Knowledge + Practice

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 1–75

274 questions total · 4 pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 4

1

MCQhard

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

A.Kubernetes Liveness probes configured with HTTP GET request headers.

B.OCI Audit log queries combined with Object Storage bucket lifecycle rules.

C.OCI Notifications service broadcast topics configured with JSON log forwarding.

D.W3C Trace Context header propagation across API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs in applications.

AnswerD

W3C Trace Context propagation supplies the standardised `traceparent` header that links spans across every hop, satisfying the requirement to trace API Gateway requests through Envoy sidecars to application pods. OpenTelemetry SDKs export this data via OTLP to any open-standards backend, avoiding vendor-specific agents.

Why this answer

Distributed tracing across API Gateway, service mesh sidecars, and application pods requires a common trace context propagated end-to-end. The W3C Trace Context standard (traceparent/tracestate headers) is the open standard that API Gateway, OCI Service Mesh Envoy proxies, and OpenTelemetry SDKs all understand, allowing spans to be correlated and exported to any OpenTelemetry-compatible backend. This is the only option that describes an actual tracing architecture.

Exam trap

The trap is selecting log aggregation or audit services (Notifications, Audit, Object Storage) as if they provided tracing; the exam tests whether you know tracing requires W3C Trace Context propagation and OpenTelemetry, not logs.

How to eliminate wrong answers

Option A is wrong because Kubernetes liveness probes are health checks that restart unhealthy pods; HTTP GET headers on probes have nothing to do with trace context propagation. Option B is wrong because OCI Audit logs record control-plane API activity and Object Storage lifecycle rules manage object retention; neither captures or correlates distributed traces. Option C is wrong because OCI Notifications broadcasts messages to subscribers and JSON log forwarding is log shipping, not distributed trace context propagation across services.

Full explanation →

2

MCQeasy

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

A.Azure Application Gateway

B.Azure ExpressRoute Gateway

C.Azure Virtual Network NAT

D.Azure Traffic Manager

AnswerB

The ExpressRoute virtual network gateway terminates the Azure side of the ExpressRoute circuit provisioned by OCI-Azure Interconnect, providing the BGP peering endpoint required for private connectivity. It satisfies the Ashburn deployment's need for a directly associated Azure resource, unlike ExpressRoute circuits themselves, which are logical connectivity constructs rather than the gateway terminating traffic.

Why this answer

The Azure ExpressRoute Gateway is the specific Azure-side resource that terminates the ExpressRoute circuit and connects it to the Azure Virtual Network. During OCI-Azure Interconnect onboarding, the ExpressRoute circuit is created and then associated with an ExpressRoute Gateway in the designated Azure subscription and VNet. This gateway provides the private connectivity endpoint for traffic coming from OCI via the ExpressRoute peering.

Exam trap

The trap here is confusing Azure's various gateway types (VPN Gateway, Application Gateway, NAT Gateway) with the ExpressRoute Gateway, which is the only one that terminates an ExpressRoute circuit.

How to eliminate wrong answers

Option A is wrong because Azure Application Gateway is a layer-7 web traffic load balancer and WAF, not a private connectivity endpoint for ExpressRoute. Option C is wrong because Azure Virtual Network NAT provides outbound internet connectivity for subnets, not private circuit termination. Option D is wrong because Azure Traffic Manager is a DNS-based global traffic distribution service, unrelated to ExpressRoute circuit attachment.

Full explanation →

3

MCQeasy

What is the primary architectural advantage of using Exadata Database Service on Dedicated Infrastructure compared to Exadata Database Service on Cloud@Customer?

A.It requires the customer to manage physical rack power, cooling, and hardware replacement

B.It exclusively supports non-relational database formats unlike Cloud@Customer

C.It eliminates the need for Virtual Cloud Networks (VCNs)

D.The physical Exadata hardware resides and operates entirely within an OCI data center managed by Oracle

AnswerD

Dedicated Infrastructure runs the Exadata hardware inside an Oracle-managed OCI data centre, so Oracle owns the physical environment. Cloud@Customer instead places that same hardware in the customer's own data centre, which is the architectural axis the question contrasts.

Why this answer

Exadata Database Service on Dedicated Infrastructure runs the Exadata hardware inside an OCI data center fully managed by Oracle, so the customer does not own or operate the physical infrastructure. This is the primary architectural advantage over Cloud@Customer, where the Exadata rack sits in the customer's own data center and the customer is responsible for power, cooling, and physical security.

Exam trap

1Z0-997-26 often tests the inversion of responsibility between Dedicated Infrastructure and Cloud@Customer — candidates must remember that Dedicated Infrastructure is Oracle-managed in OCI, while Cloud@Customer puts the hardware in the customer's data center with customer-managed facilities.

How to eliminate wrong answers

Option A is wrong because managing physical rack power, cooling, and hardware replacement is a characteristic of Cloud@Customer, not Dedicated Infrastructure — it is the opposite of the advantage. Option B is wrong because both offerings support Oracle relational databases (and Exadata is specifically optimized for them); neither is non-relational-only. Option C is wrong because both offerings still use VCNs for network isolation — Dedicated Infrastructure does not eliminate VCN requirements.

Full explanation →

4

MCQhard

An organization running an Oracle Exadata Database Service requires compliance auditing where all database administrative actions and sensitive data queries must be logged, tamper-proof, and retained in an isolated repository. Which combination of OCI and Oracle Database features provides this capability?

A.OCI Object Storage unversioned buckets with public read permissions

B.Oracle Data Safe combined with Database Unified Audit policies

C.Oracle Data Pump export logs stored in local temporary directories

D.Standard Linux syslog daemon writing to local disk partitions

AnswerB

Database Unified Audit policies capture administrative actions and sensitive queries, while Oracle Data Safe centralises and stores those audit records in a tamper-proof, isolated repository with retention controls. Together they satisfy the compliance auditing mandate for Exadata Database Service.

Why this answer

Oracle Data Safe combined with Database Unified Audit policies provides centralized, tamper-proof auditing for administrative actions and sensitive data queries. Data Safe collects audit trails into a secure repository, applies masking and security assessments, and Unified Auditing captures the required events at the database level.

Exam trap

The trap is choosing storage or OS-level logging (Object Storage, syslog, Data Pump logs) for compliance auditing — only Data Safe with Unified Auditing provides tamper-proof, centralized, database-aware audit trails.

How to eliminate wrong answers

Option A is wrong because unversioned buckets with public read permissions are insecure and do not provide tamper-proof audit logging — public access violates compliance. Option C is wrong because Data Pump export logs stored in local temporary directories are not tamper-proof, not centralized, and not an auditing mechanism. Option D is wrong because syslog to local disk is not tamper-proof, not isolated, and does not capture database-level administrative actions or sensitive queries.

Full explanation →

5

Multi-Selectmedium

When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?

Select 3 answers

A.Attach a public IP address directly to the WebLogic administration console port.

B.Install OCI Management Agent on the host running the WebLogic Server.

C.Configure a BGP peering session between WebLogic and the OCI Control Plane.

D.Provide valid WebLogic administrator credentials and JMX connection details.

E.Run the Stack Monitoring discovery wizard via the OCI Console or CLI.

AnswersB, D, E

Stack Monitoring discovers WebLogic Server resources through the Management Agent, which must be installed on the WebLogic host to collect metrics and topology data. Without this agent, no discovery or monitoring of the WebLogic domain is possible, making it a mandatory prerequisite.

Why this answer

Option B is correct because Stack Monitoring relies on the OCI Management Agent installed on the WebLogic host to collect metrics and communicate with the OCI Monitoring service. Option D is correct because discovery requires valid WebLogic administrator credentials plus JMX connection details (host, port, protocol) so the agent can query the WebLogic MBeans. Option E is correct because the Stack Monitoring discovery wizard, run from the OCI Console or CLI, is the mechanism that creates the WebLogic resource and associates it with the agent.

Option A is not required, as the administration console does not need a public IP and exposing it would be a security risk. Option C is not required, since BGP peering is a networking concept unrelated to WebLogic discovery and monitoring.

Exam trap

The trap is assuming network-level prerequisites like BGP peering or public IP exposure are needed for Stack Monitoring, when in fact discovery relies entirely on the outbound Management Agent plus JMX credentials.

Full explanation →

6

Multi-Selecthard

When designing an API Gateway implementation on OCI to expose backend microservices running on OKE, which THREE features or capabilities can you configure directly within the API Gateway deployment? (Choose three.)

Select 3 answers

A.Request throttling and rate-limiting to protect backend microservices from traffic surges.

B.Automatic multi-region database failover orchestration for Oracle Autonomous Database.

C.Cross-Origin Resource Sharing (CORS) policies to control browser-based access from web frontend applications.

D.JSON Web Token (JWT) validation for validating bearer tokens from identity providers.

E.Automatic provisioning and scaling of Kubernetes worker node pools inside OKE.

AnswersA, C, D

OCI API Gateway supports usage plans with request throttling and rate-limiting per client, enforced at the gateway before requests reach OKE backend microservices. This satisfies the requirement to protect backends from traffic surges without modifying application code.

Why this answer

Option A is correct because OCI API Gateway lets you define usage plans with request throttling and rate-limiting policies per deployment, protecting backend microservices on OKE from traffic surges. Option C is correct because API Gateway supports configuring CORS policies at the deployment level, allowing you to control which web frontend origins can make browser-based cross-origin requests to the API. Option D is correct because API Gateway can be configured with JWT authentication to validate bearer tokens issued by identity providers before forwarding requests to backend services.

Option B is not part of API Gateway's capabilities; Autonomous Database multi-region failover is handled by Data Guard and database-level services, not the gateway. Option E is also unrelated, since OKE worker node pool provisioning and scaling are managed through OKE node pools and the cluster autoscaler, not through API Gateway.

Exam trap

1Z0-997-26 often tests the boundary between API Gateway features and backend platform features — candidates must recognize that database failover and OKE node scaling are outside API Gateway's scope.

Full explanation →

7

Multi-Selecthard

When designing high availability for an Oracle RAC (Real Application Clusters) database deployed on OCI Exadata Database Service, which THREE architectural characteristics ensure fault tolerance and uptime? (Choose three.)

Select 3 answers

A.Running the entire cluster on a single Oracle Linux compute instance without Grid Infrastructure

B.Storing all database data on a single local NVMe drive on node 1

C.Multi-node database clustering across distinct Fault Domains or Availability Domains

D.Application Continuity or Transparent Application Failover (TAF) for seamless session recovery

E.Redundant Exadata Storage Servers (Storage Cells) providing clustered grid storage

AnswersC, D, E

Spreading RAC nodes across distinct Fault Domains or Availability Domains isolates each instance from a single hardware or datacentre failure, so surviving nodes continue serving the database. This directly satisfies the fault-tolerance and uptime requirement by removing any single point of failure at the infrastructure layer.

Why this answer

Option C is correct because Oracle RAC achieves fault tolerance by distributing cluster nodes across distinct Fault Domains or Availability Domains, so the failure of one domain does not take down the entire database. Option D is correct because Application Continuity and Transparent Application Failover (TAF) mask instance or node failures by replaying or failing over in-flight sessions, preserving application uptime during outages. Option E is correct because Exadata Storage Cells use Exadata Smart Flash Cache and ASM redundancy across multiple Storage Servers, so a failed cell does not cause data loss or database downtime.

Option A is wrong because a single Oracle Linux instance without Grid Infrastructure cannot form a RAC cluster and provides no node-level redundancy. Option B is wrong because a single local NVMe drive on one node is a single point of failure and is not shared clustered storage, which RAC requires.

Exam trap

The trap is confusing 'high availability' with 'backup' or 'performance' — candidates may pick options that sound resilient (single powerful node) but actually remove redundancy, missing that HA requires eliminating every single point of failure across compute, storage, and sessions.

Full explanation →

8

MCQmedium

You are configuring an Autonomous Database instance and need to restrict incoming database traffic so that only specific corporate subnet CIDR blocks can access the database service endpoints. Which feature should you configure?

A.OCI Web Application Firewall (WAF) attached directly to the database listener port

B.OCI Identity and Access Management dynamic groups

C.Database Vault realm restrictions

D.Autonomous Database Access Control Lists (ACLs) specifying allowed IP CIDR blocks

AnswerD

Autonomous Database ACLs restrict access at the database service endpoint level by permitting only specified IP CIDR blocks. This directly enforces the corporate subnet restriction, unlike VCN security lists or NSGs, which filter traffic at the network layer rather than the database endpoint itself.

Why this answer

Autonomous Database supports Access Control Lists (ACLs) that specify allowed IP CIDR blocks for database service endpoints. This is the native, supported mechanism to restrict incoming traffic to specific corporate subnets without deploying additional network appliances.

Exam trap

1Z0-997-26 often tests the misconception that WAF or IAM can restrict database network access — candidates must recognize that ADB ACLs are the correct CIDR-based control for database endpoints.

How to eliminate wrong answers

Option A is wrong because OCI WAF is designed for HTTP/HTTPS application traffic, not for database listener ports (e.g., TCPS 1522) — WAF cannot inspect or filter database protocol traffic. Option B is wrong because IAM dynamic groups control OCI resource principals' permissions, not network-level access to database endpoints. Option C is wrong because Database Vault realm restrictions control privileged user access and separation of duties within the database, not network CIDR-based access control.

Full explanation →

9

MCQeasy

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

A.Dynamic Routing Gateway (DRG) with Remote VCN Peering

B.Internet Gateway (IGW)

C.NAT Gateway

D.Local Peering Gateway (LPG)

AnswerA

A Dynamic Routing Gateway with remote VCN peering links VCNs across OCI regions over Oracle's private backbone, providing the routing required for cross-region Data Guard traffic. This satisfies the stem's requirement for secure inter-region connectivity without traversing the public internet.

Why this answer

Remote VCN Peering in OCI uses a Dynamic Routing Gateway (DRG) attached to each VCN, with the two DRGs connected over OCI's private backbone to link VCNs in different regions. This provides private, encrypted-in-transit connectivity suitable for cross-region Data Guard redo transport without traversing the public internet. The DRG is the required routing anchor for any inter-VCN or on-premises connectivity in OCI.

Exam trap

1Z0-997-26 often tests the confusion between Local Peering Gateway (same-region VCN peering) and DRG-based Remote VCN Peering (cross-region), catching candidates who assume any peering gateway works across regions.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway provides public inbound/outbound internet access for a VCN and routes over the public internet — it is not a private cross-region VCN-to-VCN path and is unsuitable for Data Guard replication security requirements. Option C is wrong because a NAT Gateway only allows outbound internet access for private subnets and cannot peer two VCNs. Option D is wrong because a Local Peering Gateway (LPG) connects VCNs only within the same region (and same tenancy), not across regions.

Full explanation →

10

MCQmedium

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

A.OCI Container Instances

B.OCI Functions

C.Oracle Container Engine for Kubernetes (OKE)

D.OCI Compute Standard virtual machine instances

AnswerA

Container Instances runs containers directly without exposing or requiring you to manage the host operating system, so kernel patching and VM scaling are handled by OCI. That serverless container execution satisfies the stated constraint of avoiding OS administration for a standard Docker image.

Why this answer

OCI Container Instances is a serverless compute service that runs containers directly without requiring you to manage the underlying host OS, kernel patching, or VM scaling. It is purpose-built for running single containers or small groups of tightly coupled containers, making it the ideal fit for migrating a standard Docker container with minimal operational overhead. Unlike OKE, it abstracts away the Kubernetes control plane and worker nodes, so you don't manage any cluster infrastructure.

This directly satisfies the requirement to avoid OS management and VM scaling.

Exam trap

1Z0-997-26 often tests the distinction between serverless container services and orchestration platforms, so candidates mistakenly choose OKE because they assume Kubernetes is required for all containerized workloads, overlooking that Container Instances eliminates cluster management entirely.

How to eliminate wrong answers

Option B is wrong because OCI Functions is a Function-as-a-Service (FaaS) platform that executes event-driven code snippets, not long-running containerized web applications; it has execution time limits and does not support arbitrary Docker containers. Option C is wrong because OKE is a managed Kubernetes service that still requires you to manage worker nodes, cluster scaling, and Kubernetes objects—adding operational overhead rather than removing it. Option D is wrong because OCI Compute Standard VM instances require you to manage the guest OS, apply kernel patches, and configure autoscaling yourself, which contradicts the goal of avoiding OS and VM management.

