Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) 1Z0-997-26 Questions 76–150 | Page 2/4

Multi-Selectmedium

When designing a disaster recovery plan using OCI Full Stack Disaster Recovery (FSDR), which THREE resource types can be managed and orchestrated within a DR Protection Group? (Choose three.)

Select 3 answers

A.OCI Load Balancers and Network Load Balancers

B.Oracle Database systems (Base Database and Exadata Database Service)

C.OCI Compute instances (including boot and block volumes)

D.OCI Key Management service Vault encryption keys

E.OCI Identity and Access Management (IAM) global policies

AnswersA, B, C

Load Balancers and Network Load Balancers are supported members of an FSDR Protection Group, so their configuration and traffic steering can be orchestrated during a switchover or failover. They are among the resource types the DR plan can manage.

Why this answer

OCI Full Stack Disaster Recovery (FSDR) DR Protection Groups support several OCI resource types that can be added as members and orchestrated during switchover/failover. Option A is correct because OCI Load Balancers and Network Load Balancers are supported member types that FSDR can manage as part of the DR plan. Option B is correct because Oracle Base Database and Exadata Database Service systems are supported members, allowing FSDR to orchestrate database-level DR operations.

Option C is correct because OCI Compute instances, along with their attached boot and block volumes, are supported members that FSDR can move and start in the standby region. Option D is not correct because KMS Vault encryption keys are not a manageable member type in a DR Protection Group; key replication is handled separately via KMS key replication, not FSDR orchestration. Option E is not correct because IAM global policies are account-wide and not a regional resource that can be added to or orchestrated by a DR Protection Group.

Exam trap

1Z0-997-26 often tests the misconception that any OCI resource can be added to a DR Protection Group — candidates incorrectly assume global services like IAM or KMS are orchestrated alongside regional compute, database, and load balancer resources.

Full explanation →

MCQhard

Your organization has deployed an enterprise workload on OCI Exadata Database Service. You are configuring Data Guard with Fast-Start Failover (FSFO). To prevent split-brain scenarios where both primary and standby databases assume primary roles simultaneously, where must the Data Guard Observer be placed?

A.Directly on the primary database compute node to ensure low-latency communication.

B.Inside an OCI Object Storage bucket as a serverless function.

C.Inside the same Oracle Grid Infrastructure clusterware home on the standby database.

D.In a separate fault domain or external location independent of both the primary and standby database nodes.

AnswerD

Placing the Observer in a separate fault domain or external location isolates it from both database nodes, so it retains quorum and can arbitrate failover even if one site fails. This directly prevents the split-brain scenario described in the stem.

Why this answer

The Data Guard Observer must run on a host that is independent of both the primary and standby database systems so it can act as an impartial third-party arbitrator during Fast-Start Failover. Placing it in a separate fault domain or external location ensures that a failure affecting either database node does not also take down the Observer, allowing it to reliably detect failures and issue the failover command without risking split-brain.

Exam trap

1Z0-997-26 often tests the misconception that placing the Observer on the primary (for low latency) or on the standby (for convenience) is acceptable, when the exam's key point is that the Observer must be independent of both databases to prevent split-brain.

How to eliminate wrong answers

Option A is wrong because running the Observer on the primary node means a primary outage also kills the Observer, defeating its purpose as an independent arbiter. Option B is wrong because OCI Object Storage serverless functions cannot host the Oracle Data Guard Observer binary, which requires a persistent Oracle client/observer process with direct network connectivity to both databases. Option C is wrong because co-locating the Observer inside the standby's Grid Infrastructure home ties its fate to the standby — if the standby fails, the Observer cannot arbitrate, and it also violates the independence requirement.

Full explanation →

MCQhard

An architect manages an Autonomous Database on Dedicated Infrastructure (ADB-D) with an Autonomous Container Database (ACD) that hosts several Autonomous Databases. During a maintenance window, the operations team needs to patch the ACD. What happens to the Autonomous Databases running on that ACD during the patching operation?

A.The Autonomous Databases continue serving read-only queries from the ACD's read replicas while writes are queued and replayed after patching completes.

B.Each Autonomous Database on the ACD is patched independently and remains available, because ADB-D patches at the pluggable database level without touching the container.

C.The Autonomous Databases on the ACD become unavailable while the container is patched and restarted, unless a standby ACD is configured and a switchover is performed first.

D.The Autonomous Databases are automatically relocated to another ACD in the same compartment with sufficient capacity, so end users experience no downtime.

AnswerC

Patching an Autonomous Container Database requires restarting the container, which makes the Autonomous Databases hosted on it unavailable for the duration. To avoid this outage, you can configure a standby ACD with Data Guard and perform a switchover before patching, then patch the original container while the standby serves the workload, then switch back.

Why this answer

Patching an Autonomous Container Database restarts the container, so every Autonomous Database hosted on it experiences downtime unless a standby ACD is configured and a switchover moves the workload before patching. A standby ACD with Data Guard provides the continuity path. Independent per-PDB patching, automatic relocation, and automatic read-replica fallback are not features of ADB-D patching.

Exam trap

The trap here is assuming that individual Autonomous Databases are patched independently of their container or that the service automatically moves them elsewhere during a container patch.

Full explanation →

MCQeasy

An Oracle Cloud Infrastructure (OCI) architect is designing a high-availability web tier across multiple Availability Domains (ADs) within a single region. Which component should be used to distribute incoming client traffic evenly across web server instances residing in different ADs?

A.An OCI Dynamic Routing Gateway (DRG) configured with equal-cost multi-path routing.

B.A Network Load Balancer restricted to a single Availability Domain subnet.

C.A primary Local Peering Gateway (LPG) connected to multiple VCNs.

D.An OCI Public Load Balancer configured with backend sets spanning multiple ADs.

AnswerD

A public load balancer with backend sets spanning multiple ADs distributes client traffic across web servers in different fault domains, satisfying the cross-AD high-availability requirement. Regional public load balancers are AD-aware and health-check backends per AD.

Why this answer

An OCI Public Load Balancer can be configured with backend sets that include web server instances in multiple Availability Domains within a region, distributing traffic evenly and providing high availability. It operates at Layer 7 (HTTP/HTTPS) and supports health checks to route traffic only to healthy instances. This design ensures that if one AD fails, traffic is automatically routed to instances in other ADs, meeting the high-availability requirement.

Exam trap

1Z0-997-26 often tests high-availability design, and candidates may confuse network components like DRG or LPG with load balancing; the trap is selecting a network gateway instead of a load balancer for traffic distribution.

How to eliminate wrong answers

Option A is wrong because a Dynamic Routing Gateway (DRG) is used for connectivity between a VCN and on-premises networks or other VCNs, not for distributing client traffic across web servers; equal-cost multi-path routing is a network routing concept, not load balancing. Option B is wrong because a Network Load Balancer restricted to a single AD subnet cannot distribute traffic across multiple ADs, defeating the high-availability goal. Option C is wrong because a Local Peering Gateway (LPG) connects VCNs within the same region, not for load balancing client traffic to web servers.

Full explanation →

MCQeasy

Which Autonomous Database workload type is specifically optimized for running complex analytical queries, machine learning, and data warehousing workloads?

A.Autonomous Data Warehouse (ADW)

B.Autonomous JSON Database (AJD)

C.Autonomous Transaction Processing (ATP)

D.Autonomous Apex Application Development (APEX)

AnswerA

Autonomous Data Warehouse (ADW) uses columnar storage and automatic indexing to accelerate complex analytical queries, machine learning and data warehousing. This directly satisfies the stem's requirement for a workload type optimised for analytics, unlike transaction-processing or mixed workloads, which prioritise row-based access and concurrency instead.

Why this answer

Autonomous Data Warehouse (ADW) is the Autonomous Database workload type specifically tuned for analytical workloads: it uses columnar compression, automatic indexing for analytics, materialized view refresh, and parallel execution optimized for complex queries, machine learning, and data warehousing. ATP is tuned for high-concurrency transactional workloads, and AJD is optimized for JSON document workloads.

Exam trap

The trap is assuming all Autonomous Database types are interchangeable — candidates must remember that ADW is analytics/ML, ATP is OLTP, AJD is JSON, and APEX is low-code development, each with distinct optimization targets.

How to eliminate wrong answers

Option B is wrong because Autonomous JSON Database (AJD) is optimized for schema-less JSON document storage and querying (SODA), not for complex analytical SQL or data warehousing. Option C is wrong because Autonomous Transaction Processing (ATP) is tuned for OLTP with row-based access patterns, high concurrency, and short transactions — not for large analytical scans. Option D is wrong because Autonomous APEX Application Development is a low-code application development service, not a workload type optimized for analytics or machine learning.

Full explanation →

MCQmedium

Your organization uses an external identity provider (IdP), such as Microsoft Entra ID (Azure AD), to authenticate users. You need to map IdP group memberships to OCI IAM groups so that users inherit the correct permissions upon login. How is this integration achieved?

A.Attach API signing keys to each federated user profile manually through the OCI Console.

B.Create dynamic groups in OCI with matching rules checking the user's corporate email domain string.

C.Configure a Federation in OCI IAM using SAML 2.0, establish the IdP trust, and then create IdP Group Mappings to OCI IAM groups.

D.Write a custom Python script running on compute instances that synchronizes user passwords from the IdP to OCI local users every hour.

AnswerC

SAML 2.0 federation establishes the trust between the external IdP and OCI IAM; IdP Group Mappings then translate IdP group claims into OCI IAM group membership, so users inherit the correct policies at login. This directly satisfies the group-to-permissions mapping requirement.

Why this answer

OCI IAM federation with SAML 2.0 establishes trust with the external IdP, and IdP Group Mappings map the IdP's group claims to OCI IAM groups. When a user logs in, OCI reads the group attribute from the SAML assertion and grants the permissions associated with the mapped OCI groups. This provides automatic, centralized authorization based on corporate group membership.

Exam trap

1Z0-997-26 often tests the difference between authentication (SAML federation) and authorization (IdP group mappings) — candidates incorrectly pick dynamic groups or API keys, which are for OCI resources and programmatic access, not for mapping human IdP groups.

How to eliminate wrong answers

Option A is wrong because API signing keys are used for programmatic API access, not for mapping IdP group memberships to OCI groups — attaching keys to federated users does not grant group-based permissions. Option B is wrong because dynamic groups match OCI compute instances or other resources, not federated human users; dynamic group rules cannot evaluate an IdP's group claims. Option D is wrong because synchronizing passwords is unnecessary and insecure — federation uses SAML assertions, not password replication, and local OCI users are not used for federated identities.

Full explanation →

MCQeasy

Which OCI service can be used to monitor the health and performance of your load balancers and backend compute instances across multiple availability domains, triggering alarms if health checks fail?

A.OCI Monitoring service with Alarm definitions

B.OCI DNS Traffic Management

C.OCI Audit service

D.OCI Vault service

AnswerA

OCI Monitoring collects load balancer and backend health metrics across availability domains, and alarm definitions evaluate those metrics to trigger notifications when health checks fail. This directly satisfies the cross-AD health monitoring and alarm requirement.

Why this answer

The OCI Monitoring service ingests metrics from load balancers, compute instances, and other resources, and lets you define alarms on those metrics that fire when thresholds (such as unhealthy backend count or health check failures) are breached. Alarms can trigger notifications via OCI Notifications and can drive autoscaling or Functions. This is the native OCI service for health and performance monitoring with alarm definitions.

Exam trap

1Z0-997-26 often tests the overlap between OCI Monitoring (metrics and alarms) and OCI DNS Traffic Management (DNS-level health checks and steering), catching candidates who pick the DNS service for general health monitoring.

How to eliminate wrong answers

Option B is wrong because OCI DNS Traffic Management handles DNS-based traffic steering and failover (e.g., steering policies, health checks at the DNS layer) but is not the general-purpose metric monitoring and alarm service for load balancers and compute. Option C is wrong because OCI Audit records API activity and control-plane events for compliance and forensics — it does not monitor runtime health metrics or trigger performance alarms. Option D is wrong because OCI Vault stores and manages encryption keys and secrets; it has no monitoring or alarm capability.

Full explanation →

Multi-Selecthard

An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?

Select 3 answers

A.Associate the newly created custom parser with a custom Log Source in Logging Analytics.

B.Provide a sample log message to test and validate pattern matching.

C.Define extraction rules using regular expressions or parser builder tools to map fields (e.g., timestamp, severity, message).

D.Modify the hypervisor kernel parameters on all compute instances.

E.Compile a C++ binary package and upload it to an OCI Function.

AnswersA, B, C

A custom parser only takes effect once bound to a custom Log Source, which governs ingestion and field mapping for the non-standard application logs. This step satisfies the stem's requirement by linking the parser to the specific log stream so out-of-the-box parsers are bypassed.

Why this answer

Option A is correct because a custom parser in OCI Logging Analytics must be attached to a custom Log Source so that the service knows which parser to apply when ingesting that log type. Option B is correct because the parser creation workflow requires supplying sample log messages to test and validate that the pattern matching and field extraction work against real data. Option C is correct because the core of a custom parser is defining extraction rules, typically via regular expressions or the parser builder, to map fields such as timestamp, severity, and message.

Option D is incorrect because hypervisor kernel parameters are unrelated to Logging Analytics parsing and cannot influence log field extraction. Option E is incorrect because Logging Analytics parsers are configured declaratively in the service, not by compiling and deploying C++ binaries to OCI Functions.

Exam trap

1Z0-997-26 often tests whether candidates know that custom parsing is a declarative, service-side configuration (regex/parser builder + Log Source association) rather than code compilation or agent-side changes.

Full explanation →

MCQeasy

When designing high availability across multiple Availability Domains in an OCI region, how should database or application subnets be configured to ensure fault tolerance?

A.Restrict all subnets to a single Availability Domain to prevent cross-AD latency.

B.Create regional subnets so that instances can be placed across multiple Availability Domains.

C.Disable security lists on subnets to allow uninterrupted cross-AD replication traffic.

D.Attach all VNICs directly to the Dynamic Routing Gateway without using subnets.

AnswerB

Regional subnets in OCI are not bound to a single Availability Domain, so instances can be launched across all three ADs within the region. This satisfies the fault-tolerance constraint directly: an AD outage leaves instances in surviving ADs reachable, unlike AD-specific subnets, which confine placement and defeat cross-AD high availability.

Why this answer

Regional subnets in OCI are not scoped to a single availability domain, so instances launched in them can be placed in any AD within the region. This allows you to spread database and application instances across multiple ADs for fault tolerance while keeping them in the same subnet and VCN.

Exam trap

The trap is thinking subnets must be tied to a single AD for performance or simplicity; the exam expects you to know that regional subnets are the recommended way to enable multi-AD placement for high availability.

How to eliminate wrong answers

Option A is wrong because restricting subnets to a single AD concentrates all resources in one failure domain, which defeats the purpose of multi-AD high availability. Option C is wrong because disabling security lists removes network access controls and creates a security risk; security lists do not block legitimate cross-AD replication when configured correctly, and disabling them is never a recommended HA practice. Option D is wrong because VNICs must reside in a subnet; attaching them directly to a DRG is not a valid OCI configuration, and the DRG is a routing gateway, not a subnet substitute.

