1Z0-997-26 Cloud Native Architecture — 25 Questions

Question 1

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.. OCI Events Service can route events to OCI Streams, which provide durable, at-least-once delivery and allow custom consumer groups to process events. By configuring a DLQ on the function invocation, failed invocations are captured. This combination meets all requirements: guaranteed delivery, filtering (via Events rules), and DLQ.

Answer

OCI API Gateway configured with a mock backend routing to OCI Functions.

Answer

OCI Notifications Service publishing directly to an OCI Object Storage bucket.

Answer

OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

Question 2

Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?

Accepted Answer

OCI IAM Workload Identity for OKE. OCI IAM Workload Identity for OKE allows Kubernetes service accounts to be mapped to OCI IAM policies via dynamic groups, so pods can authenticate to OCI services like Autonomous Database using short-lived tokens instead of static credentials. This eliminates the need to store plain-text DB passwords in Kubernetes Secrets, since the pod's service account identity is federated directly to OCI IAM.

Answer

Kubernetes Persistent Volume Claims with Block Storage

Answer

OCI Vault Master Encryption Key rotation

Answer

OCI Bastion Service port forwarding

Question 3

You are managing an OKE cluster where developer teams frequently deploy new microservice versions. You need to implement a canary deployment strategy where 10% of production traffic is automatically routed to the new version while 90% goes to the stable version, without rewriting your application code. Which tool or pattern should you use?

Accepted Answer

OCI Service Mesh traffic split rules. OCI Service Mesh provides traffic split rules that allow weighted routing between Kubernetes services without application code changes. By defining a VirtualDeployment and HTTPRoute with weighted backends (e.g., 90/10), you achieve canary deployments natively at the mesh layer. This is the idiomatic OCI-native pattern for progressive delivery on OKE.

Answer

OCI Notifications service broadcast rules

Answer

Kubernetes standard Service resource with multiple selectors pointing to the same pod

Answer

OCI Load Balancer listener port re-mapping

Question 4

Your development team needs to build and push container images to a secure, private registry hosted on OCI before deploying them to OKE. Which OCI service should they use?

Accepted Answer

OCI Registry (OCIR). OCI Registry (OCIR) is Oracle's managed, private Docker/OCI-compliant container registry service used to store, version, and distribute container images that are then pulled by OKE clusters. It integrates natively with OCI IAM for authentication and supports both public and private repositories, making it the correct choice for pushing images before OKE deployment. Developers authenticate with an auth token and use standard docker push/pull commands against the regional OCIR endpoint.

Answer

OCI Object Storage standard bucket

Answer

OCI Artifact Registry

Answer

OCI DevOps Code Repository

Question 5

Your OKE cluster has multiple worker node pools. You want to ensure that a specific set of resource-intensive machine learning microservices pods are scheduled *only* on dedicated GPU worker nodes, preventing them from running on standard CPU worker nodes. Which Kubernetes feature should you apply to your pods and node pools?

Accepted Answer

Kubernetes taints on GPU node pools and corresponding tolerations on the specific workload pods. To ensure pods run only on dedicated GPU nodes, you apply taints to the GPU node pools (e.g., nvidia.com/gpu=true:NoSchedule) and matching tolerations to the ML microservice pods. Taints repel pods that do not tolerate them, and tolerations allow the specific pods to be scheduled onto the tainted nodes. This is the standard Kubernetes mechanism for dedicating nodes to specific workloads.

Answer

OCI Load Balancer backend set weighting rules

Answer

Kubernetes Horizontal Pod Autoscaler resource targets

Answer

OCI Identity and Access Management dynamic group policies

Question 6

You are designing a serverless data ingestion pipeline where OCI Functions are triggered by messages arriving in an OCI Stream. Under peak load, messages arrive faster than the functions can process them, causing invocation failures due to concurrency limits. How can you reliably buffer and throttle the event flow before invoking the functions?

Accepted Answer

Use OCI Queue between the stream and the functions, leveraging queue message visibility timeouts and batch polling.. OCI Queue provides a reliable buffer between the stream and the functions. By placing messages into a queue, you can control the rate at which functions are invoked using batch polling and visibility timeouts. This decouples the ingestion rate from the processing rate, preventing invocation failures due to concurrency limits.

Answer

Increase the OCI VCN bandwidth limit to maximum.

Answer

Enable public access on the OCI Functions application endpoint.

Answer

Configure OCI Object Storage lifecycle rules to delete excess messages.

Question 7

You are deploying an application on OKE using Helm charts. You need to ensure that Helm release secrets and deployment state are stored securely and persistently within the cluster so that failed tiller/helm operations do not corrupt deployment tracking. Where does Helm v3 store its release state in OKE by default?

