1Z0-997-26 Practice Test 23 — 15 Questions

Question 1

Your organization is performing a zero-downtime database migration from an Oracle Database on-premises to OCI Exadata Database Service using Oracle Zero Downtime Migration (ZDM). During the migration job execution, the workflow pauses during the dataguard broker configuration step. Reviewing the ZDM logs, you find a network timeout error communicating between the ZDM service host and the OCI database listener. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI VCN Security Lists or Network Security Groups block incoming TCP port 1521 or SSH port 22 from the ZDM client subnet.. ZDM orchestrates migrations by communicating over SSH and Oracle SQL*Net (port 1521) between the ZDM service host, the on-premises database, and the OCI database. Security lists, network security groups, or firewalls blocking port 1521 or SSH will cause communication timeouts.

Answer

OCI Object Storage bucket policies prevent ZDM from reading temporary backup files.

Answer

The Exadata database service requires Autonomous Database credentials to establish connection.

Answer

OCI IAM quotas restrict the creation of more than 10 Data Guard associations per tenancy.

Question 2

You want to monitor the health and performance of your Oracle Autonomous Database in OCI. Which built-in metric namespace in OCI Monitoring should you query?

Accepted Answer

oci_database. Oracle Database services in OCI publish their metrics to the oci_database namespace in the OCI Monitoring service.

Answer

oci_autonomous_metrics

Answer

oci_apm_metrics

Answer

oci_compute_infra

Question 3

Which TWO protocols or formats are natively supported for publishing custom metrics to the OCI Monitoring service?

Accepted Answer

OCI Monitoring REST API. OCI Monitoring service supports publishing custom metrics via the OCI Monitoring API and the StatsD protocol.

Answer

SQL*Net protocol

Answer

Syslog RFC 5424

Answer

IMAP email protocol

Question 4

You want to track API calls made by a specific user who deleted a critical production database in OCI. Which OCI service log should you examine?

Accepted Answer

OCI Audit Log. OCI Audit service logs all API calls, recording who did what, when, and from which IP address.

Answer

OCI VCN Flow Log

Answer

OCI APM Transaction Log

Answer

OCI Database Alert Log

Question 5

Your organization is implementing strict compliance requirements for log retention and auditing in OCI. Which THREE architectural implementations ensure secure, long-term log governance?

Accepted Answer

Encrypt log groups in OCI Logging using Customer-Managed Keys (CMK) from OCI Vault.. Log governance involves using Service Connector Hub to archive logs to Object Storage, leveraging Object Storage bucket immutability (Object Lock) for compliance, and encrypting log groups with customer-managed keys in OCI Vault.

Answer

Store unencrypted log backups on public Object Storage buckets for easy developer access.

Answer

Disable OCI Audit service logging to prevent unauthorized users from viewing API history.

Question 6

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

Accepted Answer

Configure OCI IAM identity federation with your enterprise IdP for developers, and apply an IAM authentication policy enforcing MFA for native console administrators.. OCI IAM supports identity federation with SAML 2.0-compliant IdPs for enterprise users while enforcing local or native MFA policies for native console accounts, configured via IAM authentication policies and IdP federation.

Answer

Create separate tenancies for administrators and developers.

Answer

Write IAM policies with conditional statements checking the user's IP address.

Answer

Disable native IAM users entirely and force all users to share a single administrator account with MFA.

Question 7

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

Accepted Answer

OCI VCN Flow Logs. OCI VCN Flow Logs record accepted and rejected traffic flowing through VNICs, helping troubleshoot security list and NSG rules.

Answer

OCI Health Checks ping monitors

Answer

OCI Monitoring service VNIC packet counters

Answer

OCI Network Firewall system logs

Question 8

When designing an advanced alerting and monitoring strategy using OCI Monitoring Metric Query Language (MQL), which THREE practices or syntax rules should an architect follow?

Accepted Answer

Alarms can be configured to evaluate multiple metric streams using compound expressions or grouped dimensions.. MQL queries specify a metric namespace, metric name, optional interval, and functions (e.g., .mean()). Alarms can evaluate multiple metric streams or aggregate across dimensions, and alarms support transitioning states between OK, FIRING, and SUSPENDED.

Answer

An alarm in OCI Monitoring can only be in one of two states: Active or Inactive.

Answer

MQL does not support mathematical functions or aggregations; all calculations must be performed prior to ingestion.

Question 9

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

Accepted Answer

Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.. Remote VCN peering across regions requires a DRG attachment for each VCN, an RPC configured on both DRGs, and a peering connection request accepted by the target region's DRG, with appropriate security lists and routing tables.

Answer

Configure public IP addresses on all participating compute instances.

Answer

Route all inter-region traffic through public Internet Gateways with IPsec tunneling.

Answer

Deploy an OCI NAT Gateway in each region.

Question 10

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Accepted Answer

Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.. Effective IAM design at scale relies on groups, least-privilege verbs, and compartment hierarchy inheritance.

Answer

Hardcode IAM user passwords directly in instance metadata.

Answer

Assign all human users directly to the Administrators group for operational simplicity.

Question 11

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard provides threat detection and automated remediation (via responder recipes) to continuously monitor the security posture of OCI resources.

Answer

OCI Bastion Service

Answer

OCI Vault

Answer

OCI Vulnerability Scanning Service

Question 12

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

Accepted Answer

Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.. OCI Logging Analytics provides native Object Storage log ingestion capabilities where you can configure ingestion rules to pull and parse logs from designated Object Storage buckets.

Answer

Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

Answer

Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

Answer

Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

Question 13

An enterprise is designing a comprehensive cost observability and governance strategy in OCI. Which THREE practices or features should be implemented?

Accepted Answer

Enforce defined tags for resource creation using IAM policy conditions or tag defaults.. Effective OCI cost governance involves enforcing defined tags for attribution, using Budgets with forecast alerts, and leveraging Cost Analysis for trend monitoring.

Answer

Route all VCN flow logs through OCI Logging Analytics to calculate cloud infrastructure billing.

Answer

Install APM Java agents on all block storage volumes to track storage encryption costs.

Question 14

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that enables users to run containers directly on OCI without managing underlying virtual machines or servers, perfect for simple containerized deployments without Kubernetes overhead.

Answer

OCI Functions

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

OCI Compute Standard virtual machine instances

Question 15

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

Accepted Answer

Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.. Network Security Groups (NSGs) or Security Lists control packet-level traffic. NSGs are applied directly to specific VNICs, providing granular control over instance-level traffic isolation.

Answer

Disable the OCI Internet Gateway on the VCN route table.

Answer

Enable OCI Bastion service on the database subnet.

Answer

Configure OCI IAM policies to block network ingress at the user level.