1Z0-997-26 Practice Test 3 — 25 Questions

Question 1

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication policies that can validate JSON Web Tokens (JWT) issued by an identity provider before forwarding requests to backend services. Configuring a JWT validation authentication policy ensures only requests with a valid, unexpired token from the trusted issuer reach the microservices. This is the native, purpose-built feature for token-based API authentication.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 2

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Accepted Answer

Using route distributions to control which routes are imported into or exported from a DRG route table.. Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering. Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Answer

Automatically peering AWS VPC route tables directly from the DRG console.

Answer

Enabling Ophaned route garbage collection on Internet Gateways.

Answer

Converting OCI VCN subnets into Azure Subnets via DRG translation rules.

Question 3

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

Accepted Answer

IKEv2 with AES-256 encryption and SHA-2 hashing. OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, which meets robust compliance requirements for encrypted tunnel traffic. IKEv2 is the recommended key exchange protocol, and AES-256 with SHA-2 provides strong confidentiality and integrity for IPsec tunnels. This combination is the standard supported configuration for OCI VPN.

Answer

SSL/TLS v1.3 with RSA key exchange

Answer

SSH tunneling with Blowfish cipher

Answer

PPTP with MPPE 128-bit encryption

Question 4

Which TWO tools or interfaces can administrators use to manage Oracle Autonomous Database instances in OCI? (Choose two.)

Accepted Answer

OCI Command Line Interface (CLI) and REST APIs. Option D is correct because Oracle Autonomous Database is a fully managed OCI service whose lifecycle and management operations (such as scaling, starting/stopping, cloning, and viewing details) are exposed through the OCI Command Line Interface and the OCI REST APIs, which administrators can script and automate. Option E is correct because the OCI Console provides the web-based graphical interface where administrators can create, monitor, and manage Autonomous Database instances without writing code. The other options do not belong: A (floppy disk image uploads) is an obsolete local media method with no role in OCI cloud management, B (RDP to the Autonomous database hypervisor) is impossible because Oracle manages the infrastructure and customers have no hypervisor access, and C (physical serial console cable to Exadata rack blades) is not a customer-accessible management path in a managed cloud service.

Answer

Local floppy disk drive image uploads

Answer

Windows Remote Desktop Connection (RDP) to the Autonomous database hypervisor

Answer

Direct physical serial console cable attached to Exadata rack blades

Question 5

Which Autonomous Database workload type is specifically optimized for running complex analytical queries, machine learning, and data warehousing workloads?

Accepted Answer

Autonomous Data Warehouse (ADW). Autonomous Data Warehouse (ADW) is the Autonomous Database workload type specifically tuned for analytical workloads: it uses columnar compression, automatic indexing for analytics, materialized view refresh, and parallel execution optimized for complex queries, machine learning, and data warehousing. ATP is tuned for high-concurrency transactional workloads, and AJD is optimized for JSON document workloads.

Answer

Autonomous JSON Database (AJD)

Answer

Autonomous Transaction Processing (ATP)

Answer

Autonomous Apex Application Development (APEX)

Question 6

You are designing a hybrid cloud architecture during a phased workload migration to OCI. On-premises applications must securely communicate with migrated OCI workloads over a private, dedicated connection with high throughput and encryption. Which OCI networking service combination provides this capability?

Accepted Answer

OCI FastConnect with MACsec encryption or an IPsec VPN tunnel over FastConnect. OCI FastConnect provides a dedicated private connection from on-premises to OCI, and pairing it with MACsec (Layer 2 encryption) or running an IPsec VPN over the FastConnect virtual circuit delivers the required encryption and high throughput. This is the standard hybrid pattern for private, dedicated, encrypted connectivity.

Answer

OCI Local Peering Gateway with public IP addressing

Answer

OCI NAT Gateway combined with Service Gateway

Answer

OCI Internet Gateway with SSL/TLS certificates

Question 7

You are designing an automated backup strategy for an Exadata Database Service on Dedicated Infrastructure. You want to ensure that incremental backups are taken daily and full backups weekly, with long-term retention stored in OCI Object Storage. Where are these backup schedules configured?

Accepted Answer

In the OCI Console under the database system backup configuration settings or via API/CLI. Backup schedules for Exadata Database Service on Dedicated Infrastructure are configured through the OCI Console under the database system's backup configuration, or via the OCI API/CLI. These settings define the retention period, backup window, and whether backups are stored in OCI Object Storage, and they control the automated incremental and full backup cadence.

