Courseiva

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 226–274

274 questions total · 4 pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 4

226
MCQeasy

You are using Fn Project CLI to deploy an OCI Function. Which command is used to build, push, and deploy the function to your application in OCI in a single streamlined step?

A.oci functions function create
B.kubectl apply -f function.yaml
C.docker build and docker push only
D.fn deploy --app <app-name>
AnswerD

The fn deploy command packages the function, pushes the image to the configured registry, and creates or updates the function within the specified application. Supplying --app targets that application, completing build, push and deploy in one streamlined invocation.

Why this answer

The Fn Project CLI command 'fn deploy --app <app-name>' performs the full lifecycle in one step: it builds the function image from the func.yaml, pushes it to the configured Docker registry (such as OCIR), and creates or updates the function and its route in the specified OCI Functions application. This is the canonical streamlined deployment command used with OCI Functions.

Exam trap

1Z0-997-26 often tests whether candidates know the difference between the Fn Project CLI (fn) and the raw OCI CLI (oci), so the trap is selecting an oci functions command that only manages metadata instead of the fn deploy command that builds, pushes, and deploys in one step.

How to eliminate wrong answers

Option A is wrong because 'oci functions function create' is a raw OCI CLI command that only creates the function resource metadata — it does not build or push the container image, so it is not a single streamlined step. Option B is wrong because 'kubectl apply -f function.yaml' is a Kubernetes manifest operation and OCI Functions is not deployed via kubectl manifests. Option C is wrong because 'docker build' and 'docker push' only produce and upload the image; they do not register or deploy the function into an OCI Functions application.

Full explanation →
227
MCQhard

An organization has multiple child compartments under a parent compartment. A security architect needs to write an IAM policy that allows a specific developer group to manage compute instances across all child compartments without granting permissions at the root tenancy level. How should this policy be structured?

A.Allow group Developers to manage compute-instances in compartment ParentCompartment
B.Allow group Developers to manage compute-instances in tenancy
C.Allow group Developers to manage compute-instances in root
D.Write individual policies for every single child compartment separately without referencing the parent.
AnswerA

Placing the policy on the parent compartment lets the Developers group manage compute instances in every child compartment through Oracle Cloud Infrastructure's compartment hierarchy inheritance, since child compartments inherit parent policies. This satisfies the requirement of covering all child compartments without granting root tenancy-level permissions.

Why this answer

OCI IAM policies are hierarchical: a policy statement that grants access at a parent compartment automatically applies to all child compartments within that hierarchy. By writing the policy at ParentCompartment, the developer group gets manage permissions on compute instances in all child compartments without granting tenancy-wide access. This follows the principle of least privilege while meeting the requirement.

Exam trap

1Z0-997-26 often tests the misconception that you must write policies for each child compartment individually — candidates must remember that OCI policies inherit down the compartment hierarchy, so a parent-level policy covers all children.

How to eliminate wrong answers

Option B is wrong because granting 'manage compute-instances in tenancy' gives permissions across the entire tenancy, including compartments outside the parent, violating the requirement to avoid root-level access. Option C is wrong because 'in root' is not valid OCI policy syntax — the root compartment is referred to as 'tenancy' in policies, and using 'root' would cause a policy error. Option D is wrong because writing individual policies for every child compartment is operationally inefficient and error-prone; OCI's hierarchical inheritance makes a single parent-level policy sufficient and more maintainable.

Full explanation →
228
MCQhard

An enterprise is migrating a cluster of microservices running on Kubernetes from an on-premises data center to OCI Container Engine for Kubernetes (OKE). The cluster uses custom CNI (Container Network Interface) plugins and persistent storage backed by an on-premises Ceph cluster. During migration planning, how should you architect the persistent storage layer in OCI to support OKE stateful workloads?

A.Use ephemeral container scratch space for all persistent state requirements in OKE.
B.Mount the on-premises Ceph cluster directly inside OKE worker nodes using public IP addresses over an internet gateway.
C.Install the OCI Block Volume and OCI File Storage CSI drivers in the OKE cluster to dynamically provision persistent storage volumes.
D.Store all database and application state inside OCI Object Storage bucket folders mounted via local loop devices.
AnswerC

The OCI Block Volume and File Storage CSI drivers let OKE dynamically provision PersistentVolumes backed by OCI Block Volume and File Storage, replacing the on-premises Ceph layer. This satisfies the requirement for persistent storage supporting stateful workloads after migration.

