Courseiva

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 1–75

344 questions total · 5pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 5

Page 2
1
MCQhard

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

A.Kubernetes Liveness probes configured with HTTP GET request headers.
B.OCI Audit log queries combined with Object Storage bucket lifecycle rules.
C.OCI Notifications service broadcast topics configured with JSON log forwarding.
D.W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.
AnswerD

Correct. W3C Trace Context headers ensure trace continuity across API Gateway, Service Mesh, and application code.

Why this answer

OCI API Gateway, OCI Service Mesh (Envoy proxies), and application OpenTelemetry (OTel) SDKs can be configured to propagate W3C trace context headers and export traces to an OTel-compatible collector.

Full explanation →
2
MCQeasy

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

A.Azure Application Gateway
B.Azure ExpressRoute Gateway
C.Azure Virtual Network NAT
D.Azure Traffic Manager
AnswerB

An ExpressRoute Gateway is required on the Azure side to terminate the ExpressRoute circuit.

Why this answer

The Azure ExpressRoute circuit connects to an Azure ExpressRoute Gateway (Virtual Network Gateway) deployed in the target Virtual Network to facilitate cross-cloud communication.

Full explanation →
3
MCQeasy

What is the primary architectural advantage of using Exadata Database Service on Dedicated Infrastructure compared to Exadata Database Service on Cloud@Customer?

A.It requires the customer to manage physical rack power, cooling, and hardware replacement
B.It exclusively supports non-relational database formats unlike Cloud@Customer
C.It eliminates the need for Virtual Cloud Networks (VCNs)
D.The physical Exadata hardware resides and operates entirely within an OCI data center managed by Oracle
AnswerD

Correct. Dedicated Infrastructure is hosted in OCI cloud regions, while Cloud@Customer is hosted on-premises.

Why this answer

Exadata Database Service on Dedicated Infrastructure runs entirely within OCI datacenters, whereas Cloud@Customer runs physically inside the customer's on-premises datacenter.

Full explanation →
4
Multi-Selectmedium

When designing cloud-native architectures on OCI using OCI Events and OCI Notifications, which THREE delivery endpoints are natively supported by OCI Notifications for publishing alert or event messages?

Select 3 answers
A.OCI Queue / OCI Streaming (via service endpoints)
B.HTTPS Custom Webhooks
C.Direct SMS text messages to mobile phone numbers globally
D.Physical fax machine transmission over analog telephone lines
E.Email
AnswersA, B, E

Correct. Notifications can publish messages to streaming or queue endpoints.

Why this answer

OCI Notifications service supports endpoints such as Email, HTTPS/Custom Webhooks, and OCI Streaming or OCI Queue / PagerDuty / Slack integrations via HTTPS.

Full explanation →
5
MCQhard

An organization running an Oracle Exadata Database Service requires compliance auditing where all database administrative actions and sensitive data queries must be logged, tamper-proof, and retained in an isolated repository. Which combination of OCI and Oracle Database features provides this capability?

A.OCI Object Storage unversioned buckets with public read permissions
B.Oracle Data Safe combined with Database Unified Audit policies
C.Oracle Data Pump export logs stored in local temporary directories
D.Standard Linux syslog daemon writing to local disk partitions
AnswerB

Correct. Data Safe provides assessment, user management, and audit collection, while Unified Audit logs all database activities.

Why this answer

Oracle Audit Vault and Database Firewall (AVDF) or OCI Audit combined with Oracle Data Safe and Database Unified Audit provides robust, tamper-proof auditing and compliance reporting.

Full explanation →
6
MCQmedium

You are managing an Oracle Base Database Service instance and need to configure Data Guard to provide disaster recovery in another OCI region. Which prerequisite must be met before creating the Data Guard association?

A.Establish network connectivity between the primary and standby VCNs using a DRG and remote VCN peering.
B.Ensure the standby database has a larger shape than the primary database.
C.Manually install the Oracle Data Guard binaries on the standby database compute instance prior to association.
D.Convert the primary database to an Autonomous Database instance.
AnswerA

Cross-region database replication requires established network connectivity between the respective Virtual Cloud Networks.

Why this answer

Cross-region Data Guard requires remote VCN peering via a Dynamic Routing Gateway (DRG) or local peering if regional, and proper security list/NSG rules allowing traffic on ports such as 1521.

Full explanation →
7
MCQhard

You are designing a high-throughput event-driven system on OCI where OCI Functions are invoked asynchronously via OCI Events. A specific function experiences intermittent database connection timeouts during traffic spikes, resulting in dropped events. How should you architect the invocation pipeline to ensure reliable, at-least-once delivery and smooth out spikes?

A.Configure OCI API Gateway with request throttling in front of the OCI Function.
B.Increase the maximum memory and execution timeout limits on the OCI Function configuration.
C.Insert an OCI Queue or OCI Streaming service between OCI Events and the OCI Function to buffer and batch payloads.
D.Deploy the OCI Function inside a public subnet with an internet gateway for faster database roundtrips.
AnswerC

Buffers like OCI Queue or OCI Streaming decouple event producers from consumers, holding messages securely until the function is ready to process them.

Why this answer

Placing an OCI Streaming or OCI Queue service between OCI Events and OCI Functions allows buffering of incoming events so that functions can pull messages at a controlled rate, guaranteeing at-least-once delivery.

Full explanation →
8
Multi-Selecthard

An architect is designing a hybrid network using OCI FastConnect. Which THREE components are mandatory for setting up a Private Virtual Circuit using a FastConnect Partner? (Choose THREE)

Select 3 answers
A.Virtual Cloud Network (VCN)
B.OCI Web Application Firewall (WAF)
C.Customer-Premises Equipment (CPE) object
D.Dynamic Routing Gateway (DRG)
E.FastConnect Virtual Circuit
AnswersA, D, E

A VCN is required so the DRG can attach to it and route traffic to workloads.

Why this answer

To set up a partner FastConnect virtual circuit, you need a VCN, a DRG attached to that VCN, and a FastConnect Virtual Circuit object configured with the partner details which generates the service key for the partner.

Full explanation →
9
Multi-Selectmedium

When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?

Select 3 answers
A.Attach a public IP address directly to the WebLogic administration console port.
B.Install OCI Management Agent on the host running the WebLogic Server.
C.Configure a BGP peering session between WebLogic and the OCI Control Plane.
D.Provide valid WebLogic administrator credentials and JMX connection details.
E.Run the Stack Monitoring discovery wizard via the OCI Console or CLI.
AnswersB, D, E

Correct. Management agents collect telemetry for Stack Monitoring.

Why this answer

Stack Monitoring requires installing Management Agents on the host, granting necessary JMX/admin credentials, and running the discovery wizard.

Full explanation →
10
MCQhard

Your enterprise tenancy has hundreds of compartments. You need to ensure that any newly created compute instance across any compartment automatically has the OCI Logging Agent configured to ship system logs. Which feature should you implement?

A.Configure a Service Connector Hub rule to push agent binaries to new instances upon creation.
B.Enable the Management Agent plugin via OCI Compute Instance Configurations and IAM tenancy-level policies.
C.Rely on default OCI Monitoring service metric collection, which automatically collects guest OS log files without agents.
D.Create an OCI Events rule for instance creation that triggers a Resource Manager stack to install the agent via SSH.
AnswerB

Correct. Management Agent and Cloud Agent plugins can be enabled automatically to ensure agents are active on newly provisioned instances.