Full explanation →

Multi-Selectmedium

When designing IAM policies at scale in a large OCI enterprise tenancy, which THREE best practices should be followed? (Choose three.)

Select 3 answers

A.Hardcode IAM user passwords directly in instance metadata.

B.Apply the principle of least privilege by using the most restrictive verbs (inspect, read, use, manage) necessary.

C.Use IAM groups to organize users based on job functions rather than writing policies for individual users.

D.Assign all human users directly to the Administrators group for operational simplicity.

E.Leverage compartment hierarchy so that policies defined on parent compartments cascade to child compartments.

AnswersB, C, E

Least privilege means granting only the weakest verb that satisfies the task: inspect, read, use or manage, in ascending order. Scoping policies to the narrowest verb and compartment limits blast radius if credentials are misused.

Why this answer

Option B is correct because OCI IAM verbs are ordered from least to most permissive (inspect < read < use < manage), and granting only the minimum verb needed for a task enforces least privilege and limits blast radius at scale. Option C is correct because attaching policies to IAM groups mapped to job functions lets you manage entitlements centrally; adding or removing a user from a group changes their access without rewriting individual user policies, which is essential in large tenancies. Option E is correct because OCI policies are inherited down the compartment hierarchy, so a policy written at a parent compartment applies to all child compartments, drastically reducing the number of policies you must author and maintain.

Option A is wrong because storing credentials in instance metadata exposes secrets and violates OCI security guidance; instances should use instance principals instead. Option D is wrong because assigning every human user to the Administrators group grants full tenancy-wide privileges, directly violating least privilege and defeating the purpose of groups and compartment-scoped policies.

Exam trap

1Z0-997-26 often tests the misconception that 'operational simplicity' justifies broad access (like adding everyone to Administrators) or that per-user policies scale better than groups — the exam rewards least privilege, group-based policy attachment, and compartment inheritance instead.

Full explanation →

MCQmedium

Your organization is implementing a multicloud strategy where workloads in OCI must securely communicate with workloads in AWS over a private connection. You decide to set up a third-party software virtual appliance (VPN gateway) inside an OCI VCN. What specific VCN configuration change is required to ensure that return traffic from OCI compute instances correctly routes back through the virtual appliance instance?

A.Configure a Local Peering Gateway on the appliance subnet.

B.Disable 'Source/Destination Check' on the virtual appliance's VNIC and update the VCN route table to point traffic to the appliance's private IP.

C.Enable 'Source/Destination Check' on the virtual appliance's VNIC.

D.Attach an Internet Gateway to the virtual appliance instance to route packets to AWS.

AnswerB

Disabling Source/Destination Check lets the appliance's VNIC forward traffic not addressed to itself, while the route table directs return traffic to the appliance's private IP. Both changes are required for the virtual appliance to act as a transit gateway.

Why this answer

A third-party virtual appliance (e.g., a VPN gateway VM) that forwards traffic not destined for itself must have Source/Destination Check disabled on its VNIC, otherwise OCI drops packets whose source/destination IPs don't match the VNIC. You must also update the VCN route table to steer traffic to the appliance's private IP so return traffic is symmetric.

Exam trap

1Z0-997-26 often tests the default Source/Destination Check behavior, so candidates assume enabling it (or leaving it default) is correct when the opposite is required for any forwarding appliance.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway connects two VCNs in the same region and has nothing to do with routing traffic through a virtual appliance. Option C is wrong because enabling Source/Destination Check (the default) causes OCI to drop forwarded packets, breaking the appliance's routing function. Option D is wrong because an Internet Gateway provides public internet access, not private connectivity to AWS, and would expose traffic rather than keep it private.

Full explanation →

Multi-Selecteasy

Which TWO of the following services are native components of the Oracle Cloud Infrastructure Observability and Management platform?

Select 2 answers

A.OCI Autonomous Database

B.OCI Container Engine for Kubernetes

C.OCI Application Performance Monitoring (APM)

D.OCI File Storage Service

E.OCI Logging Analytics

AnswersC, E

OCI Application Performance Monitoring is a native pillar of the OCI Observability and Management platform, providing distributed tracing and synthetic monitoring. It satisfies the stem's requirement for a native component, integrating directly with OCI telemetry rather than requiring third-party agents or separate licensing.

Why this answer

OCI Application Performance Monitoring (APM) (option C) is a native Observability and Management service that provides distributed tracing, synthetic monitoring, and real-user monitoring to diagnose application performance issues. OCI Logging Analytics (option E) is also a native Observability and Management service that uses machine-learning-driven log indexing, correlation, and visualization to analyze log data across the environment. Both belong to the OCI Observability and Management platform, which also includes services such as Monitoring, Notifications, Events, and Operations Insights.

In contrast, OCI Autonomous Database (A), OCI Container Engine for Kubernetes (B), and OCI File Storage Service (D) are core data and compute/storage services, not observability or management components, so they do not qualify.

Exam trap

1Z0-997-26 often tests whether candidates can distinguish core OCI services (database, storage, Kubernetes) from the Observability and Management portfolio — the trap is assuming any OCI service with 'monitoring-like' features belongs to the platform.

Full explanation →

Multi-Selecthard

An enterprise is designing a comprehensive cost observability and governance strategy in OCI. Which THREE practices or features should be implemented?

Select 3 answers

A.Route all VCN flow logs through OCI Logging Analytics to calculate cloud infrastructure billing.

B.Enforce defined tags for resource creation using IAM policy conditions or tag defaults.

C.Analyze spending patterns and spot cost anomalies using OCI Cost Analysis dashboards.

D.Configure OCI Budgets with both actual and forecasted spending alert thresholds.

E.Install APM Java agents on all block storage volumes to track storage encryption costs.

AnswersB, C, D

IAM policy conditions and tag defaults enforce defined tags at resource creation, making cost allocation reliable across compartments and preventing untagged spend from obscuring governance reporting. This underpins accurate cost observability by guaranteeing consistent tagging metadata.

Why this answer

Option B is correct because enforcing defined tags via IAM policy conditions (e.g., request.tag.definedTag) or tag defaults ensures consistent cost allocation and governance across compartments and resources. Option C is correct because OCI Cost Analysis provides dashboards and filtering to analyze spending trends and detect cost anomalies by service, compartment, or tag. Option D is correct because OCI Budgets support alert rules on both actual spend and forecasted spend, enabling proactive governance before thresholds are breached.

Option A is incorrect because VCN flow logs capture network traffic metadata, not billing data, and Logging Analytics does not calculate OCI infrastructure charges. Option E is incorrect because APM Java agents monitor application performance, not block volume storage encryption costs, and encryption at rest is included in OCI storage pricing.

Exam trap

1Z0-997-26 often tests the misconception that network or application monitoring tools can directly provide cost data, confusing observability with billing.

Full explanation →

MCQhard

An enterprise application uses an Oracle Exadata Database Service on Dedicated Infrastructure with Maximum Availability Architecture (MAA). A catastrophic regional disaster occurs, and you must initiate a failover to the standby region. What is the expected behavior of Active Data Guard during this process?

A.The standby database converts to the primary role, opens for read/write operations, and stops applying redo from the old primary.

B.The standby database automatically initiates a flashback database operation to sync with object storage backups before opening.

C.Active Data Guard remains in read-only mode until a manual database restore command is issued.

D.The database becomes inaccessible until Full Stack Disaster Recovery automatically reprovisions the storage cells.

AnswerA

Active Data Guard failover transitions the standby to primary, opening it read/write and halting redo apply from the former primary. This restores service in the standby region, matching the MAA disaster-recovery requirement in the stem.

Why this answer

During a Data Guard failover, the standby database transitions from the standby role to the primary role, opens for read/write operations, and stops applying redo from the former primary. This is the defining behavior of a role transition: the standby ends its redo apply process and becomes the new source of truth. Active Data Guard's read-only workload is replaced by full read/write capability once the failover completes.

Exam trap

1Z0-997-26 often tests the confusion between failover and switchover, and between Data Guard role transition and storage-level recovery—candidates may incorrectly expect flashback or storage reprovisioning to be part of the failover itself.

How to eliminate wrong answers

Option B is wrong because Data Guard failover does not automatically perform a flashback to sync with Object Storage backups; flashback is a manual or scripted reinstate step used later to convert the old primary into a standby. Option C is wrong because the standby does not remain read-only after failover—it must open read/write to serve the application. Option D is wrong because the database does not become inaccessible pending storage cell reprovisioning; Exadata storage cells are already part of the standby infrastructure and do not need to be reprovisioned for a Data Guard role transition.

Full explanation →

Multi-Selecthard

You are designing an OKE-based cloud-native microservices architecture and want to ensure high availability and robust security isolation. Which THREE architectural best practices should you implement?

Select 3 answers

A.Enable private Kubernetes API server endpoint access so the control plane is not exposed publicly.

B.Deploy worker nodes in private subnets with no direct public IP addresses.

C.Distribute OKE worker node pools across multiple Fault Domains or Availability Domains within the region.

D.Disable all Kubernetes RBAC authorization to allow unrestricted developer deployments.

E.Run all Kubernetes system pods and application workloads in the 'default' namespace as root user.

AnswersA, B, C

A private Kubernetes API endpoint keeps the control plane off the public internet, so only hosts with VCN access can reach it. This directly enforces the security isolation the architecture demands, removing an externally reachable attack surface.

Why this answer

Option A is correct because enabling a private Kubernetes API server endpoint in OKE ensures the control plane is only reachable through the VCN (via private IPs, VPN, FastConnect, or bastion), removing public internet exposure and reducing the attack surface for the cluster's management plane. Option B is correct because placing worker nodes in private subnets with no public IPs prevents direct inbound internet access to nodes, forcing traffic through controlled ingress (load balancers, NAT gateway for egress), which enforces network isolation and least-privilege connectivity. Option C is correct because spreading worker node pools across multiple Fault Domains or Availability Domains within the region provides fault tolerance against AD/FD-level failures, so the loss of one domain does not take down all worker capacity and preserves high availability.

Option D is incorrect because disabling Kubernetes RBAC removes authorization controls, granting unrestricted access and violating the security isolation requirement rather than improving it. Option E is incorrect because running all system pods and workloads in the default namespace as root eliminates namespace-based isolation and least-privilege execution, which are core security best practices for multi-tenant or microservices architectures.

Exam trap

1Z0-997-26 often tests whether candidates recognize that security best practices include private endpoints and RBAC, not disabling RBAC or using the default namespace as root, so the trap is selecting convenience-oriented options that weaken security.

Full explanation →

Multi-Selecteasy

Which TWO OCI networking features help achieve high availability for applications accessing external services or on-premises datacenters? (Choose two.)

Select 2 answers

A.Disabling Dynamic Routing Gateway route propagation.

B.Redundant FastConnect virtual circuits terminating on separate DRG ports or diverse provider locations.

C.Redundant IPSec VPN tunnels configured on the Dynamic Routing Gateway.

D.Single public Internet Gateway attached without backup routes.

E.Using local peering gateways for on-premises connections.

AnswersB, C

Two FastConnect virtual circuits terminating on separate DRG ports or diverse provider locations remove the single point of failure at the physical and provider layers. If one circuit or location fails, traffic fails over to the other, sustaining on-premises connectivity.

Why this answer

Option B is correct because redundant FastConnect virtual circuits that terminate on separate DRG ports or diverse provider locations eliminate single points of failure in the private dedicated connectivity between OCI and on-premises datacenters, allowing traffic to fail over and maintain high availability. Option C is correct because configuring redundant IPSec VPN tunnels on the Dynamic Routing Gateway provides multiple encrypted paths over the internet; if one tunnel or its underlying network path fails, BGP or static routing can shift traffic to the surviving tunnel, preserving connectivity to on-premises or external services. Option A is incorrect because disabling DRG route propagation removes learned routes and would break reachability rather than improve availability.

Option D is incorrect because a single Internet Gateway with no backup routes is itself a single point of failure and does not provide redundancy. Option E is incorrect because local peering gateways connect VCNs within the same region and are not used for on-premises connections, which require FastConnect, IPSec VPN, or a DRG.

Exam trap

The trap is selecting options that sound like they improve networking but actually reduce availability (e.g., disabling route propagation) or are irrelevant (local peering). Candidates may also overlook that high availability requires redundancy in paths.

Full explanation →

Multi-Selecthard

You are tasked with migrating a large enterprise database to OCI Exadata Database Service. To ensure minimal downtime and high reliability during cutover, which TWO Oracle migration tools or features are specifically designed for this purpose? (Choose two.)

Select 2 answers

A.Windows Robocopy utility

B.OCI File Storage CLI upload utility

C.Oracle Zero Downtime Migration (ZDM)

D.OCI Streaming Service Kafka producer APIs

E.Oracle Data Guard

AnswersC, E

Oracle Zero Downtime Migration automates the migration of on-premises or cloud databases to OCI Exadata Database Service, using Data Guard-based physical migration with automated cutover and rollback. This directly satisfies the stem's requirement for minimal downtime and high reliability during cutover.

Why this answer

Oracle Zero Downtime Migration (ZDM) (C) is purpose-built for migrating Oracle databases to OCI with near-zero downtime, using Oracle Data Guard or logical/physical methods and automated orchestration to keep the source online until cutover. Oracle Data Guard (E) is the core Oracle high-availability and disaster-recovery feature that maintains a synchronized standby database, enabling a fast switchover with minimal downtime during the cutover to Exadata Database Service. The other options do not fit: Robocopy (A) is a Windows file-copy utility with no database awareness, the OCI File Storage CLI (B) only uploads files to a file system, and OCI Streaming Kafka APIs (D) are for event-streaming ingestion, none of which provide Oracle database migration or cutover reliability.

Exam trap

1Z0-997-26 often tests the distinction between generic file-transfer tools and Oracle-native migration tools — candidates may pick Robocopy or File Storage CLI thinking 'copy the files' is sufficient, but database migration requires transaction-aware replication and cutover orchestration that only ZDM and Data Guard provide.

Full explanation →

Multi-Selectmedium

Which THREE capabilities are provided by OCI Vault for cryptographic key management? (Choose three.)

Select 3 answers

A.Direct routing of BGP peering sessions for on-premises routers.

B.Automated or manual key rotation policies.

C.Unlimited free public storage of plaintext database files.

D.Creation and management of customer-managed master encryption keys (CMK).

E.Hardware Security Module (HSM) backing for cryptographic keys (FIPS 140-2 Level 3).

AnswersB, D, E

OCI Vault supports both automated rotation schedules and manual rotation, letting you define rotation intervals per key version. This satisfies the key lifecycle management requirement, ensuring cryptographic keys are periodically replaced without application changes, while retaining older versions for decrypting existing data.

Why this answer

Option B is correct because OCI Vault lets you define key rotation policies that rotate master encryption keys either automatically on a schedule or manually on demand. Option D is correct because OCI Vault is the service used to create and manage customer-managed master encryption keys (CMKs) in key vaults, which can then be used to encrypt data across OCI services. Option E is correct because OCI Vault keys are protected by Hardware Security Modules validated to FIPS 140-2 Level 3, providing strong hardware-backed key protection.

