1Z0-997-26 Practice Test 5 — 25 Questions

Question 1

Which THREE operational tasks should be included in a comprehensive disaster recovery runbook when utilizing OCI Full Stack Disaster Recovery for an enterprise application? (Choose three.)

Accepted Answer

Executing pre-checks in the target DR region to validate resource readiness and configurations. Option A is correct because OCI Full Stack Disaster Recovery (FSDR) runbooks should begin with pre-checks in the target DR region to confirm that compute, networking, storage, and configuration prerequisites are met before any switchover or failover is attempted. Option D is correct because for database-inclusive DR plans, the runbook must verify that the standby database has transitioned to the primary role and that redo/apply lag is resolved so no committed transactions are lost. Option E is correct because a complete DR runbook includes the client-facing cutover step, rerouting traffic through DNS (e.g., OCI DNS steering policies) or Load Balancer changes so users reach the DR region after the backend is promoted. Option B is wrong because deleting IAM policies in the primary region during normal operations would break authentication and authorization and is not a DR task. Option C is wrong because formatting primary database storage volumes would destroy production data and is never part of a disaster recovery runbook.

Answer

Manually deleting all IAM policies in the primary region during normal operations

Answer

Format-all commands on primary database storage volumes prior to initiating DR

Question 2

Which OCI storage service provides massively scalable, highly durable regional object storage that is ideal for storing database backups and disaster recovery artifacts?

Accepted Answer

OCI Object Storage. OCI Object Storage is a regional, internet-scale service designed for massive scalability and eleven-nines durability, making it the standard target for database backups, disaster recovery artifacts, and long-term retention. Its regional nature means data is redundantly stored across availability domains within a region, which is exactly what DR artifacts need.

Answer

OCI Block Volume

Answer

Local NVMe Scratch Disks

Answer

OCI Boot Volumes

Question 3

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

Accepted Answer

Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.. The essential prerequisite is private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect, with non-overlapping subnets and open firewall ports for control plane communication. A service mesh control plane (e.g., Istio) requires direct network reachability between the control plane components and the sidecar proxies across both clouds. This is achieved through the private interconnect, ensuring secure, low-latency communication without public internet exposure.

Answer

Configure an OCI Service Gateway to route traffic to Azure public endpoints.

Answer

Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.

Answer

Enable Oracle Autonomous Database cross-region data guard.

Question 4

During a database migration project using Oracle Zero Downtime Migration (ZDM), the pre-migration validation phase fails with an error indicating that the source database's time zone file version does not match the target OCI Database service time zone file version. How should you resolve this issue?

Accepted Answer

Use the DBMS_DST package on the source database to update the time zone file version to match the target database before restarting the ZDM workflow.. The DBMS_DST package is Oracle's supported mechanism for updating a database's time zone file version. When ZDM pre-migration validation detects a mismatch between source and target time zone file versions, the correct remediation is to upgrade the source database's DST version to match or exceed the target using DBMS_DST (typically via DBMS_DST.BEGIN_PREPARE, BEGIN_UPGRADE, and related procedures). This ensures data consistency for TIMESTAMP WITH TIME ZONE columns and allows the physical migration to proceed without errors.

Answer

Manually downgrade the OCI Database service time zone binaries using root OS access.

Answer

Modify the ZDM response file parameter `SKIP_DST_CHECK=TRUE` to bypass the validation check.

Answer

Restart the ZDM migration job using the logical migration workflow instead of the physical workflow.

Question 5

When configuring OCI API Gateway, which THREE types of backends are natively supported for routing incoming API requests?

