1Z0-997-26 Observability — Timed 15 Questions

Question 1

Your company requires all logs generated within the root compartment to be automatically archived to a centralized OCI Object Storage bucket in a different security tenancy for compliance purposes. Which OCI feature facilitates this serverless data pipeline?

15 minute time limit — choose an answer to begin.

Accepted Answer

OCI Service Connector Hub. OCI Service Connector Hub is a fully managed, serverless service that moves data between OCI services, such as from Logging to Object Storage, without writing code. It supports cross-tenancy delivery when configured with the appropriate policies and a target bucket in another tenancy. This makes it the correct choice for automatically archiving root compartment logs to a centralized bucket in a different security tenancy.

Answer

OCI Data Flow

Answer

OCI GoldenGate

Answer

OCI Archive Storage lifecycle rules

Question 2

You want to monitor the availability of a public-facing corporate web application from multiple global locations outside of OCI. Which OCI service provides this capability?

Accepted Answer

OCI Health Checks. OCI Health Checks is a service that monitors the availability and performance of public-facing web applications from multiple global vantage points outside OCI. It can perform HTTP(S), TCP, and ping checks from various geographic locations, providing external availability monitoring. This matches the requirement to monitor from multiple global locations outside OCI.

Answer

OCI Logging Analytics

Answer

OCI Network Firewall

Answer

OCI APM Synthetic Monitoring

Question 3

Your enterprise tenancy has hundreds of compartments. You need to ensure that any newly created compute instance across any compartment automatically has the OCI Logging Agent configured to ship system logs. Which feature should you implement?

Accepted Answer

Enable the Management Agent plugin via OCI Compute Instance Configurations and IAM tenancy-level policies.. OCI Compute Instance Configurations allow you to define a reusable template that includes Management Agent plugins (such as the Logging Agent plugin) which are automatically installed and enabled on every instance launched from that configuration. Combined with tenancy-level IAM policies granting the Management Agent service permission to deploy plugins, this ensures any new instance across any compartment gets the Logging Agent without manual intervention. This is the native, scalable OCI mechanism for enforcing agent configuration at scale.

Answer

Configure a Service Connector Hub rule to push agent binaries to new instances upon creation.

Answer

Rely on default OCI Monitoring service metric collection, which automatically collects guest OS log files without agents.

Answer

Create an OCI Events rule for instance creation that triggers a Resource Manager stack to install the agent via SSH.

Question 4

Your security operations team wants to identify log anomalies, such as sudden spikes in failed SSH login attempts across your OCI Compute fleet, without manually writing complex regex queries. Which Logging Analytics feature leverages machine learning to automatically group and identify patterns in logs?

Accepted Answer

Logging Analytics Cluster and Link commands. Logging Analytics Cluster and Link commands use machine learning to automatically group similar log entries into clusters and link related events across sources, surfacing patterns like sudden spikes in failed SSH attempts without writing regex. This is the built-in ML-driven pattern discovery feature of OCI Logging Analytics. It is designed exactly for anomaly identification in high-volume log data.

Answer

OCI Service Connector Hub pattern matching

Answer

OCI Cloud Guard Threat Detector rules

Answer

OCI APM Anomaly Detection agent

Question 5

You are managing a multi-tenancy OCI architecture where cost allocation is critical. Certain shared infrastructure resources (such as shared VCN NAT Gateways and Object Storage transfer buckets) generate shared costs. How can you allocate these shared costs across different child compartments using OCI Cost Analysis?

Accepted Answer

Use OCI Cost Analysis Cost Distribution Rules to proportionally allocate shared costs based on defined tags.. OCI Cost Analysis supports Cost Distribution Rules that let you allocate shared costs (such as a shared NAT Gateway or Object Storage bucket) across child compartments proportionally based on defined tags or usage metrics. This is the native, supported mechanism for multi-tenant chargeback and showback, and it integrates directly with the Cost Analysis dashboards and reports.

Answer

Attach IAM permission tags to shared resources to automatically split charges at the bank level.

Answer

Write custom OCI Monitoring metric alarms that automatically credit compartments when shared resources are used.

Answer

Manually split CSV invoice files in Excel after downloading monthly Cost Reports.

Question 6

An administrator wants to set up automated remediation when an OCI Monitoring alarm is triggered for high CPU utilization on a database. Specifically, they want a serverless function to execute to scale up resources. Which OCI service acts as the bridge to trigger the function upon alarm firing?

Accepted Answer

OCI Notifications Service. OCI Notifications Service is the pub/sub bridge that Monitoring alarms publish to; a subscription on the topic can target a Functions invocation, which then runs the remediation logic. This is the documented pattern for alarm-triggered serverless remediation in OCI. The alarm fires, publishes to the Notifications topic, and the Functions subscription executes the scale-up code.

Answer

OCI Service Connector Hub

Answer

OCI API Gateway

Answer

OCI Events Service

Question 7

Which TWO protocols or formats are natively supported for publishing custom metrics to the OCI Monitoring service?