Accepted Answer

Kubernetes Secrets within the respective namespace. Helm v3 stores release state as Kubernetes Secrets in the namespace of the release by default. This replaced Helm v2's Tiller and ConfigMaps, providing better security and persistence within the cluster.

Answer

OCI Object Storage bucket managed by Helm

Answer

OCI Registry chart annotations

Answer

Local SQLite database on the master control plane node

Question 8

When configuring an OCI API Gateway deployment to protect and route traffic to backend services, which THREE authentication or authorization mechanisms are natively supported?

Accepted Answer

Custom authenticator functions written and deployed as OCI Functions. OCI API Gateway natively supports three authentication/authorization mechanisms for API deployments. Option A is correct because you can author a custom authenticator as an OCI Function and reference it in the deployment's authentication policy, letting the function return an authorization decision (e.g., via a callback URL) for each request. Option B is correct because API Gateway can validate JSON Web Tokens (JWTs) against an identity provider's JWKS endpoint, checking issuer, audience, and claims before allowing the request through. Option C is correct because API Gateway supports HTTP Basic Authentication, where credentials are validated against a specified authentication backend or identity provider. Option D is not supported: SSH public key fingerprint authorization is an SSH mechanism and is not an API Gateway authentication policy. Option E is not supported: API Gateway does not directly integrate with Active Directory domain controllers via LDAP sockets over the public internet as a native authentication method.

Answer

SSH Public Key fingerprint authorization

Answer

Direct integration with Active Directory domain controller LDAP sockets over the public internet

Question 9

You are troubleshooting performance bottlenecks in an event-driven architecture using OCI Streaming. Which THREE metrics or indicators should you monitor to detect consumer lag and partitioning issues?

Accepted Answer

Consumer Lag (difference between latest message offset and consumer committed offset). Option B (Consumer Lag) is correct because lag is the definitive indicator of how far a consumer group's committed offset trails the stream's latest message offset; a growing lag signals consumers cannot keep pace with producers. Option C (Partition-level throughput) is correct because OCI Streaming enforces per-partition limits (e.g., 1 MB/s ingress and 2 MB/s egress per partition), so monitoring bytes/messages per second per partition reveals hot partitions, uneven key distribution, and throughput saturation. Option D (GetMessages Latency) is correct because the GetMessages API is how consumers fetch records, and rising latency directly reflects slow reads, throttling, or overloaded consumers, which contributes to lag. Option A is incorrect because VCN Internet Gateway BGP packet drops concern network routing to the internet, not Kafka-style stream consumption. Option E is incorrect because Object Storage bucket download bandwidth is unrelated to OCI Streaming consumer offsets or partition behavior.

Answer

OCI VCN Internet Gateway packet drop count due to BGP routing failures

Answer

OCI Object Storage bucket public download bandwidth

Question 10

When designing cloud-native architectures on OCI using OCI Events and OCI Notifications, which THREE delivery endpoints are natively supported by OCI Notifications for publishing alert or event messages?

Accepted Answer

OCI Queue / OCI Streaming (via service endpoints). OCI Notifications natively supports several subscription delivery protocols, and option A is correct because OCI Notifications can publish messages to OCI Queue and OCI Streaming through their service endpoints, enabling decoupled, cloud-native consumers to process event or alert messages. Option B is correct because HTTPS custom webhooks are a first-class OCI Notifications subscription protocol, allowing delivery of JSON-formatted messages to an external HTTP(S) endpoint. Option E is correct because email is a supported OCI Notifications subscription protocol, commonly used to send alert or event messages to individual recipients or distribution lists. Option C is not correct because OCI Notifications does not natively deliver direct SMS text messages to mobile phone numbers globally. Option D is not correct because fax transmission over analog telephone lines is not a supported OCI Notifications delivery endpoint.

Answer

Direct SMS text messages to mobile phone numbers globally

Answer

Physical fax machine transmission over analog telephone lines

Question 11

An enterprise application deployed on Oracle Container Engine for Kubernetes (OKE) requires low-latency, secure, private connectivity between microservices residing in different Virtual Cloud Network (VCN) subnets without exposing traffic to the public internet. Which OKE add-on or feature should a Solutions Architect implement?

Accepted Answer

OCI Service Mesh. OCI Service Mesh is the correct choice because it provides a dedicated infrastructure layer for managing service-to-service communication within a Kubernetes cluster. It enables secure, low-latency, private connectivity between microservices across different VCN subnets by using sidecar proxies (based on Envoy) that handle traffic routing, mutual TLS (mTLS) for encryption, and fine-grained access policies. This eliminates the need to expose services to the public internet, as all communication stays within the cluster's private network. Other options do not provide this microservices-focused connectivity and security.