Why this answer

OCI Block Volume and OCI File Storage CSI drivers integrate with OKE to dynamically provision PersistentVolumes backed by OCI Block Volume (for ReadWriteOnce block storage) and OCI File Storage (for ReadWriteMany NFS storage). This replaces the on-premises Ceph-backed persistent storage with native OCI storage that supports stateful workloads, snapshots, and dynamic provisioning. The CSI drivers are the supported mechanism for persistent storage in OKE and align with Kubernetes storage classes.

Exam trap

1Z0-997-26 often tests whether candidates assume Object Storage can serve as a POSIX-compliant persistent volume, leading them to pick the Object Storage loop-device option instead of the CSI drivers.

How to eliminate wrong answers

Option A is wrong because ephemeral container scratch space is non-persistent and is lost when the pod restarts or is rescheduled, which is unacceptable for stateful microservices. Option B is wrong because mounting an on-premises Ceph cluster over public IPs via an internet gateway is insecure, high-latency, and not a supported OCI architecture for OKE persistent storage. Option D is wrong because OCI Object Storage is an object store, not a block or file system, and mounting bucket folders via local loop devices is not a supported or reliable method for database and application state.

Full explanation →
229
MCQeasy

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

A.OCI Events Service
B.OCI GoldenGate
C.OCI DevOps Service
D.OCI Resource Manager
AnswerC

OCI DevOps Service supplies native build and deployment pipelines, with build runners executing your test and build stages and deployment pipelines releasing artefacts to targets such as OKE or Compute. It integrates directly with OCI Git repositories and external Git providers, satisfying the stem's requirement to trigger automated build, test, and deployment on every code push.

Why this answer

OCI DevOps Service is Oracle Cloud Infrastructure's native CI/CD platform, providing build pipelines, deployment pipelines, and artifact repositories that integrate directly with Git repositories. It automates the build, test, and deployment phases triggered by code pushes, making it the correct choice for native CI/CD on OCI. The other services serve different purposes such as event handling, data replication, or infrastructure-as-code.

Exam trap

The trap is confusing OCI DevOps with other OCI services that sound related (Events, Resource Manager), when only OCI DevOps provides native CI/CD pipeline functionality.

How to eliminate wrong answers

Option A is wrong because OCI Events Service is a publish-subscribe service for reacting to state changes in OCI resources; it can trigger actions but does not itself provide CI/CD pipelines. Option B is wrong because OCI GoldenGate is a data replication and integration service, not a CI/CD tool. Option D is wrong because OCI Resource Manager is a Terraform-based infrastructure-as-code service for provisioning resources, not for building and deploying application code.

Full explanation →
230
MCQeasy

Your organization is migrating a high-throughput transactional database to OCI. During peak business hours, the database experiences massive I/O bursts. You want to ensure the underlying storage configuration can scale its IOPS independently of storage capacity. Which OCI block volume feature should you enable?

A.OCI Object Storage Infrequent Access tier
B.OCI File Storage Service snapshot policies
C.OCI Local NVMe RAID striping
D.OCI Block Volume Auto-Tune performance feature or manual VPU adjustment.
AnswerD

Auto-Tune lets you raise volume performance units (VPUs) independently of volume size, so IOPS scales without provisioning extra capacity. This directly satisfies the stem's requirement for independent IOPS scaling during peak I/O bursts, since capacity-based tiers would otherwise force you to over-provision storage to gain throughput.

Why this answer

OCI Block Volume's Auto-Tune feature (or manual VPU adjustment) allows you to change performance independently of capacity, scaling IOPS and throughput up or down without resizing the volume. This directly addresses the requirement for independent IOPS scaling during I/O bursts. Auto-Tune can be set to monitor and adjust VPUs based on demand, or you can manually set a higher VPU.

Exam trap

1Z0-997-26 often tests Block Volume performance — candidates confuse capacity with performance and pick storage tiers or instance-local NVMe instead of the VPU/Auto-Tune mechanism.