Option A is not a Vault capability; BGP peering for on-premises routers is handled by OCI networking services such as FastConnect and dynamic routing gateways. Option C is not provided by Vault, since Vault manages encryption keys and secrets, not free unlimited public storage of plaintext database files.

Exam trap

1Z0-997-26 often tests the boundary of OCI Vault's responsibilities — candidates may confuse Vault with networking (BGP) or storage (plaintext files), but Vault is strictly for key and secret management, and the exam expects you to recognize that routing and file storage are outside its scope.

Full explanation →

MCQmedium

An auditor requests a complete historical record of all console sign-ins, IAM policy modifications, and compartment deletions across your OCI tenancy for the past 365 days. Which OCI service provides this data natively?

A.OCI Events Service

B.OCI Audit Service

C.OCI Cloud Guard Activity Tracking

D.OCI Logging Analytics

AnswerB

OCI Audit Service automatically records all console sign-ins, API calls, IAM policy changes and compartment deletions, retaining events for 365 days and exposing them via console, API and CLI. This satisfies the auditor's demand for a complete native historical record.

Why this answer

OCI Audit Service automatically records all control plane API activities, including console sign-ins, IAM policy modifications, and compartment deletions, and retains these events for 365 days natively. This is the authoritative source for historical audit records across the tenancy, and it can be queried via the Console, API, or CLI.

Exam trap

1Z0-997-26 often tests the confusion between OCI Audit Service (historical control plane audit) and OCI Events Service (real-time event routing), expecting candidates to know Audit is the native 365-day audit record.

How to eliminate wrong answers

Option A is wrong because OCI Events Service is a near-real-time event routing service that reacts to state changes; it does not store historical audit records for 365 days. Option C is wrong because OCI Cloud Guard is a security posture management service that detects misconfigurations and threats; it does not provide a complete historical audit trail of all API activities. Option D is wrong because OCI Logging Analytics is a log analysis platform that can ingest and analyze logs, but it does not natively capture all control plane API activities for 365 days without additional configuration and ingestion.

Full explanation →

Multi-Selecthard

Which THREE operational tasks should be included in a comprehensive disaster recovery runbook when utilizing OCI Full Stack Disaster Recovery for an enterprise application? (Choose three.)

Select 3 answers

A.Executing pre-checks in the target DR region to validate resource readiness and configurations

B.Manually deleting all IAM policies in the primary region during normal operations

C.Format-all commands on primary database storage volumes prior to initiating DR

D.Verifying database role transition and redo application status on the standby database

E.Orchestrating traffic rerouting via DNS or Load Balancers to point clients to the DR region

AnswersA, D, E

Pre-checks validate that target-region compute, networking and dependencies are provisioned and correctly configured before failover begins, catching gaps that would otherwise abort the switchover. This satisfies the runbook requirement by making readiness verification an explicit, repeatable step ahead of the DR plan execution.

Why this answer

Option A is correct because OCI Full Stack Disaster Recovery (FSDR) runbooks should begin with pre-checks in the target DR region to confirm that compute, networking, storage, and configuration prerequisites are met before any switchover or failover is attempted. Option D is correct because for database-inclusive DR plans, the runbook must verify that the standby database has transitioned to the primary role and that redo/apply lag is resolved so no committed transactions are lost. Option E is correct because a complete DR runbook includes the client-facing cutover step, rerouting traffic through DNS (e.g., OCI DNS steering policies) or Load Balancer changes so users reach the DR region after the backend is promoted.

Option B is wrong because deleting IAM policies in the primary region during normal operations would break authentication and authorization and is not a DR task. Option C is wrong because formatting primary database storage volumes would destroy production data and is never part of a disaster recovery runbook.

Exam trap

The trap is including destructive or irrelevant tasks in the DR runbook, such as deleting IAM policies or formatting storage. Candidates may think these are part of cleanup but they are not appropriate for DR.

Full explanation →

MCQeasy

An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?

A.OCI Site-to-Site VPN

B.OCI FastConnect

C.OCI Internet Gateway

D.Oracle Database Gateway

AnswerB

FastConnect provides a dedicated private peering or cross-connect into OCI, carrying traffic outside the public internet. This satisfies the bypass-internet and predictable-bandwidth constraints, unlike IPSec VPN, which traverses the internet and offers variable latency and throughput.

Why this answer

OCI FastConnect provides a dedicated, private physical connection between an on-premises data center and OCI, bypassing the public internet entirely. It offers high bandwidth (1 Gbps to 100 Gbps per connection), predictable low latency, and is the recommended service when the requirement is a private, high-performance link rather than an encrypted tunnel over the internet.

Exam trap

The trap is confusing 'private' with 'encrypted' — candidates may pick Site-to-Site VPN thinking it is more secure, but the question specifically requires bypassing the public internet and high predictable bandwidth, which only FastConnect provides.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN uses IPsec tunnels over the public internet, which does not bypass the internet and offers less predictable performance and lower bandwidth than FastConnect. Option C is wrong because an Internet Gateway provides public internet access to resources in a VCN and is the opposite of a private dedicated connection. Option D is wrong because Oracle Database Gateway is a software component for accessing non-Oracle databases from Oracle databases, not a network connectivity service.

Full explanation →

Multi-Selecthard

An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)

Select 3 answers

A.MACsec encryption on FastConnect dedicated circuits

B.OCI Site-to-Site IPSec VPN tunnels

C.Application-level encryption such as TLS 1.3 or HTTPS

D.OCI Internet Gateway packet inspection

E.OCI Local Peering Gateways with default encryption

AnswersA, B, C

MACsec secures FastConnect dedicated circuits at Layer 2, encrypting all traffic traversing the physical cross-connect before it reaches OCI's edge. This satisfies the stem's requirement for encrypted hybrid connectivity without relying on IPsec overlays, and it operates independently of the on-premises routing topology, protecting data in transit directly on the dedicated link.

Why this answer

Option A is correct because MACsec (IEEE 802.1AE) can be enabled on OCI FastConnect dedicated circuits, providing Layer 2 point-to-point encryption of traffic between the on-premises edge and the OCI edge without requiring IPsec. Option B is correct because OCI Site-to-Site IPSec VPN uses IKE/IPsec to encrypt traffic over the public internet (or over FastConnect private virtual circuits), securing data in transit between the on-premises CPE and the OCI VPN headend. Option C is correct because application-level encryption such as TLS 1.3 or HTTPS encrypts the payload end-to-end at Layer 7, protecting data in transit regardless of the underlying transport path.

Option D is not correct because an Internet Gateway simply provides public connectivity and does not perform packet inspection or encryption; security inspection would require a firewall or NGFW, not the gateway itself. Option E is not correct because Local Peering Gateways connect VCNs within the same region and do not provide encryption by default, nor do they secure on-premises-to-OCI transit.

Exam trap

1Z0-997-26 often tests the misconception that OCI gateways (Internet, Local Peering, Service) provide built-in encryption — they do not; encryption must come from MACsec, IPSec, or application-layer TLS.

Full explanation →

MCQmedium

You are designing a defense-in-depth network architecture for a multi-tier application on OCI. Database servers must reside in a private subnet and accept traffic ONLY from application servers running in a separate private subnet within the same VCN. No external traffic should reach the database. How should you configure security controls?

A.Use OCI Cloud Guard to block any unauthorized IP connection attempts to the database.

B.Attach a public IP to the database servers and use a public load balancer to filter database ports.

C.Configure a Network Security Group (NSG) for the database tier with an ingress rule allowing traffic solely from the application tier's NSG.

D.Deploy a DRG with a firewall ruleset between the app subnet and DB subnet.

AnswerC

NSGs apply stateful rules to specific VNICs, so referencing the application tier's NSG as the source restricts database ingress to those instances alone, regardless of subnet CIDR overlap. This satisfies the stem's requirement that only application servers reach the database, while security lists alone cannot filter by NSG membership.

Why this answer

NSGs in OCI allow ingress rules to reference another NSG as the source, so the database tier's NSG can permit traffic only from the application tier's NSG. This provides VNIC-level micro-segmentation that is independent of subnet CIDRs and ensures no external traffic can reach the database even if routing changes. This is the canonical OCI pattern for tiered application isolation.

Exam trap

The trap is that candidates pick DRG or Cloud Guard because they sound like security controls — but DRG is for external connectivity and Cloud Guard is detective, not preventive; only NSG-to-NSG referencing provides the required inline, private-only enforcement.

How to eliminate wrong answers

Option A is wrong because Cloud Guard is a detection and response service that identifies misconfigurations and threats — it does not enforce inline traffic blocking at the packet level. Option B is wrong because attaching a public IP to database servers directly exposes them to the internet, which is the opposite of the requirement, and a public load balancer does not provide the private-only isolation needed. Option D is wrong because a DRG (Dynamic Routing Gateway) is used for connectivity between a VCN and external networks (on-premises, other VCNs), not for intra-VCN traffic filtering between subnets.

Full explanation →

MCQhard

Your organization mandates that any newly created compartment must automatically enforce rigid security baselines (such as blocking public buckets and disallowing open security list rules). Which OCI feature should you configure to enforce these guardrails at creation time?

A.OCI Security Zones

B.IAM Policy Condition statements with 'request.time'

C.OCI Audit Log Service with Event-Driven Automation

D.OCI Tag Defaults with validation rules

AnswerA

Security Zones apply a curated, immutable policy set at compartment level, blocking public buckets and open security list rules the moment resources are created. This meets the mandate for automatic guardrails at creation time, rather than detective controls that only flag drift afterwards.

Why this answer

OCI Security Zones are a feature of Cloud Guard that enforce a set of security policies on compartments, preventing actions that violate the policies. When you create a security zone, you specify a security zone policy that includes restrictions such as blocking public buckets and disallowing open security list rules. Any attempt to create or modify resources in the compartment that violates the policy is denied.

This enforces guardrails at creation time.

Exam trap

1Z0-997-26 often tests the difference between preventive (Security Zones) and detective (Cloud Guard, Audit) controls; candidates may choose Audit Logs with automation, but that is reactive, not preventive at creation time.

How to eliminate wrong answers

Option B is wrong because IAM policy conditions with 'request.time' are used for time-based access control, not for enforcing security baselines on resource configurations. Option C is wrong because OCI Audit Log Service with Event-Driven Automation can detect and respond to events after they occur, but it does not prevent the creation of non-compliant resources. Option D is wrong because OCI Tag Defaults with validation rules only enforce tagging, not security configurations like public bucket access or security list rules.

Full explanation →

100

MCQeasy

Which OCI database service provides fully managed Oracle Database instances running on dedicated virtual machines with root access and granular control over operating system parameters?

A.Oracle Exadata Database Service on Dedicated Infrastructure

B.OCI NoSQL Database service

C.Oracle Autonomous Database Serverless

D.Oracle Base Database service

AnswerD

Oracle Base Database Service provisions dedicated virtual machines, granting root access and control over OS parameters — exactly the granular control the stem demands. Unlike Autonomous Database, which locks down the operating system, this service exposes the underlying host, satisfying the requirement for customisation at the OS level.

Why this answer

Oracle Base Database service (formerly Bare Metal and VM DB systems) provisions fully managed Oracle Database instances on dedicated VMs or bare metal where you get SSH root access and can tune OS kernel parameters, huge pages, and network settings. It is the OCI offering that sits between fully autonomous (no OS access) and self-managed (you run everything). This matches the requirement for root access and granular OS control.

Exam trap

1Z0-997-26 often tests whether candidates conflate 'fully managed' with 'no OS access' — the trap is picking Autonomous Database or Exadata when the question explicitly requires root access and OS parameter control.

How to eliminate wrong answers

Option A is wrong because Exadata Database Service on Dedicated Infrastructure is a highly engineered, appliance-based platform where Oracle manages the Exadata infrastructure and OS — customers do not get root access to the Exadata nodes. Option B is wrong because OCI NoSQL Database is a key-value/document store, not an Oracle Database instance. Option C is wrong because Autonomous Database Serverless is fully managed with no OS access at all — you cannot SSH or tune kernel parameters.

Full explanation →

101

MCQhard

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

A.Worker nodes utilizing Kata Containers runtime for hardware-level isolation

B.Standard OKE worker nodes with Kubernetes LimitRanges

C.Standard worker nodes with Network Security Groups (NSGs) applied per pod

D.Worker nodes running Docker Engine with privileged containers enabled

AnswerA

Kata Containers runs each pod inside a lightweight virtual machine, giving hardware-enforced kernel separation rather than the shared kernel of runc. This directly satisfies the stem's requirement for kernel-level isolation between tenants, containing any container breakout to its own guest kernel and preventing cross-tenant impact on the OKE worker nodes.

Why this answer

Kata Containers provide hardware-level isolation by running each container inside a lightweight virtual machine with its own kernel, so a container breakout affects only that VM and cannot compromise other tenants. This is the correct choice when strict kernel-level isolation is required on OKE.

Exam trap

1Z0-997-26 often tests whether candidates confuse network isolation (NSGs) or resource quotas (LimitRanges) with kernel-level isolation, so the trap is picking a network or quota control when the question explicitly demands protection against container breakout.

How to eliminate wrong answers

Option B is wrong because LimitRanges only enforce CPU and memory quotas per namespace or pod; they do not provide kernel-level isolation and do nothing to prevent container breakout. Option C is wrong because Network Security Groups applied per pod control network traffic, not kernel isolation, so a breakout could still affect other tenants on the same node. Option D is wrong because running Docker Engine with privileged containers actually weakens isolation by granting containers elevated host access, which is the opposite of the requirement.

Full explanation →

102

MCQhard

An administrator needs to configure DNS resolution between an on-premises datacenter and OCI. On-premises servers must resolve hostnames of compute instances in an OCI VCN. Which OCI service component must be utilized to achieve this?

A.OCI Internet Gateway DNS proxy

B.OCI Email Delivery DNS records

C.OCI Private DNS Resolver with a Listener and forwarding rules

D.OCI Load Balancer DNS plugin

AnswerC

A private DNS resolver listener accepts queries from on-premises systems over a FastConnect or VPN connection, then applies forwarding rules to direct those queries to the VCN's private zones. This satisfies the requirement that on-premises servers resolve OCI compute instance hostnames, which public DNS cannot provide.

Why this answer

OCI Private DNS Resolver provides a Listener endpoint in the VCN that on-premises DNS servers can forward queries to, and forwarding rules direct specific domains to on-premises resolvers. This enables bidirectional DNS resolution between on-premises and OCI VCN hostnames. It is the only OCI-native component designed for hybrid DNS.

Exam trap

1Z0-997-26 often tests the misconception that an Internet Gateway or Load Balancer can handle DNS forwarding, when only the Private DNS Resolver provides hybrid DNS resolution.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is a routing construct and has no DNS proxy capability. Option B is wrong because Email Delivery is an SMTP service for outbound email, unrelated to DNS resolution. Option D is wrong because a Load Balancer does not provide DNS forwarding or resolver functionality; its DNS name is just an endpoint record.

Full explanation →

103

MCQmedium

An administrator needs to track who deleted a critical database instance in OCI last week. Which service provides the exact API event history needed for this forensic investigation?