Why this answer

OCI Agent Management and Cloud Agent framework, combined with Dynamic Groups and IAM policies, can automatically manage and enable plugins like the Logging Agent across compute instances.

Full explanation →
11
Multi-Selecthard

When designing an API Gateway implementation on OCI to expose backend microservices running on OKE, which THREE features or capabilities can you configure directly within the API Gateway deployment? (Choose three.)

Select 3 answers
A.Request throttling and rate-limiting to protect backend microservices from traffic surges.
B.Automatic multi-region database failover orchestration for Oracle Autonomous Database.
C.Cross-Origin Resource Sharing (CORS) policies to control browser-based access from web frontend applications.
D.JSON Web Token (JWT) validation for validating bearer tokens from identity providers.
E.Automatic provisioning and scaling of Kubernetes worker node pools inside OKE.
AnswersA, C, D

API Gateway supports rate limiting and request throttling policies to manage client traffic loads.

Why this answer

OCI API Gateway supports CORS configuration, rate limiting / request throttling, and JWT authentication natively within its deployment specifications.

Full explanation →
12
MCQeasy

When provisioning an Oracle Base Database system on OCI, which storage management architecture is utilized by default for storing database files (datafiles, redo logs, control files)?

A.Network File System (NFS) shared mounts from a third-party NAS filer
B.Raw Device Mapping (RDM) shared via Fibre Channel SAN
C.Oracle Automatic Storage Management (ASM) configured across OCI Block Volumes
D.Local NVMe drives directly attached to the hypervisor without redundancy
AnswerC

Correct. OCI Base Databases use ASM to stripe and mirror data across high-performance OCI Block Volumes.

Why this answer

OCI Base Database systems use Oracle ASM (Automatic Storage Management) across OCI Block Volumes to manage database storage.

Full explanation →
13
Multi-Selecthard

When designing high availability for an Oracle RAC (Real Application Clusters) database deployed on OCI Exadata Database Service, which THREE architectural characteristics ensure fault tolerance and uptime? (Choose three.)

Select 3 answers
A.Running the entire cluster on a single Oracle Linux compute instance without Grid Infrastructure
B.Storing all database data on a single local NVMe drive on node 1
C.Multi-node database clustering across distinct Fault Domains or Availability Domains
D.Application Continuity or Transparent Application Failover (TAF) for seamless session recovery
E.Redundant Exadata Storage Servers (Storage Cells) providing clustered grid storage
AnswersC, D, E

RAC nodes are distributed across fault domains to survive individual node or hardware failures.

Why this answer

RAC on Exadata leverages multiple database nodes across fault domains, transparent application failover (TAF/Application Continuity), and shared storage across redundant storage cells.

Full explanation →
14
MCQmedium

You are configuring an Autonomous Database instance and need to restrict incoming database traffic so that only specific corporate subnet CIDR blocks can access the database service endpoints. Which feature should you configure?

A.OCI Web Application Firewall (WAF) attached directly to the database listener port
B.OCI Identity and Access Management dynamic groups
C.Database Vault realm restrictions
D.Autonomous Database Access Control Lists (ACLs) specifying allowed IP CIDR blocks
AnswerD

Correct. ACLs restrict inbound connectivity to specified IP addresses or VCN endpoints.

Why this answer

Access Control Lists (ACLs) on Autonomous Database allow administrators to restrict network access using IP addresses or VCN OCIDs.

Full explanation →
15
MCQeasy

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

A.Dynamic Routing Gateway (DRG) with Remote VCN Peering
B.Internet Gateway (IGW)
C.NAT Gateway
D.Local Peering Gateway (LPG)
AnswerA

Remote VCN peering via DRGs enables secure communication between VCNs across different OCI regions.

Why this answer

Remote VCN peering using Dynamic Routing Gateways (DRGs) in both regions connects VCNs across regions.

Full explanation →
16
MCQmedium

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

A.OCI Container Instances
B.OCI Functions
C.Oracle Container Engine for Kubernetes (OKE)
D.OCI Compute Standard virtual machine instances
AnswerA

OCI Container Instances is a serverless container service that allows running containers instantly without managing VMs or Kubernetes.

Why this answer

OCI Container Instances is a serverless compute service that enables users to run containers directly on OCI without managing underlying virtual machines or servers, perfect for simple containerized deployments without Kubernetes overhead.

Full explanation →
17
MCQmedium

You need to connect an on-premises datacenter to OCI using FastConnect with a Partner model. Which component must you configure in the OCI console before provisioning the virtual circuit with the FastConnect partner?

A.FastConnect Virtual Circuit with a partner provider
B.Local Peering Gateway
C.Customer-Premises Equipment (CPE) object
D.Internet Gateway
AnswerA

Creating the virtual circuit generates an Oracle OCID that you provide to your FastConnect partner.

Why this answer

To set up a Partner FastConnect, you must create a Dynamic Routing Gateway (DRG) and a FastConnect virtual circuit specifying the partner provider.

Full explanation →
18
MCQmedium

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

A.Object Storage Object Lock with Compliance mode.
B.OCI Cloud Guard data protection detectors.
C.OCI Object Storage Pre-Authenticated Requests (PAR).
D.OCI Vault key rotation policies.
AnswerA

Object Lock prevents deletion or overwriting of objects, even by users with administrative privileges, ensuring backup integrity.

Why this answer

Object Storage Object Lock enables WORM (Write Once, Read Many) storage, preventing objects from being deleted or modified until a retention period expires or indefinitely in compliance mode.

Full explanation →
19
Multi-Selecthard

You are designing a cross-region disaster recovery strategy for an Oracle Exadata Database Service on Dedicated Infrastructure deployment. Which TWO steps or configurations are required to establish an Active Data Guard standby database in a remote OCI region?

Select 2 answers
A.Mount a shared block storage volume across both OCI regions using Network File System (NFS).
B.Enable automatic backups on the standby database using the same retention period as the primary.
C.Configure Standby Redo Logs (SRLs) on both the primary and standby databases sized identically to the online redo logs.
D.Configure Oracle GoldenGate bidirectional replication as the underlying transport mechanism.
E.Establish network connectivity between the primary and standby VCNs using a Dynamic Routing Gateway (DRG) and local or remote VCN peering.
AnswersC, E

Standby redo logs are mandatory for real-time apply and data protection modes in Data Guard.

Why this answer

Establishing Active Data Guard across regions requires proper network peering (such as Remote VCN Peering or DRG) and configuring the databases with appropriate Data Guard association parameters and standby redo logs.

Full explanation →
20
MCQmedium

You are configuring disaster recovery for an Oracle Base Database system using Oracle Data Guard with Data Guard Broker. You need to perform a role transition where the primary database becomes the standby and the standby becomes the primary with zero data loss. Which Data Guard Broker command should you execute?

A.ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;
B.CONVERT DATABASE TO PHYSICAL STANDBY;
C.SWITCHOVER TO <standby_database_name>;
D.FAILOVER TO <standby_database_name>;
AnswerC

Correct. The SWITCHOVER command performs a role reversal without data loss.