How to eliminate wrong answers

Option A is wrong because Object Storage Infrequent Access is an object storage tier for cold data, not block storage, and does not provide IOPS scaling for databases. Option B is wrong because File Storage snapshot policies are for data protection, not performance tuning. Option C is wrong because Local NVMe RAID striping is instance-local storage that is ephemeral and not a Block Volume feature; it also does not scale independently of the instance.

Full explanation →
231
MCQmedium

Your OKE cluster has autoscaling enabled using the Kubernetes Cluster Autoscaler. However, during peak hours, new pods remain in 'Pending' state for 15 minutes before the cluster autoscaler provisions new worker nodes. How can you reduce this provisioning delay?

A.Deploy Kubernetes over-provisioning pods (pause pods) with lower priority to keep spare node capacity ready instantly.
B.Convert all worker nodes from virtual machines to bare metal shapes.
C.Increase the OCI Load Balancer bandwidth shape to maximum.
D.Disable OCI IAM token caching on worker nodes.
AnswerA

Over-provisioning pause pods with low priority reserve idle node capacity, so pending workload pods pre-empt them immediately rather than waiting for the Cluster Autoscaler to react. This directly removes the 15-minute scale-up delay during peak hours, since capacity already exists and no node provisioning cycle is triggered.

Why this answer

Over-provisioning pods (low-priority pause pods) reserve spare capacity on existing nodes so that when a real workload pod is scheduled, it can immediately preempt the pause pod and start running without waiting for the Cluster Autoscaler to provision a new node. This eliminates the 15-minute node provisioning delay during peak hours.

Exam trap

1Z0-997-26 often tests whether candidates understand that autoscaler latency is a scheduling problem solvable with priority-based over-provisioning, not a hardware or networking problem, tricking them into choosing bare metal or load balancer options.

How to eliminate wrong answers

Option B is wrong because bare metal shapes still require provisioning time and do not inherently reduce the autoscaler's node startup latency; they may even be slower to provision. Option C is wrong because load balancer bandwidth affects traffic throughput, not pod scheduling or node provisioning delays. Option D is wrong because IAM token caching on worker nodes is unrelated to the time it takes the Cluster Autoscaler to detect pending pods and provision new nodes.

Full explanation →
232
MCQhard

Your security team mandates that all traffic entering your OCI VCN from the internet must be inspected by a next-generation firewall before reaching backend web servers. How should you design this architecture?

A.Attach public IP addresses directly to all backend web servers.
B.Rely entirely on default VCN Security Lists without route table modifications.
C.Route inbound traffic from the Internet Gateway through a firewall appliance subnet before forwarding it to backend subnets via route tables.
D.Use OCI Object Storage to filter incoming HTTP packets.
AnswerC

Directing Internet Gateway traffic into a firewall appliance subnet, then routing to backend subnets via route tables, forces all inbound flows through inspection. This satisfies the mandate that internet traffic be inspected before reaching web servers.

Why this answer

To force all inbound internet traffic through a next-generation firewall before it reaches backend web servers, you place the firewall appliance in its own subnet and use route tables to steer traffic: the Internet Gateway routes inbound traffic to the firewall subnet, and the firewall subnet's route table forwards inspected traffic to the backend subnet. This is the standard hub-and-spoke or DMZ architecture in OCI, where the firewall is the next hop for the backend subnet's ingress path.

Exam trap

1Z0-997-26 often tests whether candidates understand that security lists alone do not provide inspection — the trap is picking 'default security lists' or 'public IPs' instead of the route-table-based firewall insertion.

How to eliminate wrong answers

Option A is wrong because attaching public IPs directly to backend servers bypasses the firewall entirely — traffic reaches the servers without inspection, violating the security mandate. Option B is wrong because default security lists only provide stateless packet filtering at the subnet level; they do not perform next-generation inspection, and without route table changes traffic cannot be redirected through a firewall. Option D is wrong because Object Storage is a data storage service and cannot filter or inspect HTTP packets — it has no role in network traffic inspection.

Full explanation →
233
Multi-Selectmedium

Which THREE features are provided by OCI Application Performance Monitoring (APM)?

