1Z0-997-26 Practice Test 4 — 25 Questions

Question 1

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Vault (Secrets management). OCI Vault's Secrets management feature is designed to store sensitive values like database connection strings and API keys, and OCI Functions can retrieve them securely at runtime via the OCI SDK or by referencing them as environment variables. This keeps secrets encrypted and access-controlled through IAM policies.

Answer

OCI Object Storage public bucket

Answer

OCI Audit log retention policy

Answer

OCI Resource Manager stack configuration output

Question 2

You are managing an enterprise OKE cluster that runs multi-tenant workloads. Certain sensitive pods must run on dedicated worker nodes to comply with strict isolation mandates. Which combination of Kubernetes scheduling features should you configure on OCI to enforce this requirement reliably?

Accepted Answer

Kubernetes Taints, Tolerations, and Node Affinity. Taints repel pods from nodes unless the pod has a matching toleration, and Node Affinity (specifically nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution) pins pods to nodes with specific labels. Combining taints on the dedicated nodes with tolerations on the sensitive pods, plus node affinity to select those labeled nodes, guarantees that only the intended sensitive workloads land on the dedicated worker nodes. This is the canonical Kubernetes pattern for hard multi-tenant isolation at the scheduling layer.

Answer

OCI Identity and Access Management (IAM) dynamic groups and compartment isolation

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) and OCI Cluster Autoscaler

Answer

OCI Load Balancer flexible shapes and backend set weights

Question 3

During a migration cutover weekend, your team encounters unexpected DNS resolution failures preventing users from reaching the newly migrated OCI application endpoints. Which TWO immediate troubleshooting steps should you perform? (Choose two.)

Accepted Answer

Check OCI VCN DNS resolver settings and custom resolver forwarders if integrating with on-premises DNS.. Option A is correct because during a migration cutover, DNS resolution failures often stem from the OCI VCN resolver configuration — specifically the Internet and VCN Resolver settings, custom resolver endpoints, and forwarding rules used when integrating with on-premises DNS (e.g., via IPSec VPN or FastConnect). Verifying these ensures the VCN's resolver is correctly forwarding queries and resolving OCI-internal names. Option B is correct because the most common cutover issue is stale or incorrect public DNS records; you must confirm the A records (and CNAMEs) point to the new OCI Load Balancer public IP addresses and check TTL values, since high TTLs can cause clients to cache old records long after the cutover. Option C is irrelevant — changing tenant subscription currency from USD to EUR has no effect on DNS resolution. Option D is unrelated — reformatting backend database tables with SQL*Plus addresses data storage, not name resolution. Option E is destructive and nonsensical — deleting all OCI compartments and recreating the tenancy root would break the environment rather than troubleshoot DNS.

Answer

Change the tenant subscription currency from USD to EUR.

Answer

Reformat all backend database tables using SQL*Plus.

Answer

Delete all OCI compartments and recreate the tenancy root structure.

Question 4

Your organization runs a multi-tenant Oracle Base Database Service and you need to monitor the storage utilization of individual Pluggable Databases (PDBs) within a Container Database (CDB). Which OCI native service and metric should you review?

Accepted Answer

OCI Database Management service PDB storage metrics.. The OCI Database Management service provides native monitoring for Oracle databases, including PDB-level storage metrics. It collects and displays metrics such as tablespace usage, datafile size, and storage utilization for each PDB within a CDB. This is the correct OCI-native service for monitoring individual PDB storage.

Answer

OCI Logging Analytics with custom log parsers for alert.log.

Answer

Compute Instance metrics via OCI Monitoring service agent.

Answer

Autonomous Health Framework (AHF) health check reports.

Question 5

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.

Question 6

Your finance department requires detailed cost visibility and granular chargeback reporting for multiple cloud environments spanning different business units, departments, and environments (Prod/Dev). Tagging is strictly enforced via OCI Tag Defaults. To analyze historical cost trends and forecast future cloud spend across these business dimensions, which OCI native feature should you use?