Answer

OCI Streaming Service

Answer

Oracle Cloud Guard

Answer

OCI API Gateway

Question 12

You are designing a high-throughput event-driven system on OCI where OCI Functions are invoked asynchronously via OCI Events. A specific function experiences intermittent database connection timeouts during traffic spikes, resulting in dropped events. How should you architect the invocation pipeline to ensure reliable, at-least-once delivery and smooth out spikes?

Accepted Answer

Insert an OCI Queue or OCI Streaming service between OCI Events and the OCI Function to buffer and batch payloads.. OCI Events invokes Functions asynchronously, but there is no built-in retry or buffering mechanism for failed invocations. Inserting OCI Queue or OCI Streaming between Events and the Function decouples the producer from the consumer, providing durable storage of events and allowing the Function to poll and process at its own pace. This architecture smooths traffic spikes, enables at-least-once delivery via queue semantics, and prevents event loss during database timeouts.

Answer

Configure OCI API Gateway with request throttling in front of the OCI Function.

Answer

Increase the maximum memory and execution timeout limits on the OCI Function configuration.

Answer

Deploy the OCI Function inside a public subnet with an internet gateway for faster database roundtrips.

Question 13

Your development team has built a serverless application consisting of multiple OCI Functions. They want to orchestrate these functions into a coherent, server-side workflow that handles parallel execution, error retries, and branching logic. Which OCI service should you use?

Accepted Answer

Oracle Integration. OCI Workflow is not a service; Oracle Cloud Infrastructure Process Automation or OCI Functions coupled with OCI GoldenGate/Streaming might exist, but the native serverless orchestration service designed specifically for chaining tasks and functions is OCI Workflow / OCI GoldenGate? Wait, the correct native service for orchestrating serverless tasks is Oracle Cloud Infrastructure (OCI) GoldenGate? No, OCI GoldenGate is data integration. The actual OCI service for serverless workflow orchestration is Oracle Cloud Infrastructure Process Automation or specifically OCI GoldenGate? Wait, OCI has 'OCI GoldenGate' and 'Oracle Integration'. Let's check OCI native serverless workflow service: Oracle Cloud Infrastructure does not have a dedicated 'AWS Step Functions' equivalent named OCI Workflow, but wait, OCI has 'OCI Workflow' within OCI Data Integration or Oracle Integration. Wait, let's look at the options to provide a realistic OCI service name.

Answer

OCI Streaming

Answer

OCI Resource Manager

Answer

OCI Vault

Question 14

You are configuring an OCI API Gateway deployment to secure a backend microservice running on OKE. You need to implement token-based authentication where the API Gateway validates a JSON Web Token (JWT) issued by an external identity provider before routing the request. Where should you configure this validation?

Accepted Answer

Within an OCI Functions-based custom authorizer or native JWT validation block in the API Gateway deployment specification.. JWT validation at the API Gateway is configured in the API deployment specification, either through a native JWT validation policy (specifying issuer, audience, and public keys/JWKS URI) or via a custom authorizer implemented as an OCI Function. The gateway then rejects requests with invalid or missing tokens before routing to the OKE backend.

Answer

Inside an OCI Events rule matching the incoming HTTP request payload.

Answer

By attaching an OCI IAM policy to the target VCN subnet route table.

Answer

Inside the Ingress Controller configuration manifest deployed on the OKE cluster.

Question 15

Your organization wants to deploy an ephemeral, event-driven data processing task that runs for less than 3 minutes whenever a new object is uploaded to an OCI Object Storage bucket. Which serverless combination is the most cost-effective and operationally efficient solution?

Accepted Answer

Configure an OCI Events rule to trigger an OCI Function upon object creation in Object Storage.. Configuring an OCI Events rule to trigger an OCI Function when an object is created in Object Storage is the most cost-effective and operationally efficient serverless pattern. It is event-driven, requires no idle infrastructure, and scales automatically with the workload. This aligns with the serverless paradigm for short, event-triggered tasks.

Answer

Use an OCI Database with PL/SQL triggers to download files from Object Storage.

Answer

Deploy a Kubernetes deployment with 10 replicas on an OKE cluster to monitor bucket logs.

Answer

Provision an Always Free Compute VM running a cron job that polls Object Storage every minute.

Question 16

You are designing a serverless event-driven architecture on OCI using OCI Events, OCI Notifications, and OCI Functions. Which THREE actions are valid capabilities when integrating these services? (Choose three.)