Why this answer

To perform a planned switchover with zero data loss using Data Guard Broker, the SWITCHOVER command is executed.

Full explanation →
21
Multi-Selecthard

Which THREE factors should an architect evaluate when determining Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for an OCI database disaster recovery solution? (Choose three.)

Select 3 answers
A.Level of automation configured for failover (e.g., Fast-Start Failover vs. manual scripts)
B.Network bandwidth and latency between the primary and DR regions
C.Business criticality and acceptable data loss window during unexpected outages
D.The color scheme and layout of the OCI Console dashboard
E.The default tenant tenancy OCID string length
AnswersA, B, C

Manual interventions increase RTO, whereas automated tools like FSFO reduce it significantly.

Why this answer

RPO and RTO are driven by business tolerance for data loss, network throughput/latency constraints for replication, and the degree of automation (like FSFO or FSDR) applied to failover procedures.

Full explanation →
22
Multi-Selecthard

When designing an enterprise-grade disaster recovery architecture on OCI, which THREE practices are recommended to ensure a successful failover and minimize operational risk during a disaster event? (Choose three.)

Select 3 answers
A.Disable all health checks on load balancers to prevent false alarms during failover.
B.Automate failover orchestration using tools like OCI Full Stack Disaster Recovery.
C.Conduct regular disaster recovery drills using non-disruptive testing features like Snapshot Standby.
D.Rely solely on manual documentation stored on local laptops for failover steps.
E.Ensure adequate compute and database capacity is provisioned or reserved in the target DR region.
AnswersB, C, E

Automation reduces human error and speeds up recovery execution.

Why this answer

Best practices include regularly testing DR plans via drills, automating workflows with FSDR or runbooks, and ensuring identical resource capacity in the DR region.

Full explanation →
23
Multi-Selecteasy

Which TWO features of OCI Object Storage contribute to its high durability and reliability for disaster recovery workflows? (Choose two.)

Select 2 answers
A.Restricting bucket access exclusively to local console sessions.
B.Storing all objects on a single physical disk inside a single compute instance.
C.Object versioning support to protect against accidental deletion or overwriting.
D.Requiring manual user replication scripts for every individual file uploaded.
E.Data is automatically replicated across multiple fault domains and availability domains.
AnswersC, E

Versioning preserves previous states of objects for recovery.

Why this answer

Object Storage stores data redundantly across multiple fault domains/ADs and offers lifecycle management / versioning capabilities.

Full explanation →
24
MCQhard

You are managing a multi-tenancy OCI architecture where cost allocation is critical. Certain shared infrastructure resources (such as shared VCN NAT Gateways and Object Storage transfer buckets) generate shared costs. How can you allocate these shared costs across different child compartments using OCI Cost Analysis?

A.Attach IAM permission tags to shared resources to automatically split charges at the bank level.
B.Use OCI Cost Analysis Cost Distribution Rules to proportionally allocate shared costs based on defined tags.
C.Write custom OCI Monitoring metric alarms that automatically credit compartments when shared resources are used.
D.Manually split CSV invoice files in Excel after downloading monthly Cost Reports.
AnswerB

Correct. Cost Distribution Rules allow administrators to redistribute shared costs across compartments or tags.

Why this answer

OCI Cost Analysis supports cost distribution rules (or proportional splitting based on defined tags or consumption metrics) to allocate shared costs across compartments.

Full explanation →
25
Multi-Selecthard

Which TWO of the following statements are correct regarding the architecture and capabilities of OCI Application Performance Monitoring (APM)?

Select 2 answers
A.OCI APM can only monitor applications deployed inside OCI Compute instances and cannot trace traffic originating from API Gateways.
B.OCI APM supports ingestion of standard OpenTelemetry traces from applications running on-premises, in OCI, or in other clouds.
C.OCI APM alerting is strictly limited to SMS notifications and cannot integrate with external incident management systems like PagerDuty.
D.OCI APM provides Real User Monitoring (RUM) capabilities to track end-user performance, page load times, and browser errors.
E.OCI APM requires the user to manually provision and manage an underlying Autonomous Transaction Processing database to store trace spans.
AnswersB, D

Correct. APM supports OpenTelemetry protocol (OTLP) ingestion for distributed tracing across multi-cloud and on-premises environments.

Why this answer

OCI APM supports both server-side tracing (Java, Node.js, Python, etc.) and real user monitoring (RUM) via browser agents. It ingests OpenTelemetry standard traces and does not require dedicated database storage to be provisioned manually by the user.

Full explanation →
26
MCQmedium

Your OKE cluster uses Calico for Kubernetes network policy enforcement. You need to write a network policy that allows Pod A in namespace 'frontend' to communicate with Pod B in namespace 'backend', while blocking all other ingress traffic to Pod B. How should you implement this?

A.Apply an OCI Identity and Access Management (IAM) policy restricting pod access.
B.Configure an OCI Load Balancer listener rule for namespace ports.
C.Create a Kubernetes NetworkPolicy in the 'backend' namespace selecting Pod B and allowing ingress exclusively from namespace 'frontend'.
D.Modify the VCN Security List for the worker node subnet to filter traffic by pod name.
AnswerC

Correct. Kubernetes NetworkPolicy objects enable fine-grained namespace and pod-level isolation.

Why this answer

A Kubernetes NetworkPolicy in namespace 'backend' specifying podSelector for Pod B and ingress rules allowing from namespaceSelector with 'frontend' satisfies this requirement.

Full explanation →
27
Multi-Selecthard

An OCI Security Administrator is designing a multi-tenancy IAM architecture using compartments and dynamic groups. Which TWO best practices should be implemented to ensure least-privilege access and scalable policy management?

Select 2 answers
A.Write all IAM policies at the tenancy level referencing compartment-scoped dynamic groups to minimize the total number of policy statements.
B.Disable multi-factor authentication (MFA) for federation users relying on external IdPs to streamline administrative logins.
C.Assign users directly to administrative compartments using inline policies instead of defining groups.
D.Leverage tag-based access control by defining IAM policies that evaluate resource tags (e.g., where target.resource.tag.department.value = 'Finance').
E.Use dynamic group matching rules based on resource OCIDs rather than compartment OCIDs for maximum flexibility.
AnswersA, D

Placing policies at the root/tenancy level while delegating administrative control via compartment definitions makes management cleaner and avoids policy sprawl.

Why this answer

Best practices for IAM at scale include using tenancy-level policies pointing to compartment-scoped dynamic groups for cross-compartment automation, and leveraging groups with dynamic matching rules based on resource attributes rather than static user assignments.

Full explanation →
28
MCQmedium

An OCI architect is reviewing the disaster recovery plan for a mission-critical database. The business requires a recovery drill to be executed in production without interrupting ongoing primary database operations or impacting RPO. Which Data Guard feature allows this?

A.Snapshot Standby mode, which converts the standby to a read-write database for testing and later converts it back to a physical standby, merging changes.
B.Manual database cloning from Object Storage snapshots.
C.Logical Standby mode with SQL Apply disabled permanently.
D.Primary database switchover executed during peak business hours.
AnswerA

Snapshot Standby allows read-write operations for testing while preserving redo from the primary to be applied when reverted back to physical standby.