A.OCI Cloud Guard Responder Logs

B.OCI Audit Service

C.OCI Database Performance Hub

D.OCI Monitoring Service

AnswerB

OCI Audit Service records every API call against your tenancy, capturing the principal, timestamp, source IP and request details. It retains this event history for 90 days by default, covering last week's deletion. Filtering on the DeleteDbSystem action identifies exactly who removed the database instance, satisfying the forensic requirement.

Why this answer

OCI Audit Service automatically records all API calls made against OCI resources, including who made the call, when, from which source IP, and the request/response details. Deleting a database instance is an API operation (e.g., TerminateDbSystem), so the exact event history — actor, timestamp, and resource — is captured in Audit logs and can be queried in the Console or via the Audit API/CLI. This makes it the authoritative source for forensic investigations of resource changes.

Exam trap

1Z0-997-26 often tests the distinction between Audit (who did what API call) and Monitoring/Cloud Guard (metrics and threat detection), so candidates who pick Monitoring or Cloud Guard for 'who deleted X' lose the point.

How to eliminate wrong answers

Option A is wrong because Cloud Guard Responder Logs are generated by Cloud Guard's threat-detection recipes and responder actions, not a complete record of every API call — they only surface problems and remediations Cloud Guard itself detects. Option C is wrong because Database Performance Hub provides performance metrics (AWR-style reports, SQL monitoring) for databases, not an audit trail of control-plane API events. Option D is wrong because OCI Monitoring Service collects metric data points (CPU, memory, throughput) for alarms and dashboards; it does not log API calls or the identity of the caller.

Full explanation →

104

MCQeasy

An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?

A.OS Management Hub

B.OCI Service Connector Hub

C.OCI Logging Agent

D.OCI Streaming Service

AnswerC

The OCI Logging Agent runs on Compute instances and ships custom application log files to OCI Logging. It satisfies the requirement to collect logs from custom applications, since platform services cannot read application log files directly.

Why this answer

The OCI Logging Agent is a lightweight agent installed on Compute instances that collects custom application logs (and system logs) from the instance and ships them to the OCI Logging service via the Unified Monitoring Agent framework. It is the designated mechanism for ingesting instance-originated custom logs into OCI Logging.

Exam trap

The trap is confusing Service Connector Hub (service-to-service data movement) with the Logging Agent (instance-to-service log collection); 1Z0-997-26 frequently tests this boundary because both involve 'moving logs' but operate at different layers.

How to eliminate wrong answers

Option A is wrong because OS Management Hub is for patching, package management, and OS lifecycle operations on managed instances, not log ingestion. Option B is wrong because Service Connector Hub moves data between OCI services (e.g., Logging to Object Storage or Streaming); it does not collect logs from inside a Compute instance. Option D is wrong because OCI Streaming is a Kafka-compatible message bus for real-time data streams, not an agent-based log collector for Compute instances.

Full explanation →

105

MCQhard

You are migrating a 50 TB Oracle Database from an on-premises Sun Solaris SPARC server to OCI Exadata Database Service on X9M hardware (Linux x86-64 architecture). Because the source and target platforms have different endianness and operating system architectures, standard RMAN backup restoration is not possible. Which migration strategy should you implement?

A.Perform a cold OS-level tar/gzip copy of the Oracle home and data directories from Solaris to Linux.

B.Use OCI Zero Downtime Migration (ZDM) physical offline migration mode without endian conversion parameters.

C.Take an RMAN incremental backup on Solaris SPARC, copy the backup pieces to OCI Object Storage, and restore them directly onto the Exadata target.

D.Use Transportable Tablespaces with RMAN `CONVERT DATAFILE` or Oracle Data Pump to transfer and convert data between different endian architectures.

AnswerD

Transportable Tablespaces with RMAN CONVERT DATAFILE or Data Pump performs byte-order conversion between big-endian SPARC and little-endian x86-64, which plain RMAN restore cannot do. This directly satisfies the stem's endianness and cross-platform constraint for the 50 TB migration.

Why this answer

Transportable Tablespaces (TTS) with RMAN CONVERT DATAFILE or Data Pump is the standard Oracle-supported method for cross-platform, cross-endian migration because it performs the required byte-order conversion of datafiles during transport. It moves only the tablespace data plus metadata rather than the entire database, and it is explicitly designed for heterogeneous source/target platforms such as Solaris SPARC (big-endian) to Linux x86-64 (little-endian).

Exam trap

The trap here is assuming any RMAN backup is portable — candidates pick the incremental backup/restore option because RMAN is Oracle's flagship backup tool, forgetting that RMAN restores are platform- and endianness-bound unless an explicit CONVERT step is used.

How to eliminate wrong answers

Option A is wrong because a cold OS-level tar/gzip copy of Oracle home and datafiles cannot work across different operating systems and endianness — the binaries are platform-specific and the datafile byte order would be unreadable on Linux x86-64. Option B is wrong because ZDM physical offline migration still relies on RMAN backup/restore mechanics and requires endian conversion to be handled; running it without conversion parameters on a cross-endian pair will fail. Option C is wrong because RMAN backup pieces taken on Solaris SPARC cannot be restored directly onto a Linux x86-64 Exadata target — RMAN restore requires matching platform/endianness unless a CONVERT step is performed.

Full explanation →

106

MCQhard

An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?

A.Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.

B.Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.

C.Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.

D.Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.

AnswerD

Defined tags drive cost attribution to business units, Cost Analysis provides historical trends, Object Storage exports enable long-term retention, and Budgets with alert rules deliver anomaly detection. Together these satisfy both dynamic tagging-based attribution and trend analysis requirements.

Why this answer

OCI Cost Analysis supports filtering and grouping by defined tags, enabling dynamic attribution of spend to business units based on resource metadata. Exporting Cost Reports to Object Storage provides durable historical data for trend analysis, and Budgets with alert rules deliver anomaly detection and threshold-based notifications. This combination directly satisfies the requirements for tag-based attribution, historical trends, and anomaly detection.

Exam trap

1Z0-997-26 often tests whether candidates confuse performance monitoring tools (APM, Monitoring) with cost management tools (Cost Analysis, Budgets), and whether they recognize that tag-based attribution requires defined tags plus Cost Analysis grouping.

How to eliminate wrong answers

Option A is wrong because parsing invoice PDFs with Logging Analytics is a brittle, indirect method that lacks real-time tag-based attribution and does not provide native anomaly detection or budget alerts. Option B is wrong because Tag Defaults and Monitoring alarms on the Billing namespace do not provide historical trend analysis or robust cost attribution by business unit; Monitoring alarms are threshold-based, not anomaly-detection oriented for spend. Option C is wrong because APM Java agents measure application performance (JVM memory, traces), not cloud spend, and cannot attribute costs to business units.

Full explanation →

107

MCQeasy

Which OCI tool should a cloud architect recommend for automating the lifecycle management, patching, and backing up of a fleet of Oracle Base Database systems across multiple compartments?

A.OCI Compute Instance Scheduler

B.Oracle Cloud Infrastructure GoldenGate deployment console

C.OCI Identity and Access Management (IAM) policies

D.OCI Database Management service

AnswerD

OCI Database Management provides fleet-level lifecycle, patching and backup automation across compartments for Base Database systems. It is the service scoped to that administrative task, unlike infrastructure or monitoring tools that do not orchestrate patching.

Why this answer

OCI Database Management service is purpose-built for fleet-level lifecycle operations on Base Database and Exadata systems: it provides patching, backup management, performance monitoring, and compliance reporting across compartments from a single console. It integrates with OCI IAM for compartment-scoped access and supports both autonomous and non-autonomous databases. This is the only option that directly addresses patching and backup automation for a fleet of Base Database systems.

Exam trap

1Z0-997-26 often tests whether candidates confuse replication tools (GoldenGate) or scheduling tools (Instance Scheduler) with the dedicated database fleet management service — the trap is picking a tool that does one adjacent thing but not lifecycle management.

How to eliminate wrong answers

Option A is wrong because Compute Instance Scheduler only starts/stops compute instances on a schedule — it has no database patching or backup capability. Option B is wrong because GoldenGate is a data replication and integration tool, not a lifecycle/patching/backup manager. Option C is wrong because IAM policies control authorization and access, not operational lifecycle tasks like patching or backups.

Full explanation →

108

MCQeasy

You want to quickly visualize CPU utilization across 50 Compute instances on a single pane of glass without creating complex custom dashboards. Which OCI Monitoring feature allows you to view pre-packaged metrics grouped by resource?

A.OCI Logging Analytics Dashboards

B.OCI APM Dashboards

C.OCI Stack Monitoring

D.OCI Metrics Explorer

AnswerD

OCI Metrics Explorer provides pre-packaged, resource-grouped metric charts without custom dashboard construction, satisfying the single-pane-of-glass requirement across 50 Compute instances. It queries the Monitoring service directly, aggregating CPU utilisation by resource, so no manual widget configuration is needed for rapid visualisation.

Why this answer

OCI Metrics Explorer lets you query and visualize any OCI Monitoring metric (e.g., CpuUtilization) across many resources at once, with grouping by resource or dimension, giving a single-pane view without building a custom dashboard. It is the fastest way to chart 50 instances' CPU on one graph.

Exam trap

1Z0-997-26 often tests the distinction between Metrics Explorer (ad-hoc metric visualization) and Monitoring Dashboards (saved, curated views), so candidates pick the dashboard option when the question asks for quick, no-dashboard visualization.

How to eliminate wrong answers

Option A is wrong because Logging Analytics Dashboards visualize log-derived data, not native OCI Monitoring metrics like CPU utilization. Option B is wrong because APM Dashboards focus on application traces, spans, and RUM/synthetic data, not infrastructure CPU metrics. Option C is wrong because Stack Monitoring is for discovering and monitoring application stacks (e.g., WebLogic, Tomcat) and their components, not for ad-hoc cross-resource metric visualization.

Full explanation →

109

MCQeasy

Which OCI storage service provides massively scalable, highly durable regional object storage that is ideal for storing database backups and disaster recovery artifacts?

A.OCI Object Storage

B.OCI Block Volume

C.Local NVMe Scratch Disks

D.OCI Boot Volumes

AnswerA

Object Storage delivers regional, replicated object durability across Availability Domains, satisfying the backup and disaster recovery requirement. Unlike block or file storage, its flat namespace and REST API scale to exabyte volumes, making it the designated target for database backup artefacts and cross-region DR copies.

Why this answer

OCI Object Storage is a regional, internet-scale service designed for massive scalability and eleven-nines durability, making it the standard target for database backups, disaster recovery artifacts, and long-term retention. Its regional nature means data is redundantly stored across availability domains within a region, which is exactly what DR artifacts need.

Exam trap

The trap is confusing block and object storage: candidates pick Block Volume because backups feel like disk images, but the question's keywords 'massively scalable, highly durable, regional' point specifically to Object Storage.

How to eliminate wrong answers

Option B is wrong because Block Volume is block-level storage attached to a single compute instance within one availability domain; it is not a massively scalable regional object store and is not shared across ADs. Option C is wrong because local NVMe scratch disks are ephemeral, instance-local storage that is lost on instance termination and unsuitable for durable backups. Option D is wrong because Boot Volumes are block volumes that host the OS for a compute instance; they are instance-bound and not a regional object storage service.

Full explanation →

110

MCQmedium

You are migrating an Oracle Database to an Exadata Database Service on Dedicated Infrastructure. You need to ensure that database backups are stored securely with zero public internet exposure. What is the recommended networking architecture for backup transmission?

A.Deploy an internet gateway with IPSec VPN tunnels terminating at the backup bucket

B.Configure a Service Gateway in your VCN to access OCI Object Storage privately

C.Expose a NAT Gateway with strict IP whitelisting

D.Attach a secondary public IP address to the database VM guest nodes

AnswerB

A Service Gateway lets resources in the VCN reach OCI Object Storage over the Oracle network fabric, never traversing the public internet. Backup traffic therefore stays private while still landing in Object Storage, satisfying the zero-public-exposure constraint.

Why this answer

A Service Gateway in the VCN provides a private path from the VCN to OCI Object Storage (and other Oracle services) without traversing the internet or requiring a NAT or internet gateway. Traffic to Object Storage stays on the Oracle backbone network, so backups from Exadata Database Service on Dedicated Infrastructure are transmitted with zero public internet exposure, satisfying the security requirement.

Exam trap

The trap is confusing NAT Gateway with Service Gateway — candidates often think NAT provides private access, but NAT still uses the public internet, whereas only a Service Gateway keeps Oracle service traffic entirely on the Oracle network.

How to eliminate wrong answers

Option A is wrong because an internet gateway exposes the VCN to the public internet, and terminating IPSec tunnels at a backup bucket is not a supported architecture — Object Storage buckets are not VPN endpoints. Option C is wrong because a NAT Gateway still routes traffic through the public internet (with source NAT), so it does not meet the 'zero public internet exposure' requirement even with IP whitelisting. Option D is wrong because attaching a secondary public IP to database VM guest nodes directly exposes the database hosts to the internet, which is a severe security violation and unnecessary for backup traffic.

Full explanation →

111

MCQmedium

A financial services company runs its mission-critical application on OCI. The application uses a regional public subnet with a fleet of compute instances behind a flexible load balancer. The architect must ensure the application remains available even if an entire availability domain (AD) fails, without introducing cross-region latency for the primary traffic. What should the architect do to meet this requirement?

A.Place the compute instances in a private subnet across multiple availability domains and use a NAT gateway to provide inbound access from the internet to the load balancer.

B.Create a separate regional public subnet in each availability domain and peer them using a local VCN peering gateway so the load balancer can reach instances in all ADs.

C.Deploy the compute instances in a single availability domain and use a backup region with a standby load balancer that is activated only when the primary AD fails.

D.Deploy the compute instances in multiple availability domains within the region, attach them to the same regional public subnet, and configure the load balancer to distribute traffic across all instances.

AnswerD

A regional public subnet spans all availability domains in a region, so instances in different ADs can share the same subnet and be behind a single flexible load balancer. If one AD fails, the load balancer health checks route traffic to instances in the surviving ADs. This meets the requirement without cross-region latency because everything stays within the same region.

Why this answer

The correct design uses a regional public subnet that spans all availability domains in a region. Compute instances are placed in multiple ADs within that subnet, and a flexible load balancer distributes traffic across them. If one AD fails, health checks remove the failed instances from rotation, and the remaining ADs continue serving traffic.

This provides AD-level high availability without cross-region latency.

Exam trap

The trap here is assuming that a separate subnet per availability domain is required for multi-AD deployment, when a regional subnet already spans all ADs and simplifies the architecture.

Full explanation →

112

Multi-Selectmedium

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Select 2 answers

A.Automatically peering AWS VPC route tables directly from the DRG console.

B.Using route distributions to control which routes are imported into or exported from a DRG route table.

C.Importing static or dynamic routes from FastConnect and VPN attachments into DRG route tables.

D.Enabling Ophaned route garbage collection on Internet Gateways.

E.Converting OCI VCN subnets into Azure Subnets via DRG translation rules.

