1Z0-997-26 Observability — 10 Questions

Question 1

Your company requires all logs generated within the root compartment to be automatically archived to a centralized OCI Object Storage bucket in a different security tenancy for compliance purposes. Which OCI feature facilitates this serverless data pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Service Connector Hub. OCI Service Connector Hub is a fully managed, serverless service that moves data between OCI services, such as from Logging to Object Storage, without writing code. It supports cross-tenancy delivery when configured with the appropriate policies and a target bucket in another tenancy. This makes it the correct choice for automatically archiving root compartment logs to a centralized bucket in a different security tenancy.

Answer

OCI Data Flow

Answer

OCI GoldenGate

Answer

OCI Archive Storage lifecycle rules

Question 2

You want to monitor the availability of a public-facing corporate web application from multiple global locations outside of OCI. Which OCI service provides this capability?

Accepted Answer

OCI Health Checks. OCI Health Checks is a service that monitors the availability and performance of public-facing web applications from multiple global vantage points outside OCI. It can perform HTTP(S), TCP, and ping checks from various geographic locations, providing external availability monitoring. This matches the requirement to monitor from multiple global locations outside OCI.

Answer

OCI Logging Analytics

Answer

OCI Network Firewall

Answer

OCI APM Synthetic Monitoring

Question 3

Your enterprise tenancy has hundreds of compartments. You need to ensure that any newly created compute instance across any compartment automatically has the OCI Logging Agent configured to ship system logs. Which feature should you implement?

Accepted Answer

Enable the Management Agent plugin via OCI Compute Instance Configurations and IAM tenancy-level policies.. OCI Compute Instance Configurations allow you to define a reusable template that includes Management Agent plugins (such as the Logging Agent plugin) which are automatically installed and enabled on every instance launched from that configuration. Combined with tenancy-level IAM policies granting the Management Agent service permission to deploy plugins, this ensures any new instance across any compartment gets the Logging Agent without manual intervention. This is the native, scalable OCI mechanism for enforcing agent configuration at scale.

Answer

Configure a Service Connector Hub rule to push agent binaries to new instances upon creation.

Answer

Rely on default OCI Monitoring service metric collection, which automatically collects guest OS log files without agents.

Answer

Create an OCI Events rule for instance creation that triggers a Resource Manager stack to install the agent via SSH.

Question 4

Your security operations team wants to identify log anomalies, such as sudden spikes in failed SSH login attempts across your OCI Compute fleet, without manually writing complex regex queries. Which Logging Analytics feature leverages machine learning to automatically group and identify patterns in logs?

Accepted Answer

Logging Analytics Cluster and Link commands. Logging Analytics Cluster and Link commands use machine learning to automatically group similar log entries into clusters and link related events across sources, surfacing patterns like sudden spikes in failed SSH attempts without writing regex. This is the built-in ML-driven pattern discovery feature of OCI Logging Analytics. It is designed exactly for anomaly identification in high-volume log data.

Answer

OCI Service Connector Hub pattern matching

Answer

OCI Cloud Guard Threat Detector rules

Answer

OCI APM Anomaly Detection agent

Question 5

You are managing a multi-tenancy OCI architecture where cost allocation is critical. Certain shared infrastructure resources (such as shared VCN NAT Gateways and Object Storage transfer buckets) generate shared costs. How can you allocate these shared costs across different child compartments using OCI Cost Analysis?

Accepted Answer

Use OCI Cost Analysis Cost Distribution Rules to proportionally allocate shared costs based on defined tags.. OCI Cost Analysis supports Cost Distribution Rules that let you allocate shared costs (such as a shared NAT Gateway or Object Storage bucket) across child compartments proportionally based on defined tags or usage metrics. This is the native, supported mechanism for multi-tenant chargeback and showback, and it integrates directly with the Cost Analysis dashboards and reports.

Answer

Attach IAM permission tags to shared resources to automatically split charges at the bank level.

Answer

Write custom OCI Monitoring metric alarms that automatically credit compartments when shared resources are used.

Answer

Manually split CSV invoice files in Excel after downloading monthly Cost Reports.

Question 6

An administrator wants to set up automated remediation when an OCI Monitoring alarm is triggered for high CPU utilization on a database. Specifically, they want a serverless function to execute to scale up resources. Which OCI service acts as the bridge to trigger the function upon alarm firing?

Accepted Answer

OCI Notifications Service. OCI Notifications Service is the pub/sub bridge that Monitoring alarms publish to; a subscription on the topic can target a Functions invocation, which then runs the remediation logic. This is the documented pattern for alarm-triggered serverless remediation in OCI. The alarm fires, publishes to the Notifications topic, and the Functions subscription executes the scale-up code.

Answer

OCI Service Connector Hub

Answer

OCI API Gateway

Answer

OCI Events Service

Question 7

Which TWO protocols or formats are natively supported for publishing custom metrics to the OCI Monitoring service?