Full explanation →

11

MCQmedium

You need to ensure that database backups stored in OCI Object Storage are protected against accidental deletion or ransomware encryption by administrators. Which feature should you enable on the bucket?

A.Object Storage Object Lock with Compliance mode.

B.OCI Cloud Guard data protection detectors.

C.OCI Object Storage Pre-Authenticated Requests (PAR).

D.OCI Vault key rotation policies.

AnswerA

Object Lock with Compliance mode enforces WORM protection, preventing any user—including tenancy administrators—from deleting or overwriting objects until the retention period expires. This directly satisfies the stem's requirement to protect backups against accidental deletion or ransomware encryption by administrators, since even privileged accounts cannot bypass Compliance-mode retention.

Why this answer

Object Lock with Compliance mode enforces a WORM (Write Once, Read Many) retention policy that cannot be removed or shortened by any user — including tenancy administrators — until the retention period expires. This directly protects backups against accidental deletion and ransomware encryption because objects cannot be overwritten or deleted during the retention window. Compliance mode is the strictest of the two Object Lock modes (the other being Governance mode, which privileged users can bypass).

Exam trap

1Z0-997-26 often tests the distinction between detection services (Cloud Guard), access-sharing features (PARs), and cryptographic controls (Vault) versus true immutability controls (Object Lock), so candidates who pick a 'security-sounding' service instead of the WORM feature get it wrong.

How to eliminate wrong answers

Option B is wrong because Cloud Guard is a threat-detection and posture-management service that identifies risky configurations and suspicious activity; it generates findings and can trigger remediation, but it does not enforce immutability on stored objects. Option C is wrong because Pre-Authenticated Requests grant time-limited, unauthenticated access to specific objects or buckets — they are an access-sharing mechanism, not a protection mechanism, and actually widen the attack surface. Option D is wrong because Vault key rotation policies only rotate the encryption keys used to protect data at rest; rotation does not prevent an administrator from deleting or overwriting bucket objects.

Full explanation →

12

MCQhard

A healthcare company must prove to auditors that no one, including tenancy administrators, could have altered or deleted a specific month of application logs stored in OCI Object Storage. Logs arrive continuously from OCI Logging via Service Connector Hub. Which combination of settings guarantees this?

A.Apply an Object Storage retention rule with a time-bound retention duration to the bucket, then lock the rule

B.Configure a lifecycle policy that transitions the logs to Archive Storage after 30 days and keeps them there indefinitely

C.Create a pre-authenticated request for the bucket and share it only with the audit team

D.Enable Object Versioning on the bucket and store the logs in a Standard tier bucket

AnswerA

A retention rule prevents objects from being overwritten or deleted until the retention period expires, and locking the rule makes it irrevocable so even tenancy administrators cannot shorten or remove it. This delivers the immutability and non-repudiation the auditors demand for the specified month of logs.

Why this answer

Object Storage retention rules block overwrite and deletion of objects until the retention period ends. Locking the rule removes the ability to modify or delete it, even for tenancy administrators, which is the property auditors need for non-repudiation. Versioning, lifecycle transitions, and pre-authenticated requests manage access or cost but do not enforce immutability.

Exam trap

The trap here is treating Object Versioning as equivalent to immutability, when versioning still permits deletion of all versions by a privileged user.

Full explanation →

13

Multi-Selecthard

You are designing a cross-region disaster recovery strategy for an Oracle Exadata Database Service on Dedicated Infrastructure deployment. Which TWO steps or configurations are required to establish an Active Data Guard standby database in a remote OCI region?

Select 2 answers

A.Mount a shared block storage volume across both OCI regions using Network File System (NFS).

B.Enable automatic backups on the standby database using the same retention period as the primary.

C.Configure Standby Redo Logs (SRLs) on both the primary and standby databases sized identically to the online redo logs.

D.Configure Oracle GoldenGate bidirectional replication as the underlying transport mechanism.

E.Establish network connectivity between the primary and standby VCNs using a Dynamic Routing Gateway (DRG) and local or remote VCN peering.

AnswersC, E

Standby redo logs on both databases, sized identically to the online redo logs, let the standby receive and apply redo shipped from the primary. Active Data Guard requires this configuration to sustain real-time synchronisation across the remote region.

Why this answer

Option C is correct because Oracle Data Guard requires standby redo logs (SRLs) on both the primary and standby databases to receive redo from the primary and to support role transitions; best practice is to size them identically to the online redo logs and add one extra SRL group per thread. Option E is correct because an Active Data Guard standby in a remote OCI region needs network connectivity between the primary and standby VCNs, which in OCI is achieved with a Dynamic Routing Gateway (DRG) plus local or remote VCN peering (or equivalent DRG-based routing). Option A is not required because Data Guard transports redo over Oracle Net (TCP), not by mounting shared NFS block storage across regions, which is neither supported nor how Data Guard works.

Option B is not required because automatic backups on the standby are optional and independent of establishing the standby; Data Guard configuration does not depend on matching backup retention. Option D is not required because GoldenGate is a logical replication product, whereas Active Data Guard uses redo transport and apply, not GoldenGate, as its transport mechanism.

Exam trap

1Z0-997-26 often tests the misconception that shared storage or GoldenGate is required for Data Guard, when in fact Data Guard uses redo transport over the network and requires SRLs and proper VCN connectivity via DRG.

Full explanation →

14

MCQmedium

You are configuring disaster recovery for an Oracle Base Database system using Oracle Data Guard with Data Guard Broker. You need to perform a role transition where the primary database becomes the standby and the standby becomes the primary with zero data loss. Which Data Guard Broker command should you execute?

A.ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;

B.CONVERT DATABASE TO PHYSICAL STANDBY;

C.SWITCHOVER TO <standby_database_name>;

D.FAILOVER TO <standby_database_name>;

AnswerC

SWITCHOVER performs a planned, reversible role transition with zero data loss, since the primary flushes all redo to the standby before roles reverse. This satisfies the stem's zero-data-loss requirement, unlike FAILOVER, which is for unplanned outages and may discard unapplied redo.

Why this answer

In Data Guard Broker, a switchover is a planned role transition where the primary becomes the standby and the standby becomes the primary with zero data loss. The command to perform a switchover is 'SWITCHOVER TO <standby_database_name>;' executed via DGMGRL. This ensures no data loss because the primary is synchronized with the standby before the transition.

Exam trap

The trap is confusing switchover with failover; candidates may select 'FAILOVER' thinking it is the command for role transition, but failover is for unplanned outages and may lose data, while switchover is planned and zero-data-loss.

How to eliminate wrong answers

Option A is wrong because 'ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;' is a SQL command to stop managed recovery on a standby, not a Data Guard Broker command for role transition. Option B is wrong because 'CONVERT DATABASE TO PHYSICAL STANDBY;' is not a valid Data Guard Broker command; conversion to standby is done via RMAN or SQL, not Broker. Option D is wrong because 'FAILOVER TO <standby_database_name>;' is used for a failover, which is an unplanned transition that may result in data loss, not a zero-data-loss switchover.

Full explanation →

15

Multi-Selecthard

Which THREE factors should an architect evaluate when determining Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for an OCI database disaster recovery solution? (Choose three.)

Select 3 answers

A.Level of automation configured for failover (e.g., Fast-Start Failover vs. manual scripts)

B.Network bandwidth and latency between the primary and DR regions

C.Business criticality and acceptable data loss window during unexpected outages

D.The color scheme and layout of the OCI Console dashboard

E.The default tenant tenancy OCID string length

AnswersA, B, C

Failover automation directly governs RTO: Fast-Start Failover with Data Guard broker completes role transitions in seconds to minutes, whereas manual scripts add detection and human execution delays. It does not change RPO, which depends on redo transport mode and apply lag.

Why this answer

Option A is correct because the degree of failover automation directly determines how quickly the standby can take over, which sets the achievable RTO — Oracle Data Guard Fast-Start Failover with an observer can cut RTO to seconds or minutes, whereas manual switchover scripts add human detection and execution time. Option B is correct because network bandwidth and latency between primary and DR regions govern how fast redo/archive logs can be shipped and applied; high latency or insufficient bandwidth increases data-loss exposure (RPO) and delays synchronization, especially for synchronous or far-sync configurations. Option C is correct because RPO and RTO are business-driven targets: the criticality of the workload and the tolerable data-loss window during an outage define what values the architecture must meet, and thus what replication mode and topology are required.

Option D is incorrect because OCI Console dashboard colors and layout are cosmetic UI preferences with no bearing on data replication or recovery metrics. Option E is incorrect because the length of a tenancy OCID string is a fixed identifier characteristic and has no relationship to RPO or RTO design decisions.

Exam trap

1Z0-997-26 often tests whether candidates can distinguish business drivers (criticality, data-loss tolerance) from technical enablers (bandwidth, automation) when selecting RPO/RTO factors, while including obviously irrelevant distractors.

Full explanation →

16

Multi-Selecthard

When designing an enterprise-grade disaster recovery architecture on OCI, which THREE practices are recommended to ensure a successful failover and minimize operational risk during a disaster event? (Choose three.)

Select 3 answers

A.Disable all health checks on load balancers to prevent false alarms during failover.

B.Automate failover orchestration using tools like OCI Full Stack Disaster Recovery.

C.Conduct regular disaster recovery drills using non-disruptive testing features like Snapshot Standby.

D.Rely solely on manual documentation stored on local laptops for failover steps.

E.Ensure adequate compute and database capacity is provisioned or reserved in the target DR region.

AnswersB, C, E

OCI Full Stack Disaster Recovery automates failover orchestration across compute, database, and networking tiers, removing manual steps that introduce error during a disaster. This satisfies the stem's requirement to minimise operational risk and ensure successful failover.

Why this answer

Option B is correct because OCI Full Stack Disaster Recovery provides automated orchestration of failover and switchover across compute, databases, and storage, reducing human error and failover time during a disaster. Option C is correct because regular DR drills validate runbooks and RTO/RPO assumptions, and non-disruptive testing features such as Snapshot Standby (for Autonomous Database) allow validation without impacting production. Option E is correct because the target DR region must have sufficient compute shapes and database capacity (or reserved capacity) provisioned in advance; otherwise failover will fail or be throttled due to capacity shortages.

Option A is incorrect because disabling load balancer health checks removes automatic traffic redirection and failure detection, increasing risk rather than minimizing it. Option D is incorrect because relying solely on manual documentation stored on local laptops is fragile, error-prone, and unavailable if local systems are lost during a disaster.

Exam trap

1Z0-997-26 often tests DR best practices, and candidates may incorrectly select options that suggest disabling health checks or relying on manual documentation; the trap is choosing seemingly simple but risky practices over automation and testing.

Full explanation →

17

Multi-Selecteasy

Which TWO features of OCI Object Storage contribute to its high durability and reliability for disaster recovery workflows? (Choose two.)

Select 2 answers

A.Restricting bucket access exclusively to local console sessions.

B.Storing all objects on a single physical disk inside a single compute instance.

C.Object versioning support to protect against accidental deletion or overwriting.

D.Requiring manual user replication scripts for every individual file uploaded.

E.Data is automatically replicated across multiple fault domains and availability domains.

AnswersC, E

Object versioning retains prior copies of every object, so an accidental deletion or overwrite does not destroy the only copy. This directly supports the stem's durability and reliability requirement for disaster recovery workflows, since earlier versions remain recoverable after human error or corruption.

Why this answer

Option C is correct because OCI Object Storage supports object versioning, which retains prior versions of an object when it is overwritten or deleted, enabling recovery from accidental deletion or corruption and supporting point-in-time restore in disaster recovery workflows. Option E is correct because OCI Object Storage automatically replicates data across multiple fault domains and availability domains within a region, providing redundancy that protects against hardware and datacenter failures without user intervention. Option A is incorrect because Object Storage access is controlled through IAM policies, pre-authenticated requests, and API/SDK access, not restricted to local console sessions.

Option B is incorrect because storing objects on a single physical disk in a single compute instance offers no redundancy and is the opposite of a durable, replicated storage design. Option D is incorrect because replication is handled automatically by the service; manual per-file replication scripts are neither required nor a durability feature.

Exam trap

The trap is confusing access control with durability — candidates may pick 'restrict access to console' thinking security equals reliability, but durability comes from replication and versioning, not from limiting who can reach the data.

Full explanation →

18

Multi-Selecthard

Which TWO of the following statements are correct regarding the architecture and capabilities of OCI Application Performance Monitoring (APM)?

Select 2 answers

A.OCI APM can only monitor applications deployed inside OCI Compute instances and cannot trace traffic originating from API Gateways.

B.OCI APM supports ingestion of standard OpenTelemetry traces from applications running on-premises, in OCI, or in other clouds.

C.OCI APM alerting is strictly limited to SMS notifications and cannot integrate with external incident management systems like PagerDuty.

D.OCI APM provides Real User Monitoring (RUM) capabilities to track end-user performance, page load times, and browser errors.

E.OCI APM requires the user to manually provision and manage an underlying Autonomous Transaction Processing database to store trace spans.

AnswersB, D

OCI APM natively accepts OpenTelemetry Protocol (OTLP) trace data, so instrumented applications can send spans regardless of where they run — on-premises, in OCI, or on rival clouds. This satisfies the stem's cross-environment ingestion requirement, since no OCI-only agent or network-bound collector is mandated for trace submission.

Why this answer

Option B is correct because OCI APM natively supports the OpenTelemetry protocol (OTLP) for trace ingestion, allowing instrumented applications running on-premises, in OCI, or in other clouds to send distributed tracing data to the APM domain via the public OTLP endpoint. Option D is correct because OCI APM includes Real User Monitoring (RUM), which uses a JavaScript agent injected into web pages to capture end-user metrics such as page load times, AJAX calls, and browser-side errors. Option A is incorrect because APM is not limited to OCI Compute: it can trace traffic from API Gateways, load balancers, functions, and external sources through OpenTelemetry instrumentation.

Option C is incorrect because APM alarms integrate with OCI Notifications, which in turn can fan out to email, SMS, Slack, PagerDuty, and other HTTPS endpoints, so alerting is not restricted to SMS. Option E is incorrect because APM is a fully managed service; Oracle provisions and manages the underlying storage for trace spans, and no Autonomous Transaction Processing database needs to be created or maintained by the customer.

Exam trap

1Z0-997-26 often tests the misconception that APM is limited to OCI-hosted applications or that it requires self-managed databases; candidates should remember APM is multi-cloud and fully managed, with RUM and OpenTelemetry support.

Full explanation →

19

MCQmedium

Your OKE cluster uses Calico for Kubernetes network policy enforcement. You need to write a network policy that allows Pod A in namespace 'frontend' to communicate with Pod B in namespace 'backend', while blocking all other ingress traffic to Pod B. How should you implement this?

A.Apply an OCI Identity and Access Management (IAM) policy restricting pod access.

B.Configure an OCI Load Balancer listener rule for namespace ports.

C.Create a Kubernetes NetworkPolicy in the 'backend' namespace selecting Pod B and allowing ingress exclusively from namespace 'frontend'.

D.Modify the VCN Security List for the worker node subnet to filter traffic by pod name.

AnswerC

Calico enforces standard Kubernetes NetworkPolicy objects, so a policy in the 'backend' namespace with podSelector matching Pod B and an ingress rule using namespaceSelector for 'frontend' permits only that traffic. Because NetworkPolicy is default-deny once a pod is selected, all other ingress to Pod B is blocked, satisfying the isolation requirement.

Why this answer

A Kubernetes NetworkPolicy in the 'backend' namespace that selects Pod B and allows ingress only from namespace 'frontend' is the correct Calico-enforced approach. NetworkPolicies are namespace-scoped, select pods by labels, and define allowed ingress/egress, which is exactly what is needed to permit frontend-to-backend while blocking all other ingress.

Exam trap

1Z0-997-26 often tests the misconception that OCI IAM, VCN Security Lists, or Load Balancer rules can enforce Kubernetes pod-level network policy — candidates must recognize that only a CNI-enforced NetworkPolicy (Calico) operates at the pod label/namespace level.