Accepted Answer

OCI Cost Analysis dashboards filtered by Cost-Tracking Tags.. OCI Cost Analysis is the native cost visibility and chargeback tool that supports filtering by Cost-Tracking Tags, which are the tags enforced by Tag Defaults. It provides historical trend analysis and forecasting across business dimensions like business unit, department, and environment. Unlike Budgets, which are for threshold alerts, Cost Analysis is designed for granular cost exploration and reporting.

Answer

OCI Logging Analytics custom dashboards querying the Usage Report log stream.

Answer

OCI Budgets with scheduled CSV report exports sent to an Object Storage bucket.

Answer

OCI Resource Manager stack drift reports mapped against IAM compartment hierarchies.

Question 7

Your organization has strict security policies requiring all log data in OCI Logging to be encrypted using a customer-managed encryption key (CMK) stored in OCI Vault. How should you implement this?

Accepted Answer

Assign a customer-managed master encryption key from OCI Vault to the Log Group in OCI Logging.. OCI Logging allows you to assign a customer-managed master encryption key from OCI Vault at the Log Group level. All logs stored in that log group are then encrypted with the specified CMK, satisfying the policy without per-object configuration. This is the native, supported mechanism for CMK encryption of log data in OCI Logging.

Answer

Configure the OCI Logging Agent on compute instances with local disk encryption enabled via IAM policies.

Answer

Attach the master encryption key directly to each individual log object stored in Object Storage.

Answer

Use OCI Streaming to intercept logs and apply customer-managed keys before writing to OCI Logging.

Question 8

An architect is designing a database migration from an on-premises Oracle Database (Non-CDB structure) to an OCI Autonomous Database (Serverless). Which migration method is mandatory because of the architectural constraints of Autonomous Database?

Accepted Answer

Logical migration using Oracle Data Pump or Oracle Zero Downtime Migration (logical workflow). Autonomous Database (Serverless) is a fully managed, sealed platform that does not expose the OS, filesystem, or SYSDBA-level access needed for physical migration techniques, so migration must be logical. Oracle Data Pump (expdp/impdp) or ZDM's logical workflow moves schemas and data over a database link or dump files, which is the only supported path into Autonomous Database.

Answer

Direct block-level storage snapshot replication using OCI Block Volume replication

Answer

RMAN transportable tablespaces with physical file conversion

Answer

Physical standby database via Oracle Data Guard broker

Question 9

You are architecting a multi-region cloud-native application where OCI API Gateway is deployed in Region A and Region B. You need to ensure that global users are automatically routed to the closest healthy API Gateway endpoint with automatic failover if an entire OCI region experiences an outage. Which OCI service should you use in front of the API Gateways?

Accepted Answer

OCI DNS Traffic Management Steering with Failover and Health Checks. OCI Traffic Management (or OCI DNS Traffic Management / Global Load Balancing) routes users across multiple regions based on latency, geo-location, or failover policies.

Answer

OCI File Storage cross-region replication

Answer

OCI Bastion Service in the primary region

Answer

OCI Local VCN Peering across regions

Question 10

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

Accepted Answer

You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.. In the FastConnect Provider model, you establish connectivity through an Oracle-approved partner (e.g., Equinix Fabric, Megaport, AT&T) that already has a presence in the Oracle Cloud region. You do not need to install or patch your own equipment in an Oracle Meet-Me-Room; the partner handles the Layer 2/3 handoff. This contrasts with the Colocation model, where you must physically deploy your router in a colocation facility connected to Oracle.

Answer

You must physically patch your fiber into Oracle's Meet-Me-Room.

Answer

Traffic is routed exclusively over the public internet with guaranteed SLA.

Answer

Oracle installs a dedicated router inside your on-premises datacenter.