Accepted Answer

OCI Monitoring REST API. Option C (OCI Monitoring REST API) is correct because OCI Monitoring exposes a public REST endpoint (https://telemetry-ingestion.<region>.oraclecloud.com/20180401/metrics) that accepts JSON POST requests containing MetricDataDetails, allowing any application to publish custom metrics directly. Option E (StatsD protocol) is correct because OCI Monitoring natively supports ingesting StatsD-formatted metrics, typically via the OCI Monitoring agent or a StatsD-compatible endpoint, so applications already emitting StatsD counters, gauges, and timers can publish custom metrics without format conversion. Option A (SQL*Net) is incorrect because it is Oracle Database's proprietary network protocol for SQL client-server traffic, not a metrics ingestion format. Option B (Syslog RFC 5424) is incorrect because syslog is a logging/event transport standard and is not a native custom-metric publishing protocol for OCI Monitoring. Option D (IMAP) is incorrect because IMAP is an email retrieval protocol with no role in metrics ingestion.

Answer

SQL*Net protocol

Answer

Syslog RFC 5424

Answer

IMAP email protocol

Question 8

An observability architect is designing a high-availability alerting and incident response strategy in OCI. Which THREE best practices should be incorporated?

Accepted Answer

Set appropriate evaluation periods and repeat intervals to prevent alarm flapping.. Option A is correct because OCI Monitoring alarms use configurable evaluation periods (e.g., 1 minute, 5 minutes) and repeat notification intervals; tuning these prevents flapping and repeated noisy alerts when a metric oscillates around a threshold. Option B is correct because OCI composite alarms let you combine multiple underlying metric alarms with logical operators (AND/OR) so that cascading or correlated failures trigger a single actionable alert instead of many, directly reducing alert fatigue. Option D is correct because OCI Notifications topics support multiple subscriptions across protocols such as Email, HTTPS (webhooks), PagerDuty, Slack, and SMS, so redundant endpoints ensure the on-call engineer is reached even if one channel fails. Option C is not appropriate because manual polling of Metrics Explorer is reactive, non-scalable, and defeats the purpose of automated high-availability alerting. Option E is not appropriate because disabling IAM policies during an incident is a serious security anti-pattern; least-privilege access and break-glass procedures should be used instead.

Answer

Rely exclusively on manual polling of the OCI Metrics Explorer console by the on-call engineer.

Answer

Disable all IAM security policies during alarm firing to allow unrestricted troubleshooting access.

Question 9

You are designing an enterprise observability architecture where logs from hundreds of Virtual Cloud Networks (VCNs) and various OCI services must be centrally aggregated. Security mandates that log data must be retained in an immutable, write-once-read-many (WORM) storage bucket for compliance purposes while simultaneously being indexed for rapid search and analysis. Which architectural pattern satisfies these requirements?

Accepted Answer

Configure OCI Logging to export logs to an Object Storage bucket with a Retention Rule in Compliance mode, while retaining logs in the Log Group for search.. OCI Logging can export log data to Object Storage, and Object Storage Retention Rules in Compliance mode provide WORM immutability that even tenancy administrators cannot override or delete before the retention period expires. Retaining the logs in the Log Group simultaneously preserves the indexed, searchable copy for rapid analysis via the Console, CLI, or Logging Search API. This dual-write pattern satisfies both the compliance immutability mandate and the operational search requirement without compromising either.

Answer

Configure OCI Logging to stream logs to an OCI Streaming topic, which then writes to a Block Volume with hardware-enforced encryption.

Answer

Route all logs through an OCI API Gateway, enforce a WORM storage policy via IAM JSON syntax, and query via Logging Analytics.

Answer

Use Oracle Database Vault to ingest log data into autonomous JSON databases configured with immutable tables.

Question 10

Your organization is implementing an alerting strategy in OCI Monitoring to avoid alert fatigue caused by transient network blips. You need to configure an alarm so that it only fires when a high CPU utilization condition persists for at least 3 consecutive evaluation periods of 5 minutes each. Which parameter in the Alarm definition should you modify?

Accepted Answer

Configure the Alarm evaluation window and set the trigger condition based on consecutive evaluation periods exceeding the threshold.. OCI Monitoring alarms support a trigger rule that evaluates a metric against a threshold over a specified number of consecutive evaluation periods. By setting the evaluation window and requiring the condition to be met for 3 consecutive 5-minute periods, the alarm only fires on sustained high CPU, filtering out transient blips. This is the correct parameter to modify in the alarm definition.

Answer

Modify the OCI Events service emission frequency to throttle metric collection to once every 15 minutes.

Answer

Apply a smoothing function like 'Moving Average' directly within the OCI Notifications topic subscription settings.

Answer

Set the Repetition Interval to 15 minutes.

Question 11

When designing an advanced alerting and monitoring strategy using OCI Monitoring Metric Query Language (MQL), which THREE practices or syntax rules should an architect follow?