How to eliminate wrong answers

Option A is wrong because OCI IAM policies govern OCI API access, not pod-to-pod network traffic inside the cluster. Option B is wrong because an OCI Load Balancer listener rule operates at L4/L7 for external traffic, not for intra-cluster pod-to-pod policy enforcement. Option D is wrong because VCN Security Lists filter at the subnet/ENI level by IP and port, not by Kubernetes pod name or namespace labels.

Full explanation →

20

MCQmedium

A retail company uses Oracle Autonomous Transaction Processing (ATP) with auto-scaling enabled. During a flash sale, the application observes that performance degrades despite auto-scaling being active. The architect reviews the ATP configuration and finds the base OCPU count is set to 4 with auto-scaling enabled. What is the most likely explanation for the degraded performance?

A.Auto-scaling requires the database to be restarted to take effect, so the extra OCPUs are not available until the next maintenance window.

B.Auto-scaling is disabled automatically when the database exceeds 80 percent CPU utilization for more than 15 minutes to protect the underlying infrastructure.

C.Auto-scaling on ATP only adjusts storage IOPS and does not change the number of OCPUs allocated to the database.

D.Auto-scaling triples the base OCPU count to a maximum of 12 OCPUs, but if the workload requires more than that or hits session or concurrency limits, performance still degrades.

AnswerD

With a base of 4 OCPUs, ATP auto-scaling can scale up to 3x, or 12 OCPUs, during peak demand. If the flash sale drives demand beyond 12 OCPUs' worth of work or hits other limits such as maximum sessions or parallel execution servers, throughput still suffers. The architect should raise the base OCPU count to lift the auto-scaling ceiling.

Why this answer

ATP auto-scaling can expand the base OCPU count by up to three times during demand spikes. A base of 4 OCPUs therefore tops out at 12 OCPUs, and a flash sale that needs more compute or hits session and concurrency limits will still see degraded performance. Raising the base OCPU count increases the auto-scaling ceiling and is the appropriate architectural response.

Exam trap

The trap here is believing that auto-scaling provides unlimited elasticity or that it only affects storage, when in fact it triples the base OCPU count within a fixed ceiling.

Full explanation →

21

MCQmedium

An OCI architect is setting up a disaster recovery environment where compute instances in the DR region need identical network configurations (private IPs, VNICs, security lists) to the primary region. Which OCI capability assists in deploying reproducible network topologies across regions?

A.OCI File Storage Network File System (NFS) exports

B.OCI Resource Manager with Terraform configurations

C.OCI IAM Domain Federation wizard

D.OCI Streaming service partition replication

AnswerB

OCI Resource Manager with Terraform configurations codifies VNICs, private IPs and security lists as declarative infrastructure-as-code, then provisions that identical topology in the DR region. This satisfies the reproducibility constraint directly: Terraform state and plan ensure the same network configuration is deployed across regions without manual rebuild.

Why this answer

OCI Resource Manager is a managed Terraform service that lets architects define network topologies (VCNs, subnets, security lists, VNICs, private IP assignments) as code and deploy them repeatedly across regions. Because the same Terraform configuration can be applied to a DR region, it guarantees identical, reproducible network configurations without manual drift. This is the canonical OCI answer for infrastructure-as-code and cross-region DR topology replication.

Exam trap

1Z0-997-26 often tests whether candidates confuse storage or identity services with infrastructure-as-code tooling; the trap is picking a data-plane service (File Storage, Streaming) when the question asks about reproducible topology deployment.

How to eliminate wrong answers

Option A is wrong because File Storage NFS exports provide shared file-level storage, not network topology definitions, and cannot recreate VCNs, subnets, or security lists. Option C is wrong because IAM Domain Federation is an identity/authentication feature for federating users from external IdPs, not an infrastructure deployment mechanism. Option D is wrong because OCI Streaming is a Kafka-compatible message ingestion service; partition replication concerns stream data durability, not network configuration cloning.

Full explanation →

22

MCQeasy

An administrator wants to inspect the operational health and performance metrics of an OCI Exadata Database Service instance using the default platform metrics provided out-of-the-box by OCI. Where should the administrator navigate in the OCI Console to view these metrics?

A.Navigate to Compute > Instances, select the Exadata VM cluster, and open the Performance tab.

B.Navigate to Observability and Management > Monitoring, then select the Database service namespace.

C.Navigate to Governance and Administration > Audit, then select the Database compartment.

D.Navigate to Identity & Security > Policies to enable the DB telemetry poller.

AnswerB

OCI Monitoring's Database service namespace exposes the platform metrics that Exadata Database Service emits automatically, with no agent deployment required. Selecting that namespace surfaces compute, storage and database health telemetry, satisfying the stem's requirement to inspect default out-of-the-box metrics directly from the OCI Console.

Why this answer

OCI Exadata Database Service emits default platform metrics (CPU utilization, storage utilization, node status, etc.) into the OCI Monitoring service under the 'oci_database' or Exadata-specific namespace. Administrators view these by navigating to Observability and Management > Monitoring in the OCI Console, then selecting the appropriate Database service namespace and filtering by the Exadata resource. This is the standard path for out-of-the-box platform metrics.

Exam trap

The trap is navigating to Compute > Instances for Exadata metrics because Exadata runs on compute-like hardware — candidates must remember that Exadata Database Service metrics live under Observability and Management > Monitoring in the Database namespace.

How to eliminate wrong answers

Option A is wrong because Compute > Instances shows VM-level metrics for compute instances, not the Exadata Database Service platform metrics — Exadata VM clusters are managed under Database services, not Compute. Option C is wrong because Governance and Administration > Audit shows API activity logs, not performance metrics, and has no Database compartment metric view. Option D is wrong because Identity & Security > Policies is for IAM authorization, and there is no 'DB telemetry poller' to enable — metrics are emitted automatically by the service.

Full explanation →

23

MCQeasy

Your OCI Function needs to write audit logs or custom debugging information that can be easily searched and analyzed alongside other cloud logs. Which OCI service should your function log to?

A.OCI Logging Service

B.OCI DNS Service

C.OCI Vault

D.OCI Email Delivery Service

AnswerA

OCI Logging Service ingests custom function output through the unified agent or SDK, storing it in log groups that support search, filtering, and correlation with other OCI logs. This satisfies the stem's requirement that debugging information be searchable alongside existing cloud logs, which Object Storage or Notifications cannot provide.

Why this answer

OCI Logging Service is the correct choice because it is a fully managed, scalable service that ingests, aggregates, and indexes log data from various OCI resources, including Functions. It allows you to search, analyze, and correlate logs across services, and supports custom logs from serverless functions. By logging to OCI Logging, the function's audit and debug information becomes part of the centralized logging platform, enabling easy querying and integration with other cloud logs.

Exam trap

The trap here is confusing OCI Logging with other services that handle data (like Vault for secrets or Email Delivery for notifications), but only Logging is designed for searchable, analyzable log data.

How to eliminate wrong answers

Option B is wrong because OCI DNS Service is a domain name system management service, not a logging or audit service; it does not store or index application logs. Option C is wrong because OCI Vault is a key management and secrets storage service, designed to securely store encryption keys and secrets, not to collect or analyze log data. Option D is wrong because OCI Email Delivery Service is used to send bulk or transactional emails, not to store or search logs; it lacks log aggregation and analysis capabilities.

Full explanation →

24

MCQhard

You are hardening an OCI environment where applications running inside Oracle Kubernetes Engine (OKE) pods require access to OCI Object Storage. To adhere to security best practices, you must avoid storing long-lived user credentials or API keys inside the cluster. What is the recommended solution?

A.Attach a broad administrative instance principal to the worker node pool.

B.Expose Object Storage via a public endpoint and permit anonymous read access.

C.Embed API signing keys of a dedicated service user inside Kubernetes Secret objects mounted as environment variables.

D.Configure OCI IAM Workload Identity for OKE, allowing pods to authenticate using Kubernetes service account tokens mapped to OCI IAM dynamic groups.

AnswerD

Workload Identity maps Kubernetes service account tokens to OCI IAM dynamic groups, so pods obtain short-lived OCI credentials via instance principals rather than embedded API keys. This satisfies the requirement to avoid long-lived credentials stored inside the cluster.

Why this answer

OCI IAM Workload Identity for OKE lets individual Kubernetes pods authenticate to OCI services using their Kubernetes service account (KSA) tokens, which OCI IAM maps to dynamic groups via a defined identity provider. This eliminates the need to embed long-lived API signing keys or user credentials inside the cluster, satisfying the security best practice of short-lived, pod-scoped credentials. The KSA token is exchanged for an OCI session token, and IAM policies attached to the dynamic group grant only the required Object Storage permissions.

Exam trap

1Z0-997-26 often tests whether candidates confuse node-level instance principals (which grant all pods on a node the same identity) with pod-level workload identity, leading them to pick the broad instance principal option as a shortcut.

How to eliminate wrong answers

Option A is wrong because attaching a broad administrative instance principal to the worker node pool grants every pod on every node full admin-level OCI access, violating least privilege and still not scoping credentials to individual workloads. Option B is wrong because exposing Object Storage via a public endpoint with anonymous read access removes authentication entirely and exposes data to the internet, which is the opposite of hardening. Option C is wrong because embedding API signing keys of a service user in Kubernetes Secrets still stores long-lived credentials in the cluster, and Secrets are only base64-encoded, not encrypted by default, so they can be exfiltrated.

Full explanation →

25

MCQmedium

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

A.You must physically patch your fiber into Oracle's Meet-Me-Room.

B.You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.

C.Traffic is routed exclusively over the public internet with guaranteed SLA.

D.Oracle installs a dedicated router inside your on-premises datacenter.

AnswerB

The Provider model routes connectivity through an OCI partner's existing network, so no physical cross-connect or router equipment is required in an Oracle-partner datacentre. That removes the colocation hardware burden, which is the defining characteristic distinguishing it from the Colocation model.

Why this answer

In the FastConnect Provider model, you establish connectivity through an Oracle-approved partner (e.g., Equinix Fabric, Megaport, AT&T) that already has a presence in the Oracle Cloud region. You do not need to install or patch your own equipment in an Oracle Meet-Me-Room; the partner handles the Layer 2/3 handoff. This contrasts with the Colocation model, where you must physically deploy your router in a colocation facility connected to Oracle.

Exam trap

1Z0-997-26 often tests the confusion between Provider and Colocation models — candidates incorrectly assume Provider requires physical equipment in an Oracle facility, when that describes Colocation.

How to eliminate wrong answers

Option A is wrong because physically patching fiber into Oracle's Meet-Me-Room describes the Colocation model, not the Provider model. Option C is wrong because FastConnect never routes traffic over the public internet — that would be a Site-to-Site VPN or public internet path, and FastConnect provides a private dedicated or partner-hosted connection with SLAs. Option D is wrong because Oracle does not install routers inside customer datacenters; that is not part of any FastConnect model.

Full explanation →

26

MCQmedium

You are planning the network cutover for a large-scale migration to OCI. The on-premises data center is connected to OCI via an OCI FastConnect circuit configured with private virtual circuits. During cutover, DNS records must be updated so that client traffic resolves to OCI load balancers. Which OCI service should you use to manage internal and external DNS authoritative resolution smoothly?

A.OCI API Gateway

B.OCI Traffic Management Steering

C.OCI Network Firewall

D.OCI DNS (Public and Private Zones)

AnswerD

Public and private zones provide authoritative DNS resolution for both internet-facing and internal names, letting you update records so clients resolve to OCI load balancers during cutover. This satisfies the stem's requirement to manage internal and external authoritative resolution smoothly.

Why this answer

OCI DNS provides both public and private authoritative zones, allowing you to manage internal and external name resolution from a single service during cutover. It integrates with the VCN resolver so private zones resolve inside OCI while public zones serve external clients, making it the right tool for updating DNS records to point at OCI load balancers.

Exam trap

1Z0-997-26 often tests the distinction between DNS hosting (OCI DNS) and DNS-based traffic steering (Traffic Management Steering), so candidates who pick the steering service for authoritative resolution lose the point.

How to eliminate wrong answers

Option A is wrong because API Gateway is an API management and traffic-routing service, not an authoritative DNS service — it cannot host or serve DNS zones. Option B is wrong because Traffic Management Steering is a policy-based routing service that directs traffic among endpoints; it depends on DNS but does not itself provide authoritative zone hosting for internal and external resolution. Option C is wrong because Network Firewall inspects and filters network traffic; it has no role in DNS record management or name resolution.

Full explanation →

27

MCQhard

An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?

A.Set up an OCI Vault encryption key to automatically encrypt span attribute strings in transit.

B.Configure IAM policies to redact payload strings at the APM domain boundary.

C.Modify the OCI Monitoring alarm expression to filter out PII strings.

D.Configure APM Data Masking rules or agent configuration properties to exclude or scrub sensitive attributes.

AnswerD

Configuring APM data masking rules or agent properties directly intercepts sensitive attributes before span export, satisfying the requirement to stop header tokens and credit card numbers appearing in traces. Masking operates at collection time within the Java agent, so scrubbed values never reach OCI APM, unlike post-collection filtering which leaves data exposed in storage.

Why this answer

OCI APM provides data masking rules that can be configured at the APM domain level to scrub or exclude sensitive attributes from trace spans before they are stored. Additionally, the APM Java agent supports configuration properties that allow developers to exclude specific headers, parameters, or payload fields from being captured. Using these built-in masking and exclusion mechanisms is the correct way to prevent PII from entering APM trace data.

Exam trap

1Z0-997-26 often tests whether candidates confuse encryption (which protects data but does not remove it) with masking or exclusion (which prevents sensitive data from being collected), leading them to pick Vault-based answers for PII redaction questions.

How to eliminate wrong answers

Option A is wrong because OCI Vault encrypts data at rest or in transit at the storage layer, but it does not selectively redact sensitive strings within trace spans; encryption would not prevent the data from being visible in APM. Option B is wrong because IAM policies control access to APM resources, not the content of trace spans; they cannot redact payload strings. Option C is wrong because OCI Monitoring alarms evaluate metrics and trigger notifications, and they have no capability to filter or redact PII from APM trace data.

Full explanation →

28

MCQmedium

You are troubleshooting an OCI Functions application that fails to pull container images from a private Oracle Cloud Infrastructure Registry (OCIR) repository during deployment. The function application is configured correctly, but the build/invoke fails with authentication errors. What is the most likely missing configuration?

A.The OCI VCN Security List lacks an egress rule for port 22 to connect to GitHub.

B.Missing IAM policy granting the Functions service or dynamic group read access to the OCIR repository compartment.

C.The API Gateway deployment lacks a public IP address.

D.The OCI Vault master encryption key is disabled.

AnswerB

Pulling images from a private OCIR repository requires an IAM policy letting the Functions dynamic group read that compartment's repositories. Without it, the service principal cannot authenticate, producing the observed image-pull authentication failures during build or invoke.

Why this answer

OCI Functions pulls container images from OCIR using the function's resource principal, which is derived from the dynamic group membership of the function application. Without an IAM policy that grants this dynamic group (or the Functions service) permission to read the OCIR repository compartment, the pull fails with an authentication error. The policy must explicitly allow the dynamic group to read repos in the compartment where the OCIR repository resides.

Exam trap

1Z0-997-26 often tests the misconception that OCI Functions uses SSH or API Gateway for image pulls, when in fact it relies on IAM policies and dynamic groups for OCIR authentication.

How to eliminate wrong answers

Option A is wrong because OCI Functions does not use SSH (port 22) to pull images from OCIR; it uses the OCI API over HTTPS (port 443), and GitHub connectivity is irrelevant to OCIR authentication. Option C is wrong because API Gateway is not involved in the function's image pull process; the function runtime pulls the image directly from OCIR, and API Gateway public IP has no bearing on authentication. Option D is wrong because a disabled Vault master encryption key would affect access to secrets or encrypted data, not the authentication to OCIR; OCIR authentication relies on IAM policies and resource principals, not Vault keys.

Full explanation →

29

Multi-Selecteasy

Which TWO of the following statements are correct regarding OCI Load Balancer features for high availability? (Choose two.)