Why this answer

Active Data Guard allows the standby database to be open in read-only mode while applying redo, and Snapshot Standby allows converting a standby to a read-write testing mode temporarily before converting it back.

Full explanation →
29
MCQmedium

An OCI architect is setting up a disaster recovery environment where compute instances in the DR region need identical network configurations (private IPs, VNICs, security lists) to the primary region. Which OCI capability assists in deploying reproducible network topologies across regions?

A.OCI File Storage Network File System (NFS) exports
B.OCI Resource Manager with Terraform configurations
C.OCI IAM Domain Federation wizard
D.OCI Streaming service partition replication
AnswerB

Resource Manager automates Terraform execution to deploy consistent infrastructure stacks across regions.

Why this answer

OCI Resource Manager uses Terraform to provision infrastructure as code, allowing architects to replicate identical VCN, subnet, and security configurations across regions.

Full explanation →
30
Multi-Selecthard

An administrator is troubleshooting intermittent packet loss and latency spikes over an OCI FastConnect circuit connected to an on-premises datacenter. Which THREE diagnostic steps or tools are applicable within OCI? (Choose THREE)

Select 3 answers
A.Checking OCI Monitoring metrics for the FastConnect virtual circuit to review bandwidth utilization and error drops.
B.Using OCI Network Path Analyzer to simulate packet paths and verify reachability between VCN instances and on-premises IPs.
C.Modifying the OCI tenancy tenancy home region to reroute physical fiber cables.
D.Verifying BGP session status and logs on the DRG and on-premises routers to check for route flapping.
E.Rebooting the OCI IAM service to reset global routing tables.
AnswersA, B, D

OCI Monitoring provides metrics on traffic volume, drops, and interface health.

Why this answer

Troubleshooting hybrid network performance involves using OCI Network Path Analyzer to check reachability/routing, monitoring FastConnect virtual circuit metrics (such as bandwidth and error drops) in OCI Monitoring, and verifying BGP session stability.

Full explanation →
31
Multi-Selecteasy

When planning a workload migration to OCI, what are TWO primary benefits of conducting a comprehensive discovery and assessment phase using tools like OCI Migration? (Choose two.)

Select 2 answers
A.Accurately right-sizing OCI compute and storage resources based on historical utilization metrics
B.Automatically rewriting legacy COBOL source code into modern Python applications
C.Physically replacing hard drives in on-premises servers before shipping them
D.Instantly upgrading on-premises cooling systems without cloud involvement
E.Identifying application dependencies and grouping servers into logical migration waves
AnswersA, E

Assessment tools analyze CPU and memory usage to recommend cost-effective OCI shapes avoiding over-provisioning.

Why this answer

Discovery and assessment helps identify workload dependencies, right-size compute shapes, and estimate costs accurately before migration execution.

Full explanation →
32
MCQeasy

An administrator wants to inspect the operational health and performance metrics of an OCI Exadata Database Service instance using the default platform metrics provided out-of-the-box by OCI. Where should the administrator navigate in the OCI Console to view these metrics?

A.Navigate to Compute > Instances, select the Exadata VM cluster, and open the Performance tab.
B.Navigate to Observability and Management > Monitoring, then select the Database service namespace.
C.Navigate to Governance and Administration > Audit, then select the Database compartment.
D.Navigate to Identity & Security > Policies to enable the DB telemetry poller.
AnswerB

Correct. The Monitoring service consolidates metrics by service namespace, including database metrics.

Why this answer

Database metrics emitted by Oracle Databases and Exadata instances are viewed directly under the Database details page in the Console under 'Metrics', or via the Monitoring service dashboard.

Full explanation →
33
MCQhard

An architect is designing a high-availability hybrid cloud strategy utilizing OCI FastConnect and OCI Site-to-Site VPN to the same VCN. To ensure automatic failover from FastConnect to VPN without routing loops, what design pattern must be implemented on the OCI Dynamic Routing Gateway (DRG)?

A.Utilize separate DRG route tables for FastConnect and VPN attachments, ensuring VPN route rules have a more specific prefix or backup preference configured via static overrides if BGP fails.
B.Enable Equal-Cost Multi-Path (ECMP) routing on the DRG to split packets evenly across FastConnect and VPN.
C.Configure identical metric values for both FastConnect and VPN routes within a single DRG route table to load-balance traffic.
D.Attach both the FastConnect virtual circuit and the VPN tunnel to the default VCN route table directly, bypassing the DRG.
AnswerA

Setting up explicit route preferences or utilizing static backup routes ensures that traffic seamlessly fails over to the VPN when the FastConnect BGP session drops.

Why this answer

To achieve active-passive failover between FastConnect and Site-to-Site VPN, you configure the DRG route tables such that routes learned via FastConnect have a preferred path (or lower priority metric if using static, but FastConnect uses BGP where AS-path prepending or local preference controls the path, whereas VPN connections can be configured with specific priorities in the DRG route rules). Specifically, DRG route tables allow you to set static routes or manage BGP preferences so that VPN routes act as backups.

Full explanation →
34
MCQeasy

Your OCI Function needs to write audit logs or custom debugging information that can be easily searched and analyzed alongside other cloud logs. Which OCI service should your function log to?

A.OCI Logging Service
B.OCI DNS Service
C.OCI Vault
D.OCI Email Delivery Service
AnswerA

Correct. OCI Functions automatically stream logs to the OCI Logging service.

Why this answer

OCI Functions natively integrate with OCI Logging service, allowing function stdout/stderr to be captured and queried easily.

Full explanation →
35
MCQhard

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

A.Attach a broad administrative instance principal to the worker node pool.
B.Expose Object Storage via a public endpoint and permit anonymous read access.
C.Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.
D.Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.
AnswerD

Workload Identity integrates OKE service accounts with OCI IAM, providing short-lived security tokens without static credentials.

Why this answer

OCI Identity and Access Management (IAM) Workload Identity for OKE allows Kubernetes pods to assume OCI IAM roles securely using service account tokens, eliminating long-lived credentials.

Full explanation →
36
MCQmedium

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

A.You must physically patch your fiber into Oracle's Meet-Me-Room.
B.You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.
C.Traffic is routed exclusively over the public internet with guaranteed SLA.
D.Oracle installs a dedicated router inside your on-premises datacenter.
AnswerB

The Provider model leverages partner networks to reach OCI without a direct cage in an Oracle datacenters.

Why this answer

In the FastConnect Provider model, you connect via an OCI partner (such as Equinix, Megaport, or AT&T) who provides network connectivity to an OCI region, whereas the Colocation model requires you to have infrastructure physically installed in an Oracle-partner datacenter where OCI routers reside.

Full explanation →
37
MCQmedium

You are planning the network cutover for a large-scale migration to OCI. The on-premises data center is connected to OCI via an OCI FastConnect circuit configured with private virtual circuits. During cutover, DNS records must be updated so that client traffic resolves to OCI load balancers. Which OCI service should you use to manage internal and external DNS authoritative resolution smoothly?

A.OCI API Gateway
B.OCI Traffic Management Steering
C.OCI Network Firewall
D.OCI DNS (Public and Private Zones)
AnswerD

OCI DNS supports highly scalable public and private zones to manage DNS record cutovers for migrated applications.

Why this answer

OCI DNS provides robust public and private DNS zone management, enabling seamless management of records, traffic steering, and integration with VCNs.

