1Z0-997-26 Cloud Native Architecture — 25 Questions

Question 1

Your development team has built a serverless application consisting of multiple OCI Functions. They want to orchestrate these functions into a coherent, server-side workflow that handles parallel execution, error retries, and branching logic. Which OCI service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Oracle Integration. OCI Workflow is not a service; Oracle Cloud Infrastructure Process Automation or OCI Functions coupled with OCI GoldenGate/Streaming might exist, but the native serverless orchestration service designed specifically for chaining tasks and functions is OCI Workflow / OCI GoldenGate? Wait, the correct native service for orchestrating serverless tasks is Oracle Cloud Infrastructure (OCI) GoldenGate? No, OCI GoldenGate is data integration. The actual OCI service for serverless workflow orchestration is Oracle Cloud Infrastructure Process Automation or specifically OCI GoldenGate? Wait, OCI has 'OCI GoldenGate' and 'Oracle Integration'. Let's check OCI native serverless workflow service: Oracle Cloud Infrastructure does not have a dedicated 'AWS Step Functions' equivalent named OCI Workflow, but wait, OCI has 'OCI Workflow' within OCI Data Integration or Oracle Integration. Wait, let's look at the options to provide a realistic OCI service name.

Answer

OCI Streaming

Answer

OCI Resource Manager

Answer

OCI Vault

Question 2

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication and authorization policies, including JWT validation to verify tokens issued by third-party identity providers.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 3

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions have a configurable timeout limit. You can update the function's timeout configuration either via the Fn Project CLI or the OCI Console.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 4

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

Accepted Answer

OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.. OCI Events Service allows filtering and routing of events, but to guarantee handling with a dead-letter queue and retry capabilities, routing events through OCI Streaming or OCI Queue with OCI Notifications/Events integration is required. Specifically, OCI Events can publish to OCI Streaming, or OCI Queue can be integrated with Functions and a DLQ.

Answer

OCI API Gateway configured with a mock backend routing to OCI Functions.

Answer

OCI Notifications Service publishing directly to an OCI Object Storage bucket.

Answer

OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

Question 5

You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?

Accepted Answer

OCI API Gateway route pointing to the OCI Function. OCI API Gateway can be configured with a route pointing directly to an OCI Function, exposing it as an HTTP endpoint.

Answer

OCI Object Storage pre-authenticated request (PAR)

Answer

OCI Cloud Guard trigger policy

Answer

OCI Streaming cursor initialization

Question 6

Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?

Accepted Answer

OCI IAM Workload Identity for OKE. OCI IAM Workload Identity for OKE enables Kubernetes service accounts to be mapped to OCI IAM principals, allowing pods to authenticate to OCI services without storing long-lived credentials.

Answer

Kubernetes Persistent Volume Claims with Block Storage

Answer

OCI Vault Master Encryption Key rotation

Answer

OCI Bastion Service port forwarding

Question 7

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

Accepted Answer

Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter. Prometheus Adapter combined with the Horizontal Pod Autoscaler (HPA) allows Kubernetes to scale pods based on custom metrics scraped from Prometheus.

Answer

Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits

Answer

OCI Autoscaling for OKE worker nodes

Answer

OCI Instance Pool autoscaling configuration

Question 8

You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?

Accepted Answer

Configure each consumer instance to belong to a separate, unique consumer group.. In OCI Streaming, to have multiple independent applications process the exact same stream concurrently, each application must use a unique consumer group. Messages are distributed among instances within the same consumer group, but separate consumer groups each get their own copy of the message stream.

Answer

Use the OCI Streaming default single-consumer mode with multithreaded polling.

Answer

Assign all consumer instances to the exact same consumer group and increase the number of partitions.

Answer

Publish events via OCI Notifications instead, as Streaming does not support consumer groups.

Question 9

You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?

Accepted Answer

OCI Native Ingress Controller configured with an OCI Load Balancer. OCI Native Ingress Controller for OKE allows you to configure routing rules based on paths and hosts, leveraging an OCI Load Balancer to handle traffic routing and external exposure efficiently.

Answer

OCI File Storage Service mounted on all worker nodes

Answer

Kubernetes NodePort service directly pointing to every individual pod

Answer

OCI API Gateway without any OKE Ingress

Question 10

You are managing an OKE cluster where developer teams frequently deploy new microservice versions. You need to implement a canary deployment strategy where 10% of production traffic is automatically routed to the new version while 90% goes to the stable version, without rewriting your application code. Which tool or pattern should you use?

Accepted Answer

OCI Service Mesh traffic split rules. Service mesh solutions like Istio or OCI-supported service mesh routing features allow fine-grained traffic splitting for canary deployments.

Answer

OCI Notifications service broadcast rules

Answer

Kubernetes standard Service resource with multiple selectors pointing to the same pod

Answer

OCI Load Balancer listener port re-mapping

Question 11

Your development team needs to build and push container images to a secure, private registry hosted on OCI before deploying them to OKE. Which OCI service should they use?

