requirement to periodically run browser-based synthetic scripts from multiple locations to validate user-facing login workflows.

Answer

OCI Health Checks Ping Monitors

Answer

Logging Analytics synthetic agent extensions

Answer

OCI Monitoring service Synthetic Probes

Question 9

An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?

Accepted Answer

OCI Logging Analytics. OCI Logging Analytics is a machine-learning-driven log analysis service that ingests logs from many sources and lets users run SQL-like queries (Log Explorer query language), build dashboards, and detect anomalies. It is purpose-built for deep log analytics and visualization, unlike basic Logging which focuses on collection and search.

Answer

OCI Audit Service

Answer

OCI Health Checks

Answer

OCI Object Storage

Question 10

An architect is designing an Oracle Exadata Database Service on Dedicated Infrastructure deployment with multiple VM clusters on a single Exadata rack. Which architectural feature allows secure isolation of CPU, memory, and database workloads between these distinct VM clusters?

Accepted Answer

Hard partitioning using Oracle VM (dom0/domU) hypervisor virtualization on the database servers. Exadata Database Service on Dedicated Infrastructure uses Oracle VM (OVM) with dom0/domU architecture to provide hard partitioning between VM clusters. Each VM cluster runs in its own set of domU guests on the database servers, with CPU, memory, and I/O isolated by the hypervisor. This hard partitioning is what allows multiple VM clusters to coexist securely on a single Exadata rack.

Answer

OCI Block Volume volume group replicas synchronized via block replication

Answer

Software-defined VLAN tagging enforced by the OCI Virtual Cloud Network (VCN) hypervisor only

Answer

Autonomous Database container database resource pools sharing a single OS kernel

Question 11

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

Accepted Answer

Higher bandwidth, lower latency, and predictable performance. FastConnect is a dedicated private physical connection between on-premises and OCI, bypassing the public internet. This yields higher, more consistent bandwidth, lower and more predictable latency, and reduced jitter compared to an IPSec VPN, which traverses the public internet and is subject to variable paths and congestion. That predictability is the primary reason enterprises choose FastConnect for latency-sensitive or high-throughput workloads.

Answer

Ability to route traffic over public cellular networks

Answer

Zero configuration required on the on-premises router

Answer

Automatic encryption of all traffic at Layer 2 by default

Question 12

You are performing maintenance on an OCI Load Balancer backend set. You want to temporarily stop sending traffic to a specific backend server without immediately dropping active persistent connections. What feature should you use?

Accepted Answer

Enable Connection Draining on the backend server.. Connection Draining is the OCI Load Balancer feature that gracefully removes a backend from rotation while allowing in-flight persistent connections to complete. When enabled, the backend is marked as draining, existing sessions continue until they finish or the drain timeout expires, and no new connections are routed to it. This matches the requirement to stop new traffic without abruptly dropping active persistent connections.

Answer

Set the backend server weight to zero without enabling draining.

Answer

Delete the backend server from the backend set immediately.

Answer

Modify the security list to drop all TCP packets on port 443.

Question 13

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit. To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 14

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

Accepted Answer

Customer-Premises Equipment (CPE). The Customer-Premises Equipment (CPE) object represents the on-premises VPN device in OCI. Before creating an IPSec connection, you must create a CPE object that specifies the public IP address of the on-premises device. This allows OCI to establish the IPSec tunnels to that endpoint.

Answer

NAT Gateway

Answer

Service Gateway

Answer

Virtual Cloud Network (VCN)

Question 15

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

Accepted Answer

Configure an OCI Service Gateway in your VCN and add a route rule for OCI Services to the private subnet's route table.. An OCI Service Gateway provides private access from a VCN to OCI public services like OCIR without traversing the internet. By adding a route rule in the private subnet's route table pointing OCI Services traffic to the Service Gateway, pods can pull images securely while worker nodes remain isolated from the public internet.

Answer

Install an external Squid proxy on an on-premises server connected via IPsec VPN.

Answer

Set up a NAT Gateway and forward all traffic to the internet.

Answer

Attach a Public IP address to every worker node in the OKE cluster.

Question 16

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Accepted Answer

OCI Vault (Secrets management). OCI Vault's Secrets management feature is designed to store sensitive values like database connection strings and API keys, and OCI Functions can retrieve them securely at runtime via the OCI SDK or by referencing them as environment variables. This keeps secrets encrypted and access-controlled through IAM policies.

Answer

OCI Object Storage public bucket

Answer

OCI Audit log retention policy

Answer

OCI Resource Manager stack configuration output

Question 17

You are managing an enterprise OKE cluster that runs multi-tenant workloads. Certain sensitive pods must run on dedicated worker nodes to comply with strict isolation mandates. Which combination of Kubernetes scheduling features should you configure on OCI to enforce this requirement reliably?

Accepted Answer

Kubernetes Taints, Tolerations, and Node Affinity. Taints repel pods from nodes unless the pod has a matching toleration, and Node Affinity (specifically nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution) pins pods to nodes with specific labels. Combining taints on the dedicated nodes with tolerations on the sensitive pods, plus node affinity to select those labeled nodes, guarantees that only the intended sensitive workloads land on the dedicated worker nodes. This is the canonical Kubernetes pattern for hard multi-tenant isolation at the scheduling layer.

Answer

OCI Identity and Access Management (IAM) dynamic groups and compartment isolation

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) and OCI Cluster Autoscaler

Answer

OCI Load Balancer flexible shapes and backend set weights

Question 18

During a migration cutover weekend, your team encounters unexpected DNS resolution failures preventing users from reaching the newly migrated OCI application endpoints. Which TWO immediate troubleshooting steps should you perform? (Choose two.)

Accepted Answer

Check OCI VCN DNS resolver settings and custom resolver forwarders if integrating with on-premises DNS.. Option A is correct because during a migration cutover, DNS resolution failures often stem from the OCI VCN resolver configuration — specifically the Internet and VCN Resolver settings, custom resolver endpoints, and forwarding rules used when integrating with on-premises DNS (e.g., via IPSec VPN or FastConnect). Verifying these ensures the VCN's resolver is correctly forwarding queries and resolving OCI-internal names. Option B is correct because the most common cutover issue is stale or incorrect public DNS records; you must confirm the A records (and CNAMEs) point to the new OCI Load Balancer public IP addresses and check TTL values, since high TTLs can cause clients to cache old records long after the cutover. Option C is irrelevant — changing tenant subscription currency from USD to EUR has no effect on DNS resolution. Option D is unrelated — reformatting backend database tables with SQL*Plus addresses data storage, not name resolution. Option E is destructive and nonsensical — deleting all OCI compartments and recreating the tenancy root would break the environment rather than troubleshoot DNS.

Answer

Change the tenant subscription currency from USD to EUR.

Answer

Reformat all backend database tables using SQL*Plus.

Answer

Delete all OCI compartments and recreate the tenancy root structure.

Question 19

Your organization runs a multi-tenant Oracle Base Database Service and you need to monitor the storage utilization of individual Pluggable Databases (PDBs) within a Container Database (CDB). Which OCI native service and metric should you review?

Accepted Answer

OCI Database Management service PDB storage metrics.. The OCI Database Management service provides native monitoring for Oracle databases, including PDB-level storage metrics. It collects and displays metrics such as tablespace usage, datafile size, and storage utilization for each PDB within a CDB. This is the correct OCI-native service for monitoring individual PDB storage.

Answer

OCI Logging Analytics with custom log parsers for alert.log.

Answer

Compute Instance metrics via OCI Monitoring service agent.

Answer

Autonomous Health Framework (AHF) health check reports.

Question 20

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.