1Z0-997-26 Practice Test 2 — 30 Questions

Question 1

Which THREE features are provided by OCI Application Performance Monitoring (APM)?

Accepted Answer

Distributed Tracing across microservices. OCI Application Performance Monitoring (APM) provides Distributed Tracing across microservices (A), which lets you follow a single request through multiple services and identify latency or errors in the call chain. It also provides Real User Monitoring (RUM) (C), which captures browser-side performance data from actual end users via a JavaScript agent. Additionally, APM offers Synthetic Monitoring (E) using browser and script-based tests to proactively simulate user interactions and measure availability and performance. Options B and D are incorrect because automatic bare metal database backups are a database service capability, and BGP routing table management for FastConnect belongs to OCI networking, not APM.

Answer

Automatic provisioning of bare metal database backups

Answer

Management of BGP routing tables for FastConnect

Question 2

You are provisioning an Autonomous Data Warehouse (ADW) instance and want to configure network access so that only specific corporate IP addresses can connect to the database. Which feature should you enable?

Accepted Answer

Autonomous Database Access Control Lists (ACLs).. Autonomous Database Access Control Lists (ACLs) are the native ADB feature that restricts connections to a defined set of public IP addresses or CIDR blocks, or to a private endpoint. Enabling an ACL on the ADW instance ensures only the specified corporate IP ranges can reach the database listener, satisfying the requirement directly.

Answer

Virtual Cloud Network (VCN) Security Lists only.

Answer

OCI Web Application Firewall (WAF) rule sets.

Answer

OCI Identity and Access Management (IAM) dynamic groups.

Question 3

You are configuring transparent data encryption (TDE) for an Oracle Database on Exadata Database Service using OCI Vault for master encryption key management. What happens if the database loses connectivity to the OCI Vault key management service?

Accepted Answer

The database continues to run using keys cached in memory for a period, but cannot be restarted until connectivity to OCI Vault is restored. When TDE uses OCI Vault as the external key management service, the database caches the master encryption key in memory after first retrieval. If connectivity to OCI Vault is lost, running instances continue to operate using the cached key, but any restart or new instance mount fails because the key cannot be fetched to open the TDE wallet. This is the documented behavior for external key management with TDE.

Answer

The database instantly crashes and forces an immediate failover to the standby database

Answer

The database automatically falls back to self-managed wallet storage without alerting administrators

Answer

All encrypted data files are automatically wiped to prevent security breaches

Question 4

Which TWO architectural best practices should you follow when designing cloud-native microservices on Oracle Container Engine for Kubernetes (OKE) to ensure high availability and resilience? (Choose two.)

Accepted Answer

Distribute OKE worker node pools across multiple Fault Domains or Availability Domains.. Option C is correct because spreading OKE worker node pools across multiple Fault Domains or Availability Domains ensures that a failure in one physical domain does not take down the entire cluster, which is a fundamental high-availability practice for cloud-native microservices. Option E is correct because Kubernetes Pod Disruption Budgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions such as node maintenance, upgrades, or scaling, directly supporting resilience and availability guarantees. Option A is not recommended because a single flat namespace does not improve communication speed and reduces isolation, making it harder to apply network policies, resource quotas, and RBAC for microservices. Option B is incorrect because storing state or sessions on the ephemeral container root filesystem means data is lost when the pod restarts or is rescheduled, breaking resilience; state should be externalized to a database or persistent volume. Option D is incorrect because exposing all microservices via NodePorts bypasses the OCI Load Balancer, lacks advanced traffic management, TLS termination, and health checks, and is not a best practice for production high availability.

Answer

Deploy all microservices into a single flat Kubernetes namespace to maximize intra-cluster communication speed.

Answer

Store all application state and user sessions locally on the ephemeral container root filesystem.

Answer

Use NodePorts for all external microservice access directly bypassing the OCI Load Balancer.

Question 5

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

Accepted Answer

OCI IAM token-based database authentication combined with Oracle Autonomous Database.. OCI IAM token-based database authentication, when combined with Oracle Autonomous Database, allows developers to authenticate using short-lived tokens issued by OCI IAM instead of long-term database passwords. This supports zero-trust principles by eliminating static credentials and enabling centralized identity management with token expiration and revocation.

Answer

Disabling all authentication to maximize application performance.

Answer

Hardcoded administrator passwords stored in plain text configuration files.

Answer

Using static API signing keys for database connection strings.

Question 6

You are migrating a monolithic application to microservices on OKE and implementing resilient design patterns. Which THREE resiliency patterns should you implement to handle transient failures gracefully?

