Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) 1Z0-997-26 Questions 151–225 | Page 3/5

151

Multi-Selecteasy

Which TWO methods are valid for protecting OCI Compute instance boot volumes against data loss or corruption? (Choose two.)

Select 2 answers

A.Attaching the boot volume to an Internet Gateway.

B.Creating manual or scheduled boot volume backups.

C.Configuring cross-region boot volume replication.

D.Storing OS files in an OCI Streaming queue.

E.Using local NVMe scratch disks for OS persistence.

AnswersB, C

Boot volume backups allow full restoration of OS instances.

Why this answer

Boot volumes can be protected using manual or scheduled volume backups, as well as cross-region volume replication.

Full explanation →

152

MCQhard

An internal security audit reveals that database credentials are being passed insecurely in environment variables within OCI Functions. What is the recommended secure pattern to manage these secrets?

A.Hardcode the credentials inside the function source code repository.

B.Store secrets in OCI Object Storage with public read access.

C.Encode the credentials in Base64 and store them in IAM policy descriptions.

D.Store secrets in OCI Vault and retrieve them securely at runtime using the OCI SDK with dynamic group authentication.

AnswerD

Storing secrets in OCI Vault and fetching them dynamically ensures credentials are encrypted at rest and in transit without exposure in configurations.

Why this answer

OCI Vault Secrets management allows applications and functions to securely store and retrieve credentials at runtime using OCI SDKs, eliminating plaintext secrets in environment variables or code.

Full explanation →

153

MCQeasy

Your development team needs to build and push container images to a secure, private registry hosted on OCI before deploying them to OKE. Which OCI service should they use?

A.OCI Object Storage standard bucket

B.OCI Artifact Registry

C.OCI Registry (OCIR)

D.OCI DevOps Code Repository

AnswerC

Correct. OCIR is the native OCI service for storing and managing container images.

Why this answer

OCI Registry (OCIR) is Oracle's managed enterprise-grade container registry service for storing and managing Docker v2 container images.

Full explanation →

154

MCQeasy

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

A.SSL/TLS v1.3 with RSA key exchange

B.SSH tunneling with Blowfish cipher

C.PPTP with MPPE 128-bit encryption

D.IKEv2 with AES-256 encryption and SHA-2 hashing

AnswerD

OCI natively supports IKEv1 and IKEv2 with robust encryption standards such as AES-256 and SHA-2.

Why this answer

OCI Site-to-Site VPN supports industry-standard IPsec VPN protocols, including Internet Key Exchange version 2 (IKEv2) and strong encryption algorithms like AES-256 with SHA-2.

Full explanation →

155

MCQeasy

Your organization is designing a disaster recovery strategy as part of a workload migration project to OCI. The business requirement states that in the event of a regional outage in OCI region A, workloads must fail over to OCI region B with a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of less than 15 minutes. Which OCI networking feature should you deploy to interconnect the two regions for database replication?

A.OCI Local Peering Gateway (LPG)

B.OCI Dynamic Routing Gateway (DRG) with Remote Peering Connection (RPC)

C.OCI Service Gateway

D.OCI Internet Gateway with IPsec VPN tunnels over the public internet

AnswerB

DRG with RPC enables secure, high-bandwidth peering of VCNs across different OCI regions over Oracle's backbone network.

Why this answer

To connect VCNs across different OCI regions with low latency and high security for database replication (such as Data Guard), you should use OCI Remote Peering across Local Peering Gateways or Remote Peering Connections (RPC) through Dynamic Routing Gateways (DRGs).

Full explanation →

156

MCQhard

You are configuring Oracle Data Guard between an Exadata Database Service on Dedicated Infrastructure primary database and a remote standby database in another OCI region. To ensure maximum performance with zero data loss risk under normal operations, which Data Guard protection mode and transport setting should you configure?

A.Maximum Protection mode with SYNC and AFFIRM transport.

B.Maximum Availability mode with SYNC transport and NOAFFIRM.

C.Maximum Availability mode with ASYNC transport and ARCHivelog compression.

D.Maximum Performance mode with ASYNC transport.

AnswerA

Maximum Protection mode with SYNC and AFFIRM ensures redo is written to the standby disk before the primary transaction commits, guaranteeing zero data loss.

Why this answer

Maximum Protection mode guarantees zero data loss (Zero Data Loss architecture) by ensuring transactions do not commit until the redo data is written to the standby redo log files on at least one synchronized standby database.

Full explanation →

157

Multi-Selectmedium

When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?

Select 3 answers

A.Evaluation window (time interval and period)

B.Metric namespace and metric name

C.OCI Vault Master Encryption Key OCID

D.Virtual Cloud Network (VCN) CIDR block

E.Threshold value and trigger operator (e.g., greater than)

AnswersA, B, E

Correct. The evaluation window defines how long a condition must persist before triggering.

Why this answer

Creating an OCI Monitoring alarm requires defining the metric namespace and name, the evaluation window/period, and the threshold condition.

Full explanation →

158

MCQhard

You are managing an Oracle Base Database Service instance configured with Data Guard in OCI. Due to a severe networking anomaly, the standby database falls significantly behind in applying redo. You decide to rebuild the standby database from an incremental backup taken on the primary. Which Recovery Manager (RMAN) command or process is used to synchronize the standby with the new incremental backup?

A.Execute a complete cold restore of all datafiles using FTP over port 21.

B.Reboot the OCI compute host using the OCI console 'Reset' button.

C.Apply an incremental backup from SCN on the primary database to the standby database using RMAN.

D.Run 'ALTER DATABASE CONVERT TO SNAPSHOT STANDBY' and drop all tablespaces.

AnswerC

RMAN incremental backups from SCN can catch up a lagging standby database efficiently.

Why this answer

RMAN incremental backup from SCN allows you to apply an incremental backup taken from the primary database directly to the standby database to catch it up without having to recreate the entire standby from scratch.

Full explanation →

159

MCQeasy

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

A.OCI Object Storage public bucket

B.OCI Audit log retention policy

C.OCI Resource Manager stack configuration output

D.OCI Vault (Secrets management)

AnswerD

Correct. OCI Vault provides secure secret management and integrates with OCI Functions.

Why this answer

OCI Vault allows you to store secrets securely, which can then be referenced by OCI Functions configuration or retrieved via SDK.

Full explanation →

160

MCQhard

You are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?

A.Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.

B.Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.

C.Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.

D.Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.

AnswerC

Using a dedicated service account with granular sudoers permissions adheres to the principle of least privilege while enabling successful data collection.

Why this answer

OCI Migration requires a secure SSH connection with appropriate permissions (sudo/privilege escalation) to execute discovery commands. You must provision an authorized SSH key on the target VMs and configure a sudoers file allowing the OCI Migration agent service account to run necessary inventory scripts.

Full explanation →

161

MCQmedium

Your security architecture requires segregating production workloads from development workloads using distinct VCNs. However, certain microservices in the development VCN must communicate securely with a database in the production VCN without exposing traffic to the internet. What is the recommended networking construct?

A.Local VCN Peering.

B.Dynamic Routing Gateway (DRG) with internet breakout enabled.

C.Internet Gateway with strict Security List rules.

D.OCI Bastion service.

AnswerA

Local VCN Peering connects two VCNs in the same region privately, enabling secure inter-VCN traffic without internet exposure.

Why this answer

VCN Peering (specifically Local VCN Peering within the same region) allows resources in different VCNs to communicate privately using private IP addresses.

Full explanation →

162

MCQmedium

Your company requires all logs generated within the root compartment to be automatically archived to a centralized OCI Object Storage bucket in a different security tenancy for compliance purposes. Which OCI feature facilitates this serverless data pipeline?

A.OCI Service Connector Hub

B.OCI Data Flow

C.OCI GoldenGate

D.OCI Archive Storage lifecycle rules

AnswerA

Correct. Service Connector Hub orchestrates data movement between OCI services like Logging and Object Storage.

Why this answer

OCI Service Connector Hub enables seamless, serverless movement of data between OCI services, such as streaming logs from OCI Logging to Object Storage or Streaming.

Full explanation →

163

MCQmedium

You are planning the final cutover for a critical production database migrating from an on-premises Oracle Real Application Clusters (RAC) database to OCI Base Database Service using Oracle Data Guard for replication. To minimize application downtime during the cutover window, which sequence of steps must be executed?

A.Stop source application, shut down source database immediately, open standby database in read-write mode, and update DNS.

B.Delete the source database home, re-run ZDM pre-migration checks, and deploy a fresh Autonomous Database instance.

C.Take an offline Data Pump export on premises, ship the dump via FastConnect, import it into OCI, and keep the source running indefinitely.

D.Ensure zero data lag on the Data Guard standby, perform a switchover/failover to promote the OCI standby database to primary, and update application connection strings to point to the new OCI primary listener.

AnswerD

This ensures all transactions are synchronized, eliminates data loss, and cleanly promotes the cloud database with minimal cutover time.

Why this answer

To achieve minimal downtime with Data Guard, you instantiate the standby, let it catch up, perform a final log switch, apply all remaining redo, transition the role to primary, and then redirect application connection strings.

Full explanation →

164

MCQeasy

An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?

A.OCI Data Transfer Service using physical Data Transfer Appliances.

B.OCI FastConnect with a dedicated 1 Gbps partner circuit.

C.OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.

D.Parallelized multi-part uploads using the OCI CLI over public internet connections.

AnswerA

OCI Data Transfer Service allows customers to securely copy data to high-capacity storage appliances provided by Oracle and ship them to an OCI data center.

Why this answer

Data Transfer Appliance or Data Transfer Disk is designed for large-scale offline data migration where network bandwidth is insufficient to transfer data within a reasonable timeframe.

Full explanation →

165

MCQeasy

When designing high availability for stateless web servers in OCI, which combination of services provides automatic scaling and load distribution across multiple Availability Domains?

A.OCI Streaming and OCI Notifications service

B.OCI Database Backup Policies and Local Peering Gateways

C.OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer

D.OCI Vaults and OCI Key Management service

AnswerC

Instance pools with autoscaling manage compute capacity across ADs, while the load balancer distributes traffic.

Why this answer

Combining OCI Instance Pools, Autoscaling Configurations, and an OCI Load Balancer provides automated scaling and multi-AD high availability.

Full explanation →

166

MCQhard

Your organization has a strict Recovery Point Objective (RPO) of 5 minutes and Recovery Time Objective (RTO) of 15 minutes for a multi-tier application. The database tier uses Oracle Data Guard. During a test drill, you notice that redo transport lag spikes to 8 minutes. What is the most likely architectural bottleneck causing this issue?

A.Exceeded OCI Block Volume IOPS limits on the standby database's local NVMe scratchpad.

B.Misconfigured OCI IAM policy allowing read-only access to database backups.

C.Incorrect OCI Load Balancer SSL certificate configuration on the web tier.

D.Inadequate cross-region network bandwidth or high latency causing redo transport congestion.

AnswerD

If network throughput between regions cannot keep up with the primary's redo generation rate, transport lag increases.

Why this answer

Redo transport lag exceeding RPO is frequently caused by insufficient network bandwidth or high latency between regions, preventing synchronous or fast asynchronous redo shipping from keeping pace with transaction volume.

Full explanation →

167

Multi-Selecteasy

Which TWO backup destinations are natively supported when configuring automated backups for Oracle Base Database systems on OCI? (Choose two.)

Select 2 answers

A.OCI Object Storage Archive tier (for long-term retention policies)

B.Local unformatted swap partitions on the database host

C.OCI Object Storage (Standard tier buckets)

D.Public GitHub code repositories

E.Local USB flash drives plugged into the database VM guest node

AnswersA, C

Correct. Archive storage is supported for long-term backup retention.

Why this answer

Base Database systems support backups directly to OCI Object Storage (Standard bucket) or OCI Object Storage Classic / Archive storage tiers.

Full explanation →

168

Multi-Selecthard

Your security team requires that all data stored in OCI Object Storage must adhere to strict compliance frameworks preventing accidental or malicious deletion. Which TWO features should be configured? (Choose two.)

Select 2 answers

A.Disable versioning on all buckets to save storage space.

B.Grant 'manage' permissions on the bucket to all anonymous users.

C.Enable Object Storage Object Lock in Compliance or Governance mode to enforce WORM retention policies.

D.Store all files without encryption to ensure faster deletion.

E.Implement least-privilege IAM policies restricting bucket deletion and management to authorized security groups.

AnswersC, E

Object Lock prevents objects from being deleted or overwritten during the specified retention period.

Why this answer

Object Storage Object Lock provides WORM capabilities, and IAM policies control who can manage or delete storage resources.

Full explanation →

169

MCQmedium

Your company operates a multi-region OCI deployment. Security policies dictate that encryption keys must never leave their respective home regions. How should you design your OCI Vault deployment?

A.Create a single global vault in the root tenancy that replicates master keys across all regions automatically.

B.Provision separate OCI Vaults and customer-managed keys in each region where workloads reside.

C.Use OCI Object Storage cross-region replication to copy encrypted keys to secondary regions.

D.Store all keys in the home region and use the OCI Service Gateway for remote decryption.

AnswerB

Provisioning regional vaults ensures that keys remain localized to their respective regions without crossing geographic boundaries.

Why this answer

OCI Vault keys are regional resources. To comply with data residency and security policies, you must provision separate vaults and master encryption keys in each operating region.

Full explanation →

170

Multi-Selecteasy

Which TWO of the following are key architectural benefits of adopting serverless OCI Functions compared to managing traditional container clusters for event-driven tasks?

Select 2 answers

A.Built-in requirement to configure manual Kubernetes Horizontal Pod Autoscalers

B.Guaranteed permanent container warm-start memory caching with zero cold starts ever

C.Full administrative root access to the underlying hypervisor and host operating system kernel

D.Automatic scaling from zero to thousands of executions based on incoming events without managing servers

E.Pay-as-you-go pricing model where you only pay for the exact execution time consumed down to the millisecond

AnswersD, E

Correct. Serverless functions scale automatically and require no server management.

Why this answer

OCI Functions provide automatic scaling down to zero and relieve operators from managing underlying infrastructure/servers.

Full explanation →

171

Multi-Selecthard

You are tasked with migrating a mission-critical three-tier enterprise application from an on-premises environment to OCI. The database tier uses Oracle RAC, and the application tier consists of stateless Java applications running on JBoss. Which TWO strategies or tools should be incorporated into the migration plan to ensure high availability and minimal downtime during cutover? (Choose two.)

Select 2 answers

A.Utilize Oracle Zero Downtime Migration (ZDM) to automate the database migration from on-premises RAC to OCI Exadata Database Service.

B.Rely exclusively on manual Oracle SQL*Plus scripts to perform a cold backup and restore across all tiers simultaneously.

C.Configure an OCI Load Balancer in front of the stateless application tier instances deployed across multiple fault domains to allow seamless traffic redirection during cutover.

D.Migrate the application tier using physical block-level cloning of the running JBoss server memory states.

E.Convert the database architecture immediately to MySQL HeatWave during the cutover window without schema validation.

AnswersA, C

ZDM streamlines complex database migrations including RAC-to-Exadata transformations with minimal downtime.

Why this answer

For Oracle RAC databases migrating to OCI, Oracle Zero Downtime Migration (ZDM) provides automated workflows. For stateless application tiers, deploying behind an OCI Load Balancer allows seamless shifting of traffic during cutover without session disruption.

Full explanation →

172

MCQhard

Your organization uses OCI Full Stack Disaster Recovery to manage failovers between Region A and Region B. During a DR drill, you notice that a custom user-defined step failed because the dependent compute instance in Region B was not yet fully running. How should you resolve this dependency issue in the FSDR plan?

A.Manually SSH into each instance during the drill to run the script.

B.Increase the OCI Compute instance shape size in Region B to boot faster.

C.Edit the DR plan group and add a dependency or adjust the sequence order so that the start compute step completes before the custom script step.

D.Disable all pre-checks in the FSDR plan settings.

AnswerC

FSDR plans support ordered groups and dependencies to ensure proper sequencing of recovery actions.

Why this answer

OCI Full Stack Disaster Recovery allows you to configure plan groups and dependencies, ensuring that steps (such as running scripts or starting applications) wait until prerequisite infrastructure steps (like starting compute instances) complete successfully.

Full explanation →

173

MCQmedium

An enterprise customer needs to restrict access to an OCI Object Storage bucket so that only requests originating from a specific Virtual Cloud Network (VCN) via a Service Gateway can read objects. Which combination of Identity and Access Management (IAM) and network policies should be implemented?

A.Configure a bucket policy that denies all read requests unless the request comes through a Service Gateway using the condition 'request.region, target.bucket.id, and request.network.source'.

B.Enable OCI Cloud Guard Security Zones on the compartment and automatically enforce a deny-all policy on the bucket.

C.Route all Object Storage traffic through a DRG (Dynamic Routing Gateway) and apply stateful network firewall rules to drop non-VCN traffic.

D.Create an IAM policy with the condition 'where request.vcn.id = <vcn-ocid>' and attach a security list to the VCN subnet allowing outbound traffic to Object Storage.

AnswerA

Object Storage bucket policies support advanced conditions such as request.network.source to restrict traffic exclusively to specified Service Gateways or VCNs.

Why this answer

To restrict access to a VCN via a Service Gateway, you must use IAM policy conditional statements utilizing the target.orcl.ocid for the service gateway or the request.vcn.id, combined with an appropriate Object Storage bucket policy or IAM policy.

Full explanation →

174

MCQmedium

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

A.Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

B.Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

C.Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.

D.Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

AnswerC

Correct. Logging Analytics supports configuring Object Storage as a log source for automated ingestion.

Why this answer

OCI Logging Analytics provides native Object Storage log ingestion capabilities where you can configure ingestion rules to pull and parse logs from designated Object Storage buckets.

Full explanation →

175

MCQmedium

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

A.Local Peering mode

B.Dynamic Routing (BGP) mode

C.FastConnect Partner mode

D.Static Routing mode

AnswerD

Static routing mode allows you to specify static CIDR blocks for the on-premises network.

Why this answer

OCI Site-to-Site VPN supports both dynamic routing (BGP) and static routing. You must select static routing and define the static CIDR routes for your on-premises network.

Full explanation →

176

MCQmedium

An application running on OCI compute instances requires disaster recovery protection. You want to replicate boot volumes and block volumes to a secondary region. Which OCI Block Volume feature facilitates this?

A.OCI File Storage cross-mount replication policies

B.Manual Object Storage export of raw volume blocks using dd commands

C.Real-time synchronous block volume mirroring via software RAID

D.Asynchronous cross-region block volume replication

AnswerD

Cross-region replication allows continuous replication of block and boot volumes to a target region for fast DR recovery.

Why this answer

OCI Block Volume provides asynchronous cross-region volume replication for both boot and block volumes, enabling disaster recovery without manual backup-and-restore steps.

Full explanation →

177

MCQmedium

An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?

A.OCI Application Performance Monitoring (APM)

B.OCI Logging Analytics

C.OCI Stack Monitoring

D.OCI Monitoring Service

AnswerC

Correct. Stack Monitoring discovers and monitors enterprise software stacks like WebLogic and Oracle Database.

Why this answer

OCI Stack Monitoring provides out-of-the-box discovery and monitoring of enterprise application stacks, including Oracle databases, WebLogic servers, and underlying host infrastructure.

Full explanation →

178

Multi-Selecthard

An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)

Select 3 answers

A.Dynamic Routing Gateway (DRG) for hybrid ingress/egress

B.OCI Internet Gateway for public IP resolution

C.OCI Email Delivery service for database alert routing

D.Virtual Cloud Network (VCN) acting as the transit and hosting environment

E.Private Endpoints associated with the Autonomous Database instance

AnswersA, D, E

The DRG terminates the FastConnect or VPN connection from on-premises.

Why this answer

Private hybrid access to Autonomous Database requires a Dynamic Routing Gateway (DRG) connected via FastConnect or VPN, a VCN, and a Service Gateway or Private Endpoint depending on whether it is Autonomous Database Dedicated/Shared (Shared uses Private Endpoints in the VCN, and hybrid traffic reaches them via DRG and VCN routing).

Full explanation →

179

MCQeasy

You need to trigger an OCI Function asynchronously whenever an object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the event router between Object Storage and the Function?

A.OCI DNS

B.OCI Events Service

C.OCI File Storage Service

D.OCI Data Transfer Service

AnswerB

Correct. OCI Events listens to resource state changes and triggers OCI Functions.

Why this answer

OCI Events service captures changes to OCI resources (like Object Storage uploads) and routes them to destinations such as OCI Functions.

Full explanation →

180

MCQhard

An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?

A.Active Data Guard with snapshot standby mode and automated cron-based switchovers.

B.Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.

C.Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.

D.Maximum Protection mode with asynchronous redo transport and manual failover scripts.

AnswerC

Maximum Availability mode with synchronous transport ensures zero data loss (RPO=0) while FSFO achieves an RTO under two minutes by automating failover.

Why this answer

Maximum Availability (Maximum Availability Architecture - MAA) mode with synchronous transport provides zero data loss (RPO = 0) and fast automatic failover via Fast-Start Failover (FSFO).

Full explanation →

181

MCQhard

An enterprise is implementing a multi-database architecture utilizing Oracle GoldenGate microservices on OCI Compute instances to replicate data between an operational Exadata database and an analytical Autonomous Data Warehouse. Which network security construct must be configured to allow communication between the GoldenGate deployment and the Autonomous Database instance?

A.Configure VCN security lists or Network Security Groups (NSGs) allowing outbound TCP port 1522 and inbound mTLS traffic, and supply the ADB wallet

B.Expose an API Gateway with public IP routing directly to the database undo tablespace

C.Configure a Local Peering Gateway with remote VCN route tables pointing to port 22

D.Attach an Internet Gateway directly to the Autonomous Database private IP address

AnswerA

Correct. Port 1522 is standard for Autonomous Database TCPS/mTLS connections, requiring appropriate NSG rules and the client wallet.

Why this answer

Autonomous Database requires mTLS connections and specific egress/ingress rules; when using GoldenGate to connect to Autonomous Database, the GoldenGate subnet must allow outbound traffic and connect using the appropriate wallet and port 1522.

Full explanation →

182

MCQeasy

You are planning the backup retention strategy for critical Oracle Base Database Service instances in OCI. You want to retain weekly backups for 12 months and daily backups for 30 days. Where are these automated backups stored by default?

A.In an OCI File Storage Service (FSS) mount target.

B.In a customer-managed Block Volume attached to the database compute instance.

C.In local temporary NVMe drives on the database node.

D.In an Oracle-managed Object Storage bucket inaccessible to direct user manipulation.

AnswerD

OCI automatically stores database backups in an isolated, secure Oracle-managed Object Storage location.

Why this answer

Automated database backups in OCI Base Database Service are stored securely in Oracle-managed Object Storage buckets that are isolated from the customer tenancy storage.

Full explanation →

183

MCQhard

You are designing a serverless data ingestion pipeline where OCI Functions are triggered by messages arriving in an OCI Stream. Under peak load, messages arrive faster than the functions can process them, causing invocation failures due to concurrency limits. How can you reliably buffer and throttle the event flow before invoking the functions?

A.Increase the OCI VCN bandwidth limit to maximum.

B.Enable public access on the OCI Functions application endpoint.

C.Configure OCI Object Storage lifecycle rules to delete excess messages.

D.Use OCI Queue between the stream and the functions, leveraging queue message visibility timeouts and batch polling.

AnswerD

Correct. OCI Queue buffers messages, provides visibility timeouts, and allows functions to poll batches at a controlled rate, avoiding concurrency limits.

Why this answer

Using OCI Queue or configuring OCI Streaming with a controlled polling mechanism/batching allows managing ingestion rates. Alternatively, OCI Queue natively supports batching and message locking, preventing concurrency overloads on OCI Functions.

Full explanation →

184

MCQmedium

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

A.DRG attachments and DRG Route Tables

B.Local Peering Gateway chaining

C.Internet Gateway route forwarding

D.Service Gateway cross-region peering

AnswerA

DRG route tables allow granular routing control across multiple VCN and hybrid attachments.

Why this answer

The DRG v2 architecture includes DRG attachments and DRG route tables, allowing you to centrally manage routing between multiple VCNs, remote VCN peering, and hybrid connections (FastConnect/VPN).

Full explanation →

185

Multi-Selecteasy

Which TWO of the following are valid methods to trigger an OCI Function execution?

Select 2 answers

A.OCI Identity and Access Management password rotation policy

B.OCI Events Service rule reacting to object storage or compute state changes

C.Direct physical USB drive insertion into OCI Exadata infrastructure

D.HTTP requests routed through OCI API Gateway

E.OCI Block Volume disk defragmentation schedule

AnswersB, D

Correct. OCI Events can trigger functions asynchronously.

Why this answer

OCI Functions can be invoked synchronously via HTTP requests (using API Gateway) or asynchronously via OCI Events service.

Full explanation →

186

MCQmedium

You are migrating a mission-critical multi-tier application from an on-premises data center to OCI. During the migration assessment phase, you identify that the application relies heavily on low-latency network communication (< 1ms round trip time) between the web tier and database tier. Which OCI architectural feature should you implement to satisfy this latency requirement?

A.Use OCI Local Peering Gateways (LPGs) to connect different Virtual Cloud Networks (VCNs) containing the tiers.

B.Utilize OCI Compute Placement Groups with a 'Cluster' strategy or deploy instances within the same Fault Domain with a strict locality policy.

C.Deploy the instances across different Availability Domains within the same OCI region.

D.Utilize OCI Compute Placement Groups with a 'Spread' strategy.

AnswerB

Cluster placement groups or strict proximity rules in placement groups place instances physically close together on the same underlying network fabric to achieve ultra-low latency.

Why this answer

OCI Compute Instances can be grouped into Compute Clusters (using Cluster Networks for HPC or Placement Groups for low latency) to ensure instances are physically close to each other within the data center, minimizing network latency.

Full explanation →

187

MCQhard

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

A.Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.

B.Configure an OCI Internet Gateway to peer with GCP Cloud DNS.

C.Attach a GCP VPC as a secondary VCN in the OCI console.

D.Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.

AnswerD

SDN exchange providers allow cross-connection between FastConnect and GCP Interconnect at Layer 2/3.

Why this answer

Using a third-party network virtualization appliance (such as Megaport Cloud Router or Equinix Fabric) to bridge OCI FastConnect and GCP Interconnect provides private multicloud connectivity.

Full explanation →

188

MCQeasy

What is the primary function of OCI Network Security Groups (NSGs)?

A.To balance HTTP/HTTPS traffic across multiple backend web servers.

B.To act as a virtual firewall that controls inbound and outbound traffic for a set of specifically chosen VNICs.

C.To encrypt data at rest in block storage volumes.

D.To manage human user passwords and multi-factor authentication.

AnswerB

NSGs provide granular, VNIC-level network traffic filtering.

Why this answer

NSGs provide virtual firewall rules that apply to a specific set of VNICs of your choosing, unlike Security Lists which apply to all VNICs in a subnet.