Select 3 answers
A.Distributed Tracing across microservices
B.Automatic provisioning of bare metal database backups
C.Real User Monitoring (RUM) to track end-user browser performance
D.Management of BGP routing tables for FastConnect
E.Synthetic Monitoring using browser and script-based tests
AnswersA, C, E

Distributed tracing follows a request across microservice boundaries, capturing span timing and causal relationships to pinpoint latency bottlenecks. This satisfies the stem's requirement for an APM capability, since OCI APM natively ingests trace data from instrumented services, unlike infrastructure monitoring tools that report only host-level metrics.

Why this answer

OCI Application Performance Monitoring (APM) provides Distributed Tracing across microservices (A), which lets you follow a single request through multiple services and identify latency or errors in the call chain. It also provides Real User Monitoring (RUM) (C), which captures browser-side performance data from actual end users via a JavaScript agent. Additionally, APM offers Synthetic Monitoring (E) using browser and script-based tests to proactively simulate user interactions and measure availability and performance.

Options B and D are incorrect because automatic bare metal database backups are a database service capability, and BGP routing table management for FastConnect belongs to OCI networking, not APM.

Exam trap

1Z0-997-26 often tests whether candidates confuse APM (application-level tracing/RUM/synthetic) with infrastructure monitoring (Monitoring) or database services, so they pick backup or BGP options that belong elsewhere.

Full explanation →
234
MCQeasy

You are provisioning an Autonomous Data Warehouse (ADW) instance and want to configure network access so that only specific corporate IP addresses can connect to the database. Which feature should you enable?

A.Autonomous Database Access Control Lists (ACLs).
B.Virtual Cloud Network (VCN) Security Lists only.
C.OCI Web Application Firewall (WAF) rule sets.
D.OCI Identity and Access Management (IAM) dynamic groups.
AnswerA

ACLs restrict connections to a defined list of allowed CIDR blocks or IP addresses at the network layer, so only the specified corporate ranges can reach the ADW instance. This directly satisfies the requirement to permit specific corporate IPs while blocking all other sources.

Why this answer

Autonomous Database Access Control Lists (ACLs) are the native ADB feature that restricts connections to a defined set of public IP addresses or CIDR blocks, or to a private endpoint. Enabling an ACL on the ADW instance ensures only the specified corporate IP ranges can reach the database listener, satisfying the requirement directly.

Exam trap

The trap is assuming VCN Security Lists apply to Autonomous Database — ADB is a managed service outside the customer VCN unless a private endpoint is configured, so subnet-level Security Lists do not govern its public listener.

How to eliminate wrong answers

Option B is wrong because VCN Security Lists control traffic at the subnet/VNIC layer for resources inside a VCN, but ADW is a managed service whose endpoint is not directly governed by customer Security Lists unless accessed via private endpoint. Option C is wrong because OCI WAF protects HTTP/HTTPS web applications, not the Oracle SQL*Net protocol used by ADW. Option D is wrong because IAM dynamic groups grant permissions to OCI resources for principals — they do not restrict which source IPs can connect to a database.

Full explanation →
235
MCQmedium

An enterprise application hosted on OCI requires high availability across multiple fault domains within a single availability domain. Which resource placement strategy should you use for your application compute instances?

A.Distribute instances evenly across three different Fault Domains.
B.Configure a dedicated virtual cloud network for each fault domain.
C.Attach all instances to separate Internet Gateways.
D.Place all instances in Fault Domain 1 to optimize network latency.
AnswerA

Fault domains are independent groupings of hardware within a single availability domain, each with separate power and network. Spreading instances evenly across all three fault domains ensures that failure of one domain does not take down the application, satisfying the multi-fault-domain HA requirement.

Why this answer

Within a single availability domain, fault domains are independent groupings of hardware with separate power and network. Distributing compute instances evenly across the three fault domains ensures that a hardware failure in one fault domain does not take down the entire application, which is the correct HA strategy at the AD-internal level.

Exam trap

The trap is confusing fault domains with availability domains or thinking a single fault domain is sufficient; the exam expects you to know that within one AD, spreading across the three fault domains is the correct HA placement strategy.

How to eliminate wrong answers

Option B is wrong because creating a separate VCN per fault domain adds unnecessary complexity and does not improve fault tolerance; VCNs are regional constructs and fault domains are within an AD, so this mapping is neither required nor beneficial. Option C is wrong because attaching instances to separate Internet Gateways does not provide fault tolerance and is not a valid HA pattern; an Internet Gateway is a VCN-level component, and multiple IGWs per VCN are not the mechanism for fault-domain resilience. Option D is wrong because placing all instances in Fault Domain 1 concentrates risk in a single fault domain, so a failure there would take down the whole application, directly contradicting the HA requirement.

