1Z0-997-26 Cloud Native Architecture — Timed 10 Questions

Question 1

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

10 minute time limit — choose an answer to begin.

Accepted Answer

OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.. OCI Events Service can route events to OCI Streams, which provide durable, at-least-once delivery and allow custom consumer groups to process events. By configuring a DLQ on the function invocation, failed invocations are captured. This combination meets all requirements: guaranteed delivery, filtering (via Events rules), and DLQ.

Answer

OCI API Gateway configured with a mock backend routing to OCI Functions.

Answer

OCI Notifications Service publishing directly to an OCI Object Storage bucket.

Answer

OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

Question 2

Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?

Accepted Answer

OCI IAM Workload Identity for OKE. OCI IAM Workload Identity for OKE allows Kubernetes service accounts to be mapped to OCI IAM policies via dynamic groups, so pods can authenticate to OCI services like Autonomous Database using short-lived tokens instead of static credentials. This eliminates the need to store plain-text DB passwords in Kubernetes Secrets, since the pod's service account identity is federated directly to OCI IAM.

Answer

Kubernetes Persistent Volume Claims with Block Storage

Answer

OCI Vault Master Encryption Key rotation

Answer

OCI Bastion Service port forwarding

Question 3

You are managing an OKE cluster where developer teams frequently deploy new microservice versions. You need to implement a canary deployment strategy where 10% of production traffic is automatically routed to the new version while 90% goes to the stable version, without rewriting your application code. Which tool or pattern should you use?

Accepted Answer

OCI Service Mesh traffic split rules. OCI Service Mesh provides traffic split rules that allow weighted routing between Kubernetes services without application code changes. By defining a VirtualDeployment and HTTPRoute with weighted backends (e.g., 90/10), you achieve canary deployments natively at the mesh layer. This is the idiomatic OCI-native pattern for progressive delivery on OKE.

Answer

OCI Notifications service broadcast rules

Answer

Kubernetes standard Service resource with multiple selectors pointing to the same pod

Answer

OCI Load Balancer listener port re-mapping

Question 4

Your development team needs to build and push container images to a secure, private registry hosted on OCI before deploying them to OKE. Which OCI service should they use?

Accepted Answer

OCI Registry (OCIR). OCI Registry (OCIR) is Oracle's managed, private Docker/OCI-compliant container registry service used to store, version, and distribute container images that are then pulled by OKE clusters. It integrates natively with OCI IAM for authentication and supports both public and private repositories, making it the correct choice for pushing images before OKE deployment. Developers authenticate with an auth token and use standard docker push/pull commands against the regional OCIR endpoint.

Answer

OCI Object Storage standard bucket

Answer

OCI Artifact Registry

Answer

OCI DevOps Code Repository

Question 5

Your OKE cluster has multiple worker node pools. You want to ensure that a specific set of resource-intensive machine learning microservices pods are scheduled *only* on dedicated GPU worker nodes, preventing them from running on standard CPU worker nodes. Which Kubernetes feature should you apply to your pods and node pools?

Accepted Answer

Kubernetes taints on GPU node pools and corresponding tolerations on the specific workload pods. To ensure pods run only on dedicated GPU nodes, you apply taints to the GPU node pools (e.g., nvidia.com/gpu=true:NoSchedule) and matching tolerations to the ML microservice pods. Taints repel pods that do not tolerate them, and tolerations allow the specific pods to be scheduled onto the tainted nodes. This is the standard Kubernetes mechanism for dedicating nodes to specific workloads.

Answer

OCI Load Balancer backend set weighting rules

Answer

Kubernetes Horizontal Pod Autoscaler resource targets

Answer

OCI Identity and Access Management dynamic group policies

Question 6

You are designing a serverless data ingestion pipeline where OCI Functions are triggered by messages arriving in an OCI Stream. Under peak load, messages arrive faster than the functions can process them, causing invocation failures due to concurrency limits. How can you reliably buffer and throttle the event flow before invoking the functions?

Accepted Answer

Use OCI Queue between the stream and the functions, leveraging queue message visibility timeouts and batch polling.. OCI Queue provides a reliable buffer between the stream and the functions. By placing messages into a queue, you can control the rate at which functions are invoked using batch polling and visibility timeouts. This decouples the ingestion rate from the processing rate, preventing invocation failures due to concurrency limits.