Accepted Answer

OCI Functions backend. OCI API Gateway natively supports three backend types for routing API requests: OCI Functions backend (A), which lets a route invoke a serverless function in OCI Functions as the API's origin; HTTP/HTTPS URL backend (B), which forwards requests to an external or internal web server via a standard URL; and Stock Response (Mock) backend (C), which returns a predefined static response without contacting any origin, useful for testing or stubbing. These are the documented backend options available when creating a route in an API Gateway deployment. Option D is incorrect because Identity Domain SAML federation metadata XML is an identity/authentication artifact, not a routable API backend. Option E is incorrect because raw magnetic tape drive backup is not a supported API Gateway backend type and is unrelated to API request routing.

Answer

OCI Identity Domain SAML federation metadata XML file store

Answer

Direct raw magnetic tape drive backup backend

Question 6

You are configuring an OCI API Gateway deployment to route requests to backend microservices running on OKE. You need to ensure that if a backend microservice takes longer than 3 seconds to respond, the API Gateway cancels the request and returns a 504 Gateway Timeout error to the client. Where should you configure this timeout?

Accepted Answer

In the API Gateway deployment specification under the route backend configuration timeout parameter.. The API Gateway deployment specification includes a route backend configuration where you can set a timeout parameter that controls how long the gateway waits for a backend response before returning a 504 Gateway Timeout. Configuring the timeout there ensures the gateway cancels the request after 3 seconds as required.

Answer

In the OCI WAF protection ruleset configuration.

Answer

In the OCI Load Balancer idle timeout setting associated with the subnet.

Answer

In the OKE Kubernetes Ingress resource annotations.

Question 7

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Accepted Answer

Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.. Option A is correct because cross-cloud DR commonly relies on database-level replication such as Oracle Data Guard, which can ship redo from an OCI Autonomous Database to a standby database running in AWS, giving a low-RPO failover target for the data tier. Option B is correct because OCI Traffic Management Steering policies (health-check-based failover, weighted, or geolocation steering) can direct DNS resolution to OCI or AWS endpoints and automatically shift traffic when health checks fail, which is a standard cross-cloud traffic-failover mechanism. Option E is correct because private cross-cloud connectivity for DR is typically built with redundant IPsec VPN tunnels between an OCI Dynamic Routing Gateway (DRG) and an AWS Virtual Private Gateway (VGW), providing encrypted, resilient transport that survives a single tunnel failure. Option C is not valid because AWS VPCs are logical software-defined networks; there are no physical VPC switches to place in OCI Meet-Me-Rooms, and Meet-Me-Rooms are for physical network/carrier interconnects, not VPC hardware. Option D is not valid because OCI IAM identity domains cannot be natively replicated into AWS IAM; cross-cloud identity is achieved through federation (SAML/OIDC) or identity brokering, not native replication between the two proprietary IAM systems.

Answer

Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.

Answer

Replicating OCI IAM identity domains natively inside AWS IAM without federation.

Question 8

You are designing a secure network architecture for migrating production workloads into an OCI Virtual Cloud Network (VCN). Compliance standards require strict traffic inspection, isolation, and secure administrative access. Which THREE OCI networking and security features should you incorporate into your design? (Choose three.)

Accepted Answer

Implement stateful Security Lists and Network Security Groups (NSGs) to enforce least-privilege traffic filtering at the subnet and VNIC levels.. Option A is correct because OCI Security Lists provide stateful, subnet-level filtering while Network Security Groups (NSGs) apply stateful rules at the VNIC level, together enabling least-privilege micro-segmentation required for strict isolation and compliance. Option C is correct because the OCI Bastion service creates ephemeral, time-limited SSH/RDP sessions to private instances that have no public IP, with all sessions audited, satisfying the secure administrative access requirement. Option E is correct because OCI Network Firewall is a managed next-generation firewall that inspects inter-subnet (east-west) traffic inside the VCN, providing the traffic inspection layer the compliance standards demand. Option B is wrong because removing route tables and allowing free public broadcast destroys network segmentation, routing control, and isolation. Option D is wrong because exposing database and backend servers with public IPs violates least privilege and isolation, and direct public administrative access is exactly what the Bastion service is meant to avoid.

Answer

Disable all VCN route tables and allow all subnets to broadcast traffic freely across the public internet.