Answer

By modifying the crontab configuration file as root on the dom0 hypervisor node

Answer

By editing the initialization parameter file (spfile) using SQL*Plus

Answer

Via Oracle Enterprise Manager Cloud Control deployed exclusively on-premises

Question 8

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions allow you to configure the function timeout up to the service limit (default 30 seconds, maximum 300 seconds) via the Fn Project CLI or OCI Console. Increasing the timeout directly addresses the failure when calling a slow third-party REST API, and is the recommended best practice for long-running calls.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 9

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

Accepted Answer

Dynamic Routing Gateway (DRG) with Remote VCN Peering. Remote VCN Peering in OCI uses a Dynamic Routing Gateway (DRG) attached to each VCN, with the two DRGs connected over OCI's private backbone to link VCNs in different regions. This provides private, encrypted-in-transit connectivity suitable for cross-region Data Guard redo transport without traversing the public internet. The DRG is the required routing anchor for any inter-VCN or on-premises connectivity in OCI.

Answer

Internet Gateway (IGW)

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Question 10

You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?

Accepted Answer

Cross-Region Autonomous Data Guard. Cross-Region Autonomous Data Guard is the native OCI feature that creates a standby Autonomous Database in a remote region and provides automatic or manual failover with low RPO (typically seconds) and low RTO. It is purpose-built for ADB Serverless disaster recovery and requires no manual backup shipping.

Answer

OCI Block Volume cross-region replication

Answer

Manual RMAN incremental backups copied to Object Storage in the remote region

Answer

Database Express Export/Import scheduled via cron

Question 11

Your company is planning to migrate 50 TB of unstructured file data from an on-premises Network Attached Storage (NAS) appliance to OCI File Storage Service (FSS). The target RTO/RPO allows for a phased baseline copy followed by incremental syncs. Which tool should you use to transfer the data efficiently over your dedicated OCI FastConnect link?

Accepted Answer

Parallelized rsync or custom multithreaded copy scripts via an OCI Compute instance acting as a migration gateway mounted to the FSS target. For migrating large unstructured file data to OCI File Storage Service (FSS) over a dedicated FastConnect link, the recommended approach is to mount the FSS target on an OCI Compute instance acting as a migration gateway and use parallelized rsync or multithreaded copy scripts. This leverages the high bandwidth of FastConnect and the parallelism needed for 50 TB, while supporting incremental syncs for phased cutover.

Answer

OCI Streaming Service

Answer

OCI Data Transfer Appliance

Answer

Oracle Data Pump

Question 12

You are planning the final cutover for a critical production database migrating from an on-premises Oracle Real Application Clusters (RAC) database to OCI Base Database Service using Oracle Data Guard for replication. To minimize application downtime during the cutover window, which sequence of steps must be executed?

Accepted Answer

Ensure zero data lag on the Data Guard standby, perform a switchover/failover to promote the OCI standby database to primary, and update application connection strings to point to the new OCI primary listener.. The correct cutover sequence for a Data Guard-based migration is to first confirm the standby has zero (or near-zero) data lag, then promote the OCI standby to primary via switchover (preferred) or failover, and finally repoint the application connection strings to the new OCI primary listener. This minimizes downtime because the standby is already synchronized and only the connection endpoint needs to change.

Answer

Stop source application, shut down source database immediately, open standby database in read-write mode, and update DNS.

Answer

Delete the source database home, re-run ZDM pre-migration checks, and deploy a fresh Autonomous Database instance.

Answer

Take an offline Data Pump export on premises, ship the dump via FastConnect, import it into OCI, and keep the source running indefinitely.

Question 13

Your organization has a strict Recovery Point Objective (RPO) of 5 minutes and Recovery Time Objective (RTO) of 15 minutes for a multi-tier application. The database tier uses Oracle Data Guard. During a test drill, you notice that redo transport lag spikes to 8 minutes. What is the most likely architectural bottleneck causing this issue?

Accepted Answer

Inadequate cross-region network bandwidth or high latency causing redo transport congestion.. A redo transport lag spike to 8 minutes most likely indicates a network bottleneck between the primary and standby regions. Data Guard redo transport depends on sufficient cross-region bandwidth and low latency; if bandwidth is constrained or latency is high, the standby cannot receive and apply redo fast enough, causing the lag to exceed the 5-minute RPO. This is an architectural issue, not a database or application configuration issue.

Answer

Exceeded OCI Block Volume IOPS limits on the standby database's local NVMe scratchpad.

Answer

Misconfigured OCI IAM policy allowing read-only access to database backups.