AnswersB, C

Route distributions define which routes a DRG route table imports from an attachment or exports to it, letting architects filter and scope reachability per attachment. This is a supported DRG routing concept, distinct from static route entries added directly to the table.

Why this answer

Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering.

Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Exam trap

1Z0-997-26 often tests whether candidates understand that DRG route distributions control import/export of routes between attachments, and candidates who confuse this with VCN route tables or security lists pick incorrect answers.

Full explanation →

113

MCQeasy

Your company requires automated daily backups of block volumes attached to critical production compute instances in OCI. Which OCI service feature should you configure?

A.Custom Oracle Autonomous Linux scripts cron-scheduled to push to Object Storage.

B.OCI File Storage service snapshot schedules.

C.OCI Block Volume Vaults with automated cross-region replication policies.

D.OCI Volume Backup Policies attached to the block volumes.

AnswerD

Volume backup policies bind a schedule directly to the block volume, so OCI automatically creates incremental backups at the defined frequency and retention. This satisfies the daily automated backup requirement without custom scripting or manual intervention.

Why this answer

OCI Block Volume Backup Policies are the native, automated mechanism for scheduling backups of block volumes. You create a backup policy (e.g., Bronze/Silver/Gold or a custom policy) defining backup frequency and retention, then attach it to the block volume or its compartment. OCI then automatically creates volume backups on the defined schedule, which can be restored to new volumes or used for cloning.

Exam trap

1Z0-997-26 often tests whether candidates confuse Block Volume Backup Policies (the scheduler) with Block Volume Vaults (the storage/replication destination) or with File Storage snapshots, so the trap is picking a related but incorrect service.

How to eliminate wrong answers

Option A is wrong because custom cron scripts on Autonomous Linux pushing to Object Storage is a manual, self-managed approach — it is not an OCI service feature, requires custom scripting and monitoring, and does not leverage OCI's native backup/restore tooling. Option B is wrong because OCI File Storage snapshot schedules apply to file systems (NFS), not block volumes; using them for block volume backup is a category error. Option C is wrong because OCI Block Volume Vaults with cross-region replication policies provide backup storage and replication, but the automated daily backup schedule itself is defined by a Backup Policy, not by the vault — the vault is the destination, not the scheduler.

Full explanation →

114

MCQeasy

An architect is designing a cloud-native application that must remain available if an entire OCI region becomes unavailable. The application uses OCI Object Storage for static assets and an Autonomous Database for transactional data. Which approach best meets the cross-region availability requirement?

A.Enable Object Storage replication to a bucket in a second region, and configure Autonomous Database cross-region disaster recovery with a standby in that region.

B.Enable Object Storage versioning and take daily Autonomous Database backups to a bucket in the same region.

C.Configure a load balancer across two availability domains in the primary region and enable health checks on the backend services.

D.Use OCI Block Volume backups replicated within the same availability domain and rely on the Autonomous Database's automatic backups.

AnswerA

Object Storage replication copies objects to a bucket in another region, and Autonomous Database supports cross-region disaster recovery with a standby that can be promoted. Together they provide data durability and availability across regions, directly addressing the requirement to survive a full region outage with minimal data loss.

Why this answer

Surviving a full region outage requires data and services to exist in another region. Object Storage replication maintains a copy of static assets in a second region, and Autonomous Database cross-region disaster recovery provides a promotable standby. Load balancing or versioning within one region cannot preserve availability when that region fails, so the cross-region replication approach is required.

Exam trap

The trap here is confusing high availability within a region, such as multi-AD load balancing or versioning, with cross-region disaster recovery that can survive the loss of an entire region.

Full explanation →

115

MCQeasy

What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?

A.To authenticate OCI console users via single sign-on.

B.To encrypt all payloads traversing the FastConnect physical fiber.

C.To assign public IP addresses to OCI compute instances.

D.To uniquely identify routing domains and enable dynamic exchange of network routes between OCI and on-premises routers.

AnswerD

BGP ASNs uniquely identify each routing domain, letting OCI's dynamic routing gateway and your on-premises routers peer and exchange reachable prefixes automatically. This satisfies FastConnect's requirement for dynamic route propagation over the private virtual circuit, rather than relying on static routes that cannot adapt to topology changes.

Why this answer

BGP ASNs are used to uniquely identify routing domains and enable the dynamic exchange of network routes between OCI and on-premises routers. When establishing FastConnect, each side is assigned an ASN, and BGP peering uses these ASNs to exchange reachability information, allowing automatic route propagation.

Exam trap

The trap is confusing ASNs with IP addresses or encryption; candidates must remember that ASNs are purely for routing protocol identification and dynamic route exchange.

How to eliminate wrong answers

Option A is wrong because ASNs are not used for user authentication; SSO is handled by IAM. Option B is wrong because ASNs do not encrypt traffic; encryption is provided by IPSec VPN or MACsec, not BGP. Option C is wrong because ASNs do not assign public IP addresses; IP addressing is separate from routing protocol identifiers.

Full explanation →

116

MCQmedium

You are designing a high-availability architecture for an Oracle Base Database system across two Availability Domains (ADs) within a single OCI region. Which multi-database HA pattern ensures automatic failover with minimal data loss?

A.Oracle Data Guard configured between primary and standby database instances across ADs

B.Periodic RMAN duplication scripts executed via cron jobs every hour

C.Active-Active Oracle RAC cluster spanning multiple Availability Domains over long-distance synchronous interconnects

D.Shared OCI Block Volumes mounted simultaneously by database nodes in different ADs

AnswerA

Data Guard ships redo from the primary to a standby in a second AD, applying changes continuously. This gives automatic failover with minimal data loss, satisfying the cross-AD HA requirement, whereas single-AD or non-replicating patterns cannot survive an AD outage.

Why this answer

Oracle Data Guard is Oracle's native disaster-recovery and HA solution that maintains a synchronized standby database in a different Availability Domain. With Data Guard in Maximum Availability or Maximum Performance mode using asynchronous or synchronous redo transport, failover can be automated via Fast-Start Failover (FSFO) with the Data Guard broker, achieving minimal data loss (zero with SYNC, near-zero with ASYNC) and automatic role transition. This is the standard multi-AD HA pattern for Oracle Base Database on OCI.

Exam trap

1Z0-997-26 often tests whether candidates confuse backup strategies (RMAN, snapshots) with HA/failover strategies (Data Guard, RAC), so the trap is selecting a backup-based option when the question explicitly asks for automatic failover with minimal data loss.

How to eliminate wrong answers

Option B is wrong because hourly RMAN duplication is a batch backup/restore approach with an RPO of up to one hour and no automatic failover — it is a backup strategy, not an HA pattern, and would require manual intervention to promote the copy. Option C is wrong because Oracle RAC across Availability Domains over long-distance synchronous interconnects is not supported — RAC requires low-latency (sub-millisecond) interconnect, and OCI ADs are physically separated by kilometers, making cross-AD RAC cache fusion impractical and unsupported for production. Option D is wrong because OCI Block Volumes are zonal resources that cannot be simultaneously mounted read-write by nodes in different ADs; multi-attach is limited to specific use cases within the same AD and requires a cluster-aware filesystem, so this is not a valid HA pattern.

Full explanation →

117

Multi-Selecteasy

Which TWO methods are valid for protecting OCI Compute instance boot volumes against data loss or corruption? (Choose two.)

Select 2 answers

A.Attaching the boot volume to an Internet Gateway.

B.Creating manual or scheduled boot volume backups.

C.Configuring cross-region boot volume replication.

D.Storing OS files in an OCI Streaming queue.

E.Using local NVMe scratch disks for OS persistence.

AnswersB, C

Scheduled or manual boot volume backups capture point-in-time copies stored independently of the instance, so corruption or accidental deletion of the original volume does not propagate to the backup. This directly satisfies the stem's requirement to protect boot volumes against data loss, since backups can restore the volume or create a new instance.

Why this answer

Option B is correct because OCI Block Volume service supports both manual and policy-driven scheduled backups of boot volumes, which create point-in-time copies stored in Object Storage that can be used to restore or clone the boot volume after data loss or corruption. Option C is correct because cross-region boot volume replication asynchronously copies the boot volume to a volume in another OCI region, providing protection against region-level failures and enabling recovery or disaster-recovery failover. Option A is wrong because an Internet Gateway is a VCN networking component for public connectivity, not a data-protection mechanism for boot volumes.

Option D is wrong because OCI Streaming is a Kafka-compatible messaging service for streaming data, not a storage or backup target for OS boot volumes. Option E is wrong because local NVMe scratch disks are ephemeral, non-persistent instance storage that is wiped on reboot or termination, so they cannot provide OS persistence or protection.

Exam trap

The trap is mixing networking or ephemeral storage options into a data-protection question, so candidates pick plausible-sounding but functionally unrelated services.

Full explanation →

118

MCQhard

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

A.Hardcode the credentials inside the function source code repository.

B.Store secrets in OCI Object Storage with public read access.

C.Encode the credentials in Base64 and store them in IAM policy descriptions.

D.Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.

AnswerD

OCI Vault stores secrets encrypted, and Functions retrieve them at runtime via the SDK using dynamic group authentication, so no credentials persist in environment variables. This satisfies the requirement to eliminate insecure credential exposure in function configuration.

Why this answer

OCI Vault is the managed secrets service designed to store and rotate sensitive values such as database credentials, and OCI Functions can retrieve them at runtime using the OCI SDK. Authentication to Vault is achieved through a dynamic group that matches the function's resource principal, so no long-lived credentials are embedded anywhere. This eliminates the insecure environment-variable pattern while providing auditability and centralized rotation.

Exam trap

1Z0-997-26 often tests whether candidates confuse encoding (Base64) with encryption, or assume Object Storage is an acceptable secret store — the trap is picking any option that 'hides' the credential rather than one that provides managed, auditable secret retrieval.

How to eliminate wrong answers

Option A is wrong because hardcoding credentials in source code exposes them to anyone with repository access and makes rotation extremely difficult — it is the exact anti-pattern the audit flagged. Option B is wrong because Object Storage with public read access makes secrets world-readable; even with IAM policies, Object Storage lacks the secret-specific lifecycle, rotation, and audit features of Vault. Option C is wrong because Base64 is encoding, not encryption — it is trivially reversible — and IAM policy descriptions are not a secret store; they are visible to anyone who can read policies.

Full explanation →

119

MCQeasy

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

A.SSL/TLS v1.3 with RSA key exchange

B.SSH tunneling with Blowfish cipher

C.PPTP with MPPE 128-bit encryption

D.IKEv2 with AES-256 encryption and SHA-2 hashing

AnswerD

OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, meeting the compliance requirement for robust encryption with a specific hashing algorithm. IKEv1 and weaker hashes such as SHA-1 fall short of the mandated standard.

Why this answer

OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, which meets robust compliance requirements for encrypted tunnel traffic. IKEv2 is the recommended key exchange protocol, and AES-256 with SHA-2 provides strong confidentiality and integrity for IPsec tunnels. This combination is the standard supported configuration for OCI VPN.

Exam trap

1Z0-997-26 often tests whether candidates confuse application-layer encryption protocols (SSL/TLS) with network-layer VPN protocols (IPsec/IKEv2), leading them to select TLS-based answers for site-to-site VPN questions.

How to eliminate wrong answers

Option A is wrong because SSL/TLS v1.3 with RSA key exchange is used for application-layer encryption such as HTTPS, not for site-to-site IPsec VPN tunnels. Option B is wrong because SSH tunneling with Blowfish is a deprecated and weak cipher suite not used for OCI Site-to-Site VPN. Option C is wrong because PPTP with MPPE 128-bit is an obsolete and insecure VPN protocol that OCI does not support for Site-to-Site VPN.

Full explanation →

120

MCQeasy

Your organization is designing a disaster recovery strategy as part of a workload migration project to OCI. The business requirement states that in the event of a regional outage in OCI region A, workloads must fail over to OCI region B with a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of less than 15 minutes. Which OCI networking feature should you deploy to interconnect the two regions for database replication?

A.OCI Local Peering Gateway (LPG)

B.OCI Dynamic Routing Gateway (DRG) with Remote Peering Connection (RPC)

C.OCI Service Gateway

D.OCI Internet Gateway with IPsec VPN tunnels over the public internet

AnswerB

A DRG with a Remote Peering Connection links two VCNs across regions over Oracle's private backbone, providing the low-latency, high-bandwidth path needed for synchronous database replication. This satisfies the zero-RPO and sub-15-minute RTO targets, which internet-based connectivity cannot reliably meet.

Why this answer

A DRG attached to VCNs in both regions, connected via a Remote Peering Connection (RPC), provides private, low-latency, high-bandwidth interconnect between OCI regions over Oracle's backbone. This is the standard OCI mechanism for cross-region database replication (e.g., Data Guard, GoldenGate) needed to achieve RPO=0 and RTO<15 minutes. RPC traffic stays on Oracle's private network, avoiding public internet variability that would jeopardize the aggressive RTO.

Exam trap

1Z0-997-26 often tests the assumption that any private connectivity option works for cross-region DR — candidates pick LPG (same-region only) or IPsec VPN (public internet) without recognizing that only DRG+RPC provides private, backbone-grade cross-region interconnect.

How to eliminate wrong answers

Option A is wrong because an LPG only connects two VCNs within the same region — it cannot span regions and therefore cannot support cross-region DR replication. Option C is wrong because a Service Gateway provides private access to OCI public services (Object Storage, etc.) from within a VCN; it does not interconnect VCNs or regions. Option D is wrong because an Internet Gateway with IPsec VPN over the public internet introduces variable latency, jitter, and bandwidth limits that cannot reliably meet RPO=0/RTO<15min, and it exposes replication traffic to the public internet rather than Oracle's private backbone.

Full explanation →

121

Multi-Selectmedium

When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?

Select 3 answers

A.Evaluation window (time interval and period)

B.Metric namespace and metric name

C.OCI Vault Master Encryption Key OCID

D.Virtual Cloud Network (VCN) CIDR block

E.Threshold value and trigger operator (e.g., greater than)

AnswersA, B, E

Every alarm requires an evaluation window, defined by the interval and period over which the metric query runs, determining how frequently the threshold is assessed. Without it, OCI cannot decide when the metric stream breaches the configured trigger rule.

Why this answer

Option A is correct because an OCI Monitoring alarm requires an evaluation window, defined by the interval (for example, 1m, 5m, 1h) and the period over which the metric is aggregated, so OCI knows how often and over what span to evaluate the metric. Option B is correct because every alarm must reference the metric to monitor, which is identified by its metric namespace (such as oci_computeagent) and metric name (such as CpuUtilization). Option E is correct because an alarm must define the trigger condition, consisting of the threshold value and the operator (for example, greater than, less than, or equal to) that determines when the alarm fires.

Option C is not required because a Vault Master Encryption Key OCID is used for encrypting data at rest, not for defining alarm evaluation logic. Option D is not required because a VCN CIDR block is a networking construct unrelated to specifying which metric and threshold an alarm should evaluate.

Exam trap

1Z0-997-26 often tests the required parameters for alarms; candidates may incorrectly include encryption keys or network details, but the core three are metric, evaluation window, and threshold/operator.