Full explanation →
236
MCQhard

You are configuring transparent data encryption (TDE) for an Oracle Database on Exadata Database Service using OCI Vault for master encryption key management. What happens if the database loses connectivity to the OCI Vault key management service?

A.The database instantly crashes and forces an immediate failover to the standby database
B.The database automatically falls back to self-managed wallet storage without alerting administrators
C.The database continues to run using keys cached in memory for a period, but cannot be restarted until connectivity to OCI Vault is restored
D.All encrypted data files are automatically wiped to prevent security breaches
AnswerC

OCI Vault connectivity loss does not halt a running database: the TDE master key remains cached in memory, so operations continue. However, restart requires re-fetching the key, so the instance cannot come back up until Vault is reachable again.

Why this answer

When TDE uses OCI Vault as the external key management service, the database caches the master encryption key in memory after first retrieval. If connectivity to OCI Vault is lost, running instances continue to operate using the cached key, but any restart or new instance mount fails because the key cannot be fetched to open the TDE wallet. This is the documented behavior for external key management with TDE.

Exam trap

1Z0-997-26 often tests the misconception that losing Vault connectivity immediately crashes the database; the trap is ignoring the in-memory key cache that keeps running instances alive.

How to eliminate wrong answers

Option A is wrong because the database does not instantly crash on Vault connectivity loss; it continues running with cached keys, and failover is not automatic. Option B is wrong because there is no silent fallback to a self-managed wallet; the database cannot switch key stores without reconfiguration, and administrators are alerted. Option D is wrong because encrypted data files are never wiped automatically; that would be catastrophic data loss and is not a TDE behavior.

Full explanation →
237
Multi-Selecthard

Which TWO architectural best practices should you follow when designing cloud-native microservices on Oracle Container Engine for Kubernetes (OKE) to ensure high availability and resilience? (Choose two.)

Select 2 answers
A.Deploy all microservices into a single flat Kubernetes namespace to maximize intra-cluster communication speed.
B.Store all application state and user sessions locally on the ephemeral container root filesystem.
C.Distribute OKE worker node pools across multiple Fault Domains or Availability Domains.
D.Use NodePorts for all external microservice access directly bypassing the OCI Load Balancer.
E.Configure Kubernetes Pod Disruption Budgets (PDBs) to control minimum available pods during maintenance or scaling events.
AnswersC, E

Spreading worker node pools across multiple Fault Domains or Availability Domains ensures that a single domain failure cannot take down all nodes hosting the microservices, satisfying the high-availability and resilience requirement by removing a shared failure domain.

Why this answer

Option C is correct because spreading OKE worker node pools across multiple Fault Domains or Availability Domains ensures that a failure in one physical domain does not take down the entire cluster, which is a fundamental high-availability practice for cloud-native microservices. Option E is correct because Kubernetes Pod Disruption Budgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions such as node maintenance, upgrades, or scaling, directly supporting resilience and availability guarantees. Option A is not recommended because a single flat namespace does not improve communication speed and reduces isolation, making it harder to apply network policies, resource quotas, and RBAC for microservices.

Option B is incorrect because storing state or sessions on the ephemeral container root filesystem means data is lost when the pod restarts or is rescheduled, breaking resilience; state should be externalized to a database or persistent volume. Option D is incorrect because exposing all microservices via NodePorts bypasses the OCI Load Balancer, lacks advanced traffic management, TLS termination, and health checks, and is not a best practice for production high availability.

Exam trap

1Z0-997-26 often tests HA design patterns, and candidates pick options that sound efficient (single namespace, NodePorts) but actually reduce resilience or bypass managed load-balancing features.

Full explanation →
238
MCQhard

You are designing a secure zero-trust architecture for database access in OCI. Developers must authenticate using short-lived tokens rather than long-term database passwords. Which OCI and database feature combination supports token-based authentication?