Accepted Answer

Alarms can be configured to evaluate multiple metric streams using compound expressions or grouped dimensions.. Option C is correct because OCI Monitoring alarms support compound alarm conditions built from multiple MQL expressions combined with logical operators, and MQL queries can group by dimensions (for example, group by resourceId or availabilityDomain) so a single alarm evaluates multiple metric streams. Option D is correct because a valid MQL query must begin by identifying the metric namespace and metric name, followed optionally by dimension filters, e.g. CpuUtilization[1m]{resourceId = "ocid1..."}.groupBy(...).aggregate(...); omitting the namespace and metric name makes the query invalid. Option E is correct because the interval in brackets, such as [1m] or [5m], defines the time window over which data points are aggregated (the resolution/aggregation window) before functions like mean(), max(), or sum() are applied. Option A is not correct because OCI alarms have more than two states; they can be OK, Firing, and also Pending/Reset depending on the alarm state transitions, so limiting them to Active or Inactive is inaccurate. Option B is not correct because MQL does support mathematical operations and statistical aggregation functions such as mean(), max(), min(), sum(), rate(), and percentile(), so calculations do not need to be performed before ingestion.

Answer

An alarm in OCI Monitoring can only be in one of two states: Active or Inactive.

Answer

MQL does not support mathematical functions or aggregations; all calculations must be performed prior to ingestion.

Question 12

An administrator is planning an enterprise cost optimization and observability strategy in OCI. Which THREE native tools or reports can be utilized to analyze cloud spend, allocate costs, and optimize resource utilization?

Accepted Answer

OCI Cost Analysis dashboards. OCI Cost Analysis dashboards (A) are the native console tool for visualizing and analyzing cloud spend by compartment, tag, service, or time period, making them directly suited to cost analysis and allocation. OCI Detailed Usage Reports (C) are CSV files delivered to Object Storage that contain granular, line-item usage and cost data, enabling precise chargeback, allocation, and deeper offline analysis. OCI Budgets (E) let administrators set spending thresholds and receive alerts when actual or forecasted costs approach or exceed them, which is essential for ongoing cost control and optimization. The unmarked options do not belong: OCI Streaming Service Cost Estimator (B) is not a native OCI cost-analysis or observability tool, and OCI Logging Analytics Cost Module (D) is not a real native cost reporting feature for analyzing cloud spend.

Answer

OCI Streaming Service Cost Estimator

Answer

OCI Logging Analytics Cost Module

Question 13

An e-commerce platform runs on OCI Compute instances behind a Flexible Load Balancer. The operations team needs to detect when backend web servers return HTTP 5xx errors at an unusual rate. They want a metric that reflects the load balancer's own perspective of backend health, not application log content. Which OCI Monitoring metric should they alarm on?

Accepted Answer

The HttpResponse5xxCount metric in the oci_lbaas namespace, aggregated by backend set. The load balancer emits metrics in the oci_lbaas namespace, including HttpResponse5xxCount, which counts server-error responses as seen by the load balancer itself. Grouping by backend set isolates the affected backends, and an alarm on this metric's rate detects anomalous 5xx behavior without depending on application logs. The other metrics describe host CPU, health-check status, or an unrelated DNS service and cannot measure backend HTTP error rates.

Answer

The CpuUtilization metric in the oci_computeagent namespace for each backend instance

Answer

The LoadBalancerBackendSetHealth metric emitted by the oci_lbaas namespace

Answer

The UnhealthyBackendCount metric in the oci_healthchecks namespace

Question 14

An architect is standardizing OCI Monitoring alarms across many teams. Teams complain that alarms fire repeatedly for the same underlying incident because a metric oscillates around the threshold, and that some alarms never resolve. Which TWO alarm configuration practices address these complaints? (Choose two.)

Accepted Answer

Set the alarm's trigger rule to use a longer evaluation window and require the metric to breach for a sustained period before firing. Flapping and non-resolving alarms are controlled by how long a breach must persist. A longer evaluation window with a sustained-breach trigger rule filters out brief oscillations, and a pending duration holds the alarm in firing before notifying so short recoveries send nothing. Severity, repeat notification, and dimension removal alter routing or visibility but not the underlying state-transition behavior that causes the complaints.

Answer

Increase the alarm severity from WARNING to CRITICAL for every alarm so notifications are prioritized

Answer

Remove the metric's dimensions from the alarm query so all resources are evaluated as one aggregate

Answer

Enable the alarm's repeat notification interval so reminders are sent at fixed intervals while the alarm remains firing

Question 15

A platform team wants a single alarm to notify on-call engineers through OCI Notifications when any of three production databases exceeds 90 percent storage utilization. Each database resides in a different compartment, and all compartments belong to the same tenancy. What is the simplest correct configuration?

Accepted Answer

Create a single alarm in any compartment using a metric query that includes the database identifiers, and route it to one Notifications topic subscribed by the on-call group. OCI Monitoring alarms are tenancy-scoped and their metric queries can span compartments, so one alarm can evaluate storage utilization for all three databases using dimension matching. Publishing to a single Notifications topic with the on-call subscription gives one notification path. Multiple alarms or an intermediary connector add complexity without benefit.

Answer

Create one alarm per compartment but reuse the same topic, because alarms cannot query metrics outside their own compartment

Answer

Create one alarm per database in each compartment and subscribe the on-call group to three separate topics

Answer

Create an alarm in each compartment and use a Service Connector Hub connector to merge their outputs into one topic