Select 2 answers

A.OCI Load Balancers are restricted to a single Availability Domain and cannot cross AD boundaries.

B.An OCI Load Balancer can be deployed as either public (internet-facing) or private (internal).

C.OCI Load Balancers are regional services that span multiple Availability Domains.

D.OCI Load Balancers only support Layer 3 packet routing.

E.OCI Load Balancers require manual customer-managed keepalived failover clustering.

AnswersB, C

OCI Load Balancer supports both internet-facing public shapes and internal private shapes. A private load balancer receives only VCN-internal traffic, letting architects keep backend tiers unreachable from the internet while still balancing across healthy backends.

Why this answer

Option B is correct because OCI Load Balancer supports two deployment types: a public (internet-facing) load balancer with a public IP for external traffic, and a private (internal) load balancer with only private IPs for internal traffic within a VCN. Option C is correct because the OCI Load Balancer is a regional service: when you create it, you select a region and it can span multiple Availability Domains, with the service provisioning the load balancer across the ADs you choose for high availability. Option A is incorrect because the load balancer is not restricted to a single AD; it is regional and can be deployed across multiple ADs.

Option D is incorrect because OCI Load Balancer operates at Layer 4 (TCP) and Layer 7 (HTTP/HTTPS), not only Layer 3 packet routing. Option E is incorrect because OCI Load Balancer is a fully managed service that handles failover automatically, so no customer-managed keepalived clustering is required.

Exam trap

1Z0-997-26 often tests OCI Load Balancer features, and candidates may incorrectly believe it is AD-specific or requires manual clustering, confusing it with self-managed solutions.

Full explanation →

30

Multi-Selectmedium

Which THREE actions can be performed using OCI Cloud Guard to improve your cloud security posture? (Choose three.)

Select 3 answers

A.Trigger responder recipes to remediate detected security risks automatically or manually.

B.Automatically patch kernel-level vulnerabilities on third-party on-premises servers.

C.Monitor tenancy resources for security misconfigurations and policy violations.

D.Provide point-to-point IPsec VPN tunneling between VCNs.

E.Calculate an overall security score for the tenancy based on detected problems.

AnswersA, C, E

Cloud Guard responder recipes define automated or manual remediation actions, such as stopping a public bucket or disabling an overly permissive user, triggered when a detector recipe flags a problem. This directly improves security posture by closing detected risks.

Why this answer

Option A is correct because Cloud Guard responder recipes define actions (such as stopping an instance, deleting a public bucket, or invoking a function) that can be triggered automatically or manually when a detector rule fires on a problem. Option C is correct because Cloud Guard continuously monitors tenancy resources against detector recipes that identify security misconfigurations, risky configurations, and policy violations across OCI services. Option E is correct because Cloud Guard aggregates detected problems into a security score for the tenancy, giving an at-a-glance measure of the overall cloud security posture.

Option B is incorrect because Cloud Guard is an OCI-native service and does not patch kernel-level vulnerabilities on third-party on-premises servers. Option D is incorrect because point-to-point IPsec VPN tunneling between VCNs is provided by OCI VPN Connect/FastConnect or DRG-based connectivity, not by Cloud Guard.

Exam trap

1Z0-997-26 often tests whether candidates confuse Cloud Guard with network security services (VPN, Bastion) or with patch management — candidates pick options that sound security-related but aren't Cloud Guard capabilities.

Full explanation →

31

MCQeasy

An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?

A.OCI Cost Analysis Scheduled Reports

B.OCI Events service scheduled triggers

C.OCI Audit log exports

D.OCI Monitoring service billing alarms

AnswerA

OCI Cost Analysis scheduled reports let you define a recurring schedule that emails cost breakdowns by service directly to recipients, satisfying the weekly summary requirement without console logins. Cost Analysis aggregates actual spend data, so the report reflects top spending services automatically rather than requiring manual export or querying.

Why this answer

OCI Cost Analysis Scheduled Reports allow you to define a recurring schedule (daily, weekly, monthly) that emails a cost breakdown — including top spending services — directly to specified recipients. This is purpose-built for automated spend trend monitoring without requiring console login, unlike alarms or event rules which are not designed for cost reporting.

Exam trap

1Z0-997-26 often tests the confusion between cost-reporting tools (Cost Analysis Scheduled Reports) and operational alerting tools (Monitoring alarms, Events), so candidates pick alarms thinking they can deliver scheduled spend summaries.

How to eliminate wrong answers

Option B is wrong because OCI Events service triggers react to state-change events (e.g., resource creation, bucket update) and cannot generate scheduled cost/spend summaries. Option C is wrong because Audit log exports capture API activity and user actions for compliance, not billing or cost trend data. Option D is wrong because OCI Monitoring billing alarms only fire threshold-based notifications on a single metric (e.g., estimated cost exceeding a value) and cannot produce a weekly multi-service spend summary.

Full explanation →

32

MCQhard

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

A.Enable OCI Database Vault on the compute instances.

B.Replace the OCI Dynamic Routing Gateway with an Internet Gateway.

C.Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.

D.Recreate the Azure ExpressRoute circuit in a different Azure subscription.

AnswerC

MTU mismatches between OCI VCN, DRG, ExpressRoute gateway and Azure VNet cause fragmentation or silent drops, inflating latency for synchronous replication. Verifying consistent MTU (typically 1500 or jumbo) across every hop is the fastest first diagnostic before deeper path analysis.

Why this answer

When latency across an OCI-Azure Interconnect exceeds thresholds, the first diagnostic step within OCI is to verify MTU settings end to end — OCI VCN, DRG, Azure VNet, and the ExpressRoute gateway. MTU mismatches cause fragmentation or dropped large packets, which manifest as high latency and retransmissions rather than outright connectivity loss. Checking MTU is a low-cost, high-value first step before touching circuits or subscriptions.

Exam trap

The trap is jumping to drastic remediation (recreating circuits, changing gateways) instead of performing the standard first-line diagnostic of verifying MTU and fragmentation across all interconnect hops.

How to eliminate wrong answers

Option A is wrong because OCI Database Vault is a security feature for protecting privileged database access and has no relationship to interconnect latency. Option B is wrong because replacing the DRG with an Internet Gateway would route traffic over the public internet, which would worsen latency and defeat the purpose of a dedicated interconnect. Option D is wrong because recreating the ExpressRoute circuit in a different Azure subscription is a drastic, disruptive action that does not address the likely root cause and is not a first diagnostic step.

Full explanation →

33

Multi-Selecthard

You are designing a high-performance computing (HPC) workload migration to OCI. The application consists of tightly coupled MPI (Message Passing Interface) jobs that require extreme low latency and high throughput. Which THREE OCI architecture components must you deploy to satisfy these HPC requirements? (Choose three.)

Select 3 answers

A.Standard OCI Archive Storage for runtime application data files

B.OCI Shared micro-tenant burstable VM instances connected via public internet gateways

C.OCI Cluster Networks with RDMA (Remote Direct Memory Access) capable bare metal compute shapes

D.OCI Compute Placement Groups configured with cluster strategy

E.High-performance local NVMe storage attached directly to the bare metal compute instances

AnswersC, D, E

Cluster Networks with RDMA-capable bare metal shapes bypass the kernel and TCP/IP stack, delivering the microsecond latency and high bandwidth MPI jobs demand. This directly satisfies the stem's extreme low latency and high throughput requirement for tightly coupled communication.

Why this answer

Option C is correct because OCI Cluster Networks with RDMA-capable bare metal shapes (e.g., BM.HPC2.36 or GPU HPC shapes) provide the low-latency, high-bandwidth, kernel-bypass interconnect that tightly coupled MPI jobs require for collective operations like MPI_Allreduce. Option D is correct because a Compute Placement Group with the cluster strategy packs instances into the same low-latency, high-bandwidth network proximity within an availability domain, minimizing inter-node hop latency for MPI traffic. Option E is correct because directly attached high-performance local NVMe storage delivers the very high IOPS and throughput needed for HPC scratch/checkpoint data without network storage overhead.

Option A is not appropriate because Archive Storage is a cold, low-cost archival tier with retrieval latency measured in hours, unsuitable for runtime application data. Option B is not appropriate because micro-tenant burstable VMs are CPU-credit-limited, non-RDMA, and public internet gateways add latency, jitter, and security exposure that violate HPC requirements.

Exam trap

1Z0-997-26 often tests HPC architecture — candidates pick generic compute or storage options, missing that RDMA cluster networks, cluster placement groups, and local NVMe are the specific trio required for MPI performance.

Full explanation →

34

MCQhard

Your engineering team is troubleshooting an issue where migrated Linux virtual machines in OCI are experiencing severe disk I/O performance bottlenecks. The instances were migrated using raw block-level cloning from on-premises SAN storage. The volumes in OCI are provisioned as Lower Cost (Balanced) block volumes. What action should you take to resolve the performance bottleneck while maintaining data integrity?

A.Format the attached block volumes with ext3 file systems instead of ext4.

B.Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.

C.Modify the OCI block volume performance tier or increase the assigned Volume Performance Units (VPUs) per GB.

D.Attach an OCI File Storage Service (FSS) mount target as the primary root volume.

AnswerC

Lower Cost (Balanced) volumes cap IOPS and throughput, so the raw block-level clone's I/O demand exceeds the provisioned limits. Raising the performance tier or VPUs per GB lifts those caps without altering the volume's data, preserving integrity. This directly resolves the bottleneck while keeping the migrated Linux instances' existing block content intact.

Why this answer

Lower Cost (Balanced) block volumes deliver a baseline of 10 VPUs per GB, which caps IOPS and throughput well below what a migrated SAN-backed workload typically expects. OCI lets you change a volume's performance tier or increase its VPUs per GB online without detaching or reformatting, so the data and file system remain intact while I/O limits rise. This directly resolves the bottleneck while preserving data integrity.

Exam trap

1Z0-997-26 often tests whether candidates know that OCI block volume performance can be changed online without data loss — the trap is choosing a destructive option like reformatting or recreating instances when a non-disruptive tier change is the correct answer.

How to eliminate wrong answers

Option A is wrong because ext3 is an older, less capable file system than ext4 and would not improve I/O throughput — it would likely reduce performance and offers no benefit for a raw block clone. Option B is wrong because recreating VMs on dense AMD shapes with local NVMe changes the compute and storage architecture entirely, risks data loss, and local NVMe is ephemeral — it does not preserve the migrated block volume data. Option D is wrong because FSS is a shared NFS file system, not a bootable root volume, and cannot serve as the primary root device for these instances.

Full explanation →

35

MCQhard

You are configuring a Remote Peering Connection (RPC) between two Dynamic Routing Gateways (DRGs) in different OCI regions. What is required to ensure secure, private data transmission between the two VCNs?

A.Configure public IP addresses on all participating compute instances.

B.Establish a Remote Peering Connection between the DRGs and configure matching route table entries and security rules.

C.Route all inter-region traffic through public Internet Gateways with IPsec tunneling.

D.Deploy an OCI NAT Gateway in each region.

AnswerB

An RPC between the two DRGs carries traffic privately over Oracle's backbone, while matching route table entries and security rules permit the VCN CIDRs to communicate. This satisfies the requirement for secure, private transmission between regions.

Why this answer

A Remote Peering Connection (RPC) between two DRGs in different OCI regions is the native OCI mechanism for private, secure inter-region VCN connectivity. Once the RPC is established and the DRGs are attached to their respective VCNs, you must configure route tables in each VCN to direct traffic destined for the other VCN's CIDR to the DRG, and ensure security lists or NSGs allow the required traffic. This creates a private, encrypted connection over Oracle's backbone network without traversing the public internet.

Exam trap

1Z0-997-26 often tests the misconception that inter-region connectivity requires public IPs or internet gateways, confusing Remote Peering with VPN or NAT solutions.

How to eliminate wrong answers

Option A is wrong because public IP addresses are not required for private DRG-to-DRG peering; instances communicate using private IPs, and exposing public IPs would be a security risk. Option C is wrong because routing inter-region traffic through public Internet Gateways with IPsec tunneling describes a site-to-site VPN over the internet, not OCI's private remote peering, which uses Oracle's dedicated backbone and does not require IGWs. Option D is wrong because a NAT Gateway only provides outbound internet access for private subnets within a single VCN; it does not enable inter-VCN or inter-region connectivity and cannot replace an RPC.

Full explanation →

36

MCQeasy

A startup wants to move an on-premises Oracle Database to OCI with minimal administration and no need to manage the underlying operating system or perform manual patching. The workload is a mixed OLTP and reporting application with unpredictable demand. Which OCI database service best fits these requirements?

A.Oracle Base Database Service on a virtual machine DB system, because it provides full OS access for tuning.

B.Oracle Database software on a bare metal compute instance, because the startup can install and configure the database exactly as needed.

C.Oracle Autonomous Database, because it automates patching, tuning, and scaling and requires no OS or infrastructure administration.

D.Oracle Exadata Database Service on Dedicated Infrastructure, because dedicated hardware guarantees the lowest latency for mixed workloads.

AnswerC

Autonomous Database automates patching, backups, tuning, and scaling, and the customer does not manage the operating system or infrastructure. For a startup with limited DBA resources and a mixed OLTP and reporting workload with unpredictable demand, the Autonomous Transaction Processing workload type with auto-scaling fits well, eliminating routine administration while handling variable load.

Why this answer

Autonomous Database is the only option that removes OS and infrastructure administration while automating patching, tuning, backups, and scaling. It suits a startup with limited DBA resources and a mixed, unpredictable workload because auto-scaling and autonomous tuning absorb demand variation. The other services either require substantial administration or provide dedicated infrastructure that exceeds the startup's operational capacity.

Exam trap

The trap here is equating high performance or dedicated hardware with the best fit, when the stated priority is minimal administration and no OS management.

Full explanation →

37

Multi-Selecthard

When designing a multi-database architecture with Oracle GoldenGate for high availability and load distribution, which THREE architectural considerations are critical for success? (Choose three.)

Select 3 answers

A.Routing all write transactions through a single read-only replica without replication

B.Implementing Conflict Detection and Resolution (CDR) rules for active-active multi-master topologies

C.Configuring unique primary key generation strategies (e.g., sequence offsets) to prevent key collisions

D.Managing DDL replication synchronization to ensure schema modifications match across nodes

E.Disabling all checkpointing to maximize real-time packet loss tolerance

AnswersB, C, D

Active-active multi-master topologies let the same row be updated at multiple nodes simultaneously, so CDR rules detect and resolve those conflicting changes. Without them, replication applies divergent updates and data diverges, breaking the load-distribution design.

Why this answer

Option B is correct because in an active-active multi-master GoldenGate topology, the same rows can be modified on multiple nodes simultaneously, so Conflict Detection and Resolution (CDR) rules are essential to deterministically resolve update/delete conflicts and prevent data divergence. Option C is correct because each node must generate non-overlapping keys; using unique sequence offsets (or ranges) per node prevents primary key collisions when inserts from different replicas are applied to the same table. Option D is correct because DDL changes must be captured and replicated in a coordinated way (e.g., via DDL replication and synchronized apply order) so that table structures, columns, and indexes remain identical across nodes, avoiding extract/replicat failures and metadata mismatches.

Option A is wrong because routing all writes to a single read-only replica without replication is not a GoldenGate HA/load-distribution design and would not propagate changes. Option E is wrong because disabling checkpointing removes recovery positioning, causing data loss and preventing reliable restart after failures.

Exam trap

The trap is treating GoldenGate multi-master as simple bidirectional replication — candidates overlook that without CDR, unique key strategies, and DDL sync, active-active topologies quickly suffer key collisions and data divergence.

Full explanation →

38

Multi-Selecteasy

During the post-migration validation phase of an application migration to OCI, your team needs to verify security compliance and resource configuration posture. Which TWO OCI services should you use to assess security posture and detect misconfigurations? (Choose two.)

Select 2 answers

A.OCI Vulnerability Scanning Service

B.OCI Cost Estimator

C.OCI Streaming Service

D.OCI Cloud Guard

E.OCI Resource Manager

AnswersA, D

The Vulnerability Scanning Service inspects compute instances and container images for known CVEs and insecure packages. It satisfies the security compliance verification requirement by producing findings that evidence host-level vulnerability posture after migration, complementing configuration-focused assessment.