Full explanation →

122

MCQhard

You are managing an Oracle Base Database Service instance configured with Data Guard in OCI. Due to a severe networking anomaly, the standby database falls significantly behind in applying redo. You decide to rebuild the standby database from an incremental backup taken on the primary. Which Recovery Manager (RMAN) command or process is used to synchronize the standby with the new incremental backup?

A.Execute a complete cold restore of all datafiles using FTP over port 21.

B.Reboot the OCI compute host using the OCI console 'Reset' button.

C.Apply an incremental backup from SCN on the primary database to the standby database using RMAN.

D.Run 'ALTER DATABASE CONVERT TO SNAPSHOT STANDBY' and drop all tablespaces.

AnswerC

RMAN incremental backup roll-forward synchronises a lagging standby by applying only the changed blocks from the primary's incremental backup, starting at the standby's current SCN. This avoids a full rebuild and restores Data Guard synchronisation efficiently.

Why this answer

To synchronize a standby database with a new incremental backup taken on the primary, you use RMAN to apply an incremental backup from a specific SCN on the primary to the standby. This process involves taking an incremental backup on the primary, transferring it to the standby, and then using RMAN to recover the standby using that incremental backup. This is a standard method to roll forward a standby database that has fallen behind, without performing a full restore.

Exam trap

1Z0-997-26 often tests Data Guard synchronization methods, and candidates may confuse incremental backup recovery with other operations like snapshot standby or full restore.

How to eliminate wrong answers

Option A is wrong because a complete cold restore using FTP is not a valid or efficient method for synchronizing a standby database; it would require downtime and is not how Data Guard operates. Option B is wrong because rebooting the OCI compute host does not address the redo gap and could cause further issues. Option D is wrong because converting to a snapshot standby and dropping tablespaces is not a synchronization method and would result in data loss.

The correct approach is to use RMAN to apply an incremental backup from SCN, which efficiently brings the standby up to date.

Full explanation →

123

MCQeasy

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

A.OCI Object Storage public bucket

B.OCI Audit log retention policy

C.OCI Resource Manager stack configuration output

D.OCI Vault (Secrets management)

AnswerD

OCI Vault's secrets management stores credentials encrypted with keys held in a hardware security module, and Functions can retrieve them at runtime through the Vault API or inject them as environment variables via configuration. This satisfies the requirement to keep connection strings and API keys out of plaintext function configuration.

Why this answer

OCI Vault's Secrets management feature is designed to store sensitive values like database connection strings and API keys, and OCI Functions can retrieve them securely at runtime via the OCI SDK or by referencing them as environment variables. This keeps secrets encrypted and access-controlled through IAM policies.

Exam trap

1Z0-997-26 often tests whether candidates confuse general storage or logging services with a dedicated secret store, so the trap is picking Object Storage or Resource Manager outputs when the requirement is secure, access-controlled secret storage.

How to eliminate wrong answers

Option A is wrong because an Object Storage public bucket exposes data to anyone with the URL, which is the opposite of secure storage for sensitive configuration. Option B is wrong because Audit log retention policy governs how long audit logs are kept, not where application secrets are stored. Option C is wrong because Resource Manager stack configuration outputs are meant for infrastructure-as-code outputs and are not a secure secret store; they may be visible in state files and logs.

Full explanation →

124

MCQhard

You are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?

A.Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.

B.Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.

C.Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.

D.Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.

AnswerC

Passwordless sudo scoped to the specific discovery commands satisfies the root-privilege constraint without granting full root or embedding credentials, while the dedicated account and OCI Migration SSH key pair resolve the SSH authentication failures securely.

Why this answer

The OCI Migration discovery agent needs SSH access to Linux VMs to inventory packages, services, and configurations. The secure best practice is to create a dedicated, least-privilege migration user, grant passwordless sudo only for the specific discovery commands (via a sudoers entry), and deploy the OCI Migration SSH key pair to that user. This avoids sharing root credentials, avoids plaintext passwords, and limits the blast radius if the key is compromised.

Exam trap

1Z0-997-26 often tests the temptation to choose the 'quick fix' of granting root or embedding plaintext passwords, when the correct answer is always a least-privilege dedicated account with scoped sudo and key-based SSH.

How to eliminate wrong answers

Option A is wrong because granting root access to the default 'opc' user across all servers violates least privilege and dramatically expands the attack surface — it is not a security-preserving solution. Option B is wrong because disabling password authentication globally and then embedding the root password in plain text on the appliance is both insecure and contradictory (plaintext secrets defeat the purpose of disabling passwords). Option D is wrong because SNMPv1 polling is agentless, unencrypted, and does not provide the deep inventory data the OCI Migration agent collects; it also requires opening firewall ports and is not the supported discovery mechanism for this scenario.

Full explanation →

125

MCQmedium

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

A.Local VCN Peering.

B.Dynamic Routing Gateway (DRG) with internet breakout enabled.

C.Internet Gateway with strict Security List rules.

D.OCI Bastion service.

AnswerA

Local VCN peering connects two VCNs within the same region over Oracle's private backbone, so development microservices reach the production database without any internet exposure. It satisfies the segregation constraint because each VCN retains its own route tables, security lists and CIDR blocks, keeping workloads logically distinct while permitting the required private east-west traffic.

Why this answer

Local VCN Peering connects two VCNs in the same region over Oracle's private backbone, allowing resources in the development VCN to reach the production database privately without internet exposure. It is the recommended construct for intra-region, cross-VCN private communication.

Exam trap

The trap is assuming any private connectivity option works, but the exam distinguishes Local VCN Peering (intra-region, private) from DRG (inter-region/on-prem) and Internet Gateway (public), so candidates pick DRG or IGW incorrectly.

How to eliminate wrong answers

Option B is wrong because a DRG with internet breakout is for connecting to on-premises or other regions and would route traffic via the internet, violating the no-internet-exposure requirement. Option C is wrong because an Internet Gateway inherently exposes traffic to the public internet, even with strict security lists, which the requirement forbids. Option D is wrong because OCI Bastion service provides managed SSH/RDP access to private subnets for administrators, not service-to-service database connectivity between VCNs.

Full explanation →

126

MCQmedium

You are planning the final cutover for a critical production database migrating from an on-premises Oracle Real Application Clusters (RAC) database to OCI Base Database Service using Oracle Data Guard for replication. To minimize application downtime during the cutover window, which sequence of steps must be executed?

A.Stop source application, shut down source database immediately, open standby database in read-write mode, and update DNS.

B.Delete the source database home, re-run ZDM pre-migration checks, and deploy a fresh Autonomous Database instance.

C.Take an offline Data Pump export on premises, ship the dump via FastConnect, import it into OCI, and keep the source running indefinitely.

D.Ensure zero data lag on the Data Guard standby, perform a switchover/failover to promote the OCI standby database to primary, and update application connection strings to point to the new OCI primary listener.

AnswerD

Zero data lag on the standby guarantees no committed transaction is lost before promotion, satisfying the minimal-downtime constraint. A Data Guard switchover cleanly reverses primary and standby roles with no data divergence, then repointing connection strings to the OCI primary listener completes cutover. Skipping the lag check risks data loss during failover.

Why this answer

The correct cutover sequence for a Data Guard-based migration is to first confirm the standby has zero (or near-zero) data lag, then promote the OCI standby to primary via switchover (preferred) or failover, and finally repoint the application connection strings to the new OCI primary listener. This minimizes downtime because the standby is already synchronized and only the connection endpoint needs to change.

Exam trap

1Z0-997-26 often tests the distinction between switchover (planned, zero data loss) and failover (unplanned, possible data loss), and candidates incorrectly pick options that skip lag verification or confuse Data Guard with Data Pump-based migration.

How to eliminate wrong answers

Option A is wrong because shutting down the source database immediately without confirming zero lag or performing a controlled role transition risks data loss and an inconsistent standby that cannot be opened read-write cleanly. Option B is wrong because deleting the source database home and deploying a fresh Autonomous Database is unrelated to a Data Guard cutover and would destroy the source before migration completes. Option C is wrong because an offline Data Pump export/import is a completely different migration method that causes extended downtime and does not leverage the existing Data Guard replication already in place.

Full explanation →

127

MCQeasy

An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?

A.OCI Data Transfer Service using physical Data Transfer Appliances.

B.OCI FastConnect with a dedicated 1 Gbps partner circuit.

C.OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.

D.Parallelized multi-part uploads using the OCI CLI over public internet connections.

AnswerA

Data Transfer Service ships physical appliances to your site, you load the 80 TB, and Oracle uploads it to Object Storage. This bypasses the 50 Mbps internet link entirely, satisfying the bandwidth constraint that would otherwise take months.

Why this answer

OCI Data Transfer Service using physical Data Transfer Appliances is designed for exactly this scenario: moving very large datasets (tens to hundreds of TB) when internet bandwidth is insufficient. You copy data to an encrypted appliance, ship it to Oracle, and Oracle uploads it to Object Storage, bypassing the 50 Mbps bottleneck entirely.

Exam trap

1Z0-997-26 often tests the threshold where physical transfer beats network transfer, so candidates who pick FastConnect or Storage Gateway underestimate how long 80 TB takes over a 50 Mbps link.

How to eliminate wrong answers

Option B is wrong because provisioning a 1 Gbps FastConnect circuit still requires time to install and may not be feasible for a one-time 80 TB transfer, and it does not address the physical migration requirement efficiently. Option C is wrong because OCI Storage Gateway compresses and streams data over the existing 50 Mbps line, which would still take months and defeats the purpose of an efficient physical migration. Option D is wrong because parallelized multipart uploads over the public internet are still constrained by the 50 Mbps uplink, so they cannot overcome the bandwidth limitation.

Full explanation →

128

MCQeasy

When designing high availability for stateless web servers in OCI, which combination of services provides automatic scaling and load distribution across multiple Availability Domains?

A.OCI Streaming and OCI Notifications service

B.OCI Database Backup Policies and Local Peering Gateways

C.OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer

D.OCI Vaults and OCI Key Management service

AnswerC

Instance Pools supply the identical stateless compute, Autoscaling Configurations add or remove instances against metrics, and a regional Load Balancer spreads traffic across multiple Availability Domains, satisfying the stem's automatic scaling and cross-AD distribution requirement.

Why this answer

The combination of OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer provides automatic scaling and load distribution across multiple Availability Domains for stateless web servers. Instance Pools allow you to manage a group of identical instances, Autoscaling Configurations automatically adjust the number of instances based on metrics, and a regional Load Balancer distributes traffic across those instances in multiple ADs, ensuring high availability.

Exam trap

1Z0-997-26 often tests high availability architectures, and candidates may choose services that are not related to scaling or load balancing, such as streaming or vaults.

How to eliminate wrong answers

Option A is wrong because OCI Streaming and OCI Notifications are messaging and notification services, not for scaling or load balancing web servers. Option B is wrong because OCI Database Backup Policies and Local Peering Gateways are for database backups and network connectivity, not for web server scaling. Option D is wrong because OCI Vaults and OCI Key Management are for managing secrets and encryption keys, not for scaling or load distribution.

The correct combination is Instance Pools, Autoscaling, and a regional Load Balancer.

Full explanation →

129

MCQhard

Your organization has a strict Recovery Point Objective (RPO) of 5 minutes and Recovery Time Objective (RTO) of 15 minutes for a multi-tier application. The database tier uses Oracle Data Guard. During a test drill, you notice that redo transport lag spikes to 8 minutes. What is the most likely architectural bottleneck causing this issue?

A.Exceeded OCI Block Volume IOPS limits on the standby database's local NVMe scratchpad.

B.Misconfigured OCI IAM policy allowing read-only access to database backups.

C.Incorrect OCI Load Balancer SSL certificate configuration on the web tier.

D.Inadequate cross-region network bandwidth or high latency causing redo transport congestion.

AnswerD

Inadequate cross-region bandwidth or latency directly throttles Data Guard redo transport, since every archived redo log must traverse that link synchronously or asynchronously. The 8-minute transport lag exceeds the 5-minute RPO, confirming the network path—not the database—is the bottleneck. Provisioning dedicated, low-latency connectivity restores the required RPO.

Why this answer

A redo transport lag spike to 8 minutes most likely indicates a network bottleneck between the primary and standby regions. Data Guard redo transport depends on sufficient cross-region bandwidth and low latency; if bandwidth is constrained or latency is high, the standby cannot receive and apply redo fast enough, causing the lag to exceed the 5-minute RPO. This is an architectural issue, not a database or application configuration issue.

Exam trap

1Z0-997-26 often tests the tendency to blame database or storage components for redo transport lag, when the root cause in a multi-region Data Guard setup is usually network bandwidth or latency.

How to eliminate wrong answers

Option A is wrong because the standby database's local NVMe scratchpad is not used for redo transport; redo is written to standby redo logs on block volumes, and IOPS limits there would not directly cause transport lag. Option B is wrong because IAM policies for read-only backup access do not affect redo transport performance. Option C is wrong because load balancer SSL certificate configuration on the web tier is unrelated to database redo transport lag.

Full explanation →

130

Multi-Selecthard

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Select 2 answers

A.Disable versioning on all buckets to save storage space.

B.Grant 'manage' permissions on the bucket to all anonymous users.

C.Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.

D.Store all files without encryption to ensure faster deletion.

E.Implement least-privilege IAM policies restricting bucket deletion and management to authorized security groups.

AnswersC, E

Object Lock enforces WORM retention, blocking deletion or modification for a fixed period regardless of user privileges. Compliance mode cannot be bypassed even by tenancy administrators, directly satisfying the stem's requirement to prevent accidental or malicious deletion under strict compliance frameworks. Governance mode offers weaker protection, so Compliance mode best fits regulated workloads.

Why this answer

Option C is correct because OCI Object Storage Object Lock enforces WORM (Write Once, Read Many) retention policies: in Compliance mode, retention rules cannot be removed or shortened even by tenancy administrators until the retention period expires, directly preventing accidental or malicious deletion for strict compliance frameworks, while Governance mode offers similar protection with privileged override capability. Option E is correct because implementing least-privilege IAM policies ensures that only authorized security groups hold permissions such as BUCKET_DELETE or BUCKET_UPDATE, reducing the risk of accidental or malicious deletion by unauthorized or overly privileged users. Option A is incorrect because disabling versioning removes the ability to recover overwritten or deleted objects and does nothing to prevent deletion.

Option B is incorrect because granting 'manage' permissions to all anonymous users exposes the bucket to anyone, enabling rather than preventing malicious deletion. Option D is incorrect because storing files without encryption weakens security and compliance and has no bearing on preventing deletion.

Exam trap

1Z0-997-26 often tests the difference between Object Lock (immutability/WORM) and versioning (recoverability) — candidates incorrectly pick 'disable versioning' or 'no encryption' as deletion-prevention measures, missing that only Object Lock plus least-privilege IAM actually prevents deletion.

Full explanation →

131

MCQmedium

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

A.Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

B.Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.

C.Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

D.Store all keys in the home region and use the OCI Service Gateway for remote decryption.

AnswerB

OCI Vaults are regional constructs, so customer-managed keys are created and stored within a single region and cannot be replicated across regions. Provisioning a separate vault and key set per region therefore guarantees keys never leave their home region, meeting the residency constraint.

