1Z0-997-26 Observability Practice Test 3 — 15 Questions

Question 1

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.. OCI Logging Analytics provides a native Object Storage source type that allows you to configure a bucket as a log source. Once configured, Logging Analytics automatically discovers new log files, parses them using built-in or custom parsers, and ingests them for indexing and search. This eliminates the need for custom code or agents, and is the documented best practice for ingesting logs from Object Storage.

Answer

Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

Answer

Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

Answer

Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

Question 2

An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?

Accepted Answer

Create two separate alarms and define an OCI Monitoring Composite Alarm using the logical AND operator.. OCI Monitoring Composite Alarms are designed to combine multiple underlying metric alarms using logical operators (AND, OR, etc.). To trigger only when both CPU > 90% and latency > 500ms occur simultaneously, you create two standard metric alarms and then a composite alarm that ANDs them together.

Answer

Configure an OCI Notifications service topic subscription with a logical filter rule.

Answer

Use OCI Events service with a custom JSON payload condition.

Answer

Create a single standard alarm with a compound mathematical metric expression joining CPU and latency.

Question 3

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

Accepted Answer

OCI VCN Flow Logs. OCI VCN Flow Logs capture metadata about traffic flowing through VNICs, including source/destination IPs, ports, protocol, and whether the packet was accepted or rejected by security rules. Enabling flow logs on the subnet or VNIC lets you verify if security lists or NSGs are dropping packets to the external endpoint.

Answer

OCI Health Checks ping monitors

Answer

OCI Monitoring service VNIC packet counters

Answer

OCI Network Firewall system logs

Question 4

An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?

Accepted Answer

OCI Cost Analysis Scheduled Reports. OCI Cost Analysis Scheduled Reports allow you to define a recurring schedule (daily, weekly, monthly) that emails a cost breakdown — including top spending services — directly to specified recipients. This is purpose-built for automated spend trend monitoring without requiring console login, unlike alarms or event rules which are not designed for cost reporting.

Answer

OCI Events service scheduled triggers

Answer

OCI Audit log exports

Answer

OCI Monitoring service billing alarms

Question 5

An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?

Accepted Answer

Configure APM Data Masking rules or agent configuration properties to exclude or scrub sensitive attributes.. OCI APM provides data masking rules that can be configured at the APM domain level to scrub or exclude sensitive attributes from trace spans before they are stored. Additionally, the APM Java agent supports configuration properties that allow developers to exclude specific headers, parameters, or payload fields from being captured. Using these built-in masking and exclusion mechanisms is the correct way to prevent PII from entering APM trace data.

Answer

Set up an OCI Vault encryption key to automatically encrypt span attribute strings in transit.

Answer

Configure IAM policies to redact payload strings at the APM domain boundary.

Answer

Modify the OCI Monitoring alarm expression to filter out PII strings.

Question 6

You need to export OCI Audit logs to a third-party SIEM tool (such as Splunk or Elastic) in real-time. Which OCI architecture is best suited for this requirement?

Accepted Answer

Use OCI Service Connector Hub to route logs from OCI Audit to OCI Streaming or Object Storage for SIEM consumption.. OCI Service Connector Hub is the native service for routing logs from OCI Audit to destinations like OCI Streaming or Object Storage. For real-time SIEM integration, Service Connector Hub can stream Audit logs to OCI Streaming, which can then be consumed by Splunk or Elastic via a connector, providing near real-time export.

Answer

Schedule an OCI Resource Manager job to FTP log files every night.

Answer

Install the OCI Logging Agent directly on the OCI Audit service control plane.

Answer

Configure OCI Health Checks to poll the Audit API.

Question 7

When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?

Accepted Answer

Evaluation window (time interval and period). Option A is correct because an OCI Monitoring alarm requires an evaluation window, defined by the interval (for example, 1m, 5m, 1h) and the period over which the metric is aggregated, so OCI knows how often and over what span to evaluate the metric. Option B is correct because every alarm must reference the metric to monitor, which is identified by its metric namespace (such as oci_computeagent) and metric name (such as CpuUtilization). Option E is correct because an alarm must define the trigger condition, consisting of the threshold value and the operator (for example, greater than, less than, or equal to) that determines when the alarm fires. Option C is not required because a Vault Master Encryption Key OCID is used for encrypting data at rest, not for defining alarm evaluation logic. Option D is not required because a VCN CIDR block is a networking construct unrelated to specifying which metric and threshold an alarm should evaluate.

Answer

OCI Vault Master Encryption Key OCID

Answer

Virtual Cloud Network (VCN) CIDR block

Question 8

Which TWO of the following services are native components of the Oracle Cloud Infrastructure Observability and Management platform?

Accepted Answer

OCI Application Performance Monitoring (APM). OCI Application Performance Monitoring (APM) (option C) is a native Observability and Management service that provides distributed tracing, synthetic monitoring, and real-user monitoring to diagnose application performance issues. OCI Logging Analytics (option E) is also a native Observability and Management service that uses machine-learning-driven log indexing, correlation, and visualization to analyze log data across the environment. Both belong to the OCI Observability and Management platform, which also includes services such as Monitoring, Notifications, Events, and Operations Insights. In contrast, OCI Autonomous Database (A), OCI Container Engine for Kubernetes (B), and OCI File Storage Service (D) are core data and compute/storage services, not observability or management components, so they do not qualify.

Answer

OCI Autonomous Database

Answer

OCI Container Engine for Kubernetes

Answer

OCI File Storage Service

Question 9

An enterprise is designing a comprehensive cost observability and governance strategy in OCI. Which THREE practices or features should be implemented?

Accepted Answer

Enforce defined tags for resource creation using IAM policy conditions or tag defaults.. Option B is correct because enforcing defined tags via IAM policy conditions (e.g., request.tag.definedTag) or tag defaults ensures consistent cost allocation and governance across compartments and resources. Option C is correct because OCI Cost Analysis provides dashboards and filtering to analyze spending trends and detect cost anomalies by service, compartment, or tag. Option D is correct because OCI Budgets support alert rules on both actual spend and forecasted spend, enabling proactive governance before thresholds are breached. Option A is incorrect because VCN flow logs capture network traffic metadata, not billing data, and Logging Analytics does not calculate OCI infrastructure charges. Option E is incorrect because APM Java agents monitor application performance, not block volume storage encryption costs, and encryption at rest is included in OCI storage pricing.

Answer

Route all VCN flow logs through OCI Logging Analytics to calculate cloud infrastructure billing.

Answer

Install APM Java agents on all block storage volumes to track storage encryption costs.

Question 10

When configuring OCI Service Connector Hub to move logs from OCI Logging to OCI Object Storage, which THREE components must be defined?

Accepted Answer

Target (e.g., OCI Object Storage bucket). Option A (Target, e.g., OCI Object Storage bucket) is correct because Service Connector Hub requires a target resource to which the connector delivers the data, and for this scenario that target is an Object Storage bucket. Option D (Source, e.g., OCI Logging service) is correct because a service connector must specify the source service whose data it reads, here OCI Logging log groups. Option E (IAM policies granting the service connector permission to read from source and write to target) is correct because the Service Connector Hub service principal needs explicit IAM policy statements authorizing it to read from the Logging source and write to the Object Storage target. Option B is incorrect because Service Connector Hub is a fully managed OCI service that does not require any manual SSH tunnel between regions. Option C is incorrect because no OKE Kubernetes cluster or connector daemon is needed; the service runs as a managed OCI resource.

Answer

A manual SSH tunnel between the source and target regions

Answer

An active Kubernetes cluster in OKE to host the connector daemon

Question 11

Which TWO types of logs are natively generated and accessible within OCI Logging without requiring agent installation on compute instances?