Answer

Incorrect OCI Load Balancer SSL certificate configuration on the web tier.

Question 14

An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?

Accepted Answer

OCI Stack Monitoring. OCI Stack Monitoring is purpose-built to monitor enterprise application stacks such as WebLogic Server and Oracle Database, providing deep internal health metrics, resource utilization, and dependency topology discovery. It is the only OCI service specifically designed for full-stack enterprise application monitoring.

Answer

OCI Application Performance Monitoring (APM)

Answer

OCI Logging Analytics

Answer

OCI Monitoring Service

Question 15

You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?

Accepted Answer

OCI API Gateway route pointing to the OCI Function. OCI API Gateway can be configured with a route that points to an OCI Function as its backend, exposing the function via a public HTTP URL. This lets you invoke the function directly with a browser or curl without writing custom client code or dealing with OCI's native signed-request authentication.

Answer

OCI Object Storage pre-authenticated request (PAR)

Answer

OCI Cloud Guard trigger policy

Answer

OCI Streaming cursor initialization

Question 16

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Accepted Answer

OCI Audit service to capture all control plane API activities and resource modifications.. Option B is correct because the OCI Audit service automatically records all control plane API calls and resource modifications across the tenancy, providing an immutable, tamper-evident audit trail that is essential for security investigations and compliance. Option E is correct because the OCI Logging service ingests, stores, and analyzes log data from sources such as VCN flow logs and compute instances, enabling centralized visibility and threat detection across the environment. Option A is wrong because routing log data to unencrypted public FTP servers exposes sensitive audit information to interception and tampering, violating security best practices. Option C is wrong because disabling logging eliminates the audit trail entirely, making threat detection and compliance impossible. Option D is wrong because relying on user memory dumps is not a reliable or comprehensive audit mechanism and does not provide the continuous, structured logging required for security monitoring.

Answer

Routing all log data to unencrypted public FTP servers.

Answer

Disabling all logging services to save storage costs.

Answer

Relying solely on user memory dumps for audit compliance.

Question 17

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

Accepted Answer

Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.. To achieve high availability across availability domains, the SD-WAN instances in OCI should be deployed in different Availability Domains (or Fault Domains) within the region and configured with BGP or clustering for failover. This ensures that a single AD or fault domain failure does not take down the SD-WAN overlay connecting OCI to AWS. BGP provides dynamic route failover between the instances.

Answer

In the same subnet, pinned to a single physical host.

Answer

Inside the OCI Control Plane root compartment.

Answer

On bare metal instances without any virtual cloud networks.

Question 18

An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?

Accepted Answer

APM Synthetic Monitoring Browser Monitors using Dedicated Vantage Points. OCI APM Synthetic Monitoring Browser Monitors execute scripted browser workflows (e.g., login flows) from multiple geographic locations using Dedicated Vantage Points, which are managed vantage points that run the scripts. This directly matches the requirement to periodically run browser-based synthetic scripts from multiple locations to validate user-facing login workflows.

Answer

OCI Health Checks Ping Monitors

Answer

Logging Analytics synthetic agent extensions

Answer

OCI Monitoring service Synthetic Probes

Question 19

An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?

Accepted Answer

OCI Logging Analytics. OCI Logging Analytics is a machine-learning-driven log analysis service that ingests logs from many sources and lets users run SQL-like queries (Log Explorer query language), build dashboards, and detect anomalies. It is purpose-built for deep log analytics and visualization, unlike basic Logging which focuses on collection and search.

Answer

OCI Audit Service

Answer

OCI Health Checks

Answer

OCI Object Storage

Question 20

An architect is designing an Oracle Exadata Database Service on Dedicated Infrastructure deployment with multiple VM clusters on a single Exadata rack. Which architectural feature allows secure isolation of CPU, memory, and database workloads between these distinct VM clusters?

Accepted Answer

Hard partitioning using Oracle VM (dom0/domU) hypervisor virtualization on the database servers. Exadata Database Service on Dedicated Infrastructure uses Oracle VM (OVM) with dom0/domU architecture to provide hard partitioning between VM clusters. Each VM cluster runs in its own set of domU guests on the database servers, with CPU, memory, and I/O isolated by the hypervisor. This hard partitioning is what allows multiple VM clusters to coexist securely on a single Exadata rack.

Answer

OCI Block Volume volume group replicas synchronized via block replication

Answer

Software-defined VLAN tagging enforced by the OCI Virtual Cloud Network (VCN) hypervisor only

Answer

Autonomous Database container database resource pools sharing a single OS kernel