Accepted Answer

Circuit Breaker pattern to prevent cascading failures when downstream services are struggling. Option A (Circuit Breaker) is correct because it detects repeated failures to a downstream service and trips open, failing fast instead of letting threads pile up waiting on a struggling dependency, which prevents cascading failures across the microservice mesh. Option B (Bulkhead) is correct because it partitions resources such as thread pools or connection pools per dependency, so a single slow or failing service cannot exhaust all shared resources and starve healthy services. Option D (Retries with Exponential Backoff and Jitter) is correct because transient network blips, brief DNS hiccups, or momentary 503s are often resolved by retrying, and exponential backoff with jitter avoids synchronized retry storms that would otherwise overwhelm the recovering service. Option C is not a resiliency pattern but an anti-pattern: a single shared monolithic database without connection pooling creates a shared point of contention and failure, coupling all microservices and amplifying outages. Option E is wrong because disabling health checks and liveness probes removes Kubernetes' ability to detect and restart unhealthy containers, degrading rather than improving resilience.

Answer

Single large monolithic database instance shared by all microservices without connection pooling

Answer

Disabling all health checks and liveness probes to prevent container restarts

Question 7

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

Accepted Answer

Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.. OCI Security Zones are hardened compartments that enforce a set of immutable security policies, one of which is that resources inside cannot have public IP addresses or public-facing endpoints. Because the policy is enforced at the platform level, the create-instance call fails regardless of IAM permissions or network configuration. This is by design to prevent external exposure of workloads in the zone.

Answer

The VCN lacks an Internet Gateway.

Answer

The OCI Vault service is offline.

Answer

The team lacks IAM permissions to create compute instances.

Question 8

Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?

Accepted Answer

Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host. For mTLS connections to Autonomous Database Serverless, the client must download the connection wallet zip from the OCI Console or CLI (or via the ADB API) and extract it on the client host. The wallet contains the client credentials (e.g., cwallet.sso, tnsnames.ora, sqlnet.ora) required to authenticate the client to the database over TLS. Without the wallet, mTLS cannot be established.

Answer

Generate a Kerberos ticket granting service token via the IAM security console

Answer

Retrieve the master encryption key directly from OCI Vault using an API key

Answer

Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings

Question 9

What is the primary purpose of OCI Database Actions (SQL Developer Web) when working with an Oracle Autonomous Database?

Accepted Answer

To provide a web-based development and management interface for executing SQL, querying data, and managing database users. OCI Database Actions (SQL Developer Web) is a web-based tool that provides a development and management interface for Autonomous Database, allowing users to execute SQL, query data, manage database users, and perform other administrative tasks. It is the primary browser-based interface for interacting with Autonomous Database.

Answer

To configure physical Exadata storage cell disks and flash cache parameters

Answer

To monitor physical VCN packet drops and firewall logs

Answer

To manage OCI IAM user groups and federation settings across enterprise identity providers

Question 10

You are configuring a Data Guard association between two Oracle Base Database Systems in different OCI regions. The primary database encounters an unplanned outage, and you perform a manual failover. What action must you take afterward if you wish to restore the original architecture with the old primary as the new standby?

Accepted Answer

Recreate or reinstate the former primary database (using Flashback Database or backup restoration) to convert it into a valid standby.. After a manual failover, the old primary is no longer a valid standby because its data files and control file reflect a different point in time. To restore the original architecture, you must reinstate or recreate the former primary as a standby, typically using Flashback Database to the point of the last redo it transmitted, or by restoring from backup and re-establishing the Data Guard association. Only then can redo transport resume in the reverse direction.

Answer

Run a simple 'SWITCHOVER' command to reverse roles without any data synchronization checks.

Answer

Modify the listener.ora file manually via SSH and restart the clusterware.

Answer

Delete the standby database and provision a brand-new VCN in the primary region.

Question 11

Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?

Accepted Answer

OCI Notifications Service. OCI Notifications Service is the correct intermediary because it natively supports publishing messages to external endpoints such as PagerDuty and Slack via HTTPS subscriptions. When an OCI Monitoring alarm fires, it can publish to a Notifications topic, and the service delivers the message to all subscribed endpoints. This is the standard OCI pattern for alert fan-out to third-party incident management and chat tools.

Answer

OCI API Gateway

Answer

OCI Streaming Service

Answer

OCI Events Service

Question 12

Your organization is preparing to migrate several large Oracle databases to OCI using Oracle Data Pump. Which THREE best practices should you follow to optimize the export and import performance over network connections? (Choose three.)

Accepted Answer

Use the `PARALLEL` parameter during both export and import operations to utilize multiple worker processes.. Option A is correct because the PARALLEL parameter in Oracle Data Pump starts multiple worker processes for both export (expdp) and import (impdp), allowing the job to read and write multiple data files concurrently and thereby maximizing throughput over the network. Option C is correct because the COMPRESS parameter (e.g., COMPRESS=DATA_ONLY or ALL) reduces the size of the dump file set, which directly lowers the volume of bytes transferred across the network and shortens transfer time, especially for large Oracle databases. Option E is correct because NETWORK_LINK lets Data Pump read directly from the source database over a database link and write into the target database, eliminating the intermediate dump file on disk and the associated file transfer step, which is ideal for network-based migrations. Option B is not appropriate because running Data Pump jobs from a laptop on public Wi-Fi is unreliable and insecure, and omitting compression increases transfer volume. Option D is not appropriate because undo tablespaces are required for read consistency and transaction rollback during import; disabling them would break the import and is not a supported performance practice.