A.OCI IAM token-based database authentication combined with Oracle Autonomous Database.
B.Disabling all authentication to maximize application performance.
C.Hardcoded administrator passwords stored in plain text configuration files.
D.Using static API signing keys for database connection strings.
AnswerA

OCI IAM token-based database authentication issues short-lived tokens that Oracle Autonomous Database accepts in place of a static password. The token expiry is the mechanism enforcing zero-trust, satisfying the requirement that developers authenticate with short-lived credentials rather than long-term database passwords.

Why this answer

OCI IAM token-based database authentication, when combined with Oracle Autonomous Database, allows developers to authenticate using short-lived tokens issued by OCI IAM instead of long-term database passwords. This supports zero-trust principles by eliminating static credentials and enabling centralized identity management with token expiration and revocation.

Exam trap

1Z0-997-26 often tests the confusion between static API keys and short-lived IAM tokens, and candidates may pick static keys thinking they are more secure, when the question explicitly asks for token-based authentication.

How to eliminate wrong answers

Option B is wrong because disabling all authentication is a severe security risk and does not support token-based access. Option C is wrong because hardcoded administrator passwords in plaintext files are insecure and contradict the requirement for short-lived tokens. Option D is wrong because static API signing keys are long-term credentials, not short-lived tokens, and they are used for OCI API calls, not database authentication.

Full explanation →
239
Multi-Selecthard

You are migrating a monolithic application to microservices on OKE and implementing resilient design patterns. Which THREE resiliency patterns should you implement to handle transient failures gracefully?

Select 3 answers
A.Circuit Breaker pattern to prevent cascading failures when downstream services are struggling
B.Bulkhead pattern to isolate resource pools (e.g., thread pools) so one failing service doesn't starve others
C.Single large monolithic database instance shared by all microservices without connection pooling
D.Retries with Exponential Backoff and Jitter for transient network or service errors
E.Disabling all health checks and liveness probes to prevent container restarts
AnswersA, B, D

The Circuit Breaker pattern trips after repeated downstream failures, short-circuiting further calls so struggling services are not overwhelmed and failures do not cascade. This satisfies the requirement to handle transient failures gracefully across microservices on OKE.

Why this answer

Option A (Circuit Breaker) is correct because it detects repeated failures to a downstream service and trips open, failing fast instead of letting threads pile up waiting on a struggling dependency, which prevents cascading failures across the microservice mesh. Option B (Bulkhead) is correct because it partitions resources such as thread pools or connection pools per dependency, so a single slow or failing service cannot exhaust all shared resources and starve healthy services. Option D (Retries with Exponential Backoff and Jitter) is correct because transient network blips, brief DNS hiccups, or momentary 503s are often resolved by retrying, and exponential backoff with jitter avoids synchronized retry storms that would otherwise overwhelm the recovering service.

Option C is not a resiliency pattern but an anti-pattern: a single shared monolithic database without connection pooling creates a shared point of contention and failure, coupling all microservices and amplifying outages. Option E is wrong because disabling health checks and liveness probes removes Kubernetes' ability to detect and restart unhealthy containers, degrading rather than improving resilience.

Exam trap

1Z0-997-26 often tests the confusion between resiliency patterns and anti-patterns, such as shared monolithic databases or disabling health checks, which candidates might mistakenly select as valid.

Full explanation →
240
Multi-Selecthard

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Select 3 answers
A.Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.
B.Using OCI Traffic Management Steering to fail over DNS traffic between OCI and AWS endpoints based on health checks.
C.Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.
D.Replicating OCI IAM identity domains natively inside AWS IAM without federation.
E.Establishing redundant IPsec VPN tunnels between OCI DRG and AWS VGW for secure private connectivity.
AnswersA, B, E

Oracle Data Guard replicates redo across clouds, providing a standby database in AWS for failover. This satisfies the cross-cloud disaster recovery requirement by maintaining a synchronised data copy outside OCI, enabling recovery when the primary region is unavailable.

Why this answer

Option A is correct because cross-cloud DR commonly relies on database-level replication such as Oracle Data Guard, which can ship redo from an OCI Autonomous Database to a standby database running in AWS, giving a low-RPO failover target for the data tier. Option B is correct because OCI Traffic Management Steering policies (health-check-based failover, weighted, or geolocation steering) can direct DNS resolution to OCI or AWS endpoints and automatically shift traffic when health checks fail, which is a standard cross-cloud traffic-failover mechanism. Option E is correct because private cross-cloud connectivity for DR is typically built with redundant IPsec VPN tunnels between an OCI Dynamic Routing Gateway (DRG) and an AWS Virtual Private Gateway (VGW), providing encrypted, resilient transport that survives a single tunnel failure.

