1Z0-997-26 Practice Questions 1 — 50 Questions

Question 1

You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?

Accepted Answer

2 tunnels. OCI Site-to-Site VPN automatically provisions two tunnels per VPN connection by default, each terminating on a separate VPN headend in a different availability domain. This redundancy is built in so that if one tunnel or headend fails, traffic can fail over to the other. The two-tunnel design is a core HA characteristic of the OCI IPSec VPN service.

Answer

8 tunnels

Answer

4 tunnels

Answer

1 tunnel

Question 2

Which OCI security feature provides a centralized view of security recommendations and allows you to remediate misconfigurations with a single click?

Accepted Answer

OCI Cloud Guard Managed Recipes and Responder Rules.. OCI Cloud Guard uses Managed Recipes (detector and responder recipes) to continuously monitor a tenancy for security misconfigurations and risky activity, and Responder Rules can automatically or manually remediate findings — including one-click remediation from the Cloud Guard console. This centralized posture view with actionable remediation is exactly what Cloud Guard provides.

Answer

OCI Bastion Service session manager.

Answer

OCI Database Migration Service.

Answer

OCI IAM Policy Generator.

Question 3

During a lift-and-shift migration planning phase, your team needs to estimate the monthly running costs of various OCI Compute shapes, block storage volumes, and egress data transfer fees before provisioning resources. Which OCI tool should you use to generate this detailed cost breakdown?

Accepted Answer

OCI Cost Estimator. OCI Cost Estimator is a free, web-based planning tool that lets you model a full OCI environment — Compute shapes, Block Volume capacity/performance tiers, Object Storage, and outbound data transfer — and produces a detailed monthly cost breakdown before any resources are provisioned. It is purpose-built for pre-provisioning TCO/ROI analysis and lift-and-shift sizing exercises, and it can export the estimate to a spreadsheet for stakeholder review.

Answer

OCI Budgets and Alerts

Answer

OCI Resource Manager

Answer

OCI Migration Asset Inventory dashboard

Question 4

Your development team needs to scale up CPU cores for an Autonomous JSON Database instance dynamically without restarting the application or causing downtime. Which feature should you use?

Accepted Answer

Autonomous Database Elastic Resource Scaling.. Autonomous Database Elastic Resource Scaling allows you to scale CPU cores up or down dynamically without downtime, application restarts, or manual intervention. It is the native ADB feature for on-demand compute scaling and applies to Autonomous JSON Database as well. Because it is built into the service, the change takes effect while the database remains online.

Answer

Auto-scaling with Oracle Data Guard switchover.

Answer

OCI Compute Instance resizing via instance pool configuration.

Answer

Manual cold restart of the container database.

Question 5

You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?

Accepted Answer

Configure each consumer instance to belong to a separate, unique consumer group.. In OCI Streaming, a consumer group allows multiple consumers to coordinate and share the message processing load, with each message delivered to only one consumer in the group. To have each consumer instance maintain its own independent cursor and process every message, each instance must belong to a separate, unique consumer group. This way, each group gets its own copy of all messages, and each instance can track its own offset independently.

Answer

Use the OCI Streaming default single-consumer mode with multithreaded polling.

Answer

Assign all consumer instances to the exact same consumer group and increase the number of partitions.

Answer

Publish events via OCI Notifications instead, as Streaming does not support consumer groups.

Question 6

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

Accepted Answer

Local VCN Peering.. Local VCN Peering connects two VCNs in the same region over Oracle's private backbone, allowing resources in the development VCN to reach the production database privately without internet exposure. It is the recommended construct for intra-region, cross-VCN private communication.

Answer

Dynamic Routing Gateway (DRG) with internet breakout enabled.

Answer

Internet Gateway with strict Security List rules.

Answer

OCI Bastion service.

Question 7

You need to export OCI Audit logs to a third-party SIEM tool (such as Splunk or Elastic) in real-time. Which OCI architecture is best suited for this requirement?

Accepted Answer

Use OCI Service Connector Hub to route logs from OCI Audit to OCI Streaming or Object Storage for SIEM consumption.. OCI Service Connector Hub is the native service for routing logs from OCI Audit to destinations like OCI Streaming or Object Storage. For real-time SIEM integration, Service Connector Hub can stream Audit logs to OCI Streaming, which can then be consumed by Splunk or Elastic via a connector, providing near real-time export.

Answer

Schedule an OCI Resource Manager job to FTP log files every night.

Answer

Install the OCI Logging Agent directly on the OCI Audit service control plane.

Answer

Configure OCI Health Checks to poll the Audit API.

Question 8

Which THREE features are supported within OCI Cost Analysis to help administrators analyze and report on cloud spending?

