1Z0-997-26 Practice Test 21 — 15 Questions

Question 1

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.. OCI IAM best practice for multi-tenancy is to define dynamic groups whose matching rules are scoped to specific compartment OCIDs or instance tags, then attach policies at the compartment level rather than the tenancy root. This ensures workloads authenticate automatically via instance principals with least-privilege access limited to the resources they need. Using tags (e.g., defined tags like Operations.CostCenter) in matching rules further tightens scope and supports policy reuse across environments.

Answer

Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

Answer

Disable compartment security boundaries and assign all users to the Administrators group.

Answer

Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

Question 2

Your company is migrating static web assets and user-uploaded media files from an on-premises web server to OCI. The web application requires high durability, low latency, and global content delivery. Which OCI service should you use to store and serve these assets?

Accepted Answer

OCI Object Storage (Standard Tier). OCI Object Storage Standard Tier is designed for frequently accessed data and provides high durability (11 nines), low latency, and native integration with OCI CDN for global content delivery. It is the canonical service for serving static web assets and user-uploaded media because it supports HTTP/HTTPS access via pre-authenticated requests or public buckets. Archive Storage is for rarely accessed data with retrieval delays, File Storage is a shared NFS filesystem not optimized for web serving, and Block Volume is raw block storage attached to a single compute instance.

Answer

OCI Archive Storage

Answer

OCI File Storage Service

Answer

OCI Block Volume service

Question 3

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

Accepted Answer

To allow users to authenticate to OCI using their existing corporate credentials via SAML 2.0.. OCI IAM federation with an external IdP allows users to authenticate to OCI using their existing corporate credentials through the SAML 2.0 protocol, eliminating the need for separate OCI local users and passwords. The IdP asserts the user's identity, and OCI IAM maps IdP groups to OCI IAM groups to grant permissions. This centralizes authentication and enables single sign-on across cloud and on-premises systems.

Answer

To replicate OCI database backups to external cloud providers.

Answer

To automatically provision network security groups across regions.

Answer

To bypass OCI encryption key management requirements.

Question 4

An enterprise application running on Exadata Database Service on Dedicated Infrastructure experiences severe I/O contention due to a noisy neighbor batch reporting job. Which Exadata storage feature should you configure to isolate and guarantee I/O resources for critical online transaction processing (OLTP) workloads?

Accepted Answer

Exadata I/O Resource Management (IORM) with database-level resource plans. Exadata I/O Resource Management (IORM) is the Exadata storage-layer feature that lets you define resource plans allocating I/O shares, limits, and flash cache quotas per database, consumer group, or category. Configuring a database-level IORM plan lets you cap the batch reporting job's I/O so the OLTP workload's critical I/O is guaranteed. This is the purpose-built Exadata mechanism for noisy-neighbor isolation.

Answer

OCI Block Volume performance tiers (Higher VPU settings)

Answer

Autonomous Database concurrency limits in the OCI console

Answer

OCI Compute Auto-scaling configurations on the domU guest VMs

Question 5

You are deploying OCI Full Stack Disaster Recovery (FSDR) to orchestrate a cross-region DR plan for a multi-tier application stack. Which component acts as the primary grouping mechanism for all application assets (databases, compute, load balancers) within a compartment?

Accepted Answer

Disaster Recovery Protection Group (DR Protection Group). The Disaster Recovery Protection Group (DR Protection Group) is the primary grouping mechanism in OCI Full Stack Disaster Recovery. It logically groups all application assets—such as compute instances, databases, load balancers, and file systems—within a compartment so they can be managed and failed over together as a single unit. DR plans are then built on top of these protection groups to orchestrate cross-region failover and failback.

Answer

Backup Policy Group

Answer

OCI IAM Dynamic Group

Answer

Load Balancer Backend Set Group

Question 6

Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?

Accepted Answer

Dynamic Routing Gateway (DRG). The Dynamic Routing Gateway (DRG) is the OCI virtual router that serves as the central hub for all private connectivity between VCNs and external networks, including FastConnect and IPSec VPN. It supports route tables, route distribution, and attachments to multiple VCNs and on-premises connections.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 7

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

Accepted Answer

OCI Vulnerability Scanning Service. The OCI Vulnerability Scanning Service (VSS) is designed to scan compute instances and container images for known software vulnerabilities and malware. It inspects OS packages and application dependencies against vulnerability databases and reports findings, which is exactly the capability described.

Answer

OCI Cloud Guard

Answer

OCI Identity and Access Management

Answer

OCI Application Performance Monitoring

Question 8

Which TWO types of logs are natively generated and accessible within OCI Logging without requiring agent installation on compute instances?

Accepted Answer

OCI Audit logs. OCI Audit logs (C) are natively generated by the OCI platform itself and are automatically available in OCI Logging without any agent, since they record API activity against OCI resources at the control-plane level. OCI VCN Flow logs (E) are also natively produced by the OCI networking layer for subnets, VNICs, or VCNs and are ingested directly into OCI Logging without requiring an agent on compute instances. In contrast, custom database trace files (A) and custom application log files such as /var/log/app.log (B) reside on the instance's filesystem and require the OCI Logging agent (or Unified Monitoring agent) to be installed and configured to collect them. Third-party firewall logs from local virtual appliances (D) are likewise external to OCI's native telemetry and need an agent or custom ingestion path, so they are not natively available.