Accepted Answer

OCI Registry (OCIR). OCI Registry (OCIR) is Oracle's managed enterprise-grade container registry service for storing and managing Docker v2 container images.

Answer

OCI Object Storage standard bucket

Answer

OCI Artifact Registry

Answer

OCI DevOps Code Repository

Question 12

An OCI Function in your serverless architecture needs to process large files (up to 5GB) uploaded to an OCI Object Storage bucket. Due to ephemeral storage limits inside the function container (/tmp), the function crashes when attempting to download the entire file locally. How should you redesign this function processing flow?

Accepted Answer

Stream the file contents in chunks using Object Storage API range requests and process data iteratively without full local storage.. Instead of downloading the entire file into local ephemeral storage, the function should process the file using Object Storage multi-part upload/download streaming or range requests to process the file in chunks.

Answer

Attach an OCI Block Volume directly to the OCI Function container instance.

Answer

Increase the OCI Function memory allocation to automatically provision a larger /tmp filesystem.

Answer

Mount an OCI File Storage Service (FSS) target over the internet inside the function code.

Question 13

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Accepted Answer

OCI Vault (Secrets management). OCI Vault allows you to store secrets securely, which can then be referenced by OCI Functions configuration or retrieved via SDK.

Answer

OCI Object Storage public bucket

Answer

OCI Audit log retention policy

Answer

OCI Resource Manager stack configuration output

Question 14

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

Accepted Answer

Worker nodes utilizing Kata Containers runtime for hardware-level isolation. To achieve strong kernel-level isolation for multi-tenant workloads in OKE, you should use worker nodes configured with Kata Containers (secure containers utilizing lightweight hardware virtualization).

Answer

Standard OKE worker nodes with Kubernetes LimitRanges

Answer

Standard worker nodes with Network Security Groups (NSGs) applied per pod

Answer

Worker nodes running Docker Engine with privileged containers enabled

Question 15

You are configuring an OCI API Gateway deployment to route requests to backend microservices running on OKE. You need to ensure that if a backend microservice takes longer than 3 seconds to respond, the API Gateway cancels the request and returns a 504 Gateway Timeout error to the client. Where should you configure this timeout?

Accepted Answer

In the API Gateway deployment specification under the route backend configuration timeout parameter.. OCI API Gateway route definitions allow configuring backend timeouts (maximum time to wait for a response from the backend) per route.

Answer

In the OCI WAF protection ruleset configuration.

Answer

In the OCI Load Balancer idle timeout setting associated with the subnet.

Answer

In the OKE Kubernetes Ingress resource annotations.

Question 16

You are using Fn Project CLI to deploy an OCI Function. Which command is used to build, push, and deploy the function to your application in OCI in a single streamlined step?

Accepted Answer

fn deploy --app . The 'fn deploy --app ' command builds the image, pushes it to OCIR, and deploys the function configuration to the specified OCI application.

Answer

oci functions function create

Answer

kubectl apply -f function.yaml

Answer

docker build and docker push only

Question 17

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

Accepted Answer

OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload. OCI Service Mesh integrates with OCI Certificates service (or external CAs) to automatically issue, distribute, and rotate workload certificates using sidecar proxies (Envoy) which hot-reload certificates without pod restarts.

Answer

OCI Certbot DaemonSet running on all worker nodes

Answer

OCI Vault automatic key version rotation

Answer

Kubernetes CronJob executing kubectl rollout restart every night

Question 18

Your OKE cluster has multiple worker node pools. You want to ensure that a specific set of resource-intensive machine learning microservices pods are scheduled *only* on dedicated GPU worker nodes, preventing them from running on standard CPU worker nodes. Which Kubernetes feature should you apply to your pods and node pools?

Accepted Answer

Kubernetes taints on GPU node pools and corresponding tolerations on the specific workload pods. Kubernetes node taints and tolerations, combined with node selectors or node affinity, ensure pods are only scheduled onto nodes with matching taints.

Answer

OCI Load Balancer backend set weighting rules

Answer

Kubernetes Horizontal Pod Autoscaler resource targets

Answer

OCI Identity and Access Management dynamic group policies

Question 19

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

Accepted Answer

W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.. OCI API Gateway, OCI Service Mesh (Envoy proxies), and application OpenTelemetry (OTel) SDKs can be configured to propagate W3C trace context headers and export traces to an OTel-compatible collector.

Answer

Kubernetes Liveness probes configured with HTTP GET request headers.

Answer

OCI Audit log queries combined with Object Storage bucket lifecycle rules.

Answer

OCI Notifications service broadcast topics configured with JSON log forwarding.

Question 20

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Accepted Answer

OCI DevOps Service. OCI DevOps service provides fully managed CI/CD developer pipelines for building, testing, and deploying software applications.

Answer

OCI Events Service

Answer

OCI GoldenGate

Answer

OCI Resource Manager