1Z0-997-26 Cloud Native Architecture Practice Test 2 — 15 Questions

Question 1

You are designing a serverless event-driven architecture on OCI using OCI Events, OCI Notifications, and OCI Functions. Which THREE actions are valid capabilities when integrating these services? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Notifications can publish messages to email, PagerDuty, or HTTPS endpoints triggered by service alarms or events.. Option A is correct because OCI Notifications supports multiple subscription protocols including email, PagerDuty, HTTPS, Slack, and SMS, and its topics can be triggered by OCI Events rules or by alarms from the Monitoring service, making it a valid fan-out mechanism in an event-driven design. Option C is correct because OCI Events can ingest custom events published through the OCI SDK/CLI (via the Events service's custom event ingestion API), allowing application-generated events to drive rules alongside native service events. Option D is correct because an OCI Events rule's action can target a Function directly (in addition to Notifications topics, Streaming, and other targets), which is the core pattern for serverless event-driven execution. Option B is not correct because OCI Functions enforces a maximum function execution timeout (configurable up to 300 seconds per invocation), so functions cannot run for 24 hours. Option E is not correct because a function runs inside a VCN subnet and reaching an OCI Database (e.g., Autonomous Database or DB system) requires proper network configuration such as private endpoints, security lists/NSGs, and routing, not an unrestricted public IP path.

Answer

OCI Functions can execute indefinitely without any timeout restrictions up to 24 hours.

Answer

An OCI Function can be configured to invoke an OCI Database directly over a public IP without any VCN security configurations.

Question 2

Your OCI API Gateway deployment exposes a public endpoint that proxies requests to a backend service in a private subnet. You must ensure that the backend service instances only accept traffic that originated from the API Gateway deployment and reject any request that bypasses it. The deployment uses a public subnet for the gateway itself. Which configuration achieves this with the least operational overhead?

Accepted Answer

Configure the API Gateway to use a private endpoint, then attach a Network Security Group to the backend instances that allows ingress only from the API Gateway's subnet CIDR.. A private API Gateway endpoint makes the gateway a VCN-native resource, so requests to the backend originate from a known private subnet. Applying a Network Security Group that permits ingress only from that subnet CIDR restricts the backend to gateway traffic at the network layer. This satisfies origin enforcement without per-request logic, WAF rules, or public exposure, and it keeps ongoing operational effort minimal.

Answer

Add an API Gateway authorizer that validates a shared secret header, and configure the backend to reject requests missing that header.

Answer

Create an OCI Web Application Firewall policy in front of the backend and enable only the API Gateway's public IP address in the allow list.

Answer

Place the backend instances in a public subnet and use a security list that allows ingress from 0.0.0.0/0 on the service port, relying on the API Gateway's TLS termination for protection.

Question 3

A development team deploys a polyglot microservices application on OKE. Each service writes structured logs to stdout, and the team wants per-request correlation across services without modifying application code to emit trace IDs. They already use OCI Logging and OCI Monitoring. Which combination should an architect recommend to achieve end-to-end request correlation with minimal code change?

Accepted Answer

Deploy the OCI Logging Kubernetes agent as a DaemonSet, enable OCI Logging for the cluster, and use the request ID injected by OCI API Gateway at the edge, propagated through HTTP headers by the service mesh.. The OCI Logging Kubernetes agent streams container stdout to OCI Logging without application edits. OCI API Gateway injects a request ID at the edge, and a service mesh propagates that header between services. This platform-driven chain yields per-request correlation across polyglot services while avoiding code changes, satisfying both the correlation and minimal-modification requirements.

Answer

Instrument each service with the OCI Application Performance Monitoring Java agent and rely on its automatic trace context propagation across all language runtimes.

Answer

Enable OCI Flow Logs on the cluster's VCN and parse the five-tuple fields to reconstruct request paths between pods.

Answer

Configure OCI Monitoring alarms on each service's CPU and memory metrics, and correlate incidents using the alarm timestamps in OCI Notifications.

Question 4

You are designing a serverless workflow where an OCI Function must process messages from an OCI Streaming stream. The function must scale with partition count and must not lose messages if a function invocation fails. Which design should you recommend?

Accepted Answer

Deploy a consumer application on OCI Container Instances that reads the stream with a consumer group, commits offsets only after successful processing, and scales instances based on partition assignment.. OCI Streaming consumer groups distribute partitions among consumers, and committing offsets only after successful processing provides at-least-once delivery. Running consumers on OCI Container Instances gives explicit offset control and lets the fleet scale with partition count. This meets the scaling and no-loss goals, whereas Functions triggers do not manage offsets and Events cannot deliver per-message triggers.

Answer

Use OCI Events to trigger the Function for each message, and configure the rule to retry failed invocations indefinitely until the function succeeds.

Answer

Create a Function with a Streaming trigger, and rely on the Functions service to checkpoint offsets only after the function returns successfully.

Answer

Configure the Function to poll the stream using the OCI SDK, and set the function timeout high enough to process an entire partition before returning.

Question 5

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Accepted Answer

Authentication policy using JWT validation. OCI API Gateway supports authentication policies that can validate JSON Web Tokens (JWT) issued by an identity provider before forwarding requests to backend services. Configuring a JWT validation authentication policy ensures only requests with a valid, unexpired token from the trusted issuer reach the microservices. This is the native, purpose-built feature for token-based API authentication.

Answer

OCI Identity and Access Management (IAM) dynamic groups

Answer

Network Security Group (NSG) ingress rules on the API Gateway subnet

Answer

OCI Web Application Firewall (WAF) rate limiting rule

Question 6

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

Accepted Answer

Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.. OCI Functions allow you to configure the function timeout up to the service limit (default 30 seconds, maximum 300 seconds) via the Fn Project CLI or OCI Console. Increasing the timeout directly addresses the failure when calling a slow third-party REST API, and is the recommended best practice for long-running calls.

Answer

Increase the memory allocation to automatically and proportionally increase the timeout limit.

Answer

Deploy the function behind an OCI Load Balancer to cache timeout requests.

Answer

Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

Question 7

You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?

Accepted Answer

OCI API Gateway route pointing to the OCI Function. OCI API Gateway can be configured with a route that points to an OCI Function as its backend, exposing the function via a public HTTP URL. This lets you invoke the function directly with a browser or curl without writing custom client code or dealing with OCI's native signed-request authentication.

Answer

OCI Object Storage pre-authenticated request (PAR)

Answer

OCI Cloud Guard trigger policy

Answer

OCI Streaming cursor initialization

Question 8

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

Accepted Answer

Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter. The Kubernetes Horizontal Pod Autoscaler (HPA) can scale pods based on custom metrics when integrated with Prometheus and the Prometheus Adapter. The adapter exposes custom metrics from Prometheus to the Kubernetes metrics API, allowing HPA to query metrics like active queue length and scale accordingly. This is the standard approach for custom metric-based autoscaling in OKE.

Answer

Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits

Answer

OCI Autoscaling for OKE worker nodes

Answer

OCI Instance Pool autoscaling configuration

Question 9

You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?

Accepted Answer

Configure each consumer instance to belong to a separate, unique consumer group.. In OCI Streaming, a consumer group allows multiple consumers to coordinate and share the message processing load, with each message delivered to only one consumer in the group. To have each consumer instance maintain its own independent cursor and process every message, each instance must belong to a separate, unique consumer group. This way, each group gets its own copy of all messages, and each instance can track its own offset independently.

Answer

Use the OCI Streaming default single-consumer mode with multithreaded polling.

Answer

Assign all consumer instances to the exact same consumer group and increase the number of partitions.

Answer

Publish events via OCI Notifications instead, as Streaming does not support consumer groups.

Question 10

You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?

Accepted Answer

OCI Native Ingress Controller configured with an OCI Load Balancer. The OCI Native Ingress Controller integrates with OCI Load Balancer to provision a single public load balancer with one public IP, and it supports Kubernetes Ingress rules including URL path-based routing to backend services. This is the standard OKE pattern for exposing multiple internal services externally through one entry point with path-based routing.

Answer

OCI File Storage Service mounted on all worker nodes

Answer

Kubernetes NodePort service directly pointing to every individual pod

Answer

OCI API Gateway without any OKE Ingress

Question 11

An OCI Function in your serverless architecture needs to process large files (up to 5GB) uploaded to an OCI Object Storage bucket. Due to ephemeral storage limits inside the function container (/tmp), the function crashes when attempting to download the entire file locally. How should you redesign this function processing flow?

Accepted Answer

Stream the file contents in chunks using Object Storage API range requests and process data iteratively without full local storage.. Streaming the file in chunks using Object Storage API range requests allows the function to process data iteratively without storing the entire 5GB file locally, staying within the /tmp ephemeral storage limit. This is the recommended serverless pattern for large files, as it avoids memory and disk exhaustion.

Answer

Attach an OCI Block Volume directly to the OCI Function container instance.

Answer

Increase the OCI Function memory allocation to automatically provision a larger /tmp filesystem.

Answer

Mount an OCI File Storage Service (FSS) target over the internet inside the function code.

Question 12

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Accepted Answer

OCI Vault (Secrets management). OCI Vault's Secrets management feature is designed to store sensitive values like database connection strings and API keys, and OCI Functions can retrieve them securely at runtime via the OCI SDK or by referencing them as environment variables. This keeps secrets encrypted and access-controlled through IAM policies.

Answer

OCI Object Storage public bucket

Answer

OCI Audit log retention policy

Answer

OCI Resource Manager stack configuration output

Question 13

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

Accepted Answer

Worker nodes utilizing Kata Containers runtime for hardware-level isolation. Kata Containers provide hardware-level isolation by running each container inside a lightweight virtual machine with its own kernel, so a container breakout affects only that VM and cannot compromise other tenants. This is the correct choice when strict kernel-level isolation is required on OKE.

Answer

Standard OKE worker nodes with Kubernetes LimitRanges

Answer

Standard worker nodes with Network Security Groups (NSGs) applied per pod

Answer

Worker nodes running Docker Engine with privileged containers enabled

Question 14

You are configuring an OCI API Gateway deployment to route requests to backend microservices running on OKE. You need to ensure that if a backend microservice takes longer than 3 seconds to respond, the API Gateway cancels the request and returns a 504 Gateway Timeout error to the client. Where should you configure this timeout?

Accepted Answer

In the API Gateway deployment specification under the route backend configuration timeout parameter.. The API Gateway deployment specification includes a route backend configuration where you can set a timeout parameter that controls how long the gateway waits for a backend response before returning a 504 Gateway Timeout. Configuring the timeout there ensures the gateway cancels the request after 3 seconds as required.

Answer

In the OCI WAF protection ruleset configuration.

Answer

In the OCI Load Balancer idle timeout setting associated with the subnet.

Answer

In the OKE Kubernetes Ingress resource annotations.

Question 15

You are using Fn Project CLI to deploy an OCI Function. Which command is used to build, push, and deploy the function to your application in OCI in a single streamlined step?

Accepted Answer

fn deploy --app . The Fn Project CLI command 'fn deploy --app ' performs the full lifecycle in one step: it builds the function image from the func.yaml, pushes it to the configured Docker registry (such as OCIR), and creates or updates the function and its route in the specified OCI Functions application. This is the canonical streamlined deployment command used with OCI Functions.

Answer

oci functions function create

Answer

kubectl apply -f function.yaml

Answer

docker build and docker push only