Accepted Answer

Grouping and filtering costs using OCI Defined Tags. Option B is correct because OCI Cost Analysis lets administrators group and filter cost data by dimensions including OCI Defined Tags, enabling chargeback and showback reporting by tag keys/values. Option C is correct because Cost Analysis provides interactive charts that visualize cumulative and non-cumulative cost trends across customizable time ranges such as daily or monthly granularity. Option E is correct because Cost Analysis allows exporting the displayed cost charts and tabular cost data to CSV for offline analysis and reporting. Option A is incorrect because billing details such as credit card information are managed through Oracle Support or the account management/billing console, not by directly editing them in Cost Analysis. Option D is incorrect because Cost Analysis is a cost reporting and visualization tool; it does not execute SQL queries against Autonomous Database instances, which would be done via tools like SQL Developer, Database Actions, or OCI Data Science/APEX.

Answer

Directly modifying customer credit card billing details without contacting Oracle Support

Answer

Automatically executing database SQL queries against Autonomous Database instances

Question 9

Your organization requires the migration of 300 TB of backup archives from an on-premises data center to OCI Object Storage. The local internet connection is limited to 100 Mbps, and corporate compliance mandates that data cannot traverse the public internet unencrypted. Which solution should you select to meet these constraints?

Accepted Answer

Order an OCI Data Transfer Appliance, load the encrypted backup data locally, and ship the appliance to the designated Oracle data center.. The OCI Data Transfer Appliance is designed for exactly this scenario: migrating large volumes of data (typically >10 TB) when network bandwidth is insufficient. With only 100 Mbps, transferring 300 TB would take over 300 days, making it impractical. The appliance allows you to load encrypted data locally and ship it to Oracle, where data is uploaded to Object Storage, meeting both the bandwidth and compliance (encryption) requirements.

Answer

Deploy an OCI Storage Gateway on-premises and cache all 300 TB locally while syncing in real-time.

Answer

Use Oracle GoldenGate to replicate backup files block-by-block to Object Storage.

Answer

Stream the backups continuously over a secure IPsec VPN tunnel using rclone.

Question 10

An architect is designing a multi-region disaster recovery architecture for an application running on OCI Compute. The database layer uses Oracle Data Guard. For the application tier, what is the recommended approach to handle stateless application servers in the DR region?

Accepted Answer

Pre-provision compute instances in a stopped state or use instance pools with standby configuration, activating them during a disaster event.. For stateless application servers in a DR region, the recommended OCI approach is to pre-provision capacity that can be activated quickly without paying for full-time compute. Instance pools with a standby configuration (or stopped instances) let you maintain a warm standby that can be scaled up or started during a failover event, meeting RTO while controlling cost. Because the app tier is stateless, no data synchronization is needed—only the ability to bring compute online and point it at the newly promoted database.

Answer

Run all application servers at full capacity in both regions simultaneously with active write locks.

Answer

Store application binaries solely in Object Storage and compile them on the fly using user-data scripts during failover.

Answer

Rely entirely on manual creation of compute instances via the OCI console after an outage occurs.

Question 11

An organization is designing a disaster recovery strategy using Exadata Database Service on Dedicated Infrastructure. They require an Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of zero for an enterprise database handling mission-critical workloads. Which Data Guard configuration should be implemented?

Accepted Answer

Oracle Active Data Guard configured in Maximum Protection mode with synchronous transport. RPO of zero requires synchronous redo transport so no committed transaction can be lost, and RTO under 30 seconds requires a standby that is already mounted, open read-only, and ready for immediate failover. Maximum Protection mode with Active Data Guard satisfies both: SYNC transport guarantees zero data loss, and Active Data Guard keeps the standby continuously applying redo so failover is near-instant. This is the only option that meets both objectives simultaneously.

Answer

Manual RMAN backup replication via OCI Object Storage every 15 minutes

Answer

Oracle Data Guard configured in Maximum Performance mode with asynchronous transport

Answer

Oracle GoldenGate real-time replication with asynchronous extract configurations

Question 12

You want to track API calls made by a specific user who deleted a critical production database in OCI. Which OCI service log should you examine?

Accepted Answer

OCI Audit Log. OCI Audit Log records all API calls made against OCI resources, including the identity of the caller, source IP, timestamp, request action, and target resource. A database deletion is an API operation (e.g., DeleteAutonomousDatabase or TerminateDbSystem), so the Audit Log is the authoritative source to identify which user performed it.

Answer

OCI VCN Flow Log

Answer

OCI APM Transaction Log

Answer

OCI Database Alert Log

Question 13

You are optimizing the cost and performance of an Exadata Database Service on Dedicated Infrastructure environment hosting multiple large databases. Which THREE practices should you implement to achieve optimal resource utilization and cost efficiency?