Why this answer

OCI Vulnerability Scanning Service (A) is correct because it scans compute instances and container images for vulnerabilities and also checks host and application configurations against CIS benchmarks, directly supporting security-compliance verification and misconfiguration detection during post-migration validation. OCI Cloud Guard (D) is correct because it continuously monitors the tenancy for risky configurations and insecure activities, using detectors and responder recipes to identify misconfigured resources and security posture problems. Together these two services provide the vulnerability and configuration-posture assessment the scenario requires.

OCI Cost Estimator (B) only estimates costs for planned resources and has no security-assessment capability. OCI Streaming Service (C) is a publish-subscribe messaging platform for real-time data ingestion, unrelated to security posture. OCI Resource Manager (E) is a Terraform-based infrastructure-as-code provisioning service, not a security or misconfiguration assessment tool.

Exam trap

1Z0-997-26 often tests the distinction between configuration-posture tools (Cloud Guard) and vulnerability-scanning tools (VSS) versus provisioning/cost tools — candidates pick Resource Manager because it sounds like a governance service, but it only deploys Terraform stacks.

Full explanation →

39

MCQhard

Your organization runs a multi-tier microservices application deployed across multiple OCI regions. You are tasked with implementing OCI Application Performance Monitoring (APM) to trace distributed transactions across different API gateways and containerized services. To correlate user browser sessions with backend database queries, what is the required configuration step on the client-facing application tier?

A.Inject the APM Browser Agent (JavaScript tracer) into the web pages and ensure trace context propagation headers are enabled.

B.Deploy the APM Java asynchronous agent to the client browser using a browser extension.

C.Enable OCI Audit logs on the client subnets and stream the audit records into the APM Data Domain.

D.Configure the OCI API Gateway to natively intercept and inject synthetic monitoring payloads into the user cookies.

AnswerA

Injecting the APM Browser Agent into the web pages captures browser-side spans, while enabling trace context propagation headers lets those spans flow through the API gateways and containerised services down to the database queries. This satisfies the stem's requirement to correlate user browser sessions with backend database queries across OCI regions.

Why this answer

To correlate user browser sessions with backend database queries, the client-facing application tier must inject the APM Browser Agent (JavaScript tracer) into web pages and ensure trace context propagation headers are enabled. The Browser Agent captures browser-side performance and injects trace context into requests, which backend services then propagate to database calls, enabling end-to-end correlation.

Exam trap

1Z0-997-26 often tests the specific component needed for browser-to-backend correlation; candidates may choose backend agents or API Gateway features, but the key is the Browser Agent and trace context propagation headers.

How to eliminate wrong answers

Option B is wrong because the APM Java asynchronous agent is for JVM applications, not browsers, and cannot be deployed via a browser extension. Option C is wrong because OCI Audit logs capture control-plane API calls, not application-level user sessions, and streaming them to APM Data Domain does not provide trace correlation. Option D is wrong because OCI API Gateway does not natively intercept and inject synthetic monitoring payloads into user cookies; trace context propagation is handled by the application and APM agents.

Full explanation →

40

Multi-Selecthard

An administrator needs to configure dynamic groups to authenticate OCI compute instances so they can read secrets from OCI Vault. Which TWO components must be properly configured? (Choose two.)

Select 2 answers

A.An IAM policy granting the dynamic group permission to read secrets in the OCI Vault.

B.A dynamic group with matching rules defining which compute instances belong to the group (e.g., based on compartment OCID).

C.A public internet gateway attached to the vault storage endpoint.

D.Disabling all IAM policy enforcement across the tenancy.

E.Hardcoded passwords placed in the instance /etc/passwd file.

AnswersA, B

An IAM policy is mandatory because dynamic groups only establish instance identity; authorisation comes from policies. The policy must name the dynamic group as principal and grant `read secret-family` on the vault or compartment, satisfying the requirement that instances can read secrets from OCI Vault.

Why this answer

Option A is correct because the dynamic group itself only identifies the instances; authorization to call the OCI Vault secret-read API (e.g., `ReadSecretBundle` / `ReadSecrets`) must be granted through an IAM policy that names the dynamic group as principal and the vault or secrets as resource. Option B is correct because a dynamic group must be created with matching rules (for example, `instance.compartment.id = 'ocid1.compartment...'` or `instance.id = 'ocid1.instance...'`) so that the compute instances are recognized as members and can receive the policy permissions. Option C is wrong because a public internet gateway is a VPC networking component for internet traffic and has no role in authenticating instances to OCI Vault.

Option D is wrong because disabling IAM policy enforcement would remove the very authorization mechanism needed and is not a supported or sensible configuration. Option E is wrong because hardcoded passwords in /etc/passwd are insecure and unrelated to OCI instance principals, which use instance identity certificates rather than static credentials.

Exam trap

1Z0-997-26 often tests the confusion between dynamic groups (for resources) and regular groups (for users), and candidates may forget that both the dynamic group and the IAM policy are required — one without the other grants no access.

Full explanation →

41

MCQmedium

You are migrating a multi-tier web application to OCI. The web tier consists of Apache HTTP servers that need to be auto-scaled based on CPU utilization. Which combination of OCI services should you configure to achieve automated horizontal scaling?

A.OCI Resource Manager and Terraform apply schedules

B.OCI Events Service and OCI Notifications triggered by Object Storage uploads

C.OCI Instance Pools and OCI Auto-Scaling Configurations

D.OCI Cloud Guard and OCI Vulnerability Scanning

AnswerC

Instance Pools supply the identical, replaceable compute instances, while Auto-Scaling Configurations apply CPU-utilisation thresholds to add or remove pool members horizontally. Together they satisfy the auto-scaling requirement for the Apache web tier without manual intervention.

Why this answer

OCI Instance Pools let you manage a group of identical compute instances as a single entity, and Auto-Scaling Configurations define scaling policies (e.g., CPU utilization thresholds) that automatically adjust the pool size. Together they provide horizontal auto-scaling for the web tier based on CPU metrics. This is the native OCI solution for automated horizontal scaling.

Exam trap

1Z0-997-26 often tests the confusion between infrastructure automation tools (Resource Manager, Events) and actual auto-scaling services — candidates pick event-driven or IaC tools when the question asks for metric-based horizontal scaling.

How to eliminate wrong answers

Option A is wrong because Resource Manager and Terraform apply schedules are infrastructure-as-code deployment tools — they can run scheduled applies but do not provide dynamic, metric-driven auto-scaling. Option B is wrong because Events Service and Notifications triggered by Object Storage uploads are event-driven automation for storage events, not compute scaling based on CPU utilization. Option D is wrong because Cloud Guard and Vulnerability Scanning are security posture management and vulnerability assessment services — they do not scale compute resources.

Full explanation →

42

MCQhard

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

A.OCI Certbot DaemonSet running on all worker nodes

B.OCI Vault automatic key version rotation

C.OCI Service Mesh automated certificate management with Envoy sidecar proxy hot-reload

D.Kubernetes CronJob executing kubectl rollout restart every night

AnswerC

Envoy sidecar hot-reload lets the proxy pick up rotated certificates via its SDS (Secret Discovery Service) API without terminating the pod, so existing connections drain gracefully rather than dropping. This directly satisfies the stem's constraint that rotation must occur without pod restarts.

Why this answer

OCI Service Mesh uses an Envoy sidecar proxy injected into each pod, and its control plane (based on Istio) performs automated certificate management — issuing, rotating, and hot-reloading X.509 certificates via the Envoy SDS (Secret Discovery Service) API without restarting the pod or the proxy. This eliminates the connection drops caused by stale certificates, since the sidecar picks up the new cert in-memory.

Exam trap

The trap here is confusing generic secret-management services (OCI Vault, Certbot) with mesh-native identity management — candidates pick Vault because it 'rotates keys,' but only the mesh control plane can hot-reload Envoy sidecar certs without a restart.

How to eliminate wrong answers

Option A is wrong because Certbot is a Let's Encrypt/ACME client for public web certificates, not an OCI-native mesh component, and a DaemonSet cannot inject per-pod mTLS identities or hot-reload Envoy. Option B is wrong because OCI Vault rotates key versions for secrets/encryption keys but does not push rotated certs into running Envoy sidecars or manage SPIFFE identities. Option D is wrong because a nightly CronJob that restarts pods is disruptive, causes downtime, and does not provide automatic rotation — it is a manual workaround, not a mesh feature.

Full explanation →

43

MCQhard

Your company is migrating a large PostgreSQL database from AWS RDS to OCI Database with PostgreSQL. The database is 4 TB in size, and write operations continue 24/7. To ensure zero data loss and minimal downtime during cutover, which migration strategy should you employ?

A.Establish AWS Direct Connect to OCI FastConnect and mount an AWS EBS volume directly to an OCI VM running PostgreSQL.

B.Take an AWS RDS snapshot, download the snapshot files via AWS CLI, and restore them onto an OCI Compute instance running PostgreSQL.

C.Stop the application writes, take a pg_dump file, transfer it via SCP, and restore it into OCI during a scheduled 12-hour outage window.

D.Configure PostgreSQL logical replication (or use OCI GoldenGate / DMS equivalents) to stream ongoing transaction logs after performing an initial consistent dump and restore.

AnswerD

Logical replication streams ongoing changes after an initial consistent dump and restore, keeping the target synchronised while the source stays live. This achieves near-zero data loss and minimal cutover downtime, unlike physical backup or export/import approaches.

Why this answer

Logical replication (or OCI GoldenGate/DMS) performs an initial consistent dump and restore, then continuously streams transaction logs from the source to the target, keeping the OCI database in sync with near-zero data loss. At cutover, you stop writes briefly, apply remaining changes, and redirect the application — achieving zero data loss and minimal downtime. This is the standard approach for large, continuously written databases.

Exam trap

1Z0-997-26 often tests the assumption that snapshot or dump-and-restore is sufficient for zero data loss — candidates must recognize that continuous replication (logical replication/GoldenGate) is required when writes continue 24/7.

How to eliminate wrong answers

Option A is wrong because mounting an AWS EBS volume directly to an OCI VM is not technically feasible — EBS volumes are tied to AWS EC2 and cannot be attached across clouds, and Direct Connect/FastConnect only provide network connectivity, not block storage sharing. Option B is wrong because a snapshot-based migration captures a point-in-time copy; any writes after the snapshot are lost, violating zero data loss, and restoring 4 TB takes hours, exceeding minimal downtime. Option C is wrong because stopping writes for a 12-hour outage window directly contradicts the minimal downtime requirement and risks data loss if writes cannot be cleanly stopped.

Full explanation →

44

MCQhard

An auditor requests evidence that all API activities across your OCI tenancy are being captured, tamper-proofed, and retained for compliance. Which OCI feature should you configure?

A.Configure OCI Logging to export Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode.

B.Enable OCI Cloud Guard with default responder rules.

C.Deploy OCI Network Firewall to inspect all control plane traffic.

D.Set up OCI Events to stream API activities directly to an external SIEM using unencrypted HTTP endpoints.

AnswerA

Object Lock in Compliance mode makes exported Audit log objects immutable and undeletable for the retention period, even by administrators. This satisfies the tamper-proofing and retention evidence the auditor demands, which standard Logging retention alone cannot provide.

Why this answer

OCI Audit captures all API activity in a tenancy automatically, and OCI Logging can export those Audit events to an Object Storage bucket with Object Lock enabled in Compliance mode, providing tamper-proof, WORM retention that satisfies auditor evidence requirements. Object Lock in Compliance mode prevents any user, including tenancy administrators, from deleting or altering the retained audit objects until the retention period expires. This combination delivers capture, immutability, and long-term retention in one architecture.

Exam trap

1Z0-997-26 often tests the confusion between Cloud Guard (posture/threat detection) and Audit Logging with Object Lock (immutable compliance evidence) — candidates must recognize that only the latter provides tamper-proof retention.

How to eliminate wrong answers

Option B is wrong because Cloud Guard is a posture management and threat detection service that identifies misconfigurations and risky activity — it does not capture, tamper-proof, or retain API activity logs for compliance evidence. Option C is wrong because OCI Network Firewall inspects network traffic (north-south and east-west packet flows), not control plane API calls, and it does not provide immutable log retention. Option D is wrong because streaming API activities to an external SIEM over unencrypted HTTP violates both the tamper-proofing requirement and basic data-in-transit security, and OCI Events is an event-routing service, not an audit retention mechanism.

Full explanation →

45

MCQeasy

You need to grant a third-party auditor read-only access to view resources in a specific compartment without allowing them to modify anything or access other compartments. Which IAM policy statement achieves this?

A.Allow group Auditors to use database-families in root

B.Allow group Auditors to read all-resources in compartment Production

C.Allow group Auditors to read compartments in tenancy

D.Allow group Auditors to manage all-resources in tenancy

AnswerB

The verb 'read' grants view-only access to all resource types, and scoping the statement to compartment Production confines the auditor to that compartment, satisfying both constraints: no modification rights and no visibility into other compartments.

Why this answer

The policy statement 'Allow group Auditors to read all-resources in compartment Production' grants read-only access to all resources within the Production compartment, without allowing modifications or access to other compartments. This precisely meets the requirement for a third-party auditor to view resources in a specific compartment.

Exam trap

1Z0-997-26 often tests the difference between 'read', 'use', and 'manage' verbs, and the scope of compartments; candidates may choose 'manage' or 'use' thinking it's necessary, but 'read' is sufficient for read-only access.

How to eliminate wrong answers

Option A is wrong because 'use database-families in root' grants use of database resources in the root compartment, which is not read-only and not limited to a specific compartment. Option C is wrong because 'read compartments in tenancy' allows reading compartment metadata, not the resources within them. Option D is wrong because 'manage all-resources in tenancy' grants full management access across the entire tenancy, which is far too permissive.

Full explanation →

46

MCQmedium

You are migrating an Oracle Database 19c on-premises to OCI Exadata Database Service on Dedicated Infrastructure using Oracle Zero Downtime Migration (ZDM) in offline mode. The target database is already provisioned. Which ZDM migration phase configures the target database and initiates the data transfer via Oracle Data Pump?

A.DEPLOY

B.MIGRATE

C.POST-MIGRATE

D.PRE-MIGRATE

AnswerB

MIGRATE is the phase that configures the target database and starts the Oracle Data Pump transfer. In offline mode, ZDM runs the migration job after validation, applying target configuration and moving data directly, satisfying the requirement to initiate transfer without requiring the source to remain online continuously.

Why this answer

In ZDM's workflow, the MIGRATE phase is where the target database is configured and data transfer is initiated via Oracle Data Pump. It follows PRE-MIGRATE (validation and setup) and precedes POST-MIGRATE (cleanup and validation), making it the phase that actually moves the data.

Exam trap

1Z0-997-26 often tests the ZDM phase sequence, so candidates who confuse PRE-MIGRATE (preparation) with MIGRATE (actual data transfer) pick the wrong phase.

How to eliminate wrong answers

Option A is wrong because DEPLOY is not a ZDM migration phase in the standard workflow; ZDM phases are PRE-MIGRATE, MIGRATE, and POST-MIGRATE. Option C is wrong because POST-MIGRATE handles post-transfer validation, cleanup, and switching over, not the data transfer itself. Option D is wrong because PRE-MIGRATE performs prerequisite checks, creates the target database if needed, and prepares the environment, but does not initiate the Data Pump transfer.

Full explanation →

47

MCQhard

Your organization has set strict budgets in OCI to monitor cloud expenditure. A finance team member needs to receive an alert when forecasted spending reaches 100% of the monthly budget. How should you configure this alert?

A.Create an OCI Monitoring alarm on the Billing namespace with a metric expression for forecasted cost.

B.Use OCI Cost Analysis scheduled reports with an integrated SMTP relay.

C.Set up an OCI Events rule listening for billing threshold exceedance events.

D.Configure an OCI Budget alert rule with threshold type set to 'FORECASTED' and threshold value set to 100.

AnswerD

Setting the threshold type to FORECASTED makes OCI evaluate projected month-end spend rather than actuals, so the finance team is warned before the budget is breached. A threshold value of 100 triggers the alert when forecasted spending reaches 100% of the monthly budget, satisfying the stem's proactive notification requirement.