Answer

Attach public IP addresses to all database and application backend servers to ensure direct administrator troubleshooting capability.

Question 9

An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?

Accepted Answer

An Autonomous Exadata Infrastructure resource. To deploy an Autonomous Database on Dedicated Infrastructure, the foundational resource is the Autonomous Exadata Infrastructure (AEI). This is a dedicated Exadata system in OCI that provides the hardware and infrastructure for hosting Autonomous Container Databases (ACDs). The AEI must be provisioned first because it supplies the compute, storage, and network resources that the ACDs and subsequent Autonomous Databases will use. Without an AEI, you cannot create an ACD or any dedicated autonomous databases.

Answer

An Autonomous Database on Shared Infrastructure instance

Answer

A standard Oracle Base Database system

Answer

A Virtual Cloud Network with a default database subnet only

Question 10

An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?

Accepted Answer

Deploy APM Dedicated Vantage Points (DVPs) on Compute instances inside the private OCI VCN.. Option B is correct because APM Dedicated Vantage Points (DVPs) are the mechanism for running synthetic monitoring scripts from inside a private OCI VCN, allowing tests against resources that are not reachable from the public internet. Option D is correct because DVPs must be able to reach the APM service endpoint to upload results and receive configuration, which requires appropriate egress connectivity such as a service gateway or NAT gateway in the VCN. Option E is correct because synthetic monitors must be explicitly configured to use the DVP as their execution location rather than the default public vantage points, otherwise the scripts would still run from the internet. Option A is incorrect because attaching a public load balancer to an internal database would expose the database and is not how synthetic monitoring reaches private targets. Option C is incorrect because disabling VCN security lists and allowing inbound SSH from public APM nodes is insecure and unnecessary; DVPs run locally inside the VCN and do not require inbound SSH from public APM infrastructure.

Answer

Attach a public load balancer directly to the internal database to route synthetic traffic.

Answer

Disable all VCN security lists to allow inbound SSH from public APM nodes.

Question 11

An architect is designing a lift-and-shift migration strategy for an enterprise running diverse workloads on-premises. Which TWO of the following factors should be evaluated when deciding whether to choose a lift-and-shift (rehost) approach versus a re-architect approach? (Choose two.)

Accepted Answer

Migration timeline urgency and available project budget. Option A is correct because rehost (lift-and-shift) migrations are typically chosen when time-to-migration is short and budget is limited, since they avoid the cost and duration of rewriting code; re-architecting demands significantly more time, skilled staff, and investment. Option E is correct because re-architecting requires access to the application's source code and sufficient developer resources to refactor it into a cloud-native design (e.g., microservices, managed services); if source code is unavailable or developers are scarce, rehosting becomes the practical choice. The remaining options (B, C, and D) are irrelevant to migration strategy decisions, as carpeted floors, server bezel colors, and coffee machine brands have no bearing on whether to rehost or re-architect a workload.

Answer

Whether the on-premises facility uses carpeted floors

Answer

The physical color of the server bezels in the on-premises rack

Answer

The brand of office coffee machine currently installed in the data center

Question 12

An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?

Accepted Answer

Associate the newly created custom parser with a custom Log Source in Logging Analytics.. Option A is correct because a custom parser in OCI Logging Analytics must be attached to a custom Log Source so that the service knows which parser to apply when ingesting that log type. Option B is correct because the parser creation workflow requires supplying sample log messages to test and validate that the pattern matching and field extraction work against real data. Option C is correct because the core of a custom parser is defining extraction rules, typically via regular expressions or the parser builder, to map fields such as timestamp, severity, and message. Option D is incorrect because hypervisor kernel parameters are unrelated to Logging Analytics parsing and cannot influence log field extraction. Option E is incorrect because Logging Analytics parsers are configured declaratively in the service, not by compiling and deploying C++ binaries to OCI Functions.