Why this answer

OCI Vault is a regional service, and customer-managed keys are stored in the region where the vault is created. To ensure encryption keys never leave their home regions, you must provision separate OCI Vaults and keys in each region where workloads reside. This design keeps keys within their respective regions and complies with data residency requirements.

Exam trap

1Z0-997-26 often tests the regional nature of OCI Vault; candidates may assume a global vault or cross-region key replication, but OCI Vault is strictly regional.

How to eliminate wrong answers

Option A is wrong because OCI Vault does not support a single global vault with automatic key replication across regions; vaults are regional. Option C is wrong because Object Storage cross-region replication is for objects, not for keys; keys cannot be copied via Object Storage replication. Option D is wrong because storing keys in one region and using Service Gateway for remote decryption would still require keys to be used outside their home region, violating the policy.

Full explanation →

132

Multi-Selecteasy

Which TWO of the following are key architectural benefits of adopting serverless OCI Functions compared to managing traditional container clusters for event-driven tasks?

Select 2 answers

A.Built-in requirement to configure manual Kubernetes Horizontal Pod Autoscalers

B.Guaranteed permanent container warm-start memory caching with zero cold starts ever

C.Full administrative root access to the underlying hypervisor and host operating system kernel

D.Automatic scaling from zero to thousands of executions based on incoming events without managing servers

E.Pay-as-you-go pricing model where you only pay for the exact execution time consumed down to the millisecond

AnswersD, E

OCI Functions scales elastically from zero to thousands of concurrent executions as events arrive, removing node provisioning, cluster capacity planning and idle worker management. That directly addresses the event-driven scenario where demand is sporadic and unpredictable.

Why this answer

Option D is correct because OCI Functions is a fully managed FaaS platform that automatically scales the function fleet from zero to thousands of concurrent executions in response to incoming events, eliminating the need to provision, patch, or manage any servers or worker nodes. Option E is correct because OCI Functions bills on a pay-as-you-go model based on actual execution time measured in milliseconds (plus invocation counts and provisioned resources), so you pay only for the compute actually consumed rather than for idle cluster capacity. Option A is incorrect because manual Kubernetes Horizontal Pod Autoscalers are a container-cluster concern; serverless functions abstract away pod and HPA management entirely.

Option B is incorrect because no serverless platform guarantees permanent warm containers or zero cold starts; cold starts can still occur when scaling from zero. Option C is incorrect because serverless platforms deliberately hide the underlying hypervisor and host OS kernel, providing no root administrative access to that infrastructure.

Exam trap

1Z0-997-26 often tests serverless benefits, and candidates may incorrectly select options that describe container cluster management tasks or unrealistic guarantees like zero cold starts.

Full explanation →

133

Multi-Selecthard

You are tasked with migrating a mission-critical three-tier enterprise application from an on-premises environment to OCI. The database tier uses Oracle RAC, and the application tier consists of stateless Java applications running on JBoss. Which TWO strategies or tools should be incorporated into the migration plan to ensure high availability and minimal downtime during cutover? (Choose two.)

Select 2 answers

A.Utilize Oracle Zero Downtime Migration (ZDM) to automate the database migration from on-premises RAC to OCI Exadata Database Service.

B.Rely exclusively on manual Oracle SQL*Plus scripts to perform a cold backup and restore across all tiers simultaneously.

C.Configure an OCI Load Balancer in front of the stateless application tier instances deployed across multiple fault domains to allow seamless traffic redirection during cutover.

D.Migrate the application tier using physical block-level cloning of the running JBoss server memory states.

E.Convert the database architecture immediately to MySQL HeatWave during the cutover window without schema validation.

AnswersA, C

ZDM automates the physical migration of Oracle RAC databases to OCI Exadata Database Service, using Data Guard and zero-downtime cutover workflows. This directly satisfies the stem's minimal-downtime constraint for the RAC database tier, avoiding manual rebuilds or export/import.

Why this answer

Option A is correct because Oracle Zero Downtime Migration (ZDM) is purpose-built to automate and orchestrate migrations of Oracle databases—including RAC sources—to OCI Database services such as Exadata Database Service, using techniques like Data Guard and GoldenGate to minimize downtime during cutover. Option C is correct because placing an OCI Load Balancer in front of stateless JBoss application instances spread across multiple fault domains enables seamless traffic redirection and rolling cutover, so users experience minimal disruption while instances are switched over. Options B, D, and E are not appropriate: manual SQL*Plus cold backup/restore across all tiers would cause significant downtime and lacks automation; physical block-level cloning of running JBoss memory states is not a supported or reliable migration method for stateless Java applications; and converting to MySQL HeatWave during cutover without schema validation is risky, unsupported for an Oracle RAC-based mission-critical system, and would introduce unacceptable downtime and data integrity issues.

Exam trap

1Z0-997-26 often tests the misconception that manual backup/restore or memory cloning can achieve minimal downtime, when the correct tools are ZDM for the database and a Load Balancer across fault domains for the app tier.

Full explanation →

134

MCQhard

Your organization uses OCI Full Stack Disaster Recovery to manage failovers between Region A and Region B. During a DR drill, you notice that a custom user-defined step failed because the dependent compute instance in Region B was not yet fully running. How should you resolve this dependency issue in the FSDR plan?

A.Manually SSH into each instance during the drill to run the script.

B.Increase the OCI Compute instance shape size in Region B to boot faster.

C.Edit the DR plan group and add a dependency or adjust the sequence order so that the start compute step completes before the custom script step.

D.Disable all pre-checks in the FSDR plan settings.

AnswerC

Full Stack DR plan groups support explicit dependencies and ordered steps, so adding a dependency ensures the start-compute step completes before the custom script runs. This satisfies the stem's dependency constraint by enforcing sequencing within the group rather than relying on timing.

Why this answer

OCI Full Stack Disaster Recovery (FSDR) plans are built from ordered groups of steps. When a custom user-defined step depends on a compute instance being fully running, the correct fix is to place the 'Start Compute' step in an earlier group or add an explicit dependency so the custom script executes only after the instance reaches the RUNNING state. This is the native sequencing mechanism FSDR provides.

Exam trap

The trap is treating a sequencing problem as a performance problem — candidates pick 'increase shape size' or 'disable pre-checks' instead of recognizing that FSDR plans need explicit step ordering or dependencies.

How to eliminate wrong answers

Option A is wrong because manual SSH is not part of an automated DR plan and defeats the purpose of FSDR orchestration; it is also not repeatable during a real failover. Option B is wrong because increasing the shape size does not guarantee the instance is running before the custom step — it only changes boot performance, not step ordering. Option D is wrong because disabling pre-checks removes safety validation and does not address the dependency between the compute start and the custom script.

Full explanation →

135

MCQmedium

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

A.Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

B.Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

C.Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.

D.Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

AnswerC

An Object Storage source in Logging Analytics discovers and ingests log files from the bucket automatically, handling parsing and indexing for complex searches. This is the native, supported ingestion path, avoiding manual downloads or custom upload scripts.

Why this answer

OCI Logging Analytics provides a native Object Storage source type that allows you to configure a bucket as a log source. Once configured, Logging Analytics automatically discovers new log files, parses them using built-in or custom parsers, and ingests them for indexing and search. This eliminates the need for custom code or agents, and is the documented best practice for ingesting logs from Object Storage.

Exam trap

1Z0-997-26 often tests the misconception that you need to write custom code or use other OCI services to move data into Logging Analytics, when in fact native source types exist for common sources like Object Storage.

How to eliminate wrong answers

Option A is wrong because while it's technically possible to use the OCI SDK and REST API, it requires custom development, maintenance, and doesn't leverage Logging Analytics' native discovery and parsing capabilities. Option B is wrong because OCI File Storage Service cannot mount an Object Storage bucket as a file system; that's a fundamental misunderstanding of the two services. Option D is wrong because OCI Streaming is a publish-subscribe service for real-time data streams, not a direct ingestion path for Object Storage objects into Logging Analytics; it would require additional integration and is not the recommended approach.

Full explanation →

136

MCQmedium

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

A.Local Peering mode

B.Dynamic Routing (BGP) mode

C.FastConnect Partner mode

D.Static Routing mode

AnswerD

Static Routing mode satisfies the on-premises firewall's requirement for static routing rather than BGP. In OCI Site-to-Site VPN, this mode uses Oracle-defined static routes for the IPSec tunnels instead of dynamically exchanging prefixes via BGP, so the connection establishes correctly with a peer that cannot run BGP.

Why this answer

OCI Site-to-Site VPN supports two routing modes: Dynamic Routing (BGP) and Static Routing. When the on-premises firewall requires static routing, you must select Static Routing mode and manually specify the on-premises and OCI CIDR prefixes that should be routed over the tunnel.

Exam trap

1Z0-997-26 often tests whether candidates know that OCI VPN offers both BGP and static routing modes, and that choosing the wrong mode when the CPE lacks BGP support causes the tunnel to come up but no routes to be exchanged.

How to eliminate wrong answers

Option A is wrong because Local Peering is a VCN-to-VCN peering relationship within OCI, not a VPN routing mode. Option B is wrong because Dynamic Routing (BGP) mode requires BGP peering between the DRG and the customer edge router, which the on-premises firewall cannot support in this scenario. Option C is wrong because FastConnect Partner mode refers to connecting through an OCI FastConnect partner for dedicated private connectivity, not a Site-to-Site VPN routing option.

Full explanation →

137

MCQmedium

An application running on OCI compute instances requires disaster recovery protection. You want to replicate boot volumes and block volumes to a secondary region. Which OCI Block Volume feature facilitates this?

A.OCI File Storage cross-mount replication policies

B.Manual Object Storage export of raw volume blocks using dd commands

C.Real-time synchronous block volume mirroring via software RAID

D.Asynchronous cross-region block volume replication

AnswerD

Asynchronous cross-region block volume replication copies boot and block volumes to a paired secondary region without impacting instance performance, satisfying the disaster recovery requirement. Replication is block-level and incremental, so only changed blocks transfer after the initial sync, keeping recovery point objectives tight for OCI compute workloads.

Why this answer

OCI Block Volume supports asynchronous cross-region replication, which continuously replicates block volumes (and their boot volumes) from a primary region to a secondary region for DR purposes. This is the native OCI feature designed for cross-region block volume DR. It operates at the block level and is configured per volume or volume group.

Exam trap

1Z0-997-26 often tests the misconception that OCI provides synchronous cross-region block replication — candidates confuse it with on-premises synchronous mirroring or assume File Storage replication applies to block volumes.

How to eliminate wrong answers

Option A is wrong because OCI File Storage does not provide cross-mount replication policies for block volumes — File Storage is a separate NFS service and does not replicate block volumes. Option B is wrong because manually exporting raw blocks via dd to Object Storage is not a supported or practical replication mechanism and does not provide continuous DR replication. Option C is wrong because OCI does not offer real-time synchronous block volume mirroring via software RAID across regions — cross-region replication in OCI is asynchronous, not synchronous.

Full explanation →

138

MCQmedium

An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?

A.OCI Application Performance Monitoring (APM)

B.OCI Logging Analytics

C.OCI Stack Monitoring

D.OCI Monitoring Service

AnswerC

Stack Monitoring discovers and models WebLogic Server and Oracle Database components together, collecting deep internal health metrics, resource utilisation and dependency topology across the full stack, which generic infrastructure monitoring cannot provide for these enterprise tiers.

Why this answer

OCI Stack Monitoring is purpose-built to monitor enterprise application stacks such as WebLogic Server and Oracle Database, providing deep internal health metrics, resource utilization, and dependency topology discovery. It is the only OCI service specifically designed for full-stack enterprise application monitoring.

Exam trap

1Z0-997-26 often tests the overlap between APM, Logging Analytics, and Stack Monitoring, so candidates choose APM for enterprise stack monitoring when Stack Monitoring is the service explicitly designed for WebLogic and Database deep health.

How to eliminate wrong answers

Option A is wrong because OCI APM focuses on application performance tracing and synthetic monitoring for custom applications, not deep WebLogic or Database stack health. Option B is wrong because OCI Logging Analytics analyzes log data for troubleshooting and security, but does not provide the topology and deep stack health metrics that Stack Monitoring offers. Option D is wrong because OCI Monitoring Service handles generic infrastructure and custom metrics, not the specialized enterprise stack discovery and health modeling that Stack Monitoring provides.

Full explanation →

139

Multi-Selecthard

An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)

Select 3 answers

A.Dynamic Routing Gateway (DRG) for hybrid ingress/egress

B.OCI Internet Gateway for public IP resolution

C.OCI Email Delivery service for database alert routing

D.Virtual Cloud Network (VCN) acting as the transit and hosting environment

E.Private Endpoints associated with the Autonomous Database instance

AnswersA, D, E

The Dynamic Routing Gateway provides the ingress and egress path between the on-premises network and the OCI VCN, terminating the FastConnect or VPN attachment. Without it, private traffic from on-premises cannot reach the Autonomous Database's private endpoint.

Why this answer

Option A is correct because the Dynamic Routing Gateway (DRG) is the OCI edge router that terminates the FastConnect or Site-to-Site VPN from on-premises and exchanges routes with the VCN, enabling private hybrid ingress/egress without traversing the public internet. Option D is correct because the Virtual Cloud Network (VCN) is the foundational software-defined network that hosts the subnets, route tables, and gateways through which the private traffic transits to reach the Autonomous Database. Option E is correct because a private endpoint (using a private IP in a VCN subnet) is what allows the Autonomous Database to be reached privately rather than through its public endpoint, and it is the target of the on-premises traffic.

Option B is not part of this design because an Internet Gateway only enables public IP connectivity to and from the internet, which contradicts the requirement for a private connection. Option C is unrelated because OCI Email Delivery is a messaging service for sending email notifications, not a networking component involved in private database connectivity.

Exam trap

The trap is selecting an Internet Gateway or other unrelated service because candidates think any gateway can provide connectivity; they forget that private access requires a DRG, VCN, and private endpoint, not public components.

Full explanation →

140

MCQeasy

You need to trigger an OCI Function asynchronously whenever an object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the event router between Object Storage and the Function?

A.OCI DNS

B.OCI Events Service

C.OCI File Storage Service

D.OCI Data Transfer Service

AnswerB

OCI Events Service matches the Object Storage object-creation event against a rule and invokes the Function as the action. It is the event router connecting the bucket to the Function, satisfying the asynchronous trigger requirement.

Why this answer

OCI Events Service is the native event-routing service in OCI that listens to Object Storage bucket events (such as ObjectCreate) and delivers them to targets like OCI Functions, Notifications, or Streaming. When an object is uploaded, Object Storage emits an event to the Events Service, which matches it against a rule and invokes the Function asynchronously. This decouples the storage layer from the compute layer and is the standard serverless event-driven pattern in OCI.

Exam trap

The trap here is confusing OCI DNS or Data Transfer with event-driven integration; candidates who haven't used OCI Events Service may pick a service that sounds like it 'moves' or 'routes' data rather than the actual event router.