Answer

Increase the OCI VCN bandwidth limit to maximum.

Answer

Enable public access on the OCI Functions application endpoint.

Answer

Configure OCI Object Storage lifecycle rules to delete excess messages.

Question 7

You are deploying an application on OKE using Helm charts. You need to ensure that Helm release secrets and deployment state are stored securely and persistently within the cluster so that failed tiller/helm operations do not corrupt deployment tracking. Where does Helm v3 store its release state in OKE by default?

Accepted Answer

Kubernetes Secrets within the respective namespace. Helm v3 stores release state as Kubernetes Secrets in the namespace of the release by default. This replaced Helm v2's Tiller and ConfigMaps, providing better security and persistence within the cluster.

Answer

OCI Object Storage bucket managed by Helm

Answer

OCI Registry chart annotations

Answer

Local SQLite database on the master control plane node

Question 8

When configuring an OCI API Gateway deployment to protect and route traffic to backend services, which THREE authentication or authorization mechanisms are natively supported?

Accepted Answer

Custom authenticator functions written and deployed as OCI Functions. OCI API Gateway natively supports three authentication/authorization mechanisms for API deployments. Option A is correct because you can author a custom authenticator as an OCI Function and reference it in the deployment's authentication policy, letting the function return an authorization decision (e.g., via a callback URL) for each request. Option B is correct because API Gateway can validate JSON Web Tokens (JWTs) against an identity provider's JWKS endpoint, checking issuer, audience, and claims before allowing the request through. Option C is correct because API Gateway supports HTTP Basic Authentication, where credentials are validated against a specified authentication backend or identity provider. Option D is not supported: SSH public key fingerprint authorization is an SSH mechanism and is not an API Gateway authentication policy. Option E is not supported: API Gateway does not directly integrate with Active Directory domain controllers via LDAP sockets over the public internet as a native authentication method.

Answer

SSH Public Key fingerprint authorization

Answer

Direct integration with Active Directory domain controller LDAP sockets over the public internet

Question 9

You are troubleshooting performance bottlenecks in an event-driven architecture using OCI Streaming. Which THREE metrics or indicators should you monitor to detect consumer lag and partitioning issues?

Accepted Answer

Consumer Lag (difference between latest message offset and consumer committed offset). Option B (Consumer Lag) is correct because lag is the definitive indicator of how far a consumer group's committed offset trails the stream's latest message offset; a growing lag signals consumers cannot keep pace with producers. Option C (Partition-level throughput) is correct because OCI Streaming enforces per-partition limits (e.g., 1 MB/s ingress and 2 MB/s egress per partition), so monitoring bytes/messages per second per partition reveals hot partitions, uneven key distribution, and throughput saturation. Option D (GetMessages Latency) is correct because the GetMessages API is how consumers fetch records, and rising latency directly reflects slow reads, throttling, or overloaded consumers, which contributes to lag. Option A is incorrect because VCN Internet Gateway BGP packet drops concern network routing to the internet, not Kafka-style stream consumption. Option E is incorrect because Object Storage bucket download bandwidth is unrelated to OCI Streaming consumer offsets or partition behavior.

Answer

OCI VCN Internet Gateway packet drop count due to BGP routing failures

Answer

OCI Object Storage bucket public download bandwidth

Question 10

When designing cloud-native architectures on OCI using OCI Events and OCI Notifications, which THREE delivery endpoints are natively supported by OCI Notifications for publishing alert or event messages?

Accepted Answer

OCI Queue / OCI Streaming (via service endpoints). OCI Notifications natively supports several subscription delivery protocols, and option A is correct because OCI Notifications can publish messages to OCI Queue and OCI Streaming through their service endpoints, enabling decoupled, cloud-native consumers to process event or alert messages. Option B is correct because HTTPS custom webhooks are a first-class OCI Notifications subscription protocol, allowing delivery of JSON-formatted messages to an external HTTP(S) endpoint. Option E is correct because email is a supported OCI Notifications subscription protocol, commonly used to send alert or event messages to individual recipients or distribution lists. Option C is not correct because OCI Notifications does not natively deliver direct SMS text messages to mobile phone numbers globally. Option D is not correct because fax transmission over analog telephone lines is not a supported OCI Notifications delivery endpoint.

Answer

Direct SMS text messages to mobile phone numbers globally

Answer

Physical fax machine transmission over analog telephone lines