Answer

Custom database trace files generated inside a self-managed MySQL database on a VM

Answer

Custom application log files stored in /var/log/app.log inside a compute instance

Answer

Third-party firewall logs running on local virtual appliances

Question 9

You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?

Accepted Answer

OCI Native Ingress Controller configured with an OCI Load Balancer. The OCI Native Ingress Controller integrates with OCI Load Balancer to provision a single public load balancer with one public IP, and it supports Kubernetes Ingress rules including URL path-based routing to backend services. This is the standard OKE pattern for exposing multiple internal services externally through one entry point with path-based routing.

Answer

OCI File Storage Service mounted on all worker nodes

Answer

Kubernetes NodePort service directly pointing to every individual pod

Answer

OCI API Gateway without any OKE Ingress

Question 10

Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?

Accepted Answer

Add a route in the DRG route table pointing the Azure VNet CIDR to the FastConnect virtual circuit attachment.. In an OCI-Azure Interconnect architecture, the OCI DRG is attached to the FastConnect virtual circuit that connects to Azure ExpressRoute (via the interconnect partner). To route traffic from the OCI VCN to the Azure VNet, you must add a route in the DRG route table that points the Azure VNet CIDR to the FastConnect virtual circuit attachment. This ensures that packets destined for Azure private IPs are forwarded over the private interconnect rather than to an internet or local peering path.

Answer

Configure a local peering route to the Azure ExpressRoute circuit.

Answer

Add a route pointing the Azure VNet CIDR to the Internet Gateway.

Answer

Attach an Azure VNet directly as a subnet inside the OCI VCN.

Question 11

When planning a migration of Oracle databases to Oracle Autonomous Database (Serverless), which THREE migration methods or tools are natively supported or recommended by Oracle?

Accepted Answer

Oracle SQL Developer migration workbench / Data Loading features.. Oracle SQL Developer's migration workbench and Data Loading features (A) are natively supported for migrating to Autonomous Database, providing wizards to convert schemas and load data via the Data Pump or SQL*Loader paths. Oracle Zero Downtime Migration (ZDM) (B) is Oracle's recommended service for moving on-premises or cloud databases to Autonomous Database with minimal downtime, using Data Guard or logical migration workflows. Oracle Data Pump (D) is the standard logical export/import utility supported for loading data into Autonomous Database, typically via Object Storage or a database link. Options C and E are not supported: Autonomous Database is a managed service that does not expose ASM disk groups or permit attaching on-premises storage via iSCSI, and physical RMAN restores to Autonomous storage are not possible because customers have no OS or storage-level access.

Answer

Directly attaching on-premises ASM disk groups via iSCSI to the Autonomous container.

Answer

Direct physical RMAN full database restore to Autonomous storage.

Question 12

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

Accepted Answer

OCI Cloud Guard.. OCI Cloud Guard is the native Cloud Security Posture Management (CSPM) service that continuously monitors tenancy resources against security misconfigurations and risky operational behaviors using detector recipes and responder recipes. It aggregates findings into a unified 'Security Score' visible in the Cloud Guard console, giving a single tenancy-wide posture metric. This matches the question's requirement of continuous monitoring plus a unified security score.

Answer

OCI Audit.

Answer

OCI Web Application Firewall.

Answer

OCI Vulnerability Scanning Service.

Question 13

An enterprise is migrating a legacy Java application that requires sticky sessions and complex path-based routing rules to OCI. The migration plan requires zero dropped connections during backend server updates. Which OCI Load Balancer configuration feature should you implement?

Accepted Answer

Configure backend server draining with a specified timeout period in the backend set.. Backend server draining (connection draining) in an OCI Load Balancer backend set lets in-flight requests complete before a backend is removed from rotation, which is exactly what prevents dropped connections during backend updates. You configure it per backend set with a drain timeout, and the load balancer stops sending new requests to the draining backend while allowing existing sessions to finish.

Answer

Enable IP Hash load balancing policy without health checks.

Answer

Use OCI Web Application Firewall (WAF) rate limiting rules to drop incoming traffic during maintenance.

Answer

Configure a Layer 4 TCP Network Load Balancer with TCP session persistence disabled.

Question 14

An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?

Accepted Answer

OCI Application Performance Monitoring (APM) Distributed Tracing. OCI APM Distributed Tracing is designed to trace requests end-to-end across microservices and regions. It captures spans from each service, correlates them into a single trace, and provides a visual service map, making it the right tool for troubleshooting intermittent latency spikes across service boundaries.

Answer

OCI Network Visualizer

Answer

OCI Logging Analytics with out-of-the-box system parsers

Answer

OCI Monitoring service anomaly detection

Question 15

You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?

Accepted Answer

Traffic cannot be routed between the on-premises network and OCI over FastConnect.. BGP is the routing protocol that exchanges prefixes between the on-premises customer edge router and the OCI Dynamic Routing Gateway over a FastConnect virtual circuit. If the BGP session goes down, no routes are learned or advertised, so the DRG has no path to the on-premises network and traffic cannot be routed over FastConnect. The physical circuit may remain up, but without BGP the Layer 3 reachability is gone.

Answer

Traffic automatically fails over to the Internet Gateway.

Answer

OCI automatically falls back to an unencrypted IPSec VPN tunnel.

Answer

The FastConnect port is administratively disabled by Oracle.