Full explanation →
38
MCQhard

An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?

A.Set up an OCI Vault encryption key to automatically encrypt span attribute strings in transit.
B.Configure IAM policies to redact payload strings at the APM domain boundary.
C.Modify the OCI Monitoring alarm expression to filter out PII strings.
D.Configure APM Data Masking rules or agent configuration properties to exclude or scrub sensitive attributes.
AnswerD

Correct. APM provides data masking and filtering features to redact sensitive attributes from spans.

Why this answer

OCI APM supports data masking and filtering rules to scrub sensitive information such as passwords, tokens, and PII from trace spans before they are sent to the APM domain.

Full explanation →
39
MCQmedium

You are troubleshooting an OCI Functions application that fails to pull container images from a private Oracle Cloud Infrastructure Registry (OCIR) repository during deployment. The function application is configured correctly, but the build/invoke fails with authentication errors. What is the most likely missing configuration?

A.The OCI VCN Security List lacks an egress rule for port 22 to connect to GitHub.
B.Missing IAM policy granting the Functions service or dynamic group read access to the OCIR repository compartment.
C.The API Gateway deployment lacks a public IP address.
D.The OCI Vault master encryption key is disabled.
AnswerB

OCI Functions require explicit IAM permissions (such as allowing dynamic groups to read repositories) to pull container images from private OCIR registries.

Why this answer

OCI Functions require a properly configured Auth Token and IAM policy, or a resource principal / dynamic group permissions setup allowing the Fn CLI or OCI service to authenticate against OCIR.

Full explanation →
40
MCQmedium

Your company is executing a lift-and-shift migration of 50 physical servers running Red Hat Enterprise Linux (RHEL) to OCI. You want to ensure that the operating systems remain supported, patched, and entitled to Oracle Linux Premier Support without having to rebuild the servers. What conversion utility should you use?

A.VMware HCX OS conversion engine
B.OCI Database Migration service
C.OCI Instance Export/Import wizard
D.Oracle Linux Upgrade and Conversion tool (using the `leapp` utility and Oracle Linux yum repositories)
AnswerD

The `leapp` utility combined with Oracle support packages allows seamless in-place conversion from RHEL/CentOS to Oracle Linux.

Why this answer

OCI provides the 'Canonical' or 'OS Management Hub' tools, and specifically the 'Linux Migration' utility or 'Leapp' framework supported by Oracle to convert RHEL or CentOS instances running in OCI to Oracle Linux in-place, retaining binary compatibility and gaining Oracle support.

Full explanation →
41
Multi-Selecteasy

Which TWO of the following statements are correct regarding OCI Load Balancer features for high availability? (Choose two.)

Select 2 answers
A.OCI Load Balancers are restricted to a single Availability Domain and cannot cross AD boundaries.
B.An OCI Load Balancer can be deployed as either public (internet-facing) or private (internal).
C.OCI Load Balancers are regional services that span multiple Availability Domains.
D.OCI Load Balancers only support Layer 3 packet routing.
E.OCI Load Balancers require manual customer-managed keepalived failover clustering.
AnswersB, C

Both public and private load balancer types are supported natively in OCI.

Why this answer

OCI Load Balancers are regional services and can be configured as public or private to suit external or internal traffic routing requirements.

Full explanation →
42
Multi-Selectmedium

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Select 3 answers
A.Trigger responder recipes to remediate detected security risks automatically or manually.
B.Automatically patch kernel-level vulnerabilities on third-party on-premises servers.
C.Monitor tenancy resources for security misconfigurations and policy violations.
D.Provide point-to-point IPsec VPN tunneling between VCNs.
E.Calculate an overall security score for the tenancy based on detected problems.
AnswersA, C, E

Responder recipes provide automated or manual remediation capabilities for security findings.

Why this answer

Cloud Guard detects misconfigurations, computes security scores, and can trigger automated or manual responders to mitigate security risks.

Full explanation →
43
MCQeasy

An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?

A.OCI Cost Analysis Scheduled Reports
B.OCI Events service scheduled triggers
C.OCI Audit log exports
D.OCI Monitoring service billing alarms
AnswerA

Correct. Scheduled reports in Cost Analysis allow automated generation and delivery of cost data.

Why this answer

OCI Cost Analysis supports scheduled reports that can be exported or emailed regularly to stakeholders.

Full explanation →
44
Multi-Selectmedium

Which TWO actions are required when migrating an on-premises Oracle database to an Oracle Autonomous Database (Serverless) using Oracle Data Pump? (Choose two.)

Select 2 answers
A.Run the DBMS_CLOUD.PREPARE_FOR_AUTONOMOUS procedure on the source database to ensure compatibility
B.Download and configure the database connection wallet on the host executing the Data Pump utility
C.Disable Transparent Data Encryption (TDE) on the source database before export
D.Manually format all source datafiles into Oracle ASM disk groups prior to export
E.Configure a direct NFS mount between the source server and the Autonomous Database storage tier
AnswersA, B

Correct. This procedure checks and flags incompatible objects or configurations.

Why this answer

Migrating via Data Pump to Autonomous Database requires using a secure connection wallet and running pre-migration compatibility scripts.

Full explanation →
45
MCQhard

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

A.Enable OCI Database Vault on the compute instances.
B.Replace the OCI Dynamic Routing Gateway with an Internet Gateway.
C.Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.
D.Recreate the Azure ExpressRoute circuit in a different Azure subscription.
AnswerC

Mismatched MTU sizes causing fragmentation can severely impact performance across cloud interconnects.

Why this answer

Checking the FastConnect virtual circuit status, monitoring traffic metrics, and checking for packet drops or incorrect routing paths via OCI Monitoring and Network Path Analyzer is the correct first diagnostic step.

Full explanation →
46
Multi-Selecthard

You are designing a high-performance computing (HPC) workload migration to OCI. The application consists of tightly coupled MPI (Message Passing Interface) jobs that require extreme low latency and high throughput. Which THREE OCI architecture components must you deploy to satisfy these HPC requirements? (Choose three.)

Select 3 answers
A.Standard OCI Archive Storage for runtime application data files
B.OCI Shared micro-tenant burstable VM instances connected via public internet gateways
C.OCI Cluster Networks with RDMA (Remote Direct Memory Access) capable bare metal compute shapes
D.OCI Compute Placement Groups configured with cluster strategy
E.High-performance local NVMe storage attached directly to the bare metal compute instances
AnswersC, D, E

RDMA cluster networks provide sub-microsecond latency and high bandwidth required for MPI workloads.

Why this answer

OCI HPC deployments require Cluster Networks with RDMA (Remote Direct Memory Access) over RoCE, high-performance NVMe storage, and Compute Placement Groups to guarantee ultra-low latency.

Full explanation →
47
MCQhard

Your engineering team is troubleshooting an issue where migrated Linux virtual machines in OCI are experiencing severe disk I/O performance bottlenecks. The instances were migrated using raw block-level cloning from on-premises SAN storage. The volumes in OCI are provisioned as Lower Cost (Balanced) block volumes. What action should you take to resolve the performance bottleneck while maintaining data integrity?