Full explanation →

189

MCQmedium

Your development team needs to deploy applications into an OCI Security Zone. They attempt to create a compute instance with a public IP address attached, but the operation fails. Why did this happen?

A.Security Zones explicitly prohibit public IP addresses on compute instances to prevent external exposure.

B.The VCN lacks an Internet Gateway.

C.The OCI Vault service is offline.

D.The team lacks IAM permissions to create compute instances.

AnswerA

Security Zones enforce maximum security policies, which include blocking public IP creation on compute resources.

Why this answer

Security Zones strictly prohibit resources from having public IP addresses to prevent accidental exposure to the internet, blocking non-compliant API requests.

Full explanation →

190

MCQhard

An incident response team needs to automatically isolate a compromised compute instance in OCI by revoking its network access while preserving its storage volumes for forensic analysis. Which sequence of actions should be automated using OCI Events and Functions?

A.Delete the VCN containing the instance to stop all routing.

B.Terminate the compute instance and delete all attached block volumes immediately.

C.Revoke the IAM user credentials of the administrator who launched the instance.

D.Update the instance's Network Security Groups (NSGs) to remove existing rules and apply a restrictive quarantine NSG that denies all traffic.

AnswerD

Applying a quarantine NSG instantly cuts off network communication for the instance while preserving OS memory and storage volumes for forensics.

Why this answer

To isolate a compromised instance while keeping volumes intact, the automated function should remove the instance's existing NSGs and attach a restrictive quarantine NSG that blocks all traffic, or disassociate its VNIC from active subnets, while leaving block volumes untouched.

Full explanation →

191

MCQmedium

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

A.Kubernetes Vertical Pod Autoscaler (VPA) with static CPU limits

B.OCI Autoscaling for OKE worker nodes

C.Kubernetes Horizontal Pod Autoscaler (HPA) integrated with Prometheus and Prometheus Adapter

D.OCI Instance Pool autoscaling configuration

AnswerC

Correct. Prometheus Adapter exposes custom metrics to the Kubernetes API server, enabling HPA to scale based on application-specific metrics.

Why this answer

Prometheus Adapter combined with the Horizontal Pod Autoscaler (HPA) allows Kubernetes to scale pods based on custom metrics scraped from Prometheus.

Full explanation →

192

MCQmedium

An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?

A.Create a single dynamic group containing all compute instances across the tenancies and attach a root-level policy.

B.Disable compartment security boundaries and assign all users to the Administrators group.

C.Define dynamic groups with matching rules that use specific compartment OCIDs or instance tags, and write targeted compartment-level policies.

D.Use IAM user credentials hardcoded inside the application configuration files on the compute instances.

AnswerC

Targeted compartment-level policies combined with precise dynamic group matching rules provide secure and isolated workload authentication.

Why this answer

Using fine-grained matching rules in dynamic groups based on specific compartment OCIDs or resource tags ensures that workloads only receive the exact permissions needed, adhering to the principle of least privilege.

Full explanation →

193

Multi-Selectmedium

Your organization is preparing to migrate several large Oracle databases to OCI using Oracle Data Pump. Which THREE best practices should you follow to optimize the export and import performance over network connections? (Choose three.)

Select 3 answers

A.Use the `PARALLEL` parameter during both export and import operations to utilize multiple worker processes.

B.Execute all Data Pump jobs from a local laptop connected via public Wi-Fi without compression.

C.Enable data compression using the `COMPRESS` parameter to minimize network transfer times.

D.Disable database undo tablespaces entirely during the Data Pump import phase.

E.Use network-linked Data Pump (`NETWORK_LINK`) to stream data directly from source to target database without generating intermediate dump files on disk.

AnswersA, C, E

Parallelism drastically reduces total export and import time for large databases by running multiple threads concurrently.

Why this answer

Data Pump performance can be significantly improved by using parallel execution (PARALLEL parameter), compressing dump files, and staging files on high-performance storage or directly streaming via network links.

Full explanation →

194

MCQeasy

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

A.OCI Identity and Access Management (IAM) dynamic groups

B.Network Security Group (NSG) ingress rules on the API Gateway subnet

C.Authentication policy using JWT validation

D.OCI Web Application Firewall (WAF) rate limiting rule

AnswerC

Correct. API Gateway supports JWT validation policies to verify incoming authorization tokens before passing requests to backends.

Why this answer

OCI API Gateway supports authentication and authorization policies, including JWT validation to verify tokens issued by third-party identity providers.

Full explanation →

195

MCQmedium

Your OKE cluster has multiple worker node pools. You want to ensure that a specific set of resource-intensive machine learning microservices pods are scheduled *only* on dedicated GPU worker nodes, preventing them from running on standard CPU worker nodes. Which Kubernetes feature should you apply to your pods and node pools?

A.Kubernetes taints on GPU node pools and corresponding tolerations on the specific workload pods

B.OCI Load Balancer backend set weighting rules

C.Kubernetes Horizontal Pod Autoscaler resource targets

D.OCI Identity and Access Management dynamic group policies

AnswerA

Correct. Taints repel pods unless the pod explicitly has a matching toleration, ensuring workloads land on designated nodes.

Why this answer

Kubernetes node taints and tolerations, combined with node selectors or node affinity, ensure pods are only scheduled onto nodes with matching taints.

Full explanation →

196

MCQmedium

Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?

A.Kubernetes Persistent Volume Claims with Block Storage

B.OCI Vault Master Encryption Key rotation

C.OCI IAM Workload Identity for OKE

D.OCI Bastion Service port forwarding

AnswerC

Correct. Workload Identity allows OKE pods to assume OCI IAM roles securely using Kubernetes service account tokens.

Why this answer

OCI IAM Workload Identity for OKE enables Kubernetes service accounts to be mapped to OCI IAM principals, allowing pods to authenticate to OCI services without storing long-lived credentials.

Full explanation →

197

MCQeasy

Your company is migrating static web assets and user-uploaded media files from an on-premises web server to OCI. The web application requires high durability, low latency, and global content delivery. Which OCI service should you use to store and serve these assets?

A.OCI Archive Storage

B.OCI File Storage Service

C.OCI Block Volume service

D.OCI Object Storage (Standard Tier)

AnswerD

Object Storage Standard tier provides durable, highly accessible storage for web assets and media.

Why this answer

OCI Object Storage provides highly durable, scalable cloud storage for unstructured data, and can be integrated with OCI Edge Services / Content Delivery Network (CDN) partners for rapid global delivery.

Full explanation →

198

MCQeasy

What is the purpose of OCI IAM federation with an external identity provider (IdP)?

A.To replicate OCI database backups to external cloud providers.

B.To allow users to authenticate to OCI using their existing corporate credentials via SAML 2.0.

C.To automatically provision network security groups across regions.

D.To bypass OCI encryption key management requirements.

AnswerB

Identity federation integrates external IdPs for single sign-on (SSO) into OCI.

Why this answer

Federation allows users to sign in to OCI using their corporate credentials managed by an external IdP (like Azure AD or Okta) via SAML 2.0.