Accepted Answer

Consolidate multiple non-CDB databases into a single Multitenant Container Database (CDB) with multiple PDBs.. Option A is correct because consolidating non-CDB databases into a single Multitenant Container Database with multiple PDBs improves consolidation density, reduces per-database overhead, and enables efficient resource sharing through PDB-level resource management on Exadata. Option B is correct because Exadata Smart Flash Cache policies (for example, keeping OLTP data cached while marking DSS scans as non-cacheable) ensure flash is used for latency-sensitive random I/O and not polluted by large sequential scans, improving performance and deferring costly capacity upgrades. Option E is correct because Exadata Database Service on Dedicated Infrastructure supports dynamic OCPU scaling, so matching OCPU counts to peak and off-peak schedules avoids paying for idle compute while preserving performance during demand peaks. Option C is incorrect because moving table data to standard Block Volume bypasses Exadata storage servers, eliminating Smart Scan, storage indexes, and Exadata flash benefits, which hurts performance and cost efficiency. Option D is incorrect because disabling automatic backups removes data protection and is not a valid cost-optimization practice; backup costs should be managed through retention and tiering policies instead.

Answer

Migrate all table data to standard Block Volume storage to bypass Exadata storage servers.

Answer

Disable automatic backups entirely to save OCI Object Storage costs.

Question 14

An enterprise architect is designing a centralized log management solution in Oracle Cloud Infrastructure (OCI) Logging Analytics. The team needs to ingest logs from various heterogeneous sources, including custom applications, Oracle databases, and third-party firewalls, while ensuring that the log data is properly parsed and enriched without requiring custom regex development for every vendor format. Which feature should the architect leverage to meet this requirement?

Accepted Answer

OCI Logging Analytics out-of-the-box parsers and source configurations along with custom parsers built via the Log Parser Workbench.. OCI Logging Analytics ships with a large library of out-of-the-box parsers and source configurations that recognize common vendor formats (Oracle DB, firewalls, OS logs, etc.), so heterogeneous logs are parsed and enriched without writing regex from scratch. When a format is not covered, the Log Parser Workbench provides a GUI to build and validate custom parsers, which is exactly the requirement stated. This combination delivers structured fields and enrichment (e.g., geo-location, threat intel) at ingest time.

Answer

OCI Telemetry Data Plane auto-extractors that automatically normalize all logs into a unified OpenTelemetry schema.

Answer

OCI Object Storage lifecycle rules configured with transformation policies to convert raw text logs into structured JSON formats.

Answer

OCI Streaming Service combined with Oracle Functions to manually parse every raw log payload prior to storage.

Question 15

An OCI Administrator needs to set up proactive alerting when the CPU utilization of a production Compute instance exceeds 90% for a sustained period of 15 minutes. Which OCI service should be configured to evaluate this metric and trigger notifications via an email endpoint?

Accepted Answer

OCI Monitoring Service Alarms combined with OCI Notifications Service topics.. OCI Monitoring Service alarms evaluate metric streams against thresholds (e.g., CPU utilization > 90% for 15 minutes) and trigger actions when the condition is met. The alarm publishes to an OCI Notifications Service topic, which delivers the alert to an email endpoint. This is the standard, native pattern for proactive metric-based alerting in OCI.

Answer

OCI Health Checks configured with custom ICMP ping probes targeting the private IP of the instance.

Answer

OCI Events Service configured with a rule filtering for Compute metric threshold violations.

Answer

OCI Logging Analytics with scheduled saved search alerts.

Question 16

Your organization is planning to migrate file shares from an on-premises Windows environment (SMB protocol) to OCI. Which THREE factors or options should you consider when selecting the appropriate OCI storage architecture for Windows file shares? (Choose three.)

Accepted Answer

Deploying Windows Server instances on OCI Compute attached to high-performance OCI Block Volumes to act as native SMB file servers.. Option A is correct because deploying Windows Server instances on OCI Compute with attached high-performance Block Volumes lets you run native SMB file servers, preserving SMB semantics such as file locking, ACLs, and Active Directory integration for Windows clients. Option D is correct because OCI Marketplace partner solutions offer enterprise NAS appliances that natively support SMB/CIFS on OCI, providing a managed, protocol-compatible alternative to self-managed Windows file servers. Option E is correct because OCI File Storage Service is an NFSv3-based service and does not natively speak SMB/CIFS, so it cannot directly serve Windows SMB shares without third-party gateways or workarounds. Option B is incorrect because OCI Object Storage is an object store accessed via REST/S3 APIs, not a POSIX/SMB file system, and it does not provide the file locking and share semantics required for active SMB network drives. Option C is incorrect because OCI Archive Storage is a cloud archive tier accessed over the network via APIs, and there is no such thing as attaching it to Windows clients via USB cable simulation.