Accepted Answer

OCI Notifications can publish messages to email, PagerDuty, or HTTPS endpoints triggered by service alarms or events.. Option A is correct because OCI Notifications supports multiple subscription protocols including email, PagerDuty, HTTPS, Slack, and SMS, and its topics can be triggered by OCI Events rules or by alarms from the Monitoring service, making it a valid fan-out mechanism in an event-driven design. Option C is correct because OCI Events can ingest custom events published through the OCI SDK/CLI (via the Events service's custom event ingestion API), allowing application-generated events to drive rules alongside native service events. Option D is correct because an OCI Events rule's action can target a Function directly (in addition to Notifications topics, Streaming, and other targets), which is the core pattern for serverless event-driven execution. Option B is not correct because OCI Functions enforces a maximum function execution timeout (configurable up to 300 seconds per invocation), so functions cannot run for 24 hours. Option E is not correct because a function runs inside a VCN subnet and reaching an OCI Database (e.g., Autonomous Database or DB system) requires proper network configuration such as private endpoints, security lists/NSGs, and routing, not an unrestricted public IP path.

Answer

OCI Functions can execute indefinitely without any timeout restrictions up to 24 hours.

Answer

An OCI Function can be configured to invoke an OCI Database directly over a public IP without any VCN security configurations.

Question 17

Your OCI API Gateway deployment exposes a public endpoint that proxies requests to a backend service in a private subnet. You must ensure that the backend service instances only accept traffic that originated from the API Gateway deployment and reject any request that bypasses it. The deployment uses a public subnet for the gateway itself. Which configuration achieves this with the least operational overhead?

Accepted Answer

Configure the API Gateway to use a private endpoint, then attach a Network Security Group to the backend instances that allows ingress only from the API Gateway's subnet CIDR.. A private API Gateway endpoint makes the gateway a VCN-native resource, so requests to the backend originate from a known private subnet. Applying a Network Security Group that permits ingress only from that subnet CIDR restricts the backend to gateway traffic at the network layer. This satisfies origin enforcement without per-request logic, WAF rules, or public exposure, and it keeps ongoing operational effort minimal.

Answer

Add an API Gateway authorizer that validates a shared secret header, and configure the backend to reject requests missing that header.

Answer

Create an OCI Web Application Firewall policy in front of the backend and enable only the API Gateway's public IP address in the allow list.

Answer

Place the backend instances in a public subnet and use a security list that allows ingress from 0.0.0.0/0 on the service port, relying on the API Gateway's TLS termination for protection.

Question 18

A development team deploys a polyglot microservices application on OKE. Each service writes structured logs to stdout, and the team wants per-request correlation across services without modifying application code to emit trace IDs. They already use OCI Logging and OCI Monitoring. Which combination should an architect recommend to achieve end-to-end request correlation with minimal code change?

Accepted Answer

Deploy the OCI Logging Kubernetes agent as a DaemonSet, enable OCI Logging for the cluster, and use the request ID injected by OCI API Gateway at the edge, propagated through HTTP headers by the service mesh.. The OCI Logging Kubernetes agent streams container stdout to OCI Logging without application edits. OCI API Gateway injects a request ID at the edge, and a service mesh propagates that header between services. This platform-driven chain yields per-request correlation across polyglot services while avoiding code changes, satisfying both the correlation and minimal-modification requirements.

Answer

Instrument each service with the OCI Application Performance Monitoring Java agent and rely on its automatic trace context propagation across all language runtimes.

Answer

Enable OCI Flow Logs on the cluster's VCN and parse the five-tuple fields to reconstruct request paths between pods.

Answer

Configure OCI Monitoring alarms on each service's CPU and memory metrics, and correlate incidents using the alarm timestamps in OCI Notifications.

Question 19

You are designing a serverless workflow where an OCI Function must process messages from an OCI Streaming stream. The function must scale with partition count and must not lose messages if a function invocation fails. Which design should you recommend?

Accepted Answer

Deploy a consumer application on OCI Container Instances that reads the stream with a consumer group, commits offsets only after successful processing, and scales instances based on partition assignment.. OCI Streaming consumer groups distribute partitions among consumers, and committing offsets only after successful processing provides at-least-once delivery. Running consumers on OCI Container Instances gives explicit offset control and lets the fleet scale with partition count. This meets the scaling and no-loss goals, whereas Functions triggers do not manage offsets and Events cannot deliver per-message triggers.

Answer

Use OCI Events to trigger the Function for each message, and configure the rule to retry failed invocations indefinitely until the function succeeds.

Answer

Create a Function with a Streaming trigger, and rely on the Functions service to checkpoint offsets only after the function returns successfully.

Answer

Configure the Function to poll the stream using the OCI SDK, and set the function timeout high enough to process an entire partition before returning.

Question 20

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication policies that can validate JSON Web Tokens (JWT) issued by an identity provider before forwarding requests to backend services. Configuring a JWT validation authentication policy ensures only requests with a valid, unexpired token from the trusted issuer reach the microservices. This is the native, purpose-built feature for token-based API authentication.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule