1Z0-997-26 Cloud Native Architecture Practice Test 3 — 15 Questions

Question 1

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload. OCI Service Mesh uses an Envoy sidecar proxy injected into each pod, and its control plane (based on Istio) performs automated certificate management — issuing, rotating, and hot-reloading X.509 certificates via the Envoy SDS (Secret Discovery Service) API without restarting the pod or the proxy. This eliminates the connection drops caused by stale certificates, since the sidecar picks up the new cert in-memory.

Answer

OCI Certbot DaemonSet running on all worker nodes

Answer

OCI Vault automatic key version rotation

Answer

Kubernetes CronJob executing kubectl rollout restart every night

Question 2

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

Accepted Answer

W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.. Distributed tracing across API Gateway, service mesh sidecars, and application pods requires a common trace context propagated end-to-end. The W3C Trace Context standard (traceparent/tracestate headers) is the open standard that API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs all understand, allowing spans to be correlated and exported to any OpenTelemetry-compatible backend. This is the only option that describes an actual tracing architecture.

Answer

Kubernetes Liveness probes configured with HTTP GET request headers.

Answer

OCI Audit log queries combined with Object Storage bucket lifecycle rules.

Answer

OCI Notifications service broadcast topics configured with JSON log forwarding.

Question 3

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Accepted Answer

OCI DevOps Service. OCI DevOps Service is Oracle Cloud Infrastructure's native CI/CD platform, providing build pipelines, deployment pipelines, and artifact repositories that integrate directly with Git repositories. It automates the build, test, and deployment phases triggered by code pushes, making it the correct choice for native CI/CD on OCI. The other services serve different purposes such as event handling, data replication, or infrastructure-as-code.

Answer

OCI Events Service

Answer

OCI GoldenGate

Answer

OCI Resource Manager

Question 4

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

Accepted Answer

Configure an OCI Service Gateway in your VCN and add a route rule for OCI Services to the private subnet's route table.. An OCI Service Gateway provides private access from a VCN to OCI public services like OCIR without traversing the internet. By adding a route rule in the private subnet's route table pointing OCI Services traffic to the Service Gateway, pods can pull images securely while worker nodes remain isolated from the public internet.

Answer

Install an external Squid proxy on an on-premises server connected via IPsec VPN.

Answer

Set up a NAT Gateway and forward all traffic to the internet.

Answer

Attach a Public IP address to every worker node in the OKE cluster.

Question 5

Your OKE cluster uses Calico for Kubernetes network policy enforcement. You need to write a network policy that allows Pod A in namespace 'frontend' to communicate with Pod B in namespace 'backend', while blocking all other ingress traffic to Pod B. How should you implement this?

Accepted Answer

Create a Kubernetes NetworkPolicy in the 'backend' namespace selecting Pod B and allowing ingress exclusively from namespace 'frontend'.. A Kubernetes NetworkPolicy in the 'backend' namespace that selects Pod B and allows ingress only from namespace 'frontend' is the correct Calico-enforced approach. NetworkPolicies are namespace-scoped, select pods by labels, and define allowed ingress/egress, which is exactly what is needed to permit frontend-to-backend while blocking all other ingress.

Answer

Apply an OCI Identity and Access Management (IAM) policy restricting pod access.

Answer

Configure an OCI Load Balancer listener rule for namespace ports.

Answer

Modify the VCN Security List for the worker node subnet to filter traffic by pod name.

Question 6

You are designing a disaster recovery strategy for a stateful microservices application running on OKE across two OCI regions. Persistent data is stored on OCI Block Volumes. What is the recommended approach to replicate persistent storage data across regions for stateful workloads?

Accepted Answer

Configure cross-region block volume asynchronous replication to the secondary region.. Cross-region asynchronous block volume replication is the native OCI feature designed to copy Block Volume data from a primary region to a secondary region for DR. It continuously replicates volume data at the block level, so stateful workloads on OKE can fail over and reattach replicated volumes in the secondary region. This is the recommended, supported approach for cross-region persistence in OCI.

Answer

Rely on Kubernetes Persistent Volume snapshots stored locally on worker node local NVMe drives.

Answer

Attach the same Block Volume simultaneously to worker nodes in both regions across the VCN peering.

Answer

Use OCI Streaming to replicate raw block storage disk sectors.

Question 7

You have deployed an API on OCI API Gateway and want to protect it from common web attacks such as SQL injection, cross-site scripting (XSS), and bad bots. Which OCI service should you integrate with API Gateway?

Accepted Answer

OCI Web Application Firewall (WAF). OCI Web Application Firewall (WAF) is designed to protect web applications and APIs from common web attacks like SQL injection, XSS, and bad bots by inspecting HTTP/HTTPS traffic and applying rule-based filtering. It integrates directly with OCI API Gateway, allowing you to attach a WAF policy to the gateway to enforce security rules at the edge. This integration provides layer 7 protection without modifying the backend API.

Answer

OCI Vulnerability Scanning Service

Answer

OCI Bastion Service

Answer

OCI Cloud Guard

Question 8

Your OCI Function needs to write audit logs or custom debugging information that can be easily searched and analyzed alongside other cloud logs. Which OCI service should your function log to?

Accepted Answer

OCI Logging Service. OCI Logging Service is the correct choice because it is a fully managed, scalable service that ingests, aggregates, and indexes log data from various OCI resources, including Functions. It allows you to search, analyze, and correlate logs across services, and supports custom logs from serverless functions. By logging to OCI Logging, the function's audit and debug information becomes part of the centralized logging platform, enabling easy querying and integration with other cloud logs.

Answer

OCI DNS Service

Answer

OCI Vault

Answer

OCI Email Delivery Service

Question 9

You are troubleshooting a microservice on OKE that is experiencing intermittent 502 Bad Gateway errors when communicating with another internal service. The application uses Kubernetes ClusterIP services for discovery. You suspect DNS resolution failure within the cluster. Which diagnostic tool and approach should you use inside the OKE cluster?

Accepted Answer

Deploy a temporary diagnostic container pod (such as netshoot) and test DNS resolution using nslookup against CoreDNS.. Deploying a temporary diagnostic container pod such as netshoot and testing DNS resolution with nslookup against CoreDNS is the correct approach. This allows you to verify whether the cluster's DNS service (CoreDNS) is resolving the internal service name correctly from within a pod, which directly addresses the suspected DNS resolution failure causing 502 errors. It is a standard Kubernetes troubleshooting technique that isolates DNS issues from application or network issues.

Answer

Check the OCI VCN internet gateway route table.

Answer

Review OCI Cloud Guard threat detection policies.

Answer

Restart the OCI API Gateway service.

Question 10

You need to trigger an OCI Function asynchronously whenever an object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the event router between Object Storage and the Function?

Accepted Answer

OCI Events Service. OCI Events Service is the native event-routing service in OCI that listens to Object Storage bucket events (such as ObjectCreate) and delivers them to targets like OCI Functions, Notifications, or Streaming. When an object is uploaded, Object Storage emits an event to the Events Service, which matches it against a rule and invokes the Function asynchronously. This decouples the storage layer from the compute layer and is the standard serverless event-driven pattern in OCI.

Answer

OCI DNS

Answer

OCI File Storage Service

Answer

OCI Data Transfer Service

Question 11

Your OKE cluster has autoscaling enabled using the Kubernetes Cluster Autoscaler. However, during peak hours, new pods remain in 'Pending' state for 15 minutes before the cluster autoscaler provisions new worker nodes. How can you reduce this provisioning delay?

Accepted Answer

Deploy Kubernetes over-provisioning pods (pause pods) with lower priority to keep spare node capacity ready instantly.. Over-provisioning pods (low-priority pause pods) reserve spare capacity on existing nodes so that when a real workload pod is scheduled, it can immediately preempt the pause pod and start running without waiting for the Cluster Autoscaler to provision a new node. This eliminates the 15-minute node provisioning delay during peak hours.

Answer

Convert all worker nodes from virtual machines to bare metal shapes.

Answer

Increase the OCI Load Balancer bandwidth shape to maximum.

Answer

Disable OCI IAM token caching on worker nodes.

Question 12

You are architecting a multi-region cloud-native application where OCI API Gateway is deployed in Region A and Region B. You need to ensure that global users are automatically routed to the closest healthy API Gateway endpoint with automatic failover if an entire OCI region experiences an outage. Which OCI service should you use in front of the API Gateways?

Accepted Answer

OCI DNS Traffic Management Steering with Failover and Health Checks. OCI Traffic Management (or OCI DNS Traffic Management / Global Load Balancing) routes users across multiple regions based on latency, geo-location, or failover policies.

Answer

OCI File Storage cross-region replication

Answer

OCI Bastion Service in the primary region

Answer

OCI Local VCN Peering across regions

Question 13

Which TWO of the following are key architectural benefits of adopting serverless OCI Functions compared to managing traditional container clusters for event-driven tasks?

Accepted Answer

Automatic scaling from zero to thousands of executions based on incoming events without managing servers. Option D is correct because OCI Functions is a fully managed FaaS platform that automatically scales the function fleet from zero to thousands of concurrent executions in response to incoming events, eliminating the need to provision, patch, or manage any servers or worker nodes. Option E is correct because OCI Functions bills on a pay-as-you-go model based on actual execution time measured in milliseconds (plus invocation counts and provisioned resources), so you pay only for the compute actually consumed rather than for idle cluster capacity. Option A is incorrect because manual Kubernetes Horizontal Pod Autoscalers are a container-cluster concern; serverless functions abstract away pod and HPA management entirely. Option B is incorrect because no serverless platform guarantees permanent warm containers or zero cold starts; cold starts can still occur when scaling from zero. Option C is incorrect because serverless platforms deliberately hide the underlying hypervisor and host OS kernel, providing no root administrative access to that infrastructure.

Answer

Built-in requirement to configure manual Kubernetes Horizontal Pod Autoscalers

Answer

Guaranteed permanent container warm-start memory caching with zero cold starts ever

Answer

Full administrative root access to the underlying hypervisor and host operating system kernel

Question 14

Which TWO of the following are valid methods to trigger an OCI Function execution?

Accepted Answer

OCI Events Service rule reacting to object storage or compute state changes. Option B is correct because the OCI Events Service can publish events (for example, Object Storage object-create or Compute instance state-change events) that match a rule and invoke a Function as the rule's action, making event-driven invocation a valid trigger method. Option D is correct because OCI Functions can be exposed as HTTP endpoints, and OCI API Gateway can route incoming HTTP requests to a Function, so client HTTP calls through the gateway trigger function execution. Option A is not a trigger: IAM password rotation policy is an identity/security governance setting and does not invoke Functions. Option C is not a trigger: physically inserting a USB drive into Exadata infrastructure is not an OCI control-plane or event mechanism for Functions. Option E is not a trigger: Block Volume defragmentation scheduling is a storage maintenance operation and does not invoke Functions.

Answer

OCI Identity and Access Management password rotation policy

Answer

Direct physical USB drive insertion into OCI Exadata infrastructure

Answer

OCI Block Volume disk defragmentation schedule

Question 15

You are designing an OKE-based cloud-native microservices architecture and want to ensure high availability and robust security isolation. Which THREE architectural best practices should you implement?

Accepted Answer

Enable private Kubernetes API server endpoint access so the control plane is not exposed publicly.. Option A is correct because enabling a private Kubernetes API server endpoint in OKE ensures the control plane is only reachable through the VCN (via private IPs, VPN, FastConnect, or bastion), removing public internet exposure and reducing the attack surface for the cluster's management plane. Option B is correct because placing worker nodes in private subnets with no public IPs prevents direct inbound internet access to nodes, forcing traffic through controlled ingress (load balancers, NAT gateway for egress), which enforces network isolation and least-privilege connectivity. Option C is correct because spreading worker node pools across multiple Fault Domains or Availability Domains within the region provides fault tolerance against AD/FD-level failures, so the loss of one domain does not take down all worker capacity and preserves high availability. Option D is incorrect because disabling Kubernetes RBAC removes authorization controls, granting unrestricted access and violating the security isolation requirement rather than improving it. Option E is incorrect because running all system pods and workloads in the default namespace as root eliminates namespace-based isolation and least-privilege execution, which are core security best practices for multi-tenant or microservices architectures.

Answer

Disable all Kubernetes RBAC authorization to allow unrestricted developer deployments.

Answer

Run all Kubernetes system pods and application workloads in the 'default' namespace as root user.