A.Format the attached block volumes with ext3 file systems instead of ext4.
B.Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.
C.Modify the OCI block volume performance tier or increase the assigned Volume Performance Units (VPUs) per GB.
D.Attach an OCI File Storage Service (FSS) mount target as the primary root volume.
AnswerC

Increasing VPUs or changing performance tiers dynamically scales IOPS and throughput to match workload requirements.

Why this answer

OCI Block Volume service offers different performance tiers: Balanced, Higher Performance, and Ultra High Performance, alongside customizable VPU (Volume Performance Units) scaling. Upgrading the VPUs or switching the volume performance tier directly increases IOPS and throughput without requiring data re-migration.

Full explanation →
48
MCQhard

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

A.Configure public IP addresses on all participating compute instances.
B.Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.
C.Route all inter-region traffic through public Internet Gateways with IPsec tunneling.
D.Deploy an OCI NAT Gateway in each region.
AnswerB

RPCs leverage Oracle's private backbone, requiring proper DRG configuration, peering acceptance, route tables, and security lists.

Why this answer

Remote VCN peering across regions requires a DRG attachment for each VCN, an RPC configured on both DRGs, and a peering connection request accepted by the target region's DRG, with appropriate security lists and routing tables.

Full explanation →
49
Multi-Selecthard

When designing a multi-database architecture with Oracle GoldenGate for high availability and load distribution, which THREE architectural considerations are critical for success? (Choose three.)

Select 3 answers
A.Routing all write transactions through a single read-only replica without replication
B.Implementing Conflict Detection and Resolution (CDR) rules for active-active multi-master topologies
C.Configuring unique primary key generation strategies (e.g., sequence offsets) to prevent key collisions
D.Managing DDL replication synchronization to ensure schema modifications match across nodes
E.Disabling all checkpointing to maximize real-time packet loss tolerance
AnswersB, C, D

Correct. CDR prevents data corruption during simultaneous writes in active-active setups.

Why this answer

GoldenGate architectures require conflict resolution, careful handling of DDL changes, and proper handling of sequences.

Full explanation →
50
Multi-Selecthard

An enterprise security architect is designing a defense-in-depth strategy for an OCI environment hosting sensitive financial data. Which TWO architectural practices should be implemented to ensure robust network and data security? (Choose two.)

Select 2 answers
A.Store all master encryption keys in OCI Vault using customer-managed keys with strict rotation and access policies.
B.Rely entirely on default VCN security lists without implementing Network Security Groups.
C.Disable OCI Audit logging to prevent log tampering by administrators.
D.Expose all database instances directly to the public internet for easier management.
E.Implement granular network segmentation using private subnets, Local VCN Peering, and Network Security Groups (NSGs).
AnswersA, E

Customer-managed keys in OCI Vault ensure data at rest is cryptographically protected and strictly controlled.

Why this answer

Encrypting data at rest using customer-managed keys in OCI Vault and enforcing strict network segmentation using VCN subnets and NSGs are core pillars of a defense-in-depth architecture.

Full explanation →
51
Multi-Selecteasy

During the post-migration validation phase of an application migration to OCI, your team needs to verify security compliance and resource configuration posture. Which TWO OCI services should you use to assess security posture and detect misconfigurations? (Choose two.)

Select 2 answers
A.OCI Vulnerability Scanning Service
B.OCI Cost Estimator
C.OCI Streaming Service
D.OCI Cloud Guard
E.OCI Resource Manager
AnswersA, D

Vulnerability Scanning checks host operating systems and container images for software flaws and security issues.

Why this answer

OCI Cloud Guard and OCI Vulnerability Scanning Service are the primary native tools used to monitor security posture, detect misconfigurations, and scan compute instances for vulnerabilities.

Full explanation →
52
MCQhard

Your organization runs a multi-tier microservices application deployed across multiple OCI regions. You are tasked with implementing OCI Application Performance Monitoring (APM) to trace distributed transactions across different API gateways and containerized services. To correlate user browser sessions with backend database queries, what is the required configuration step on the client-facing application tier?

A.Inject the APM Browser Agent (JavaScript tracer) into the web pages and ensure trace context propagation headers are enabled.
B.Deploy the APM Java asynchronous agent to the client browser using a browser extension.
C.Enable OCI Audit logs on the client subnets and stream the audit records into the APM Data Domain.
D.Configure the OCI API Gateway to natively intercept and inject synthetic monitoring payloads into the user cookies.
AnswerA

Correct. The APM Browser Agent collects RUM data and propagates trace headers to tie frontend and backend metrics together.

Why this answer

To correlate browser-level real user monitoring (RUM) with server-side APM traces, the APM JavaScript agent must be injected into the HTML pages, and it must propagate trace context headers (such as 'oracle-apm-trace-header') across HTTP boundaries to the backend services.

Full explanation →
53
Multi-Selecthard

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Select 2 answers
A.An IAM policy granting the dynamic group permission to read secrets in the OCI Vault.
B.A dynamic group with matching rules defining which compute instances belong to the group (e.g., based on compartment OCID).
C.A public internet gateway attached to the vault storage endpoint.
D.Disabling all IAM policy enforcement across the tenancy.
E.Hardcoded passwords placed in the instance /etc/passwd file.
AnswersA, B

IAM policies are required to authorize the dynamic group to access vault secrets.

Why this answer

Using dynamic groups requires writing matching rules based on instance attributes and creating IAM policies granting the dynamic group access to vaults.

Full explanation →
54
MCQhard

An architect is configuring disaster recovery for an Autonomous Database (Serverless) instance using Autonomous Data Guard. The primary database resides in the US East (Ashburn) region, and the standby is in US West (Phoenix). What is the behavior of the standby database regarding read operations?

A.The standby database automatically accepts write operations and replicates them back to the primary
B.The standby database can be accessed in read-only mode for reporting and queries
C.The standby database accepts read-write transactions concurrently with the primary database
D.The standby database is completely inaccessible until a manual switchover or failover occurs
AnswerB

Correct. Autonomous Data Guard supports read-only access on the standby database.

Why this answer

Autonomous Data Guard standby databases can be opened in read-only mode to offload reporting queries from the primary database.

Full explanation →
55
MCQmedium

An administrator wants to set up automated remediation when an OCI Monitoring alarm is triggered for high CPU utilization on a database. Specifically, they want a serverless function to execute to scale up resources. Which OCI service acts as the bridge to trigger the function upon alarm firing?

A.OCI Service Connector Hub
B.OCI API Gateway
C.OCI Events Service
D.OCI Notifications Service
AnswerD

Correct. Notifications service supports OCI Functions as an endpoint to execute automated remediation workflows.

Why this answer

OCI Notifications service can invoke OCI Functions as a subscriber to an alert topic, enabling serverless event-driven remediation.

Full explanation →
56
MCQmedium

You are migrating a multi-tier web application to OCI. The web tier consists of Apache HTTP servers that need to be auto-scaled based on CPU utilization. Which combination of OCI services should you configure to achieve automated horizontal scaling?

A.OCI Resource Manager and Terraform apply schedules
B.OCI Events Service and OCI Notifications triggered by Object Storage uploads
C.OCI Instance Pools and OCI Auto-Scaling Configurations
D.OCI Cloud Guard and OCI Vulnerability Scanning
AnswerC

Instance pools manage a group of similar compute instances, while auto-scaling configurations scale the pool based on metric thresholds.