Why this answer

OCI Budgets allow you to set alert rules based on actual or forecasted spend. Setting the threshold type to 'FORECASTED' and the threshold value to 100 triggers an alert when the forecasted spend for the budget period reaches 100% of the budget amount. This directly meets the finance team's requirement to be alerted when forecasted spending hits the monthly budget.

Exam trap

1Z0-997-26 often tests the distinction between Budgets (which support forecasted alerts) and Monitoring alarms (which do not have a forecasted cost metric); candidates may incorrectly assume Monitoring can alert on forecasted billing data.

How to eliminate wrong answers

Option A is wrong because OCI Monitoring alarms on the Billing namespace do not support forecasted cost metrics; they work on actual usage and cost metrics, and the Billing namespace does not expose a forecasted cost metric. Option B is wrong because Cost Analysis scheduled reports can be emailed but do not provide threshold-based alerting on forecasted spend, and they require an SMTP relay configuration that is not native to OCI. Option C is wrong because OCI Events does not emit billing threshold exceedance events; budget alerts are handled by the Budgets service, not Events.

Full explanation →

48

MCQeasy

Which OCI identity component allows you to group users who share the same job function and require the same set of security permissions?

A.IAM Group

B.Compartment

C.Federation Provider

D.Dynamic Group

AnswerA

IAM groups aggregate users sharing a job function so that a single set of IAM policies grants identical permissions to every member. This directly satisfies the stem's requirement to group users by function and assign one common permission set, rather than attaching policies to each user individually.

Why this answer

An IAM Group in OCI is a collection of users who share the same job function and require the same permissions. Policies are written against groups rather than individual users, so grouping users by role simplifies permission management and follows the principle of least privilege at scale. This is the standard identity construct for role-based access control in OCI.

Exam trap

The trap is confusing IAM Groups (for users) with Dynamic Groups (for resources/instances) — candidates often pick Dynamic Group because it also contains the word 'group,' but it serves a completely different purpose.

How to eliminate wrong answers

Option B is wrong because a Compartment is a logical container for organizing and isolating OCI resources (compute, storage, networking) for billing and access control — it is not a grouping of users. Option C is wrong because a Federation Provider enables identity federation with external IdPs (e.g., Okta, Azure AD) via SAML/OIDC, not grouping users for permission assignment. Option D is wrong because a Dynamic Group contains compute instances (or other resources) that match a rule, used to grant permissions to resources like instance principals — it does not contain human users.

Full explanation →

49

MCQmedium

You are designing a high availability disaster recovery architecture for an Oracle Base Database Service system deployed on a 2-node Virtual Machine DB System. You need to configure automated backups. Which storage destination is automatically used by OCI to store these automated backups?

A.A separate standby Oracle ASM disk group on Block Volume storage.

B.Local NVMe scratch disk attached to the primary database node.

C.OCI Object Storage bucket managed by the database service.

D.An independent File Storage Service (FSS) mount target shared across availability domains.

AnswerC

Automated backups on a Virtual Machine DB System are written to an OCI Object Storage bucket provisioned and managed by the database service itself, requiring no customer configuration. This satisfies the stem's constraint of an automatically used destination, since the service handles bucket creation, retention and lifecycle without manual intervention.

Why this answer

OCI Base Database Service automatically stores automated backups in an OCI Object Storage bucket that is managed by the database service itself, not visible or configurable as a customer bucket. This provides durable, cross-fault-domain storage without requiring the customer to provision or manage the bucket.

Exam trap

The trap is assuming the customer must provision or manage the Object Storage bucket for automated backups — OCI manages it transparently, and candidates often confuse it with manual Data Pump exports to a customer bucket.

How to eliminate wrong answers

Option A is wrong because a standby ASM disk group on Block Volume is used for Data Guard or local redundancy, not for automated backup storage. Option B is wrong because local NVMe scratch disks are ephemeral and not used for persistent backups — they are used for temporary storage or swap. Option D is wrong because FSS is a shared file system service that is not the automatic destination for Base Database Service automated backups; it can be used for manual exports or Data Pump but not the built-in automated backup target.

Full explanation →

50

Multi-Selectmedium

Which THREE features are part of OCI Web Application Firewall (WAF) capabilities? (Choose three.)

Select 3 answers

A.Allocation of BGP routing tables for on-premises FastConnect circuits.

B.Rate limiting to mitigate denial of service (DoS) and brute-force attacks.

C.Protection against OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS).

D.Management of hardware security module (HSM) crypto keys for database volumes.

E.Access control rules based on geographic location, IP addresses, or HTTP headers.

AnswersB, C, E

Rate limiting caps request volume per client over a defined window, absorbing the flood of repeated requests that characterise DoS and brute-force attempts. This throttling mechanism directly satisfies the stem's requirement for WAF features, preventing resource exhaustion before requests reach the origin.

Why this answer

OCI Web Application Firewall (WAF) includes rate limiting (Option B), which caps the number of requests from a client within a time window to mitigate DoS and brute-force attacks. It also provides protection against OWASP Top 10 vulnerabilities (Option C), using managed rule sets to detect and block threats such as SQL injection and cross-site scripting (XSS). Additionally, WAF supports access control rules (Option E) that allow or deny traffic based on geographic location, IP addresses, or HTTP headers, enabling granular filtering.

Option A is incorrect because BGP routing for FastConnect is handled by OCI networking services, not WAF. Option D is incorrect because HSM key management for database volumes is provided by OCI Vault and Database services, not WAF.

Exam trap

The trap is mixing WAF layer-7 security features with unrelated OCI services like FastConnect routing or Vault HSM key management; candidates must recognize WAF as an HTTP/S inspection service only.

Full explanation →

51

Multi-Selecthard

You are optimizing the cost and performance of an Exadata Database Service on Dedicated Infrastructure environment hosting multiple large databases. Which THREE practices should you implement to achieve optimal resource utilization and cost efficiency?

Select 3 answers

A.Consolidate multiple non-CDB databases into a single Multitenant Container Database (CDB) with multiple PDBs.

B.Configure Exadata Smart Flash Cache policies appropriately for OLTP versus DSS workloads.

C.Migrate all table data to standard Block Volume storage to bypass Exadata storage servers.

D.Disable automatic backups entirely to save OCI Object Storage costs.

E.Dynamically scale OCPU counts on the Exadata infrastructure based on peak and off-peak workload schedules.

AnswersA, B, E

Consolidating non-CDBs into a single Multitenant CDB with multiple PDBs directly addresses the resource-utilisation constraint: PDBs share one instance's SGA, background processes and CPU, eliminating per-database overhead. This raises consolidation density on the same Exadata infrastructure, so fewer dedicated resources are provisioned, lowering cost while maintaining performance isolation.

Why this answer

Option A is correct because consolidating non-CDB databases into a single Multitenant Container Database with multiple PDBs improves consolidation density, reduces per-database overhead, and enables efficient resource sharing through PDB-level resource management on Exadata. Option B is correct because Exadata Smart Flash Cache policies (for example, keeping OLTP data cached while marking DSS scans as non-cacheable) ensure flash is used for latency-sensitive random I/O and not polluted by large sequential scans, improving performance and deferring costly capacity upgrades. Option E is correct because Exadata Database Service on Dedicated Infrastructure supports dynamic OCPU scaling, so matching OCPU counts to peak and off-peak schedules avoids paying for idle compute while preserving performance during demand peaks.

Option C is incorrect because moving table data to standard Block Volume bypasses Exadata storage servers, eliminating Smart Scan, storage indexes, and Exadata flash benefits, which hurts performance and cost efficiency. Option D is incorrect because disabling automatic backups removes data protection and is not a valid cost-optimization practice; backup costs should be managed through retention and tiering policies instead.

Exam trap

The trap is choosing options that seem cost-saving (like disabling backups or moving to Block Volume) but actually harm performance or risk data loss; the exam tests whether you understand Exadata's value proposition.

Full explanation →

52

Multi-Selecthard

Which THREE strategies are recommended when planning a large-scale database migration (exceeding 100 TB) from on-premises to Exadata Database Service on Dedicated Infrastructure with minimal downtime? (Choose three.)

Select 3 answers

A.Leveraging Transportable Tablespaces (TTS) combined with RMAN cross-platform conversion

B.Utilizing Oracle Zero Downtime Migration (ZDM) physical migration workflows

C.Copying database files across the public internet using standard FTP without encryption

D.Exporting the entire 100 TB database into a single plaintext SQL script using SQL*Developer

E.Configuring Oracle Data Guard or GoldenGate for ongoing delta synchronization prior to cutover

AnswersA, B, E

Transportable Tablespaces with RMAN cross-platform conversion moves datafiles at the physical level, transferring the bulk 100 TB quickly while only metadata is exported and imported. This minimises the cutover window, satisfying the minimal-downtime constraint for the large migration.

Why this answer

Option A is correct because Transportable Tablespaces (TTS) with RMAN cross-platform conversion moves datafiles at the physical level, avoiding the slow row-by-row logical extraction that would be impractical for 100 TB, and RMAN's CONVERT DATAFILE handles endianness/platform differences efficiently. Option B is correct because Oracle Zero Downtime Migration (ZDM) physical migration workflows are purpose-built for large on-premises-to-Exadata/ODA moves, orchestrating Data Guard-based synchronization and automated cutover to keep downtime minimal. Option E is correct because configuring Oracle Data Guard or Oracle GoldenGate for ongoing delta synchronization lets the bulk copy happen while changes continue to be applied, so only a brief final switchover is needed at cutover.

Option C is not recommended because unencrypted FTP over the public internet is insecure and unreliable for 100 TB of database files. Option D is not recommended because exporting 100 TB into a single plaintext SQL script via SQL Developer is a logical, serialized, and insecure approach that would take far too long and cannot meet minimal-downtime requirements.

Exam trap

The trap is choosing logical export/import or insecure file transfer for huge databases; the exam expects you to recognize that physical migration plus delta synchronization is the only realistic path to minimal downtime at 100 TB scale.

Full explanation →

53

MCQeasy

When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?

A.It requires manual setup of keepalived and IP failover scripts on backend compute instances.

B.It is a regional service that automatically provisions endpoints across availability domains.

C.It terminates SSL/TLS connections before forwarding traffic to backend servers.

D.It can only route HTTP and HTTPS traffic.

AnswerB

The Network Load Balancer is a regional construct that automatically provisions endpoints across availability domains, providing inherent high availability without manual per-AD configuration. This satisfies the requirement for availability domain redundancy in the NLB architecture.

Why this answer

OCI Network Load Balancer is a regional, Layer 4 (TCP/UDP) load balancing service that automatically provisions endpoints across multiple Availability Domains within a region. It provides high availability by distributing traffic across healthy backend instances in different ADs without requiring manual failover scripts or keepalived. This regional, multi-AD design is a key architectural characteristic that differentiates it from a zonal load balancer.

Exam trap

1Z0-997-26 often tests whether candidates confuse the Layer 4 NLB (regional, TCP/UDP, no SSL termination) with the Layer 7 Load Balancer (flexible shapes, HTTP/HTTPS, SSL termination), so the trap is picking an L7 characteristic for an NLB question.

How to eliminate wrong answers

Option A is wrong because NLB is a managed service — OCI handles failover automatically via health checks and multi-AD endpoints; you do not install keepalived or write IP failover scripts, which is a self-managed HA pattern for compute instances. Option C is wrong because NLB operates at Layer 4 and does not terminate SSL/TLS; SSL termination is a feature of the Layer 7 OCI Load Balancer (flexible shapes), not NLB. Option D is wrong because NLB handles TCP and UDP traffic, not just HTTP/HTTPS — HTTP/HTTPS is the domain of the Layer 7 Load Balancer, while NLB is protocol-agnostic at L4.

Full explanation →

54

MCQhard

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

A.Configure an OCI Service Gateway to route traffic to Azure public endpoints.

B.Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.

C.Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.

D.Enable Oracle Autonomous Database cross-region data guard.

AnswerC

The service mesh control plane requires direct pod-to-pod reachability across clouds. Private IP connectivity via OCI-Azure Interconnect, with non-overlapping CIDRs and firewall rules permitting control plane ports, satisfies this without exposing traffic to the public internet.

Why this answer

The essential prerequisite is private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect, with non-overlapping subnets and open firewall ports for control plane communication. A service mesh control plane (e.g., Istio) requires direct network reachability between the control plane components and the sidecar proxies across both clouds. This is achieved through the private interconnect, ensuring secure, low-latency communication without public internet exposure.

Exam trap

The trap is selecting a service that provides private access to OCI services (Service Gateway) or outbound internet (NAT Gateway) instead of true private cross-cloud IP connectivity.

How to eliminate wrong answers

Option A is wrong because an OCI Service Gateway only provides private access to OCI services (like Object Storage), not to Azure endpoints. Option B is wrong because a NAT Gateway translates private IPs to public IPs for outbound internet, not for private cross-cloud communication. Option D is wrong because Autonomous Database Data Guard is unrelated to service mesh networking.

Full explanation →

55

MCQhard

You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?

A.Set the alarm evaluation window to 30 minutes and enable metric smoothing.

B.Create an OCI Events rule with a batch window of 30 minutes.

C.Configure the 'Repeat Notification' setting in the OCI Monitoring alarm definition to 30 minutes.

D.Configure a notification suppression window in the Notifications service topic settings.

AnswerC

The Repeat Notification interval suppresses duplicate alarm notifications, sending only one per 30 minutes while the metric stays in breach. This directly prevents the alert storms the stem describes, and notifications resume normally once the condition clears.

Why this answer

OCI Monitoring alarms have a 'Repeat Notification' setting that controls how often the notification is re-sent while the alarm remains in the firing state. Setting it to 30 minutes ensures that if the metric stays above threshold, the notification is sent only once every 30 minutes, preventing alert storms. This is the correct mechanism for suppressing repeated notifications.

Exam trap

The trap is confusing the alarm evaluation window with the notification repeat interval; candidates often pick the evaluation window, but that controls when the alarm fires, not how often it notifies.

How to eliminate wrong answers

Option A is wrong because the evaluation window determines how long the metric is evaluated before triggering, not how often notifications repeat; metric smoothing affects the metric stream, not notification frequency. Option B is wrong because OCI Events rules with a batch window are for event-driven actions, not for controlling alarm notification repetition. Option D is wrong because the Notifications service does not have a per-topic 'notification suppression window' setting; suppression is configured on the alarm via Repeat Notification.

Full explanation →

56

Multi-Selectmedium

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Select 2 answers

A.Configure a public load balancer pointing directly to port 22 of all backend private compute instances.

B.Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.

C.Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.

D.Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.

E.Establish an OCI Site-to-Site VPN or FastConnect circuit from the on-premises datacenter to the VCN, enabling direct administrative access.

AnswersD, E

OCI Bastion provisions a managed jump host inside the target private subnet, so sessions reach instances over the private network without any public IP or internet gateway. Its timed, session-based SSH access with IAM-controlled permissions satisfies the administrative-access-without-public-exposure constraint directly.

Why this answer

Option D is correct because the OCI Bastion service is purpose-built for this scenario: it creates a managed, time-limited SSH session to private compute instances in a target subnet without requiring any public IP or public exposure, and access is controlled through IAM policies and session types (e.g., managed SSH). Option E is correct because an OCI Site-to-Site VPN (IPSec) or FastConnect (private dedicated connectivity) extends the on-premises network into the VCN, so administrators can reach private instances over the private network path without exposing them to the internet. Option A is wrong because a public load balancer would expose port 22 to the internet and load balancers are not an administrative access mechanism for SSH.

Option B is wrong because attaching ephemeral public IPs directly exposes the instances to the internet, contradicting the requirement. Option C is wrong because an unauthenticated public API Gateway endpoint does not provide secure administrative SSH access and would itself be an unsecured public exposure.

Exam trap

1Z0-997-26 often tests the misconception that adding a public IP with tight security lists or a public load balancer on port 22 counts as 'secure administrative access,' when the exam's intent is that any public internet exposure disqualifies the option — the correct answers must keep instances fully private.