Accepted Answer

OCI Monitoring REST API. Option C (OCI Monitoring REST API) is correct because OCI Monitoring exposes a public REST endpoint (https://telemetry-ingestion.<region>.oraclecloud.com/20180401/metrics) that accepts JSON POST requests containing MetricDataDetails, allowing any application to publish custom metrics directly. Option E (StatsD protocol) is correct because OCI Monitoring natively supports ingesting StatsD-formatted metrics, typically via the OCI Monitoring agent or a StatsD-compatible endpoint, so applications already emitting StatsD counters, gauges, and timers can publish custom metrics without format conversion. Option A (SQL*Net) is incorrect because it is Oracle Database's proprietary network protocol for SQL client-server traffic, not a metrics ingestion format. Option B (Syslog RFC 5424) is incorrect because syslog is a logging/event transport standard and is not a native custom-metric publishing protocol for OCI Monitoring. Option D (IMAP) is incorrect because IMAP is an email retrieval protocol with no role in metrics ingestion.

Answer

SQL*Net protocol

Answer

Syslog RFC 5424

Answer

IMAP email protocol

Question 8

An observability architect is designing a high-availability alerting and incident response strategy in OCI. Which THREE best practices should be incorporated?

Accepted Answer

Set appropriate evaluation periods and repeat intervals to prevent alarm flapping.. Option A is correct because OCI Monitoring alarms use configurable evaluation periods (e.g., 1 minute, 5 minutes) and repeat notification intervals; tuning these prevents flapping and repeated noisy alerts when a metric oscillates around a threshold. Option B is correct because OCI composite alarms let you combine multiple underlying metric alarms with logical operators (AND/OR) so that cascading or correlated failures trigger a single actionable alert instead of many, directly reducing alert fatigue. Option D is correct because OCI Notifications topics support multiple subscriptions across protocols such as Email, HTTPS (webhooks), PagerDuty, Slack, and SMS, so redundant endpoints ensure the on-call engineer is reached even if one channel fails. Option C is not appropriate because manual polling of Metrics Explorer is reactive, non-scalable, and defeats the purpose of automated high-availability alerting. Option E is not appropriate because disabling IAM policies during an incident is a serious security anti-pattern; least-privilege access and break-glass procedures should be used instead.

Answer

Rely exclusively on manual polling of the OCI Metrics Explorer console by the on-call engineer.

Answer

Disable all IAM security policies during alarm firing to allow unrestricted troubleshooting access.

Question 9

You are designing an enterprise observability architecture where logs from hundreds of Virtual Cloud Networks (VCNs) and various OCI services must be centrally aggregated. Security mandates that log data must be retained in an immutable, write-once-read-many (WORM) storage bucket for compliance purposes while simultaneously being indexed for rapid search and analysis. Which architectural pattern satisfies these requirements?

Accepted Answer

Configure OCI Logging to export logs to an Object Storage bucket with a Retention Rule in Compliance mode, while retaining logs in the Log Group for search.. OCI Logging can export log data to Object Storage, and Object Storage Retention Rules in Compliance mode provide WORM immutability that even tenancy administrators cannot override or delete before the retention period expires. Retaining the logs in the Log Group simultaneously preserves the indexed, searchable copy for rapid analysis via the Console, CLI, or Logging Search API. This dual-write pattern satisfies both the compliance immutability mandate and the operational search requirement without compromising either.

Answer

Configure OCI Logging to stream logs to an OCI Streaming topic, which then writes to a Block Volume with hardware-enforced encryption.

Answer

Route all logs through an OCI API Gateway, enforce a WORM storage policy via IAM JSON syntax, and query via Logging Analytics.

Answer

Use Oracle Database Vault to ingest log data into autonomous JSON databases configured with immutable tables.

Question 10

Your organization is implementing an alerting strategy in OCI Monitoring to avoid alert fatigue caused by transient network blips. You need to configure an alarm so that it only fires when a high CPU utilization condition persists for at least 3 consecutive evaluation periods of 5 minutes each. Which parameter in the Alarm definition should you modify?

Accepted Answer

Configure the Alarm evaluation window and set the trigger condition based on consecutive evaluation periods exceeding the threshold.. OCI Monitoring alarms support a trigger rule that evaluates a metric against a threshold over a specified number of consecutive evaluation periods. By setting the evaluation window and requiring the condition to be met for 3 consecutive 5-minute periods, the alarm only fires on sustained high CPU, filtering out transient blips. This is the correct parameter to modify in the alarm definition.

Answer

Modify the OCI Events service emission frequency to throttle metric collection to once every 15 minutes.

Answer

Apply a smoothing function like 'Moving Average' directly within the OCI Notifications topic subscription settings.

Answer

Set the Repetition Interval to 15 minutes.