1Z0-997-26 Practice Test 8 — 10 Questions

Question 1

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

Accepted Answer

Higher bandwidth, lower latency, and predictable performance. FastConnect is a dedicated private physical connection between on-premises and OCI, bypassing the public internet. This yields higher, more consistent bandwidth, lower and more predictable latency, and reduced jitter compared to an IPSec VPN, which traverses the public internet and is subject to variable paths and congestion. That predictability is the primary reason enterprises choose FastConnect for latency-sensitive or high-throughput workloads.

Answer

Ability to route traffic over public cellular networks

Answer

Zero configuration required on the on-premises router

Answer

Automatic encryption of all traffic at Layer 2 by default

Question 2

You are performing maintenance on an OCI Load Balancer backend set. You want to temporarily stop sending traffic to a specific backend server without immediately dropping active persistent connections. What feature should you use?

Accepted Answer

Enable Connection Draining on the backend server.. Connection Draining is the OCI Load Balancer feature that gracefully removes a backend from rotation while allowing in-flight persistent connections to complete. When enabled, the backend is marked as draining, existing sessions continue until they finish or the drain timeout expires, and no new connections are routed to it. This matches the requirement to stop new traffic without abruptly dropping active persistent connections.

Answer

Set the backend server weight to zero without enabling draining.

Answer

Delete the backend server from the backend set immediately.

Answer

Modify the security list to drop all TCP packets on port 443.

Question 3

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit. To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 4

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

Accepted Answer

Customer-Premises Equipment (CPE). The Customer-Premises Equipment (CPE) object represents the on-premises VPN device in OCI. Before creating an IPSec connection, you must create a CPE object that specifies the public IP address of the on-premises device. This allows OCI to establish the IPSec tunnels to that endpoint.

Answer

NAT Gateway

Answer

Service Gateway

Answer

Virtual Cloud Network (VCN)

Question 5

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

Accepted Answer

Configure an OCI Service Gateway in your VCN and add a route rule for OCI Services to the private subnet's route table.. An OCI Service Gateway provides private access from a VCN to OCI public services like OCIR without traversing the internet. By adding a route rule in the private subnet's route table pointing OCI Services traffic to the Service Gateway, pods can pull images securely while worker nodes remain isolated from the public internet.

Answer

Install an external Squid proxy on an on-premises server connected via IPsec VPN.

Answer

Set up a NAT Gateway and forward all traffic to the internet.

Answer

Attach a Public IP address to every worker node in the OKE cluster.

Question 6

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Accepted Answer

OCI Vault (Secrets management). OCI Vault's Secrets management feature is designed to store sensitive values like database connection strings and API keys, and OCI Functions can retrieve them securely at runtime via the OCI SDK or by referencing them as environment variables. This keeps secrets encrypted and access-controlled through IAM policies.

Answer

OCI Object Storage public bucket

Answer

OCI Audit log retention policy

Answer

OCI Resource Manager stack configuration output

Question 7

You are managing an enterprise OKE cluster that runs multi-tenant workloads. Certain sensitive pods must run on dedicated worker nodes to comply with strict isolation mandates. Which combination of Kubernetes scheduling features should you configure on OCI to enforce this requirement reliably?

Accepted Answer

Kubernetes Taints, Tolerations, and Node Affinity. Taints repel pods from nodes unless the pod has a matching toleration, and Node Affinity (specifically nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution) pins pods to nodes with specific labels. Combining taints on the dedicated nodes with tolerations on the sensitive pods, plus node affinity to select those labeled nodes, guarantees that only the intended sensitive workloads land on the dedicated worker nodes. This is the canonical Kubernetes pattern for hard multi-tenant isolation at the scheduling layer.

Answer

OCI Identity and Access Management (IAM) dynamic groups and compartment isolation

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) and OCI Cluster Autoscaler

Answer

OCI Load Balancer flexible shapes and backend set weights

Question 8

During a migration cutover weekend, your team encounters unexpected DNS resolution failures preventing users from reaching the newly migrated OCI application endpoints. Which TWO immediate troubleshooting steps should you perform? (Choose two.)

Accepted Answer

Check OCI VCN DNS resolver settings and custom resolver forwarders if integrating with on-premises DNS.. Option A is correct because during a migration cutover, DNS resolution failures often stem from the OCI VCN resolver configuration — specifically the Internet and VCN Resolver settings, custom resolver endpoints, and forwarding rules used when integrating with on-premises DNS (e.g., via IPSec VPN or FastConnect). Verifying these ensures the VCN's resolver is correctly forwarding queries and resolving OCI-internal names. Option B is correct because the most common cutover issue is stale or incorrect public DNS records; you must confirm the A records (and CNAMEs) point to the new OCI Load Balancer public IP addresses and check TTL values, since high TTLs can cause clients to cache old records long after the cutover. Option C is irrelevant — changing tenant subscription currency from USD to EUR has no effect on DNS resolution. Option D is unrelated — reformatting backend database tables with SQL*Plus addresses data storage, not name resolution. Option E is destructive and nonsensical — deleting all OCI compartments and recreating the tenancy root would break the environment rather than troubleshoot DNS.

Answer

Change the tenant subscription currency from USD to EUR.

Answer

Reformat all backend database tables using SQL*Plus.

Answer

Delete all OCI compartments and recreate the tenancy root structure.

Question 9

Your organization runs a multi-tenant Oracle Base Database Service and you need to monitor the storage utilization of individual Pluggable Databases (PDBs) within a Container Database (CDB). Which OCI native service and metric should you review?

Accepted Answer

OCI Database Management service PDB storage metrics.. The OCI Database Management service provides native monitoring for Oracle databases, including PDB-level storage metrics. It collects and displays metrics such as tablespace usage, datafile size, and storage utilization for each PDB within a CDB. This is the correct OCI-native service for monitoring individual PDB storage.

Answer

OCI Logging Analytics with custom log parsers for alert.log.

Answer

Compute Instance metrics via OCI Monitoring service agent.

Answer

Autonomous Health Framework (AHF) health check reports.

Question 10

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

Accepted Answer

OCI Security Zones.. OCI Security Zones are the purpose-built feature for enforcing security best practices on newly created resources within a compartment. When a compartment is designated as a security zone, OCI automatically applies a set of maximum-security policies — such as prohibiting public Object Storage buckets, requiring encryption, and preventing audit logging from being disabled — and blocks any API call that would violate them. This is exactly the 'automatically enforce on new compartments' requirement described.

Answer

OCI IAM compartments with default root-level policies.

Answer

OCI Cloud Guard targets with active detector recipes.

Answer

OCI Network Security Groups (NSGs) applied to the VCN.