Question 11

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

Accepted Answer

Configure a Federation in OCI IAM using SAML 2.0, establish the IdP trust, and then create IdP Group Mappings to OCI IAM groups.. OCI IAM federation with SAML 2.0 establishes trust with the external IdP, and IdP Group Mappings map the IdP's group claims to OCI IAM groups. When a user logs in, OCI reads the group attribute from the SAML assertion and grants the permissions associated with the mapped OCI groups. This provides automatic, centralized authorization based on corporate group membership.

Answer

Attach API signing keys to each federated user profile manually through the OCI Console.

Answer

Create dynamic groups in OCI with matching rules checking the user's corporate email domain string.

Answer

Write a custom Python script running on compute instances that synchronizes user passwords from the IdP to OCI local users every hour.

Question 12

An organization running an Oracle Exadata Database Service requires compliance auditing where all database administrative actions and sensitive data queries must be logged, tamper-proof, and retained in an isolated repository. Which combination of OCI and Oracle Database features provides this capability?

Accepted Answer

Oracle Data Safe combined with Database Unified Audit policies. Oracle Data Safe combined with Database Unified Audit policies provides centralized, tamper-proof auditing for administrative actions and sensitive data queries. Data Safe collects audit trails into a secure repository, applies masking and security assessments, and Unified Auditing captures the required events at the database level.

Answer

OCI Object Storage unversioned buckets with public read permissions

Answer

Oracle Data Pump export logs stored in local temporary directories

Answer

Standard Linux syslog daemon writing to local disk partitions

Question 13

An architect is configuring an OCI Full Stack Disaster Recovery plan. The plan includes a step to run a custom script on an application server during a failover drill. Which OCI service executes this custom script?

Accepted Answer

OCI Functions or OCI Compute instance run-command actions orchestrated by Full Stack DR.. OCI Full Stack Disaster Recovery orchestrates failover and drill plans that can include user-defined custom scripts. These scripts are executed either as OCI Functions invocations or as Compute instance run-command actions, which Full Stack DR calls as plan steps to run arbitrary logic on application servers during a drill or failover.

Answer

Oracle Autonomous Linux Auto-Update Daemon

Answer

OCI Resource Manager Terraform apply jobs exclusively

Answer

OCI Streaming Service consumer groups

Question 14

What is the primary benefit of using OCI Autonomous Database Serverless compared to Provisioned (Dedicated) infrastructure regarding database administration?

Accepted Answer

Oracle fully automates all patching, tuning, scaling, and provisioning with zero infrastructure management required. Autonomous Database Serverless is fully managed by Oracle: provisioning, patching, upgrades, tuning, scaling, and backups are automated with no customer access to the underlying Exadata infrastructure. This contrasts with Provisioned/Dedicated, where the customer still controls Exadata infrastructure lifecycle tasks even though the database itself is autonomous. The primary administrative benefit is therefore the elimination of infrastructure management overhead.

Answer

Customers must manually configure Exadata cell software versions

Answer

Serverless databases do not support automated backups

Answer

Customers are required to manually apply quarterly database security patches

Question 15

An application tier in a private VCN subnet needs to securely access an Oracle Autonomous Database without traversing the public internet. Which OCI networking feature provides the most secure and performant connection?

Accepted Answer

An OCI Service Gateway.. An OCI Service Gateway provides a private, secure path from a VCN to supported Oracle services like Autonomous Database without exposing traffic to the public internet. It is the most performant option because traffic stays on Oracle's private backbone, avoiding internet latency and inspection. The Service Gateway is attached to the VCN and referenced in route rules, so only resources in the VCN can use it, and access can be further restricted with IAM policies and security rules.

Answer

A NAT Gateway combined with a public IP address on the database.

Answer

A Site-to-Site VPN connection back to the corporate data center.

Answer

An Internet Gateway attached to the VCN route table.

Question 16

When configuring an OCI Application Load Balancer (Layer 7) for high availability, which THREE settings or components must be properly configured? (Choose three.)