Option C is not valid because AWS VPCs are logical software-defined networks; there are no physical VPC switches to place in OCI Meet-Me-Rooms, and Meet-Me-Rooms are for physical network/carrier interconnects, not VPC hardware. Option D is not valid because OCI IAM identity domains cannot be natively replicated into AWS IAM; cross-cloud identity is achieved through federation (SAML/OIDC) or identity brokering, not native replication between the two proprietary IAM systems.

Exam trap

The trap is selecting plausible-sounding but technically impossible options (like physically merging switches or natively replicating IAM) because they sound like 'deep integration' — the exam tests whether you know that cross-cloud DR relies on replication, DNS steering, and VPN/interconnect, not physical or identity-layer merging.

Full explanation →
241
MCQmedium

Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?

A.Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host
B.Generate a Kerberos ticket granting service token via the IAM security console
C.Retrieve the master encryption key directly from OCI Vault using an API key
D.Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings
AnswerA

Mutual TLS requires the client to present the database's trusted certificates and private key. These reside in the connection wallet zip, downloadable from the OCI Console or CLI, which must be extracted on the client host so the application can reference its contents.

Why this answer

For mTLS connections to Autonomous Database Serverless, the client must download the connection wallet zip from the OCI Console or CLI (or via the ADB API) and extract it on the client host. The wallet contains the client credentials (e.g., cwallet.sso, tnsnames.ora, sqlnet.ora) required to authenticate the client to the database over TLS. Without the wallet, mTLS cannot be established.

Exam trap

1Z0-997-26 often tests whether candidates confuse the TDE master key in OCI Vault with the client connection wallet; the trap is selecting Vault as the source of mTLS credentials.

How to eliminate wrong answers

Option B is wrong because Kerberos is a separate authentication protocol not used for ADB mTLS; IAM does not issue Kerberos tickets for database connections. Option C is wrong because the master encryption key in OCI Vault is for TDE at-rest encryption, not for client TLS authentication, and exposing it to clients would be a severe security violation. Option D is wrong because ADB does not accept arbitrary public SSL certificates configured via database parameters; the wallet provides the Oracle-managed certificates and keys.

Full explanation →
242
MCQeasy

What is the primary purpose of OCI Database Actions (SQL Developer Web) when working with an Oracle Autonomous Database?

A.To configure physical Exadata storage cell disks and flash cache parameters
B.To monitor physical VCN packet drops and firewall logs
C.To manage OCI IAM user groups and federation settings across enterprise identity providers
D.To provide a web-based development and management interface for executing SQL, querying data, and managing database users
AnswerD

Database Actions provides a browser-based interface for running SQL, querying data, and managing users on Autonomous Database, removing the need for local client tools. This directly satisfies the requirement for a web-based development and management interface.

Why this answer

OCI Database Actions (SQL Developer Web) is a web-based tool that provides a development and management interface for Autonomous Database, allowing users to execute SQL, query data, manage database users, and perform other administrative tasks. It is the primary browser-based interface for interacting with Autonomous Database.

Exam trap

The trap is overestimating the scope of Database Actions, thinking it includes infrastructure or networking management. Candidates may confuse it with broader OCI management tools.

How to eliminate wrong answers

Option A is wrong because configuring physical Exadata storage cell disks and flash cache parameters is an infrastructure-level task performed by Oracle Cloud operations, not exposed to customers via Database Actions. Option B is wrong because monitoring VCN packet drops and firewall logs is a networking task handled by OCI Networking services, not Database Actions. Option C is wrong because managing IAM user groups and federation is an identity and access management function in OCI Console, not part of Database Actions.

Full explanation →
243
MCQeasy

When creating an Oracle Base Database system, which database edition options are available for licensing on OCI?

A.Oracle Database Express Edition (XE) exclusively
B.Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance
C.Microsoft SQL Server Enterprise Edition
D.MySQL Enterprise Edition and PostgreSQL Community Edition only
AnswerB

Oracle Base Database Service on OCI offers exactly these four editions: Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance. The two EE variants differ by included options such as RAC, Active Data Guard, and Database In-Memory, satisfying the stem's licensing constraint.