Why this answer

OCI Compute Auto-Scaling configurations integrated with Instance Pools allow you to automatically provision or terminate compute instances based on metrics such as CPU or memory utilization, sitting behind an OCI Load Balancer.

Full explanation →
57
MCQhard

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

A.OCI Certbot DaemonSet running on all worker nodes
B.OCI Vault automatic key version rotation
C.OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload
D.Kubernetes CronJob executing kubectl rollout restart every night
AnswerC

Correct. OCI Service Mesh handles mTLS certificate lifecycle and Envoy proxies hot-reload certificates seamlessly.

Why this answer

OCI Service Mesh integrates with OCI Certificates service (or external CAs) to automatically issue, distribute, and rotate workload certificates using sidecar proxies (Envoy) which hot-reload certificates without pod restarts.

Full explanation →
58
MCQhard

Your company is migrating a large PostgreSQL database from AWS RDS to OCI Database with PostgreSQL. The database is 4 TB in size, and write operations continue 24/7. To ensure zero data loss and minimal downtime during cutover, which migration strategy should you employ?

A.Establish AWS Direct Connect to OCI FastConnect and mount an AWS EBS volume directly to an OCI VM running PostgreSQL.
B.Take an AWS RDS snapshot, download the snapshot files via AWS CLI, and restore them onto an OCI Compute instance running PostgreSQL.
C.Stop the application writes, take a pg_dump file, transfer it via SCP, and restore it into OCI during a scheduled 12-hour outage window.
D.Configure PostgreSQL logical replication (or use OCI GoldenGate / DMS equivalents) to stream ongoing transaction logs after performing an initial consistent dump and restore.
AnswerD

Logical replication synchronizes initial state and continuously streams WAL (Write-Ahead Logs) changes until the final switchover.

Why this answer

For heterogenous or cloud-to-cloud PostgreSQL migrations with ongoing writes, logical replication (using tools like AWS DMS or native PostgreSQL logical decoding with pg_logical / OCI GoldenGate) allows initial data snapshot loading followed by continuous change data capture (CDC).

Full explanation →
59
MCQhard

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

A.Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.
B.Enable OCI Cloud Guard with default responder rules.
C.Deploy OCI Network Firewall to inspect all control plane traffic.
D.Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.
AnswerA

Object Storage Object Lock in Compliance mode ensures that logs cannot be deleted or modified by anyone, even root users, fulfilling strict audit requirements.

Why this answer

OCI Audit logs all API calls automatically. To ensure tamper-proofing and long-term compliance retention, administrators should use Object Storage buckets configured with WORM (Write Once, Read Many) policies via Object Storage Object Lock.

Full explanation →
60
MCQeasy

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

A.Allow group Auditors to use database-families in root
B.Allow group Auditors to read all-resources in compartment Production
C.Allow group Auditors to read compartments in tenancy
D.Allow group Auditors to manage all-resources in tenancy
AnswerB

This grants read-only access strictly to resources within the specified 'Production' compartment.

Why this answer

The verb 'inspect' allows users to list resources without viewing sensitive metadata, while 'read' allows viewing resource metadata. Scoping the policy to a specific compartment restricts access appropriately.

Full explanation →
61
MCQmedium

You are managing an OKE cluster where developer teams frequently deploy new microservice versions. You need to implement a canary deployment strategy where 10% of production traffic is automatically routed to the new version while 90% goes to the stable version, without rewriting your application code. Which tool or pattern should you use?

A.OCI Notifications service broadcast rules
B.OCI Service Mesh traffic split rules
C.Kubernetes standard Service resource with multiple selectors pointing to the same pod
D.OCI Load Balancer listener port re-mapping
AnswerB

Correct. OCI Service Mesh allows declarative traffic splitting between different virtual service versions (e.g., 90/10 split).

Why this answer

Service mesh solutions like Istio or OCI-supported service mesh routing features allow fine-grained traffic splitting for canary deployments.

Full explanation →
62
MCQmedium

You are migrating an Oracle Database 19c on-premises to OCI Exadata Database Service on Dedicated Infrastructure using Oracle Zero Downtime Migration (ZDM) in offline mode. The target database is already provisioned. Which ZDM migration phase configures the target database and initiates the data transfer via Oracle Data Pump?

A.DEPLOY
B.MIGRATE
C.POST-MIGRATE
D.PRE-MIGRATE
AnswerB

The MIGRATE phase performs the actual data movement and configuration of the target database.

Why this answer

The ZDM workflow relies on distinct phases. The 'MIGRATE' phase is responsible for executing the database migration workflow, including configuring the target database and invoking Data Pump to move the data.

Full explanation →
63
MCQhard

An enterprise application running on OCI requires multi-factor authentication (MFA) for all administrators accessing the tenancy console, but developers should be authenticated using an enterprise identity provider (IdP) via SAML 2.0. How should you architect this in OCI IAM?

A.Create separate tenancies for administrators and developers.
B.Write IAM policies with conditional statements checking the user's IP address.
C.Configure OCI IAM identity federation with your enterprise IdP for developers, and apply an IAM authentication policy enforcing MFA for native console administrators.
D.Disable native IAM users entirely and force all users to share a single administrator account with MFA.
AnswerC

Federating enterprise users delegates authentication to the IdP, while IAM authentication policies enforce MFA for local or native accounts.

Why this answer

OCI IAM supports identity federation with SAML 2.0-compliant IdPs for enterprise users while enforcing local or native MFA policies for native console accounts, configured via IAM authentication policies and IdP federation.

Full explanation →
64
Multi-Selectmedium

Which TWO methods can be used to securely connect an application running in an OCI compute instance to an Autonomous Database instance with private endpoint access enabled? (Choose two.)

Select 2 answers
A.Exposing the database via an Internet Gateway and public IP address mapping
B.Establishing an SSH tunnel through the OCI Vault key management service
C.Routing application traffic through OCI Object Storage public pre-authenticated requests
D.Using mTLS authentication with the downloaded database connection wallet
E.Using TLS authentication without a wallet (TLS) via the database private IP and service name
AnswersD, E

Correct. mTLS with a wallet is supported for private endpoints.

Why this answer

Private endpoint Autonomous Databases can be accessed via private IP addresses using mTLS with a wallet or TLS without a wallet.

Full explanation →
65
Multi-Selecteasy

Which TWO protocols or formats are natively supported for publishing custom metrics to the OCI Monitoring service?

Select 2 answers
A.SQL*Net protocol
B.Syslog RFC 5424
C.OCI Monitoring REST API
D.IMAP email protocol
E.StatsD protocol
AnswersC, E

Correct. Custom metrics can be pushed directly via the Monitoring API.

Why this answer

OCI Monitoring service supports publishing custom metrics via the OCI Monitoring API and the StatsD protocol.

Full explanation →
66
MCQhard

Your organization has set strict budgets in OCI to monitor cloud expenditure. A finance team member needs to receive an alert when forecasted spending reaches 100% of the monthly budget. How should you configure this alert?

A.Create an OCI Monitoring alarm on the Billing namespace with a metric expression for forecasted cost.
B.Use OCI Cost Analysis scheduled reports with an integrated SMTP relay.
C.Set up an OCI Events rule listening for billing threshold exceedance events.
D.Configure an OCI Budget alert rule with threshold type set to 'FORECASTED' and threshold value set to 100.
AnswerD

Correct. Budgets support forecasting thresholds to alert administrators before actual budget overruns occur.