Accepted Answer

SSL/TLS certificates attached to HTTPS listeners if terminating secure traffic. Option C is correct because an OCI Layer 7 load balancer that terminates HTTPS traffic requires an SSL/TLS certificate attached to the HTTPS listener, which enables the load balancer to decrypt incoming requests and re-encrypt or forward them to backends as configured. Option D is correct because backend sets must be defined and associated with health checks so the load balancer can monitor backend instance responsiveness and route traffic only to healthy instances, which is essential for high availability. Option E is correct because listeners must be configured with the appropriate port and protocol (for example, HTTP on port 80 or HTTPS on port 443) so the load balancer can accept and process client traffic correctly. Option A is not required because OCI load balancers operate within the OCI VCN and do not need a direct physical connection to on-premises switches for high availability. Option B is not required because backend compute nodes do not need manual IP routing table modifications; OCI handles load balancer-to-backend routing through the VCN and backend set configuration.

Answer

A direct physical connection between the load balancer and on-premises switches

Answer

Manual IP routing table hacks on every backend compute node

Question 17

Your security team wants to continuously monitor OCI resources for misconfigurations and automatically remediate security violations without manual intervention. Which OCI native service should you configure?

Accepted Answer

OCI Cloud Guard. OCI Cloud Guard is the native service designed to continuously monitor OCI resources for security misconfigurations and automatically remediate violations. It uses detectors to identify risky configurations, and responders to take corrective actions such as deleting public buckets or stopping instances. This aligns with the requirement for continuous monitoring and automatic remediation without manual intervention.

Answer

OCI Bastion Service

Answer

OCI Vault

Answer

OCI Vulnerability Scanning Service

Question 18

When configuring OCI Service Connector Hub to move logs from OCI Logging to OCI Object Storage, which THREE components must be defined?

Accepted Answer

Target (e.g., OCI Object Storage bucket). Option A (Target, e.g., OCI Object Storage bucket) is correct because Service Connector Hub requires a target resource to which the connector delivers the data, and for this scenario that target is an Object Storage bucket. Option D (Source, e.g., OCI Logging service) is correct because a service connector must specify the source service whose data it reads, here OCI Logging log groups. Option E (IAM policies granting the service connector permission to read from source and write to target) is correct because the Service Connector Hub service principal needs explicit IAM policy statements authorizing it to read from the Logging source and write to the Object Storage target. Option B is incorrect because Service Connector Hub is a fully managed OCI service that does not require any manual SSH tunnel between regions. Option C is incorrect because no OKE Kubernetes cluster or connector daemon is needed; the service runs as a managed OCI resource.

Answer

A manual SSH tunnel between the source and target regions

Answer

An active Kubernetes cluster in OKE to host the connector daemon

Question 19

Your organization has set strict budgets in OCI to monitor cloud expenditure. A finance team member needs to receive an alert when forecasted spending reaches 100% of the monthly budget. How should you configure this alert?

Accepted Answer

Configure an OCI Budget alert rule with threshold type set to 'FORECASTED' and threshold value set to 100.. OCI Budgets allow you to set alert rules based on actual or forecasted spend. Setting the threshold type to 'FORECASTED' and the threshold value to 100 triggers an alert when the forecasted spend for the budget period reaches 100% of the budget amount. This directly meets the finance team's requirement to be alerted when forecasted spending hits the monthly budget.

Answer

Create an OCI Monitoring alarm on the Billing namespace with a metric expression for forecasted cost.

Answer

Use OCI Cost Analysis scheduled reports with an integrated SMTP relay.

Answer

Set up an OCI Events rule listening for billing threshold exceedance events.

Question 20

Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?

Accepted Answer

Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.. Oracle Cloud VMware Solution (OCVS) provides a native VMware SDDC environment in OCI, including vSphere, vSAN, and NSX-T, so existing VMs can be migrated without modifying the guest OS, kernel modules, or security policies. VMware HCX enables live migration (vMotion, cold, and bulk) with network extension, preserving IP addresses and network consistency. This is the only option that maintains the exact OS configurations and hypervisor layer while automating the migration.

Answer

Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.

Answer

Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.

Answer

Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.