Answer

Modify the hypervisor kernel parameters on all compute instances.

Answer

Compile a C++ binary package and upload it to an OCI Function.

Question 13

An OCI architect is setting up a disaster recovery environment where compute instances in the DR region need identical network configurations (private IPs, VNICs, security lists) to the primary region. Which OCI capability assists in deploying reproducible network topologies across regions?

Accepted Answer

OCI Resource Manager with Terraform configurations. OCI Resource Manager is a managed Terraform service that lets architects define network topologies (VCNs, subnets, security lists, VNICs, private IP assignments) as code and deploy them repeatedly across regions. Because the same Terraform configuration can be applied to a DR region, it guarantees identical, reproducible network configurations without manual drift. This is the canonical OCI answer for infrastructure-as-code and cross-region DR topology replication.

Answer

OCI File Storage Network File System (NFS) exports

Answer

OCI IAM Domain Federation wizard

Answer

OCI Streaming service partition replication

Question 14

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Accepted Answer

OCI DevOps Service. OCI DevOps Service is Oracle Cloud Infrastructure's native CI/CD platform, providing build pipelines, deployment pipelines, and artifact repositories that integrate directly with Git repositories. It automates the build, test, and deployment phases triggered by code pushes, making it the correct choice for native CI/CD on OCI. The other services serve different purposes such as event handling, data replication, or infrastructure-as-code.

Answer

OCI Events Service

Answer

OCI GoldenGate

Answer

OCI Resource Manager

Question 15

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

Accepted Answer

Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.. OCI Vault is a regional service, and customer-managed keys are stored in the region where the vault is created. To ensure encryption keys never leave their home regions, you must provision separate OCI Vaults and keys in each region where workloads reside. This design keeps keys within their respective regions and complies with data residency requirements.

Answer

Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

Answer

Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

Answer

Store all keys in the home region and use the OCI Service Gateway for remote decryption.

Question 16

You are tasked with migrating a mission-critical three-tier enterprise application from an on-premises environment to OCI. The database tier uses Oracle RAC, and the application tier consists of stateless Java applications running on JBoss. Which TWO strategies or tools should be incorporated into the migration plan to ensure high availability and minimal downtime during cutover? (Choose two.)

Accepted Answer

Utilize Oracle Zero Downtime Migration (ZDM) to automate the database migration from on-premises RAC to OCI Exadata Database Service.. Option A is correct because Oracle Zero Downtime Migration (ZDM) is purpose-built to automate and orchestrate migrations of Oracle databases—including RAC sources—to OCI Database services such as Exadata Database Service, using techniques like Data Guard and GoldenGate to minimize downtime during cutover. Option C is correct because placing an OCI Load Balancer in front of stateless JBoss application instances spread across multiple fault domains enables seamless traffic redirection and rolling cutover, so users experience minimal disruption while instances are switched over. Options B, D, and E are not appropriate: manual SQL*Plus cold backup/restore across all tiers would cause significant downtime and lacks automation; physical block-level cloning of running JBoss memory states is not a supported or reliable migration method for stateless Java applications; and converting to MySQL HeatWave during cutover without schema validation is risky, unsupported for an Oracle RAC-based mission-critical system, and would introduce unacceptable downtime and data integrity issues.

Answer

Rely exclusively on manual Oracle SQL*Plus scripts to perform a cold backup and restore across all tiers simultaneously.

Answer

Migrate the application tier using physical block-level cloning of the running JBoss server memory states.

Answer

Convert the database architecture immediately to MySQL HeatWave during the cutover window without schema validation.

Question 17

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

Accepted Answer

OCI Container Instances. OCI Container Instances is a serverless compute service that runs containers directly without requiring you to manage the underlying host OS, kernel patching, or VM scaling. It is purpose-built for running single containers or small groups of tightly coupled containers, making it the ideal fit for migrating a standard Docker container with minimal operational overhead. Unlike OKE, it abstracts away the Kubernetes control plane and worker nodes, so you don't manage any cluster infrastructure. This directly satisfies the requirement to avoid OS management and VM scaling.