Why this answer

OCI Budgets support alerts based on actual spend or forecasted spend. You can configure a threshold type of 'FORECASTED' with a percentage of 100.

Full explanation →
67
MCQeasy

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

A.IAM Group
B.Compartment
C.Federation Provider
D.Dynamic Group
AnswerA

IAM groups are collections of users that simplify policy administration.

Why this answer

An IAM user group is used to aggregate users with similar roles so that policies can be applied to the group collectively.

Full explanation →
68
MCQmedium

You are designing a high availability disaster recovery architecture for an Oracle Base Database Service system deployed on a 2-node Virtual Machine DB System. You need to configure automated backups. Which storage destination is automatically used by OCI to store these automated backups?

A.A separate standby Oracle ASM disk group on Block Volume storage.
B.Local NVMe scratch disk attached to the primary database node.
C.OCI Object Storage bucket managed by the database service.
D.An independent File Storage Service (FSS) mount target shared across availability domains.
AnswerC

Automated backups are securely stored in Oracle-managed OCI Object Storage buckets.

Why this answer

OCI Database service automatically uses OCI Object Storage as the backend destination for all automated database backups.

Full explanation →
69
Multi-Selectmedium

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

Select 3 answers
A.Allocation of BGP routing tables for on-premises FastConnect circuits.
B.Rate limiting to mitigate denial of service (DoS) and brute-force attacks.
C.Protection against OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS).
D.Management of hardware security module (HSM) crypto keys for database volumes.
E.Access control rules based on geographic location, IP addresses, or HTTP headers.
AnswersB, C, E

Rate limiting controls traffic volume from specific clients.

Why this answer

OCI WAF protects web applications using access control rules, protection rules against OWASP top 10, and rate limiting.

Full explanation →
70
Multi-Selecthard

You are optimizing the cost and performance of an Exadata Database Service on Dedicated Infrastructure environment hosting multiple large databases. Which THREE practices should you implement to achieve optimal resource utilization and cost efficiency?

Select 3 answers
A.Consolidate multiple non-CDB databases into a single Multitenant Container Database (CDB) with multiple PDBs.
B.Configure Exadata Smart Flash Cache policies appropriately for OLTP versus DSS workloads.
C.Migrate all table data to standard Block Volume storage to bypass Exadata storage servers.
D.Disable automatic backups entirely to save OCI Object Storage costs.
E.Dynamically scale OCPU counts on the Exadata infrastructure based on peak and off-peak workload schedules.
AnswersA, B, E

Consolidation reduces overhead and maximizes resource sharing across workloads.

Why this answer

To optimize Exadata Dedicated environments, you can leverage OCPUs scaling, database consolidation into multitenant container databases, and storage server flash cache optimizations.

Full explanation →
71
Multi-Selecthard

Which THREE strategies are recommended when planning a large-scale database migration (exceeding 100 TB) from on-premises to Exadata Database Service on Dedicated Infrastructure with minimal downtime? (Choose three.)

Select 3 answers
A.Leveraging Transportable Tablespaces (TTS) combined with RMAN cross-platform conversion
B.Utilizing Oracle Zero Downtime Migration (ZDM) physical migration workflows
C.Copying database files across the public internet using standard FTP without encryption
D.Exporting the entire 100 TB database into a single plaintext SQL script using SQL*Developer
E.Configuring Oracle Data Guard or GoldenGate for ongoing delta synchronization prior to cutover
AnswersA, B, E

Correct. TTS is ideal for bulk transport of large data volumes.

Why this answer

Large-scale database migrations exceeding 100 TB benefit from transportable tablespaces, physical standby creation via RMAN, and Zero Downtime Migration (ZDM).

Full explanation →
72
MCQhard

You are configuring scaling parameters for an Autonomous Database on Dedicated Infrastructure. You need to enable automatic scaling of CPU cores to handle unpredictable traffic bursts while maintaining strict cost controls. What is the maximum CPU core auto-scaling limit for an Autonomous Container Database on Dedicated Infrastructure?

A.Exactly three times the base OCPU count provisioned for the database instance
B.An unlimited amount limited only by OCI regional capacity limits
C.Up to the total number of unallocated CPU cores available in the underlying Exadata Infrastructure instance
D.Fixed at a maximum of 128 OCPUs regardless of hardware size
AnswerC

Correct. Auto-scaling on dedicated infrastructure utilizes spare CPU capacity provisioned within the Exadata VM cluster bounds.

Why this answer

On Dedicated Infrastructure, auto-scaling for Autonomous Databases can scale up to the total number of unallocated CPU cores available in the underlying Exadata Autonomous Exadata Infrastructure instance.

Full explanation →
73
MCQeasy

When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?

A.It requires manual setup of keepalived and IP failover scripts on backend compute instances.
B.It is a regional service that automatically provisions endpoints across availability domains.
C.It terminates SSL/TLS connections before forwarding traffic to backend servers.
D.It can only route HTTP and HTTPS traffic.
AnswerB

Network Load Balancers are regional and handle multi-AD resilience natively.

Why this answer

OCI Network Load Balancer is a regional service that operates at layer 4 (TCP/UDP/ICMP) and provisions load balancer ENIs across multiple ADs for high availability.

Full explanation →
74
Multi-Selecthard

When designing an advanced alerting and monitoring strategy using OCI Monitoring Metric Query Language (MQL), which THREE practices or syntax rules should an architect follow?

Select 3 answers
A.An alarm in OCI Monitoring can only be in one of two states: Active or Inactive.
B.MQL does not support mathematical functions or aggregations; all calculations must be performed prior to ingestion.
C.Alarms can be configured to evaluate multiple metric streams using compound expressions or grouped dimensions.
D.MQL queries must always start by specifying the metric namespace, metric name, and optionally dimensions.
E.Metric interval specifications in MQL (such as [1m] or [5m]) define the aggregation window for evaluating data points.
AnswersC, D, E

Correct. MQL allows grouping and multi-stream evaluation in a single alarm definition.

Why this answer

MQL queries specify a metric namespace, metric name, optional interval, and functions (e.g., .mean()). Alarms can evaluate multiple metric streams or aggregate across dimensions, and alarms support transitioning states between OK, FIRING, and SUSPENDED.

Full explanation →
75
MCQhard

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

A.Configure an OCI Service Gateway to route traffic to Azure public endpoints.
B.Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.
C.Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.
D.Enable Oracle Autonomous Database cross-region data guard.
AnswerC

Service mesh cross-cloud communication requires robust private IP routing and open ports for control/data plane discovery.

Why this answer

A cross-cloud service mesh requires IP reachability between the control plane and data planes across the VCN and VNet, typically facilitated by the OCI-Azure Interconnect and properly configured routing and security rules.

Full explanation →

Page 1 of 5

Page 2

All pages

12345

Practice 1Z0-997-26 by domain

Target a specific domain to shore up weak areas.

Cloud Native ArchitectureMulticloud And HybridObservabilityHigh Availability And Disaster RecoveryDatabasesWorkload MigrationSecurity
See all domains with question counts →