How to eliminate wrong answers

Option A is wrong because OCI DNS is a domain name resolution and traffic management service; it has no event subscription or routing capability toward Functions. Option C is wrong because OCI File Storage Service provides NFS-based shared file systems and does not emit object-upload events or route them to Functions. Option D is wrong because OCI Data Transfer Service is used for bulk data movement (appliances, disks, or over the network) and is not an event router.

Full explanation →

141

MCQhard

An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?

A.Active Data Guard with snapshot standby mode and automated cron-based switchovers.

B.Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.

C.Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.

D.Maximum Protection mode with asynchronous redo transport and manual failover scripts.

AnswerC

Synchronous redo transport guarantees zero data loss, delivering the required RPO of zero, while Fast-Start Failover automatically redirects the primary within seconds, meeting the sub-two-minute RTO. Maximum Availability mode permits synchronous transport without halting the primary when a standby is unavailable.

Why this answer

An RPO of zero requires synchronous redo transport so no committed transaction is lost, and an RTO under two minutes requires automated fast failover. Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled satisfies both: it guarantees zero data loss while the primary is available and enables automatic failover within seconds.

Exam trap

The trap is that candidates focus on the protection mode name and overlook the transport type; Maximum Performance sounds fast but uses asynchronous transport, which violates RPO zero, while Maximum Availability with SYNC and FSFO is the correct combination.

How to eliminate wrong answers

Option A is wrong because snapshot standby mode does not apply redo continuously and is used for testing, not for zero-RPO production failover; cron-based switchovers are also not fast enough for sub-two-minute RTO. Option B is wrong because Maximum Performance mode uses asynchronous redo transport, which can lose transactions and therefore cannot guarantee RPO zero. Option D is wrong because Maximum Protection mode requires synchronous transport, not asynchronous, and manual failover scripts cannot meet a sub-two-minute RTO reliably.

Full explanation →

142

MCQhard

An enterprise is implementing a multi-database architecture utilizing Oracle GoldenGate microservices on OCI Compute instances to replicate data between an operational Exadata database and an analytical Autonomous Data Warehouse. Which network security construct must be configured to allow communication between the GoldenGate deployment and the Autonomous Database instance?

A.Configure VCN security lists or Network Security Groups (NSGs) allowing outbound TCP port 1522 and inbound mTLS traffic, and supply the ADB wallet

B.Expose an API Gateway with public IP routing directly to the database undo tablespace

C.Configure a Local Peering Gateway with remote VCN route tables pointing to port 22

D.Attach an Internet Gateway directly to the Autonomous Database private IP address

AnswerA

GoldenGate microservices connect to Autonomous Data Warehouse over the dedicated TCPS endpoint on port 1522, requiring egress rules plus the ADB wallet for mutual TLS authentication. Security lists or NSGs must permit that traffic, satisfying the connectivity constraint.

Why this answer

GoldenGate microservices on OCI Compute connect to Autonomous Database using the ADB wallet for mTLS authentication and the ADB's TCPS listener on port 1522. The VCN security lists or NSGs must allow outbound TCP 1522 from the GoldenGate host and inbound mTLS traffic to the ADB, and the wallet must be supplied to GoldenGate for the connection to succeed. This is the standard secure connectivity pattern for ADB.

Exam trap

The trap is misunderstanding ADB connectivity — candidates may pick options involving public IPs, SSH port 22, or API Gateways, missing that ADB requires mTLS with a wallet over TCPS port 1522 and does not expose a directly attachable public IP.

How to eliminate wrong answers

Option B is wrong because API Gateway is an HTTP API management service and cannot route directly to a database undo tablespace — undo tablespaces are internal storage structures, not network endpoints, and this option is technically nonsensical. Option C is wrong because a Local Peering Gateway connects two VCNs in the same region, and port 22 is SSH, not the ADB TCPS port; pointing route tables to port 22 does not enable GoldenGate-to-ADB communication. Option D is wrong because Autonomous Database does not have a public IP address you can attach an Internet Gateway to — ADB connectivity is via a private endpoint (or public endpoint with ACLs) using the wallet and TCPS, not direct IGW attachment.

Full explanation →

143

MCQeasy

You are planning the backup retention strategy for critical Oracle Base Database Service instances in OCI. You want to retain weekly backups for 12 months and daily backups for 30 days. Where are these automated backups stored by default?

A.In an OCI File Storage Service (FSS) mount target.

B.In a customer-managed Block Volume attached to the database compute instance.

C.In local temporary NVMe drives on the database node.

D.In an Oracle-managed Object Storage bucket inaccessible to direct user manipulation.

AnswerD

Automated backups for Base Database Service land in an Oracle-managed Object Storage bucket that customers cannot browse or alter directly. Retention of 30 daily and 12 monthly copies is enforced by the service, satisfying the stated policy without user-managed buckets.

Why this answer

Automated backups for Oracle Base Database Service in OCI are stored in an Oracle-managed Object Storage bucket that is not directly accessible to customers. This design ensures backup integrity, security, and lifecycle management without requiring user intervention. The retention policies (weekly for 12 months, daily for 30 days) are applied to these backups automatically.

Exam trap

1Z0-997-26 often tests the default storage location for automated backups, and candidates may incorrectly assume backups are stored in customer-accessible storage like Block Volumes or FSS, when they are actually in an Oracle-managed Object Storage bucket.

How to eliminate wrong answers

Option A is wrong because OCI File Storage Service (FSS) is a shared file system, not the default storage for automated database backups. Option B is wrong because customer-managed Block Volumes are used for database data files, not for automated backups; backups are stored off-instance. Option C is wrong because local temporary NVMe drives are ephemeral and not used for persistent backup storage.

Full explanation →

144

MCQmedium

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

A.DRG attachments and DRG Route Tables

B.Local Peering Gateway chaining

C.Internet Gateway route forwarding

D.Service Gateway cross-region peering

AnswerA

DRG attachments connect each VCN and the on-premises FastConnect circuit to the DRG, while DRG Route Tables control which attachment receives traffic. This satisfies the stem's requirement to route efficiently across multiple regional VCNs and remote connections.

Why this answer

A Dynamic Routing Gateway (DRG) with attachments for each VCN and the on-premises FastConnect virtual circuit, combined with DRG Route Tables, enables centralized routing across multiple VCNs in different regions and the on-premises network. DRG Route Tables let you control which routes are imported and distributed per attachment.

Exam trap

1Z0-997-26 often tests the misconception that Local Peering Gateways or Service Gateways can provide cross-region or hybrid routing, when only DRG attachments and DRG Route Tables handle that scale.

How to eliminate wrong answers

Option B is wrong because Local Peering Gateways only connect VCNs within the same region and cannot chain across regions or to on-premises. Option C is wrong because an Internet Gateway routes public traffic and does not provide private cross-region or hybrid routing. Option D is wrong because a Service Gateway provides private access to OCI services (like Object Storage) and does not peer cross-region or route to on-premises.

Full explanation →

145

Multi-Selecteasy

Which TWO of the following are valid methods to trigger an OCI Function execution?

Select 2 answers

A.OCI Identity and Access Management password rotation policy

B.OCI Events Service rule reacting to object storage or compute state changes

C.Direct physical USB drive insertion into OCI Exadata infrastructure

D.HTTP requests routed through OCI API Gateway

E.OCI Block Volume disk defragmentation schedule

AnswersB, D

OCI Events Service rules evaluate resource state changes, such as object creation in Object Storage or compute instance lifecycle transitions, and invoke a Function as the rule's action. This satisfies the stem's requirement for an event-driven trigger rather than a manual or scheduled invocation path.

Why this answer

Option B is correct because the OCI Events Service can publish events (for example, Object Storage object-create or Compute instance state-change events) that match a rule and invoke a Function as the rule's action, making event-driven invocation a valid trigger method. Option D is correct because OCI Functions can be exposed as HTTP endpoints, and OCI API Gateway can route incoming HTTP requests to a Function, so client HTTP calls through the gateway trigger function execution. Option A is not a trigger: IAM password rotation policy is an identity/security governance setting and does not invoke Functions.

Option C is not a trigger: physically inserting a USB drive into Exadata infrastructure is not an OCI control-plane or event mechanism for Functions. Option E is not a trigger: Block Volume defragmentation scheduling is a storage maintenance operation and does not invoke Functions.

Exam trap

1Z0-997-26 often tests whether candidates know the actual OCI event sources and invocation mechanisms for Functions, tempting them with unrelated services like IAM policies or storage maintenance tasks that sound plausible but have no trigger integration.

Full explanation →

146

MCQhard

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

A.Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.

B.Configure an OCI Internet Gateway to peer with GCP Cloud DNS.

C.Attach a GCP VPC as a secondary VCN in the OCI console.

D.Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.

AnswerD

Megaport or Equinix Fabric provides a Layer 2 software-defined interconnection linking OCI FastConnect to GCP Interconnect, so traffic stays on private provider networks. This satisfies the stem's low-latency, private OCI-to-GCP requirement without public internet traversal.

Why this answer

OCI and GCP do not have a native direct interconnect between them, so private low-latency connectivity requires a Layer 2 fabric provider. FastConnect on the OCI side and Cloud Interconnect on the GCP side both terminate at the same Equinix Fabric or Megaport switch, where a virtual cross-connect joins the two circuits. This keeps traffic off the public internet and gives deterministic latency.

Exam trap

1Z0-997-26 often tests whether candidates believe OCI has a native direct interconnect to every cloud — the trap is picking a direct DRG-to-VPC peering option that does not exist for GCP.

How to eliminate wrong answers

Option A is wrong because an OCI DRG cannot peer directly to a GCP VPC — GCP Cloud Interconnect is a Layer 2/3 service that requires a partner fabric, not a direct DRG-to-VPC BGP session. Option B is wrong because an Internet Gateway routes to the public internet and Cloud DNS is a name resolution service, not a connectivity path. Option C is wrong because a GCP VPC cannot be attached as a secondary VCN in OCI — VCNs are OCI-native constructs and cross-cloud VPC attachment is not a supported feature.

Full explanation →

147

MCQeasy

What is the primary function of OCI Network Security Groups (NSGs)?

A.To balance HTTP/HTTPS traffic across multiple backend web servers.

B.To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.

C.To encrypt data at rest in block storage volumes.

D.To manage human user passwords and multi-factor authentication.

AnswerB

NSGs are virtual firewalls applied at the VNIC level, letting you define inbound and outbound rules that govern traffic for a chosen set of VNICs regardless of subnet. This VNIC-scoped enforcement is precisely what the question asks for.

Why this answer

OCI Network Security Groups (NSGs) act as virtual firewalls that control inbound and outbound traffic for a specific set of VNICs. Unlike security lists, which apply to all VNICs in a subnet, NSGs allow you to apply security rules to a group of VNICs that you explicitly choose, enabling fine-grained, instance-level micro-segmentation.

Exam trap

1Z0-997-26 often tests the distinction between NSGs and security lists, and candidates may incorrectly think NSGs are subnet-level or that they perform load balancing or encryption.

How to eliminate wrong answers

Option A is wrong because load balancing is handled by OCI Load Balancer or Network Load Balancer services, not NSGs. Option C is wrong because encryption at rest for block volumes is handled by OCI Block Volume encryption (using Vault keys), not NSGs. Option D is wrong because user password and MFA management is part of OCI IAM, not network security groups.

Full explanation →

148

MCQmedium

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

A.Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.

B.The VCN lacks an Internet Gateway.

C.The OCI Vault service is offline.

D.The team lacks IAM permissions to create compute instances.

AnswerA

Security Zones enforce a policy that blocks public IP addresses on compute instances, preventing direct internet exposure. The create operation fails because the requested public IP violates this recipe, satisfying the stem's constraint that Security Zones prohibit such exposure.

Why this answer

OCI Security Zones are hardened compartments that enforce a set of immutable security policies, one of which is that resources inside cannot have public IP addresses or public-facing endpoints. Because the policy is enforced at the platform level, the create-instance call fails regardless of IAM permissions or network configuration. This is by design to prevent external exposure of workloads in the zone.

Exam trap

1Z0-997-26 often tests whether candidates confuse a network misconfiguration (no Internet Gateway) with an enforced Security Zone policy — the giveaway is that the operation itself fails at creation, not at connectivity time.

How to eliminate wrong answers

Option B is wrong because a missing Internet Gateway would only prevent outbound internet access; it would not cause instance creation with a public IP to fail, and Security Zones block public IPs anyway. Option C is wrong because OCI Vault availability is unrelated to compute instance creation and Vault is a regional HA service. Option D is wrong because an IAM permission gap would return an authorization error, not a policy violation specific to public IP attachment.

Full explanation →

149

MCQhard

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

A.Delete the VCN containing the instance to stop all routing.

B.Terminate the compute instance and delete all attached block volumes immediately.

C.Revoke the IAM user credentials of the administrator who launched the instance.

D.Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.

AnswerD

Replacing the instance's NSGs with a quarantine NSG that denies all traffic severs network access immediately, while the boot and block volumes remain attached and untouched. This satisfies both isolation and forensic storage preservation without terminating the instance.

Why this answer

To isolate a compromised instance while preserving storage, the best action is to update its Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic. This revokes network access without terminating the instance or deleting volumes, allowing forensic analysis. This can be automated with OCI Events (triggered by a security alert) and Functions.

Exam trap

1Z0-997-26 often tests the trade-off between isolation and preservation; candidates may choose termination or deletion, but the question emphasizes preserving storage for forensics, so the correct answer must avoid destructive actions.

How to eliminate wrong answers

Option A is wrong because deleting the VCN would disrupt all resources in the VCN, not just the compromised instance, and is overly destructive. Option B is wrong because terminating the instance and deleting volumes destroys forensic evidence and may not be necessary for isolation. Option C is wrong because revoking IAM credentials of the administrator does not isolate the compromised instance's network access and may not stop the attacker if they have other credentials.

Full explanation →

150

MCQmedium

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

A.Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits

B.OCI Autoscaling for OKE worker nodes

C.Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter

D.OCI Instance Pool autoscaling configuration

AnswerC

HPA scales pods, but custom metrics such as active queue length require the Prometheus Adapter to expose them through the custom metrics API. HPA then reads those metrics, satisfying the requirement for scaling on application metrics rather than CPU or memory.

Why this answer

The Kubernetes Horizontal Pod Autoscaler (HPA) can scale pods based on custom metrics when integrated with Prometheus and the Prometheus Adapter. The adapter exposes custom metrics from Prometheus to the Kubernetes metrics API, allowing HPA to query metrics like active queue length and scale accordingly. This is the standard approach for custom metric-based autoscaling in OKE.

Exam trap

1Z0-997-26 often tests the difference between pod-level and node-level autoscaling, and candidates may confuse HPA with VPA or node pool autoscaling, especially when custom metrics are involved.

How to eliminate wrong answers

Option A is wrong because Vertical Pod Autoscaler adjusts CPU and memory requests/limits for pods, not horizontal scaling, and it does not support custom metrics like queue length. Option B is wrong because OCI Autoscaling for OKE worker nodes scales the number of nodes in a node pool, not the number of pods, and it is based on node pool metrics, not application-specific custom metrics. Option D is wrong because OCI Instance Pool autoscaling also scales compute instances, not pods, and is not integrated with Kubernetes custom metrics.

Full explanation →

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 76–150