Full explanation →

57

MCQmedium

You are planning to migrate an Oracle Database to OCI using Zero Downtime Migration (ZDM). Which underlying Oracle migration technology does ZDM orchestrate behind the scenes for large databases requiring physical migration?

A.OCI Object Storage lifecycle policies exclusively

B.Oracle RMAN and Oracle Data Guard

C.Third-party ETL pipelines and CSV flat file generation

D.MySQL Enterprise Backup and InnoDB replication

AnswerB

ZDM orchestrates Oracle RMAN for the physical backup and restore of datafiles, then Oracle Data Guard to synchronise and cut over. This physical approach suits large databases where logical replication would be impractical, matching the stem's physical migration requirement.

Why this answer

Zero Downtime Migration (ZDM) orchestrates Oracle Recovery Manager (RMAN) for the initial physical backup and restore, and Oracle Data Guard for ongoing replication to minimize downtime during the migration to OCI. For large databases requiring physical migration, ZDM leverages these native Oracle technologies to ensure data consistency and near-zero downtime. RMAN handles the bulk data movement, while Data Guard keeps the target in sync until the cutover.

Exam trap

1Z0-997-26 often tests the underlying technologies ZDM uses, and candidates may incorrectly choose logical migration methods like ETL or confuse ZDM with third-party tools; the trap is not recognizing that ZDM is built on RMAN and Data Guard.

How to eliminate wrong answers

Option A is wrong because OCI Object Storage lifecycle policies are used for managing object storage tiers and retention, not for orchestrating database migration. Option C is wrong because third-party ETL pipelines and CSV flat files are logical migration methods, not the physical migration technology ZDM uses for large databases; they are slower and not zero-downtime. Option D is wrong because MySQL Enterprise Backup and InnoDB replication are for MySQL databases, not Oracle Database, and ZDM is an Oracle-specific tool.

Full explanation →

58

MCQeasy

You want to monitor the health and performance of your Oracle Autonomous Database in OCI. Which built-in metric namespace in OCI Monitoring should you query?

A.oci_autonomous_metrics

B.oci_database

C.oci_apm_metrics

D.oci_compute_infra

AnswerB

The `oci_database` namespace exposes Autonomous Database health and performance metrics, including CPU utilisation, storage consumption, session counts and transaction throughput. Querying it in OCI Monitoring satisfies the requirement for built-in database telemetry without custom agents or additional instrumentation.

Why this answer

OCI Monitoring organizes metrics into namespaces, and all Autonomous Database metrics (CPU utilization, session counts, transaction rates, storage usage, etc.) are published under the oci_database namespace. This namespace covers both Autonomous Transaction Processing (ATP) and Autonomous Data Warehouse (ADW) instances, so querying it returns the health and performance metrics needed for dashboards and alarms.

Exam trap

The trap here is that candidates assume a service-specific namespace like 'oci_autonomous_metrics' exists, when OCI actually consolidates all database metrics under the generic oci_database namespace.

How to eliminate wrong answers

Option A is wrong because oci_autonomous_metrics is not a real OCI Monitoring namespace — it is a plausible-sounding distractor invented to mimic the naming convention. Option C is wrong because oci_apm_metrics relates to Application Performance Monitoring (APM) trace and span data, not database health metrics. Option D is wrong because oci_compute_infra covers compute instance metrics (CPU, memory, network on VMs/bare metal), not Autonomous Database metrics.

Full explanation →

59

Multi-Selecteasy

Which TWO destinations can receive messages dispatched from an OCI Notifications service topic?

Select 2 answers

A.OCI Internet Gateway route tables

B.OCI Dynamic Routing Gateway (DRG)

C.HTTPS / Webhook endpoints (e.g., Slack, PagerDuty)

D.Email endpoints and SMS

E.OCI Block Volume backup policies

AnswersC, D

OCI Notifications publishes to HTTPS endpoints, delivering JSON payloads to webhook URLs such as Slack or PagerDuty. This satisfies the stem's requirement for a valid subscription destination, since webhook subscriptions are natively supported alongside email, SMS, and Function.

Why this answer

Option C is correct because OCI Notifications topics support HTTPS subscriptions, which deliver the published message as a JSON POST to a webhook URL, enabling integrations such as Slack or PagerDuty. Option D is correct because OCI Notifications natively supports Email and SMS subscriptions, sending the message content directly to the subscribed address or phone number. The other options are incorrect because Internet Gateway route tables, Dynamic Routing Gateway (DRG), and Block Volume backup policies are networking and storage constructs, not subscription protocols or delivery destinations for a Notifications topic.

Exam trap

1Z0-997-26 often tests whether candidates confuse OCI networking components (IGW, DRG) or storage policies with Notifications subscription targets — the trap is assuming any OCI service can be a notification destination.

Full explanation →

60

MCQeasy

An administrator needs to encrypt sensitive database passwords stored in OCI Object Storage. The company policy requires customer-managed keys with strict rotation schedules. Which service should the administrator use?

A.OCI Object Storage Server-Side Encryption with Oracle-Managed Keys (SSE-S3).

B.OCI Database Management service.

C.OCI Identity and Access Management (IAM) password policies.

D.OCI Vault service to create and manage Customer-Managed Keys (CMK).

AnswerD

OCI Vault provides Customer-Managed Keys (CMK) with configurable rotation schedules, satisfying the policy's strict rotation requirement. Object Storage encrypts data with AES-256; using a Vault master key gives the administrator full control over key lifecycle and rotation, unlike Oracle-managed keys.

Why this answer

OCI Vault is the service for creating and managing customer-managed encryption keys (CMKs). By using OCI Vault, the administrator can generate and manage keys with strict rotation schedules and use them to encrypt data in Object Storage. This satisfies the requirement for customer-managed keys with rotation.

Exam trap

1Z0-997-26 often tests the difference between Oracle-managed keys and customer-managed keys; candidates may choose SSE-S3, but that does not meet the requirement for customer-managed keys with rotation schedules.

How to eliminate wrong answers

Option A is wrong because Oracle-managed keys (SSE-S3) do not provide customer control over key management or rotation schedules. Option B is wrong because OCI Database Management is for managing databases, not for encrypting objects in Object Storage. Option C is wrong because IAM password policies govern user passwords, not encryption keys for data at rest.

Full explanation →

61

MCQhard

You are designing a disaster recovery strategy for a stateful microservices application running on OKE across two OCI regions. Persistent data is stored on OCI Block Volumes. What is the recommended approach to replicate persistent storage data across regions for stateful workloads?

A.Configure cross-region block volume asynchronous replication to the secondary region.

B.Rely on Kubernetes Persistent Volume snapshots stored locally on worker node local NVMe drives.

C.Attach the same Block Volume simultaneously to worker nodes in both regions across the VCN peering.

D.Use OCI Streaming to replicate raw block storage disk sectors.

AnswerA

Cross-region block volume asynchronous replication continuously copies volume data to a secondary region, giving stateful OKE workloads a recoverable copy without synchronous latency penalties. On failover, replicated volumes are activated in the secondary region and reattached to the cluster.

Why this answer

Cross-region asynchronous block volume replication is the native OCI feature designed to copy Block Volume data from a primary region to a secondary region for DR. It continuously replicates volume data at the block level, so stateful workloads on OKE can fail over and reattach replicated volumes in the secondary region. This is the recommended, supported approach for cross-region persistence in OCI.

Exam trap

1Z0-997-26 often tests whether candidates confuse block-level replication with application-level or message-bus replication — the trap is picking OCI Streaming or local NVMe snapshots as if they provided cross-region durability for Block Volumes.

How to eliminate wrong answers

Option B is wrong because PV snapshots stored on worker node local NVMe are node-local, ephemeral, and not replicated across regions — losing the node loses the data. Option C is wrong because an OCI Block Volume cannot be simultaneously attached to worker nodes in two different regions; Block Volumes are zonal resources with single-attach semantics (or multi-attach only within the same AD for specific volume types). Option D is wrong because OCI Streaming is a Kafka-compatible message bus, not a block-level storage replication mechanism — it cannot replicate raw disk sectors.

Full explanation →

62

MCQmedium

A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?

A.Events Service

B.OCI Monitoring Service

C.OCI Logging Analytics

D.Application Performance Monitoring (APM)

AnswerB

OCI Monitoring Service exposes the PostMetricData API for ingesting custom metrics and the Metrics API for querying them, so OKE microservices can publish cart counts as custom namespace metrics. It satisfies the requirement for a native API to ingest and query application metrics.

Why this answer

The OCI Monitoring Service provides the API (PostMetricData) to ingest custom metrics and the QueryMetrics API to retrieve them. It is the native service for storing and querying both built-in and custom metrics emitted by OKE workloads.

Exam trap

1Z0-997-26 often tests the confusion between Monitoring (metrics), Logging Analytics (logs), and APM (traces), so candidates select APM or Logging Analytics for custom metric ingestion when only Monitoring provides the PostMetricData API.

How to eliminate wrong answers

Option A is wrong because the Events Service handles state-change events and triggers, not metric ingestion or querying. Option C is wrong because OCI Logging Analytics is for log ingestion, indexing, and analysis, not for custom metric time-series data. Option D is wrong because APM focuses on application performance tracing and synthetic monitoring, not on ingesting arbitrary custom metrics like cart counts.

Full explanation →

63

Multi-Selectmedium

When designing a high-performance hybrid architecture integrating an on-premises data center with OCI, which THREE key factors should be evaluated to optimize network throughput and reliability?

Select 3 answers

A.BGP timer tuning for faster convergence and failover detection

B.Maximum Transmission Unit (MTU) size configuration (supporting Jumbo Frames up to 9000 bytes)

C.Enabling public IP addresses on all internal database nodes

D.Configuring Local Peering Gateways for on-premises connectivity

E.Physical path diversity and carrier redundancy for FastConnect circuits

AnswersA, B, E

Tuning BGP keepalive and hold timers shortens failure detection, accelerating route withdrawal and failover across the FastConnect or VPN path. This directly satisfies the stem's reliability and throughput goal by minimising black-hole traffic during an on-premises link failure, though aggressive values risk session flapping on lossy circuits.

Why this answer

Option A is correct because tuning BGP timers (e.g., reducing Keepalive and Hold-time values) on the FastConnect virtual circuit and on-premises CPE accelerates route convergence and failover detection, which directly improves reliability and recovery time during path failures. Option B is correct because configuring MTU consistently across the hybrid path—supporting Jumbo Frames up to 9000 bytes on FastConnect and the on-premises network—reduces packet fragmentation and per-packet overhead, thereby increasing effective throughput for bulk data transfers. Option E is correct because physical path diversity and carrier redundancy for FastConnect circuits (e.g., multiple diverse physical connections or redundant providers) eliminate single points of failure and ensure continued connectivity if one circuit or path degrades.

Option C does not belong because exposing internal database nodes with public IP addresses weakens security and has no bearing on throughput or reliability optimization. Option D does not belong because Local Peering Gateways connect VCNs within the same OCI region, not on-premises networks, so they are irrelevant to hybrid on-premises-to-OCI connectivity.

Exam trap

The trap is selecting options that are either security anti-patterns (public IPs on DB nodes) or irrelevant to hybrid connectivity (Local Peering Gateways).

Full explanation →

64

Multi-Selecthard

An enterprise is executing a large-scale database migration to OCI using Oracle Data Pump. To ensure optimal performance and minimize the duration of the data load phase, which THREE best practices should the database administrator implement? (Choose three.)

Select 3 answers

A.Disable secondary indexes, foreign key constraints, and database triggers on target tables before import, and rebuild them afterward.

B.Use high-performance OCI Block Volume performance tiers (such as Higher Performance) or temporary NVMe scratch space for the database staging directories.

C.Configure the PARALLEL parameter in Data Pump to utilize multiple worker processes simultaneously.

D.Route all Data Pump network links strictly through the public internet without compression to maximize packet inspection.

E.Set the database compatibility parameter to a legacy version from 10g to disable modern optimizer features.

AnswersA, B, C

Dropping secondary indexes, foreign key constraints and triggers removes the per-row maintenance overhead Data Pump would otherwise incur during direct-path inserts, so the load phase completes faster; these objects are recreated once the import finishes, satisfying the requirement to minimise load duration.

Why this answer

Option A is correct because disabling secondary indexes, foreign key constraints, and triggers on the target tables before import eliminates the overhead of maintaining those objects row-by-row during the load, and rebuilding/re-enabling them afterward is far faster than incremental maintenance during a bulk insert. Option B is correct because Data Pump performance is heavily I/O-bound, so placing the database staging directories (DATA_PUMP_DIR and the datafile destinations) on high-performance OCI Block Volume tiers such as Higher Performance, or on temporary NVMe scratch space, increases throughput and reduces the data load window. Option C is correct because setting the Data Pump PARALLEL parameter spawns multiple worker processes that read and write in parallel, which is the primary mechanism for scaling a large import and shortening the load phase.

Option D does not belong because routing Data Pump links over the public internet without compression adds latency and exposes traffic unnecessarily; private endpoints or FastConnect with compression are preferred. Option E does not belong because setting COMPATIBLE to a legacy 10g value disables modern optimizer and feature capabilities and does not improve Data Pump load performance.

Exam trap

1Z0-997-26 often tests the misconception that Data Pump tuning is purely a database-side parameter exercise, luring candidates away from the equally important storage-tier and object-maintenance levers that actually determine load duration.

Full explanation →

65

MCQhard

Your organization is performing a zero-downtime database migration from an Oracle Database on-premises to OCI Exadata Database Service using Oracle Zero Downtime Migration (ZDM). During the migration job execution, the workflow pauses during the dataguard broker configuration step. Reviewing the ZDM logs, you find a network timeout error communicating between the ZDM service host and the OCI database listener. What is the most likely cause?

A.OCI Object Storage bucket policies prevent ZDM from reading temporary backup files.

B.OCI VCN Security Lists or Network Security Groups block incoming TCP port 1521 or SSH port 22 from the ZDM client subnet.

C.The Exadata database service requires Autonomous Database credentials to establish connection.

D.OCI IAM quotas restrict the creation of more than 10 Data Guard associations per tenancy.

AnswerB

ZDM reaches the OCI database listener on TCP 1521 and the host over SSH on port 22. If VCN security lists or NSGs omit inbound rules from the ZDM client subnet, the dataguard broker step times out, matching the logged network timeout.

Why this answer

The ZDM workflow pauses at Data Guard broker configuration because the ZDM service host cannot reach the OCI database listener. This is almost always caused by network security rules (Security Lists or NSGs) blocking inbound TCP 1521 (database listener) or SSH port 22 from the ZDM client subnet to the Exadata Database Service.

Exam trap

1Z0-997-26 often tests the tendency to blame storage or IAM for migration failures, so candidates overlook that a network timeout during Data Guard configuration points to blocked ports 1521/22 rather than Object Storage or quota issues.

How to eliminate wrong answers

Option A is wrong because Object Storage bucket policy issues would cause failures in backup or file transfer steps, not a network timeout during Data Guard broker configuration. Option C is wrong because Exadata Database Service does not require Autonomous Database credentials — it uses standard Oracle Database credentials and wallet-based connectivity. Option D is wrong because IAM quotas on Data Guard associations would produce an authorization or limit error, not a network timeout between the ZDM host and the database listener.

Full explanation →

66

Multi-Selecteasy

Which TWO methods can developers use to interact with OCI Registry (OCIR) for pushing and pulling container images?

Select 2 answers

A.Docker CLI authenticated with an OCI Auth Token

B.Podman CLI authenticated with OCI credentials

C.Windows Remote Desktop (RDP) file transfer

D.Kubernetes kubelet raw disk mounting

E.Direct FTP client over port 21

AnswersA, B

The Docker CLI, authenticated with an OCI Auth Token, is a supported method for pushing and pulling images to OCIR. The token replaces the password during docker login against the regional registry endpoint, satisfying the requirement for a native developer interaction method.