Accepted Answer

OCI Audit logs. OCI Audit logs (C) are natively generated by the OCI platform itself and are automatically available in OCI Logging without any agent, since they record API activity against OCI resources at the control-plane level. OCI VCN Flow logs (E) are also natively produced by the OCI networking layer for subnets, VNICs, or VCNs and are ingested directly into OCI Logging without requiring an agent on compute instances. In contrast, custom database trace files (A) and custom application log files such as /var/log/app.log (B) reside on the instance's filesystem and require the OCI Logging agent (or Unified Monitoring agent) to be installed and configured to collect them. Third-party firewall logs from local virtual appliances (D) are likewise external to OCI's native telemetry and need an agent or custom ingestion path, so they are not natively available.

Answer

Custom database trace files generated inside a self-managed MySQL database on a VM

Answer

Custom application log files stored in /var/log/app.log inside a compute instance

Answer

Third-party firewall logs running on local virtual appliances

Question 12

Which THREE features are provided by OCI Application Performance Monitoring (APM)?

Accepted Answer

Distributed Tracing across microservices. OCI Application Performance Monitoring (APM) provides Distributed Tracing across microservices (A), which lets you follow a single request through multiple services and identify latency or errors in the call chain. It also provides Real User Monitoring (RUM) (C), which captures browser-side performance data from actual end users via a JavaScript agent. Additionally, APM offers Synthetic Monitoring (E) using browser and script-based tests to proactively simulate user interactions and measure availability and performance. Options B and D are incorrect because automatic bare metal database backups are a database service capability, and BGP routing table management for FastConnect belongs to OCI networking, not APM.

Answer

Automatic provisioning of bare metal database backups

Answer

Management of BGP routing tables for FastConnect

Question 13

An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?

Accepted Answer

Associate the newly created custom parser with a custom Log Source in Logging Analytics.. Option A is correct because a custom parser in OCI Logging Analytics must be attached to a custom Log Source so that the service knows which parser to apply when ingesting that log type. Option B is correct because the parser creation workflow requires supplying sample log messages to test and validate that the pattern matching and field extraction work against real data. Option C is correct because the core of a custom parser is defining extraction rules, typically via regular expressions or the parser builder, to map fields such as timestamp, severity, and message. Option D is incorrect because hypervisor kernel parameters are unrelated to Logging Analytics parsing and cannot influence log field extraction. Option E is incorrect because Logging Analytics parsers are configured declaratively in the service, not by compiling and deploying C++ binaries to OCI Functions.

Answer

Modify the hypervisor kernel parameters on all compute instances.

Answer

Compile a C++ binary package and upload it to an OCI Function.

Question 14

Which TWO destinations can receive messages dispatched from an OCI Notifications service topic?

Accepted Answer

HTTPS / Webhook endpoints (e.g., Slack, PagerDuty). Option C is correct because OCI Notifications topics support HTTPS subscriptions, which deliver the published message as a JSON POST to a webhook URL, enabling integrations such as Slack or PagerDuty. Option D is correct because OCI Notifications natively supports Email and SMS subscriptions, sending the message content directly to the subscribed address or phone number. The other options are incorrect because Internet Gateway route tables, Dynamic Routing Gateway (DRG), and Block Volume backup policies are networking and storage constructs, not subscription protocols or delivery destinations for a Notifications topic.

Answer

OCI Internet Gateway route tables

Answer

OCI Dynamic Routing Gateway (DRG)

Answer

OCI Block Volume backup policies

Question 15

When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?

Accepted Answer

Install OCI Management Agent on the host running the WebLogic Server.. Option B is correct because Stack Monitoring relies on the OCI Management Agent installed on the WebLogic host to collect metrics and communicate with the OCI Monitoring service. Option D is correct because discovery requires valid WebLogic administrator credentials plus JMX connection details (host, port, protocol) so the agent can query the WebLogic MBeans. Option E is correct because the Stack Monitoring discovery wizard, run from the OCI Console or CLI, is the mechanism that creates the WebLogic resource and associates it with the agent. Option A is not required, as the administration console does not need a public IP and exposing it would be a security risk. Option C is not required, since BGP peering is a networking concept unrelated to WebLogic discovery and monitoring.

Answer

Attach a public IP address directly to the WebLogic administration console port.

Answer

Configure a BGP peering session between WebLogic and the OCI Control Plane.