Answer

Using OCI Object Storage as a direct replacement for active SMB shared network drives requiring file locking.

Answer

Attaching OCI Archive Storage directly to Windows clients via USB cable simulation.

Question 17

You are troubleshooting a microservice on OKE that is experiencing intermittent 502 Bad Gateway errors when communicating with another internal service. The application uses Kubernetes ClusterIP services for discovery. You suspect DNS resolution failure within the cluster. Which diagnostic tool and approach should you use inside the OKE cluster?

Accepted Answer

Deploy a temporary diagnostic container pod (such as netshoot) and test DNS resolution using nslookup against CoreDNS.. Deploying a temporary diagnostic container pod such as netshoot and testing DNS resolution with nslookup against CoreDNS is the correct approach. This allows you to verify whether the cluster's DNS service (CoreDNS) is resolving the internal service name correctly from within a pod, which directly addresses the suspected DNS resolution failure causing 502 errors. It is a standard Kubernetes troubleshooting technique that isolates DNS issues from application or network issues.

Answer

Check the OCI VCN internet gateway route table.

Answer

Review OCI Cloud Guard threat detection policies.

Answer

Restart the OCI API Gateway service.

Question 18

You are configuring the OCI-Azure Interconnect to link an OCI Virtual Cloud Network (VCN) with an Azure Virtual Network (VNet). You have already established the FastConnect and ExpressRoute circuits. What is the mandatory next step to enable cross-cloud routing between the OCI Dynamic Routing Gateway (DRG) and the Azure Virtual Network Gateway?

Accepted Answer

Establish a BGP session between the OCI DRG and the Azure Virtual Network Gateway over the FastConnect/ExpressRoute circuit.. After establishing the FastConnect and ExpressRoute circuits, the mandatory step to enable cross-cloud routing is to establish a BGP session between the OCI DRG and the Azure Virtual Network Gateway over the interconnected circuits. BGP exchanges routes between the two clouds so that the VCN and VNet can route traffic to each other. Without BGP peering, the physical circuits are up but no routes are exchanged.

Answer

Configure an OCI Service Gateway to route traffic to Azure services directly.

Answer

Attach the Azure VNet directly to an OCI Local Peering Gateway (LPG).

Answer

Deploy an OCI NAT Gateway to translate Azure private IP addresses into OCI public IP addresses.

Question 19

An architect is configuring Oracle Autonomous Database Disaster Recovery with cross-region Data Guard. The primary database is in Ashburn, and the standby is in Phoenix. You execute a switchover operation. What happens to the connection strings (such as tnsnames.ora entries) used by client applications?

Accepted Answer

Client connection strings remain valid; applications reconnect, and the regional endpoint automatically routes traffic to the new primary.. When using Oracle Autonomous Database with cross-region Data Guard, the connection strings (such as those in tnsnames.ora) remain valid after a switchover because the regional endpoint automatically routes traffic to the new primary database. Applications reconnect without any changes to their configuration. This is a key benefit of the managed service, which abstracts the underlying infrastructure changes.

Answer

The database IP addresses change, requiring manual DNS A-record updates in OCI DNS.

Answer

You must manually regenerate new wallet zip files and redeploy them to all application servers.

Answer

Client applications must be rewritten to use hardcoded IP addresses instead of TNS names.

Question 20

Which THREE strategies can be implemented in OCI to mitigate the impact of a regional availability outage on a multi-tier web application? (Choose three.)

Accepted Answer

Deploying application tiers across two OCI regions with DNS Traffic Management health checks for automated failover. Option A is correct because deploying the application tiers across two OCI regions and using OCI DNS Traffic Management with health checks enables automated failover: when health checks detect the primary region's endpoints as unhealthy, traffic is steered to the secondary region, keeping the multi-tier app reachable during a regional outage. Option B is correct because replicating critical block volumes (via block volume replication/Cross-Region Replication) and object storage data (via Object Storage replication policies or rclone/OCI CLI copy) to the secondary region ensures the data needed to run the application survives a regional failure and can be attached/accessed in the DR region. Option D is correct because Oracle Data Guard provides physical or logical standby databases in a secondary region with redo transport and role transitions (switchover/failover), which is the standard OCI approach to keep the database tier available when the primary region is lost. Option C is not correct because a single Availability Domain deployment with daily backups offers no live failover capability and cannot mitigate a regional outage, since both the AD and the backups in the same region may be affected. Option E is not correct because synchronous multi-master writes over the public internet between regions introduce unacceptable latency and consistency/locking problems, and OCI does not support such a multi-master database topology as a viable HA/DR strategy.

Answer

Relying on a single Availability Domain deployment with automated daily backups

Answer

Running all database write operations simultaneously against both regions with synchronous multi-master locking over public internet