Answer

Execute all Data Pump jobs from a local laptop connected via public Wi-Fi without compression.

Answer

Disable database undo tablespaces entirely during the Data Pump import phase.

Question 13

You need to migrate an on-premises Oracle Database to OCI Exadata Database Service using Oracle GoldenGate for zero-downtime migration with bi-directional replication. Which critical design consideration must be addressed regarding table design on both databases?

Accepted Answer

Tables must have primary keys or unique identifiers, and Conflict Detection and Resolution (CDR) must be configured. For bi-directional replication with Oracle GoldenGate, tables must have primary keys or unique identifiers to ensure that each row can be uniquely identified for conflict detection and resolution. Conflict Detection and Resolution (CDR) must be configured to handle conflicts that arise when the same row is modified on both databases. This is critical for zero-downtime migration with bi-directional replication.

Answer

Primary keys must be omitted to allow duplicate row insertion across databases

Answer

Tables must not contain any indexes, triggers, or constraints

Answer

All tables must be converted to temporary unlogged tables

Question 14

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

Accepted Answer

BGP (Border Gateway Protocol). Both OCI FastConnect and Site-to-Site VPN use BGP to dynamically exchange routes between the on-premises customer edge router and the OCI Dynamic Routing Gateway. BGP is the standard exterior gateway protocol for hybrid cloud routing and supports dynamic failover and prefix advertisement.

Answer

RIP (Routing Information Protocol)

Answer

EIGRP (Enhanced Interior Gateway Routing Protocol)

Answer

OSPF (Open Shortest Path First)

Question 15

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

Accepted Answer

OCI Security Zones. OCI Security Zones are a feature of Cloud Guard that enforce a set of security policies on compartments, preventing actions that violate the policies. When you create a security zone, you specify a security zone policy that includes restrictions such as blocking public buckets and disallowing open security list rules. Any attempt to create or modify resources in the compartment that violates the policy is denied. This enforces guardrails at creation time.

Answer

IAM Policy Condition statements with 'request.time'

Answer

OCI Audit Log Service with Event-Driven Automation

Answer

OCI Tag Defaults with validation rules

Question 16

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

Accepted Answer

Worker nodes utilizing Kata Containers runtime for hardware-level isolation. Kata Containers provide hardware-level isolation by running each container inside a lightweight virtual machine with its own kernel, so a container breakout affects only that VM and cannot compromise other tenants. This is the correct choice when strict kernel-level isolation is required on OKE.

Answer

Standard OKE worker nodes with Kubernetes LimitRanges

Answer

Standard worker nodes with Network Security Groups (NSGs) applied per pod

Answer

Worker nodes running Docker Engine with privileged containers enabled

Question 17

An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?

Accepted Answer

OCI Logging Agent. The OCI Logging Agent is a lightweight agent installed on Compute instances that collects custom application logs (and system logs) from the instance and ships them to the OCI Logging service via the Unified Monitoring Agent framework. It is the designated mechanism for ingesting instance-originated custom logs into OCI Logging.

Answer

OS Management Hub

Answer

OCI Service Connector Hub

Answer

OCI Streaming Service

Question 18

An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?

Accepted Answer

Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.. OCI Cost Analysis supports filtering and grouping by defined tags, enabling dynamic attribution of spend to business units based on resource metadata. Exporting Cost Reports to Object Storage provides durable historical data for trend analysis, and Budgets with alert rules deliver anomaly detection and threshold-based notifications. This combination directly satisfies the requirements for tag-based attribution, historical trends, and anomaly detection.

Answer

Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.

Answer

Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.

Answer

Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.

Question 19

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

Accepted Answer

Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.. A 'Tunnel Up' status only confirms that IKE Phase 1 and Phase 2 completed and the IPSec SA is established; it does not guarantee that traffic is permitted or routed. The most common cause of ping failure with an up tunnel is that Security Lists, NSGs, or the instance's OS firewall are dropping ICMP or the relevant traffic.

Answer

The FastConnect virtual circuit is disabled.

Answer

The OCI VCN does not have an Internet Gateway attached.

Answer

The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.

Question 20

Your organization has completed migrating a database to OCI Base Database Service. To ensure compliance with corporate data protection policies, you must verify that all database backups stored in OCI Object Storage are automatically encrypted using customer-managed encryption keys. Where should you configure this key management integration?

Accepted Answer

OCI Vault service (Key Management). OCI Base Database Service integrates with OCI Vault (Key Management) to allow customer-managed encryption keys (CMKs) for backups stored in Object Storage. When you configure the database's backup destination to use a customer-managed key, the service automatically encrypts backups with that key. This ensures compliance with policies requiring customer-controlled encryption rather than Oracle-managed keys.

Answer

OCI Database Migration service connection profiles

Answer

OCI Audit log configuration

Answer

OCI Identity and Access Management (IAM) password policies