1Z0-997-26 Practice Test 6 — 10 Questions

Question 1

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication policies that can validate JSON Web Tokens (JWT) issued by an identity provider before forwarding requests to backend services. Configuring a JWT validation authentication policy ensures only requests with a valid, unexpired token from the trusted issuer reach the microservices. This is the native, purpose-built feature for token-based API authentication.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 2

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Accepted Answer

Using route distributions to control which routes are imported into or exported from a DRG route table.. Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering. Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Answer

Automatically peering AWS VPC route tables directly from the DRG console.

Answer

Enabling Ophaned route garbage collection on Internet Gateways.

Answer

Converting OCI VCN subnets into Azure Subnets via DRG translation rules.

Question 3

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

Accepted Answer

IKEv2 with AES-256 encryption and SHA-2 hashing. OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, which meets robust compliance requirements for encrypted tunnel traffic. IKEv2 is the recommended key exchange protocol, and AES-256 with SHA-2 provides strong confidentiality and integrity for IPsec tunnels. This combination is the standard supported configuration for OCI VPN.

Answer

SSL/TLS v1.3 with RSA key exchange

Answer

SSH tunneling with Blowfish cipher

Answer

PPTP with MPPE 128-bit encryption

Question 4

Which TWO tools or interfaces can administrators use to manage Oracle Autonomous Database instances in OCI? (Choose two.)

Accepted Answer

OCI Command Line Interface (CLI) and REST APIs. Option D is correct because Oracle Autonomous Database is a fully managed OCI service whose lifecycle and management operations (such as scaling, starting/stopping, cloning, and viewing details) are exposed through the OCI Command Line Interface and the OCI REST APIs, which administrators can script and automate. Option E is correct because the OCI Console provides the web-based graphical interface where administrators can create, monitor, and manage Autonomous Database instances without writing code. The other options do not belong: A (floppy disk image uploads) is an obsolete local media method with no role in OCI cloud management, B (RDP to the Autonomous database hypervisor) is impossible because Oracle manages the infrastructure and customers have no hypervisor access, and C (physical serial console cable to Exadata rack blades) is not a customer-accessible management path in a managed cloud service.

Answer

Local floppy disk drive image uploads

Answer

Windows Remote Desktop Connection (RDP) to the Autonomous database hypervisor

Answer

Direct physical serial console cable attached to Exadata rack blades

Question 5

Which Autonomous Database workload type is specifically optimized for running complex analytical queries, machine learning, and data warehousing workloads?

Accepted Answer

Autonomous Data Warehouse (ADW). Autonomous Data Warehouse (ADW) is the Autonomous Database workload type specifically tuned for analytical workloads: it uses columnar compression, automatic indexing for analytics, materialized view refresh, and parallel execution optimized for complex queries, machine learning, and data warehousing. ATP is tuned for high-concurrency transactional workloads, and AJD is optimized for JSON document workloads.

Answer

Autonomous JSON Database (AJD)

Answer

Autonomous Transaction Processing (ATP)

Answer

Autonomous Apex Application Development (APEX)

Question 6

You are designing a hybrid cloud architecture during a phased workload migration to OCI. On-premises applications must securely communicate with migrated OCI workloads over a private, dedicated connection with high throughput and encryption. Which OCI networking service combination provides this capability?

Accepted Answer

OCI FastConnect with MACsec encryption or an IPsec VPN tunnel over FastConnect. OCI FastConnect provides a dedicated private connection from on-premises to OCI, and pairing it with MACsec (Layer 2 encryption) or running an IPsec VPN over the FastConnect virtual circuit delivers the required encryption and high throughput. This is the standard hybrid pattern for private, dedicated, encrypted connectivity.

Answer

OCI Local Peering Gateway with public IP addressing

Answer

OCI NAT Gateway combined with Service Gateway

Answer

OCI Internet Gateway with SSL/TLS certificates

Question 7

You are designing an automated backup strategy for an Exadata Database Service on Dedicated Infrastructure. You want to ensure that incremental backups are taken daily and full backups weekly, with long-term retention stored in OCI Object Storage. Where are these backup schedules configured?

Accepted Answer

In the OCI Console under the database system backup configuration settings or via API/CLI. Backup schedules for Exadata Database Service on Dedicated Infrastructure are configured through the OCI Console under the database system's backup configuration, or via the OCI API/CLI. These settings define the retention period, backup window, and whether backups are stored in OCI Object Storage, and they control the automated incremental and full backup cadence.

Answer

By modifying the crontab configuration file as root on the dom0 hypervisor node

Answer

By editing the initialization parameter file (spfile) using SQL*Plus

Answer

Via Oracle Enterprise Manager Cloud Control deployed exclusively on-premises

Question 8

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions allow you to configure the function timeout up to the service limit (default 30 seconds, maximum 300 seconds) via the Fn Project CLI or OCI Console. Increasing the timeout directly addresses the failure when calling a slow third-party REST API, and is the recommended best practice for long-running calls.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 9

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

Accepted Answer

Dynamic Routing Gateway (DRG) with Remote VCN Peering. Remote VCN Peering in OCI uses a Dynamic Routing Gateway (DRG) attached to each VCN, with the two DRGs connected over OCI's private backbone to link VCNs in different regions. This provides private, encrypted-in-transit connectivity suitable for cross-region Data Guard redo transport without traversing the public internet. The DRG is the required routing anchor for any inter-VCN or on-premises connectivity in OCI.

Answer

Internet Gateway (IGW)

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Question 10

You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?

Accepted Answer

Cross-Region Autonomous Data Guard. Cross-Region Autonomous Data Guard is the native OCI feature that creates a standby Autonomous Database in a remote region and provides automatic or manual failover with low RPO (typically seconds) and low RTO. It is purpose-built for ADB Serverless disaster recovery and requires no manual backup shipping.

Answer

OCI Block Volume cross-region replication

Answer

Manual RMAN incremental backups copied to Object Storage in the remote region

Answer

Database Express Export/Import scheduled via cron