Why this answer

Option A is correct because the Docker CLI is a standard, supported client for OCIR: after running `docker login <region-key>.ocir.io` with the OCI username (tenancy namespace/username) and an OCI Auth Token as the password, developers can `docker push` and `docker pull` images against OCIR repositories. Option B is correct because Podman is also a fully supported OCI-compliant container client; authenticating with OCI credentials (username plus Auth Token) via `podman login <region-key>.ocir.io` allows the same push and pull operations against OCIR. The remaining options do not belong: RDP is a remote desktop protocol for GUI sessions, not an image registry transport; kubelet raw disk mounting is not a registry interaction method and kubelet pulls images via container runtime credentials rather than mounting disks; and FTP over port 21 is a legacy file-transfer protocol that OCIR does not expose for container image push/pull operations.

Exam trap

1Z0-997-26 often tests whether candidates know OCIR is Docker V2-compatible and authenticated via OCI Auth Tokens, luring them toward generic file-transfer or Kubernetes-internal mechanisms that have nothing to do with registry operations.

Full explanation →

67

MCQmedium

Your development team needs to perform routine maintenance on database compute instances located in a private subnet without exposing SSH ports to the internet or corporate network. Which OCI service should you deploy?

A.OCI NAT Gateway.

B.OCI Load Balancer with TCP routing.

C.OCI API Gateway.

D.OCI Bastion service.

AnswerD

OCI Bastion service creates a session-based, time-limited tunnel to targets in private subnets, so administrators reach the database compute instances without any inbound SSH rule or public exposure. That satisfies the constraint of performing maintenance while keeping SSH ports closed to the internet and corporate network.

Why this answer

OCI Bastion service provides secure, time-limited, and audited SSH access to private subnet compute instances without exposing any public IP or opening inbound SSH ports. It creates a bastion session that tunnels SSH traffic through the OCI service, and access is controlled by IAM policies and session TTLs. This directly meets the requirement of performing maintenance on private database instances without internet or corporate network exposure.

Exam trap

1Z0-997-26 often tests whether candidates confuse outbound-only NAT Gateway functionality with inbound administrative access, causing them to pick NAT Gateway when the requirement is secure inbound SSH.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway only allows outbound traffic from private subnets to the internet; it does not provide inbound SSH access for administrators. Option B is wrong because a Load Balancer with TCP routing would expose the SSH port through a public listener, which is exactly what the question says to avoid. Option C is wrong because OCI API Gateway is designed for HTTP/REST API traffic and cannot proxy raw SSH sessions to compute instances.

Full explanation →

68

MCQmedium

You are designing an automated backup strategy for an Exadata Database Service on Dedicated Infrastructure. You want to ensure that incremental backups are taken daily and full backups weekly, with long-term retention stored in OCI Object Storage. Where are these backup schedules configured?

A.In the OCI Console under the database system backup configuration settings or via API/CLI

B.By modifying the crontab configuration file as root on the dom0 hypervisor node

C.By editing the initialization parameter file (spfile) using SQL*Plus

D.Via Oracle Enterprise Manager Cloud Control deployed exclusively on-premises

AnswerA

Autonomous and Exadata backup schedules are defined in the OCI Console's database backup configuration or through API/CLI, letting you set daily incremental and weekly full retention to Object Storage. This satisfies the stem's scheduling and long-term retention constraints.

Why this answer

Backup schedules for Exadata Database Service on Dedicated Infrastructure are configured through the OCI Console under the database system's backup configuration, or via the OCI API/CLI. These settings define the retention period, backup window, and whether backups are stored in OCI Object Storage, and they control the automated incremental and full backup cadence.

Exam trap

1Z0-997-26 often tests whether candidates know that backup scheduling is an OCI control-plane function, not an OS-level cron or database parameter; the trap is selecting crontab or spfile edits.

How to eliminate wrong answers

Option B is wrong because modifying crontab on the dom0 hypervisor is not a supported or safe way to configure database backups; dom0 is the control domain and direct edits can break the managed service. Option C is wrong because spfile parameters control database instance behavior, not OCI-level backup scheduling or Object Storage retention. Option D is wrong because Enterprise Manager Cloud Control is not the configuration point for OCI Exadata backup schedules, and it is not deployed exclusively on-premises for this purpose.

Full explanation →

69

MCQhard

An application deployed across two OCI regions uses a DNS-based traffic management steering policy. A database failure occurs in the primary region, and the application must failover to the secondary region. What is the primary limitation of relying solely on DNS Traffic Management for disaster recovery failover?

A.DNS steering policies cannot route traffic across different geographic regions.

B.DNS records are permanently immutable once created in OCI.

C.Client-side caching and DNS TTL expiration delays can cause continued traffic routing to the failed region.

D.DNS routing requires public IP addresses to be configured on the database backends.

AnswerC

DNS resolvers and clients cache records until TTL expiry, so some traffic keeps hitting the failed region after failover. This latency, inherent to DNS-based steering, is the core limitation when DNS alone must redirect clients during a regional database failure.

Why this answer

DNS-based traffic management only influences which endpoint a client resolves to; it cannot force clients to stop using an address they have already cached. When the primary region fails, clients and recursive resolvers that cached the old record continue sending traffic to the failed region until the TTL expires and they re-query, so failover is inherently delayed and not instantaneous.

Exam trap

The trap is treating DNS traffic management as an instant failover mechanism; candidates forget that client-side and resolver caching plus TTL expiration introduce unavoidable delay, so DNS alone cannot guarantee immediate redirection to the healthy region.

How to eliminate wrong answers

Option A is wrong because OCI DNS steering policies absolutely can route traffic across geographic regions using geolocation and failover steering policies; cross-region routing is a core capability. Option B is wrong because DNS records in OCI are fully editable and versioned; they are not immutable, and you can update or delete them at any time. Option D is wrong because DNS steering operates at the name-resolution layer and does not require public IPs on database backends; the database is typically private and reached through the application tier, not directly by DNS clients.

Full explanation →

70

MCQhard

An OCI Function in your serverless architecture needs to process large files (up to 5GB) uploaded to an OCI Object Storage bucket. Due to ephemeral storage limits inside the function container (/tmp), the function crashes when attempting to download the entire file locally. How should you redesign this function processing flow?

A.Attach an OCI Block Volume directly to the OCI Function container instance.

B.Increase the OCI Function memory allocation to automatically provision a larger /tmp filesystem.

C.Stream the file contents in chunks using Object Storage API range requests and process data iteratively without full local storage.

D.Mount an OCI File Storage Service (FSS) target over the internet inside the function code.

AnswerC

Object Storage supports HTTP range requests, letting the function fetch defined byte ranges sequentially rather than the whole 5GB object. Processing each chunk iteratively keeps memory and /tmp usage bounded, avoiding the container crash caused by full local download.

Why this answer

Streaming the file in chunks using Object Storage API range requests allows the function to process data iteratively without storing the entire 5GB file locally, staying within the /tmp ephemeral storage limit. This is the recommended serverless pattern for large files, as it avoids memory and disk exhaustion.

Exam trap

1Z0-997-26 often tests the misconception that increasing function memory also increases /tmp storage, leading candidates to choose the memory option instead of implementing chunked streaming.

How to eliminate wrong answers

Option A is wrong because OCI Functions cannot attach OCI Block Volumes directly to their container instances; they are ephemeral and stateless. Option B is wrong because increasing memory allocation does not automatically provision a larger /tmp filesystem; /tmp is fixed and ephemeral. Option D is wrong because mounting OCI File Storage Service over the internet inside the function is not supported, insecure, and impractical for serverless containers.

Full explanation →

71

MCQmedium

An enterprise has an OCI tenancy and an AWS account. They want to enable private connectivity between a VCN in OCI and a VPC in AWS without using the public internet. They have an existing FastConnect circuit in OCI and an AWS Direct Connect circuit in AWS. Which solution should the architect recommend?

A.Set up an IPSec VPN between the OCI VCN and the AWS VPC over the public internet.

B.Use OCI-Azure Interconnect to connect OCI to AWS.

C.Use OCI FastConnect and AWS Direct Connect with a shared colocation facility to cross-connect the two circuits.

D.Create a Remote Peering Connection between the OCI VCN and the AWS VPC.

AnswerC

By cross-connecting the OCI FastConnect and AWS Direct Connect circuits in a shared colocation facility, traffic remains on private physical links and never touches the public internet. This is a common multicloud interconnection pattern. It leverages existing dedicated circuits and provides private, high-bandwidth connectivity between OCI and AWS.

Why this answer

Cross-connecting FastConnect and Direct Connect in a shared colocation facility provides private, dedicated connectivity between OCI and AWS without public internet. This is a standard multicloud interconnection approach. The other options either use the public internet, are for Azure, or use OCI-only peering features that do not extend to AWS.

Exam trap

The trap here is assuming OCI has a native cross-cloud interconnect product for AWS similar to OCI-Azure Interconnect; for AWS, colocation cross-connects are the common approach.

Full explanation →

72

Multi-Selectmedium

Which THREE practices are recommended when hardening OCI VCN network security? (Choose three.)

Select 3 answers

A.Expose all database management ports to the 0.0.0.0/0 CIDR block.

B.Isolate workloads into private subnets whenever public access is not required.

C.Implement stateful security rules to automatically allow return traffic for established connections.

D.Use Network Security Groups (NSGs) for granular, VNIC-level traffic filtering.

E.Attach an Internet Gateway to every private subnet by default.

AnswersB, C, D

Placing workloads in private subnets removes unnecessary internet exposure, so only intended traffic reaches instances. This satisfies the hardening requirement by shrinking the attack surface, with public access provided solely through controlled gateways or load balancers where genuinely required.

Why this answer

Option B is correct because placing workloads in private subnets when they don't need inbound internet access removes their exposure to the public internet, and OCI private subnets have no route to an Internet Gateway, so they can only be reached via controlled paths such as a NAT Gateway, Service Gateway, or bastion. Option C is correct because OCI security rules are stateful by default, meaning return traffic for an established connection is automatically permitted, which reduces the need for wide inbound rules and lowers the risk of misconfiguration. Option D is correct because Network Security Groups (NSGs) apply at the VNIC level and let you write granular rules that reference other NSGs as sources or destinations, enabling least-privilege, application-tier-based filtering rather than broad subnet-level CIDR rules.

Option A is not recommended because exposing database management ports (e.g., 1521, 3306, 5432) to 0.0.0.0/0 makes them reachable from the entire internet and invites brute-force and exploitation attempts. Option E is not recommended because attaching an Internet Gateway to a private subnet would make it public and defeat the purpose of isolation; private subnets should instead use a NAT Gateway for outbound traffic and a Service Gateway for OCI services.

Exam trap

The trap is that candidates may select 'attach an Internet Gateway to every private subnet' thinking it improves connectivity — but the exam tests whether you understand that private subnets should never have direct internet exposure by default.

Full explanation →

73

MCQmedium

A security administrator wants to ensure that all virtual machine instances in a specific subnet reject all inbound traffic by default, except for explicitly permitted administrative traffic. Where should this rule be enforced?

A.Disable the OCI Internet Gateway on the VCN route table.

B.Enable OCI Bastion service on the database subnet.

C.Configure OCI IAM policies to block network ingress at the user level.

D.Attach a Network Security Group (NSG) with a default-deny ingress rule and specific allow rules to the instance VNICs.

AnswerD

Attaching a Network Security Group to the instance VNICs enforces stateful ingress filtering at the network interface, satisfying the subnet-wide default-deny requirement. NSG rules are evaluated by priority, so an explicit deny-all rule blocks inbound traffic while lower-priority allow rules permit only administrative sources. This gives per-instance control regardless of subnet-level configuration.

Why this answer

Network Security Groups (NSGs) in OCI are virtual firewalls applied directly to the VNICs of instances, and they support stateful ingress/egress rules. By attaching an NSG with a default-deny posture (no allow rules for unwanted traffic) plus explicit allow rules for administrative ports (e.g., SSH 22 from a bastion CIDR), all other inbound traffic is dropped at the VNIC level. This is the granular, instance-scoped enforcement point OCI provides for subnet-level or VNIC-level traffic control.

Exam trap

1Z0-997-26 often tests the confusion between routing controls (Internet Gateway, route tables), identity controls (IAM policies), and packet-filtering controls (Security Lists vs. NSGs), tempting candidates to pick a routing or IAM answer when the question asks for default-deny ingress enforcement at the instance level.

How to eliminate wrong answers

Option A is wrong because removing or disabling an Internet Gateway only affects traffic entering from the internet via that gateway; it does not block intra-VCN, peering, VPN, or FastConnect traffic, and it is a routing change rather than a security rule. Option B is wrong because the OCI Bastion service provides controlled, time-limited SSH sessions to private targets — it is an access mechanism, not a default-deny ingress firewall, and enabling it does not reject inbound traffic. Option C is wrong because IAM policies govern OCI API authorization (who can call which OCI resources), not packet-level network ingress; IAM cannot filter TCP/UDP traffic to a VNIC.

Full explanation →

74

Multi-Selectmedium

Your organization is planning a phased workload migration to OCI. To minimize risk, you decide to use a canary deployment and traffic splitting strategy for web applications. Which TWO OCI services or features can assist in routing fractional traffic percentages between on-premises and OCI environments during migration? (Choose two.)

Select 2 answers

A.OCI Vault master encryption keys

B.OCI Load Balancer backend set weight configurations

C.OCI IAM dynamic groups

D.OCI Block Volume backup policies

E.OCI Traffic Management Steering (Weighted or Load Limiting traffic steering policies)

AnswersB, E

OCI Load Balancer backend set weights let you distribute a fixed percentage of requests across backends, so you can send a small fraction to OCI while the remainder stays on-premises. This satisfies the canary requirement for fractional traffic splitting during phased migration, with weights adjusted as confidence grows.

Why this answer

Option B is correct because an OCI Load Balancer backend set can contain multiple backends (for example, an on-premises web server and an OCI web server) and each backend is assigned a weight; the load balancer distributes incoming requests proportionally to those weights, so setting weights like 90/10 or 95/5 lets you route fractional traffic percentages between on-premises and OCI during a canary migration. Option E is correct because OCI Traffic Management Steering supports Weighted traffic steering policies, which answer DNS queries with different answers according to assigned weights, and Load Limiting policies, which can direct a controlled fraction of users to a target; both enable fractional traffic splitting across on-premises and OCI endpoints. Option A is not relevant because OCI Vault master encryption keys provide key management and encryption for data at rest, not traffic routing.

Option C is not relevant because IAM dynamic groups grant permissions to compute instances based on matching rules, which is authorization, not traffic distribution. Option D is not relevant because Block Volume backup policies define scheduled backups of block volumes, which has nothing to do with routing fractional web traffic.

Full explanation →

75

MCQmedium

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

A.Increase the memory allocation to automatically and proportionally increase the timeout limit.

B.Deploy the function behind an OCI Load Balancer to cache timeout requests.

C.Upgrade the underlying OCI Compute shape of the worker nodes in OKE.

D.Modify the function timeout configuration using the Fn Project CLI or OCI Console to a higher value up to the service limit.

AnswerD

Raising the function timeout via the Fn Project CLI or OCI Console directly addresses the exceeded execution limit, allowing the third-party REST API call to complete. OCI Functions permits timeouts up to 300 seconds, so increasing the configured value within that service ceiling resolves the failure without altering application logic.

Why this answer

OCI Functions allow you to configure the function timeout up to the service limit (default 30 seconds, maximum 300 seconds) via the Fn Project CLI or OCI Console. Increasing the timeout directly addresses the failure when calling a slow third-party REST API, and is the recommended best practice for long-running calls.

Exam trap

1Z0-997-26 often tests the misconception that memory allocation and timeout are linked in OCI Functions, leading candidates to choose the memory option instead of explicitly configuring the timeout.

How to eliminate wrong answers

Option A is wrong because increasing memory allocation does not proportionally increase the timeout limit in OCI Functions; timeout is a separate configuration parameter. Option B is wrong because an OCI Load Balancer cannot cache or extend function execution timeouts; it only distributes incoming traffic. Option C is wrong because OCI Functions run on managed infrastructure, not on OKE worker nodes, so upgrading compute shapes is irrelevant.

Full explanation →

Page 1 of 4

All pages

Practice 1Z0-997-26 by domain

Target a specific domain to shore up weak areas.

Observability Cloud Native Architecture Multicloud And Hybrid High Availability And Disaster Recovery Databases Workload Migration Security

See all domains with question counts →