Answer

OCI Functions

Answer

Oracle Container Engine for Kubernetes (OKE)

Answer

OCI Compute Standard virtual machine instances

Question 18

You are tasked with migrating a large enterprise database to OCI Exadata Database Service. To ensure minimal downtime and high reliability during cutover, which TWO Oracle migration tools or features are specifically designed for this purpose? (Choose two.)

Accepted Answer

Oracle Zero Downtime Migration (ZDM). Oracle Zero Downtime Migration (ZDM) (C) is purpose-built for migrating Oracle databases to OCI with near-zero downtime, using Oracle Data Guard or logical/physical methods and automated orchestration to keep the source online until cutover. Oracle Data Guard (E) is the core Oracle high-availability and disaster-recovery feature that maintains a synchronized standby database, enabling a fast switchover with minimal downtime during the cutover to Exadata Database Service. The other options do not fit: Robocopy (A) is a Windows file-copy utility with no database awareness, the OCI File Storage CLI (B) only uploads files to a file system, and OCI Streaming Kafka APIs (D) are for event-streaming ingestion, none of which provide Oracle database migration or cutover reliability.

Answer

Windows Robocopy utility

Answer

OCI File Storage CLI upload utility

Answer

OCI Streaming Service Kafka producer APIs

Question 19

Your organization is implementing strict compliance requirements for log retention and auditing in OCI. Which THREE architectural implementations ensure secure, long-term log governance?

Accepted Answer

Encrypt log groups in OCI Logging using Customer-Managed Keys (CMK) from OCI Vault.. Option B is correct because encrypting OCI Logging log groups with Customer-Managed Keys (CMK) from OCI Vault gives the organization control over the encryption lifecycle, satisfies compliance mandates for data-at-rest protection, and allows key rotation and revocation independent of Oracle-managed keys. Option C is correct because IAM least-privilege policies ensure that only authorized principals can read, modify, or delete log groups and archival buckets, which is essential for tamper-resistant audit trails and separation of duties under compliance frameworks. Option D is correct because Service Connector Hub reliably moves logs from OCI Logging to Object Storage, and configuring the bucket with Object Lock (WORM) enforces immutability for the retention period, preventing deletion or alteration and meeting long-term log governance requirements. Option A is not appropriate because storing unencrypted log backups in public Object Storage buckets exposes sensitive audit data and violates encryption, access-control, and confidentiality requirements. Option E is not appropriate because disabling OCI Audit service logging destroys the API activity history needed for auditing and incident investigation, directly undermining compliance rather than improving security.

Answer

Store unencrypted log backups on public Object Storage buckets for easy developer access.

Answer

Disable OCI Audit service logging to prevent unauthorized users from viewing API history.

Question 20

Which TWO mechanisms are used to secure data in transit across OCI networking components? (Choose two.)

Accepted Answer

Configure IPsec VPN tunnels with strong encryption algorithms (e.g., AES-256) for on-premises connectivity.. Option A is correct because IPsec VPN tunnels using strong encryption such as AES-256 protect data in transit between on-premises networks and OCI over untrusted paths like the internet. Option E is correct because TLS/HTTPS encrypts application-layer traffic between services and endpoints, preventing eavesdropping or tampering across OCI networking components. Option B is incorrect because sending database traffic unencrypted over the public internet exposes sensitive data to interception. Option C is incorrect because plain-text HTTP provides no confidentiality or integrity for inter-microservice communication within a VCN. Option D is incorrect because disabling security lists and enabling packet sniffing removes access controls and exposes traffic rather than securing it.

Answer

Transmit all database traffic over unencrypted public internet connections.

Answer

Rely on plain-text HTTP for all inter-microservice communication within a VCN.

Answer

Disable VCN security lists to allow unhindered packet sniffing.