Full explanation →

199

MCQhard

Your organization has strict security policies requiring all log data in OCI Logging to be encrypted using a customer-managed encryption key (CMK) stored in OCI Vault. How should you implement this?

A.Configure the OCI Logging Agent on compute instances with local disk encryption enabled via IAM policies.

B.Attach the master encryption key directly to each individual log object stored in Object Storage.

C.Assign a customer-managed master encryption key from OCI Vault to the Log Group in OCI Logging.

D.Use OCI Streaming to intercept logs and apply customer-managed keys before writing to OCI Logging.

AnswerC

Correct. Log groups support encryption via customer-managed keys in OCI Vault for enhanced data protection.

Why this answer

OCI Logging supports encrypting log groups using Customer-Managed Keys (CMK) from OCI Vault.

Full explanation →

200

MCQmedium

You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?

A.8 tunnels

B.4 tunnels

C.1 tunnel

D.2 tunnels

AnswerD

OCI provisions two tunnels by default for redundancy and high availability.

Why this answer

Each OCI Site-to-Site VPN connection provides two redundant IPsec tunnels terminating on different Oracle-side VPN gateway public IPs.

Full explanation →

201

MCQhard

An enterprise application running on Exadata Database Service on Dedicated Infrastructure experiences severe I/O contention due to a noisy neighbor batch reporting job. Which Exadata storage feature should you configure to isolate and guarantee I/O resources for critical online transaction processing (OLTP) workloads?

A.Exadata I/O Resource Management (IORM) with database-level resource plans

B.OCI Block Volume performance tiers (Higher VPU settings)

C.Autonomous Database concurrency limits in the OCI console

D.OCI Compute Auto-scaling configurations on the domU guest VMs

AnswerA

Correct. IORM manages and prioritizes I/O requests across multiple databases sharing the same Exadata storage cells.

Why this answer

Exadata Storage Server Resource Management (IORM) allows administrators to allocate I/O resource shares and limit bandwidth consumption for specific database workloads or consumer groups.

Full explanation →

202

Multi-Selecthard

Which THREE features are unique or heavily enhanced capabilities of Oracle Exadata Database Service on Dedicated Infrastructure compared to standard OCI Base Database systems? (Choose three.)

Select 3 answers

A.Native support for attaching external Microsoft Azure Blob Storage containers as ASM disk groups

B.Automatic index creation managed entirely by the local Linux kernel swap daemon

C.Exadata Storage Server Resource Management (IORM) for fine-grained I/O prioritization

D.Exadata Smart Flash Cache and Persistent Memory (PMEM) integration for ultra-low latency I/O

E.Exadata Smart Scan offloading database query processing to storage servers

AnswersC, D, E

Correct. IORM manages and prioritizes storage I/O across databases sharing Exadata cells.

Why this answer

Exadata Database Service offers unique architectural features such as Smart Scan, persistent memory flash cache, and IORM.

Full explanation →

203

MCQmedium

You are deploying OCI Full Stack Disaster Recovery (FSDR) to orchestrate a cross-region DR plan for a multi-tier application stack. Which component acts as the primary grouping mechanism for all application assets (databases, compute, load balancers) within a compartment?

A.Backup Policy Group

B.Disaster Recovery Protection Group (DR Protection Group)

C.OCI IAM Dynamic Group

D.Load Balancer Backend Set Group

AnswerB

A DR Protection Group contains the list of OCI resources (compute, databases, load balancers) that are part of the DR topology.

Why this answer

In OCI Full Stack Disaster Recovery, a Protection Group is created in each region to group the resources that need to be protected and recovered together.

Full explanation →

204

MCQmedium

You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?

A.OCI Block Volume cross-region replication

B.Cross-Region Autonomous Data Guard

C.Manual RMAN incremental backups copied to Object Storage in the remote region

D.Database Express Export/Import scheduled via cron

AnswerB

Autonomous Data Guard provides automated disaster recovery for Autonomous Database across regions with zero or near-zero RPO/RTO.

Why this answer

Autonomous Database supports cross-region Data Guard / Autonomous Data Guard, allowing you to configure a remote standby database with automatic failover capabilities.

Full explanation →

205

MCQeasy

Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?

A.Local Peering Gateway

B.NAT Gateway

C.Dynamic Routing Gateway (DRG)

D.Internet Gateway

AnswerC

The DRG is the hub for connecting VCNs to FastConnect, VPNs, and remote VCN peerings.

Why this answer

The Dynamic Routing Gateway (DRG) acts as the single router hub for all hybrid and inter-VCN connectivity in OCI.

Full explanation →

206

Multi-Selecthard

You are implementing zero-trust network security for an OKE microservices application using OCI Service Mesh. Which THREE capabilities does OCI Service Mesh provide to secure service-to-service communication?

Select 3 answers

A.Telemetry data collection including latency, error rates, and request volume metrics

B.Access control policies to restrict which services can communicate with each other

C.Automatic mutual TLS (mTLS) encryption for in-transit pod-to-pod communication

D.Direct hardware firewall ACL programming on physical Oracle Exadata rack switches

E.Automatic translation of Oracle Database PL/SQL stored procedures into REST APIs

AnswersA, B, C

Correct. Envoy proxies automatically collect and export rich telemetry metrics.

Why this answer

OCI Service Mesh provides mTLS encryption, traffic metrics/telemetry, and fine-grained traffic access control policies between services.

Full explanation →

207

MCQeasy

Which OCI service checks compute instances and container images for known software vulnerabilities and malware?

A.OCI Cloud Guard

B.OCI Vulnerability Scanning Service

C.OCI Identity and Access Management

D.OCI Application Performance Monitoring

AnswerB

VSS automatically scans compute hosts and container images to identify security flaws and vulnerabilities.

Why this answer

OCI Vulnerability Scanning Service (VSS) routinely inspects host operating systems and container images for security vulnerabilities and missing patches.

Full explanation →

208

Multi-Selecteasy

Which TWO types of logs are natively generated and accessible within OCI Logging without requiring agent installation on compute instances?

Select 2 answers

A.Custom database trace files generated inside a self-managed MySQL database on a VM

B.Custom application log files stored in /var/log/app.log inside a compute instance

C.OCI Audit logs

D.Third-party firewall logs running on local virtual appliances

E.OCI VCN Flow logs

AnswersC, E

Correct. Audit logs are generated natively for all tenancies.

Why this answer

OCI Audit logs and OCI Service logs (such as VCN flow logs, load balancer access logs, and API gateway logs) are generated natively by OCI services without installing agents.

Full explanation →

209

MCQmedium

You are migrating an enterprise application that requires strict compliance and regulatory isolation. The application must run on dedicated physical hardware where no other customer's virtual instances can reside. Which OCI compute provisioning model should you choose?

A.OCI Dedicated VM Hosts

B.OCI Standard Multi-Tenant Compute Instances with high-density shapes

C.OCI Burstable Instances

D.OCI Container Instances

AnswerA

Dedicated VM Hosts provide physical server instances dedicated solely to your organization, meeting strict isolation and compliance requirements.

Why this answer

OCI Dedicated Virtual Host or Dedicated Compute Instances (Bare Metal or Dedicated VM Hosts) provide single-tenant hardware isolation where all VMs running on the host belong exclusively to a single tenant.

Full explanation →

210

MCQhard

An architect is designing a database migration from an on-premises Oracle Database (Non-CDB structure) to an OCI Autonomous Database (Serverless). Which migration method is mandatory because of the architectural constraints of Autonomous Database?

A.Logical migration using Oracle Data Pump or Oracle Zero Downtime Migration (logical workflow)

B.Direct block-level storage snapshot replication using OCI Block Volume replication

C.RMAN transportable tablespaces with physical file conversion

D.Physical standby database via Oracle Data Guard broker

AnswerA

Because Autonomous Database is a managed cloud service with strict security and architectural bounds, logical migration via Data Pump or ZDM logical mode is required.

Why this answer

OCI Autonomous Database restricts direct low-level OS access and traditional physical database structures, requiring logical migration methods such as Oracle Data Pump, SQL Developer, or Zero Downtime Migration using logical transport mechanisms.

Full explanation →

211

MCQeasy

You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?

A.OCI File Storage Service mounted on all worker nodes

B.Kubernetes NodePort service directly pointing to every individual pod

C.OCI API Gateway without any OKE Ingress

D.OCI Native Ingress Controller configured with an OCI Load Balancer

AnswerD

Correct. The native OCI Ingress Controller integrates with OKE and provisions an OCI Load Balancer to route traffic based on path and host rules.

Why this answer

OCI Native Ingress Controller for OKE allows you to configure routing rules based on paths and hosts, leveraging an OCI Load Balancer to handle traffic routing and external exposure efficiently.

Full explanation →

212

MCQhard

Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?

A.Configure a local peering route to the Azure ExpressRoute circuit.

B.Add a route pointing the Azure VNet CIDR to the Internet Gateway.

C.Add a route in the DRG route table pointing the Azure VNet CIDR to the FastConnect virtual circuit attachment.

D.Attach an Azure VNet directly as a subnet inside the OCI VCN.

AnswerC

The DRG route table must direct traffic destined for Azure's CIDR blocks to the cross-cloud ExpressRoute virtual circuit.

Why this answer

The DRG must have an import route distribution or static/dynamic route entries pointing the Azure VNet CIDR blocks toward the virtual circuit attachment associated with the Azure ExpressRoute.

Full explanation →

213

MCQeasy

Which OCI service continuously monitors your cloud resources for security misconfigurations and risky operational behaviors, providing a unified security score for your tenancy?

A.OCI Audit.

B.OCI Web Application Firewall.

C.OCI Vulnerability Scanning Service.

D.OCI Cloud Guard.

AnswerD

Cloud Guard aggregates security findings across the tenancy and computes a security score to help assess posture.

Why this answer

OCI Cloud Guard provides continuous monitoring of your OCI resources for security vulnerabilities, configuration drifts, and risky user behaviors.

Full explanation →

214

Multi-Selectmedium

When planning a migration of Oracle databases to Oracle Autonomous Database (Serverless), which THREE migration methods or tools are natively supported or recommended by Oracle?

Select 3 answers

A.Oracle SQL Developer migration workbench / Data Loading features.

B.Oracle Zero Downtime Migration (ZDM) service.

C.Directly attaching on-premises ASM disk groups via iSCSI to the Autonomous container.

D.Oracle Data Pump (import/export).

E.Direct physical RMAN full database restore to Autonomous storage.

AnswersA, B, D

SQL Developer supports data loading and schema migration to Autonomous Database.

Why this answer

Autonomous Database Serverless supports specific migration paths including Oracle Zero Downtime Migration, Data Pump, and SQL Developer migration assistants.

Full explanation →

215

Multi-Selecteasy

Which TWO tools or interfaces can administrators use to manage Oracle Autonomous Database instances in OCI? (Choose two.)

Select 2 answers

A.Local floppy disk drive image uploads

B.Windows Remote Desktop Connection (RDP) to the Autonomous database hypervisor

C.Direct physical serial console cable attached to Exadata rack blades

D.OCI Command Line Interface (CLI) and REST APIs

E.Oracle Cloud Infrastructure (OCI) Console

AnswersD, E

Correct. CLI and APIs enable programmatic management.

Why this answer

Autonomous Database can be managed via the OCI Console and the OCI CLI/API.

Full explanation →

216

MCQmedium

Your organization requires the migration of 300 TB of backup archives from an on-premises data center to OCI Object Storage. The local internet connection is limited to 100 Mbps, and corporate compliance mandates that data cannot traverse the public internet unencrypted. Which solution should you select to meet these constraints?

A.Order an OCI Data Transfer Appliance, load the encrypted backup data locally, and ship the appliance to the designated Oracle data center.

B.Deploy an OCI Storage Gateway on-premises and cache all 300 TB locally while syncing in real-time.

C.Use Oracle GoldenGate to replicate backup files block-by-block to Object Storage.

D.Stream the backups continuously over a secure IPsec VPN tunnel using rclone.

AnswerA

The OCI Data Transfer Service is designed precisely for petabyte-scale offline data migrations when network bandwidth is a bottleneck.

Why this answer

Given the massive dataset size and limited internet bandwidth, physical offline migration using the OCI Data Transfer Portal and Data Transfer Appliance is the most efficient and compliant path. Furthermore, data is encrypted prior to export.

Full explanation →

217

Multi-Selecteasy

An architect is designing a lift-and-shift migration strategy for an enterprise running diverse workloads on-premises. Which TWO of the following factors should be evaluated when deciding whether to choose a lift-and-shift (rehost) approach versus a re-architect approach? (Choose two.)

Select 2 answers

A.Migration timeline urgency and available project budget

B.Whether the on-premises facility uses carpeted floors

C.The physical color of the server bezels in the on-premises rack

D.The brand of office coffee machine currently installed in the data center

E.Availability of source application source code and developer resources

AnswersA, E

Lift-and-shift is faster and cheaper upfront compared to rewriting code for cloud-native services.

Why this answer

Lift-and-shift is fast and preserves application compatibility but may not take advantage of cloud-native elasticity or cost-saving PaaS features. Re-architecting takes longer and costs more upfront but optimizes for cloud efficiency.

Full explanation →

218

MCQhard

You are planning to migrate a large, mission-critical Oracle Database (12.1.0.2) on-premises to Exadata Database Service on Dedicated Infrastructure in OCI. The migration requires minimal downtime and must handle cross-endian platform conversion since the source is IBM AIX. Which migration tool and strategy combination is most appropriate?

A.Oracle Zero Downtime Migration (ZDM) with physical online migration workflow.

B.Oracle GoldenGate for real-time replication with initial load via datapump.

C.Oracle Data Pump transportable tablespaces with RMAN cross-platform incremental backup.

D.Standard RMAN backup and restore directly from an on-premises NFS mount to OCI Object Storage.

AnswerC

RMAN cross-platform incremental backup handles the endian conversion of datafiles efficiently, while Data Pump transports metadata, ensuring minimal downtime.

Why this answer

For cross-endian migrations of large databases with minimal downtime, Oracle Data Pump transportable tablespaces combined with Cross-Platform Incremental Backup using RMAN is the recommended and most efficient approach.

Full explanation →

219

Multi-Selecthard

An organization requires high security for its cryptographic keys stored in OCI Vault. Which THREE architectural practices must be enforced when configuring and using Master Encryption Keys (MEKs)?

Select 3 answers

A.Apply least-privilege IAM policies separating the management of Vaults/Keys from the cryptographic operations (crypto-admin vs crypto-user).

B.Use Virtual Vaults for development environments and Hardware Security Module (HSM) protected Vaults with FIPS 140-2 Level 3 validation for production.

C.Store the Vault master key backup passphrases in plain text inside an Object Storage bucket for easy disaster recovery access.

D.Share the Vault master encryption key directly across all global regions to simplify multi-region database encryption.

E.Implement automated or manual key rotation policies for your Master Encryption Keys to limit the blast radius of a compromised key.

AnswersA, B, E

Separation of duties requires distinct roles for managing vaults/keys versus invoking encrypt/decrypt operations.

Why this answer

Key management best practices include using Hardware Security Modules (HSMs) of FIPS 140-2 Level 3 validation, rotating keys periodically, and restricting access to keys using strict IAM policies and Vault management operations.

Full explanation →

220

Multi-Selectmedium

Which TWO of the following statements are correct regarding the OCI-Azure Interconnect? (Choose TWO)

Select 2 answers

A.It requires public IP addresses on all Azure Virtual Machines for cross-cloud routing.

B.It provides low-latency, dedicated private connectivity between OCI Virtual Cloud Networks and Azure Virtual Networks.

C.It requires the customer to pay standard OCI and Azure egress data transfer fees across the interconnect.

D.It is available in every OCI region globally without exception.

E.It connects OCI FastConnect directly to Azure ExpressRoute in supported multicloud regions.

AnswersB, E

The primary goal is low-latency private connectivity between VCNs and VNets.

Why this answer

The OCI-Azure Interconnect provides low-latency, high-throughput direct connectivity between OCI and Azure in supported regions. It utilizes FastConnect on the OCI side and ExpressRoute on the Azure side, and does not incur egress data transfer charges between the clouds.

Full explanation →

221

MCQmedium

You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?

A.Traffic cannot be routed between the on-premises network and OCI over FastConnect.

B.Traffic automatically fails over to the Internet Gateway.

C.OCI automatically falls back to an unencrypted IPSec VPN tunnel.

D.The FastConnect port is administratively disabled by Oracle.

AnswerA

BGP is required for route propagation; without it, connectivity over FastConnect is down.

Why this answer

Without BGP, route prefixes are not exchanged, meaning traffic cannot be routed between the on-premises network and the OCI VCN over FastConnect.

Full explanation →

222

MCQhard

An enterprise is migrating a legacy Java application that requires sticky sessions and complex path-based routing rules to OCI. The migration plan requires zero dropped connections during backend server updates. Which OCI Load Balancer configuration feature should you implement?

A.Enable IP Hash load balancing policy without health checks.

B.Use OCI Web Application Firewall (WAF) rate limiting rules to drop incoming traffic during maintenance.

C.Configure backend server draining with a specified timeout period in the backend set.

D.Configure a Layer 4 TCP Network Load Balancer with TCP session persistence disabled.

AnswerC

Backend draining ensures active client requests finish processing before a server is taken out of rotation during deployments or cutovers.

Why this answer

OCI Load Balancer supports backend set draining (draining timeout), which allows existing established connections to complete gracefully while new connections are routed to updated backend servers.

Full explanation →

223

Multi-Selecthard

You are migrating a tiered enterprise application suite to OCI. Certain legacy components require specific static MAC addresses and direct layer 2 broadcast communication, which standard OCI virtual cloud networks (VCNs) do not support by default. Which THREE OCI architectural approaches or features can you utilize to solve this requirement? (Choose three.)

Select 3 answers

A.Deploy Oracle Cloud VMware Solution (OCVS), which provides a fully dedicated VMware SDDC environment supporting standard VLANs and layer 2 guest networking.

B.Use OCI Bare Metal compute instances that support SR-IOV (Single Root I/O Virtualization) for direct hardware network access and custom MAC configurations.

C.Enable OCI Load Balancer TCP termination without backend health checks.

D.Configure OCI VCN VNICs with customized MAC addresses where supported or utilize secondary private IPs with IP aliasing.

E.Rely on standard OCI Internet Gateways to bridge layer 2 broadcast domains across the public internet.

AnswersA, B, D

OCVS supports VMware NSX and standard VLANs, preserving layer 2 networking requirements.

Why this answer

Standard VCN virtual network interfaces (VNICs) have dynamic MAC addresses and do not support layer 2 broadcasts. To support L2 networking or custom MAC requirements, architects can utilize Oracle Cloud VMware Solution (OCVS), Bare Metal instances with SR-IOV, or OCI Flexible Virtual NIC options with spoof checking disabled.

Full explanation →

224

MCQmedium

Your organization requires all newly created compartments to automatically enforce security best practices, such as prohibiting public Object Storage buckets and ensuring audit logs are never disabled. Which OCI feature is best suited to achieve this?

A.OCI IAM compartments with default root-level policies.

B.OCI Cloud Guard targets with active detector recipes.

C.OCI Network Security Groups (NSGs) applied to the VCN.

D.OCI Security Zones.

AnswerD

Security Zones enforce maximum security policies upon resource creation and block any action that violates these policies.

Why this answer

OCI Security Zones enforce strict guardrails by automatically validating resource creation and configuration changes against a predefined set of security policies, preventing non-compliant actions.

Full explanation →

225

Multi-Selectmedium

An administrator is planning an enterprise cost optimization and observability strategy in OCI. Which THREE native tools or reports can be utilized to analyze cloud spend, allocate costs, and optimize resource utilization?

Select 3 answers

A.OCI Cost Analysis dashboards

B.OCI Streaming Service Cost Estimator

C.OCI Detailed Usage Reports (downloadable CSVs in Object Storage)

D.OCI Logging Analytics Cost Module

E.OCI Budgets

AnswersA, C, E

Correct. Cost Analysis provides visual charts and filters to analyze spending trends.

Why this answer

OCI Cost Analysis, OCI Budgets, and Detailed Usage Reports (delivered as CSV files to Object Storage) are the primary tools used for cost observability, tracking, and budgeting in OCI.

Full explanation →

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 151–225