Why this answer

Oracle Base Database Service on OCI offers the same commercial editions as on-premises Oracle Database: Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance. These are the licensing options available when provisioning a Base Database system.

Exam trap

1Z0-997-26 often tests the misconception that XE or non-Oracle databases are available on Base Database, when the exam expects knowledge of the four commercial Oracle editions (SE2, EE, EE-HP, EE-EP).

How to eliminate wrong answers

Option A is wrong because Express Edition (XE) is a free, limited edition not offered as a licensing option for OCI Base Database systems. Option C is wrong because Microsoft SQL Server is a competitor product and is not available on Oracle Base Database. Option D is wrong because MySQL and PostgreSQL are separate database services on OCI, not editions of Oracle Base Database.

Full explanation →
244
MCQeasy

Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?

A.OCI API Gateway
B.OCI Streaming Service
C.OCI Events Service
D.OCI Notifications Service
AnswerD

OCI Notifications Service publishes alarm messages to topics, then delivers them through subscriptions such as PagerDuty and Slack, satisfying the immediate high-severity alerting requirement. OCI Monitoring alarms trigger the topic directly, so no polling or custom integration is needed to reach both endpoints.

Why this answer

OCI Notifications Service is the correct intermediary because it natively supports publishing messages to external endpoints such as PagerDuty and Slack via HTTPS subscriptions. When an OCI Monitoring alarm fires, it can publish to a Notifications topic, and the service delivers the message to all subscribed endpoints. This is the standard OCI pattern for alert fan-out to third-party incident management and chat tools.

Exam trap

1Z0-997-26 often tests the distinction between services that can trigger actions (Events) and services that actually deliver notifications (Notifications), causing candidates to pick Events Service when the requirement is specifically about dispatching messages to external endpoints like PagerDuty and Slack.

How to eliminate wrong answers

Option A is wrong because OCI API Gateway is designed to expose and manage APIs, not to dispatch alarm notifications to external services; it lacks native subscription and delivery mechanisms for PagerDuty or Slack. Option B is wrong because OCI Streaming Service is a high-throughput, durable message streaming platform for real-time data ingestion and processing, not a notification dispatch service; it does not directly integrate with PagerDuty or Slack. Option C is wrong because OCI Events Service reacts to state changes and can trigger actions, but it does not itself deliver notifications to external endpoints like PagerDuty or Slack; it would need to invoke another service such as Notifications to do so.

Full explanation →
245
MCQmedium

You are migrating a legacy application that relies on hardcoded IP addresses for inter-service communication. During the migration to OCI VCNs, you need to ensure that virtual machines can resolve each other's hostnames dynamically without maintaining manual /etc/hosts files. What OCI networking feature should you configure?

A.OCI API Gateway DNS forwarding rules
B.OCI Default VCN Resolver with assigned hostname prefixes
C.OCI Streaming service message brokers
D.OCI Network Load Balancer hostname rewriting
AnswerB

The default VCN resolver answers internal DNS queries for instances using their assigned hostname prefixes, removing the need for manual /etc/hosts entries. This satisfies dynamic name resolution between VMs, since hostnames are registered automatically when instances launch within the VCN.

Why this answer

OCI's Default VCN Resolver (part of the VCN's built-in DNS) automatically resolves instance hostnames when you assign a DNS hostname prefix to the subnet and enable hostname assignment on each VNIC. This eliminates manual /etc/hosts maintenance and lets instances resolve each other by FQDN such as <hostname>.<subnet-prefix>.oraclevcn.com. It is the native, zero-cost DNS service provided per VCN.

Exam trap

1Z0-997-26 often tests whether candidates confuse OCI's built-in VCN resolver with OCI DNS private zones or with load balancer DNS names — the key is that the Default VCN Resolver requires a hostname prefix on the subnet and hostname assignment on the VNIC.

How to eliminate wrong answers

Option A is wrong because OCI API Gateway is an HTTP/HTTPS ingress and API management service; it does not provide DNS forwarding or name resolution for compute instances. Option C is wrong because OCI Streaming is a Kafka-compatible publish/subscribe messaging service, not a DNS or hostname resolution mechanism. Option D is wrong because a Network Load Balancer distributes TCP/UDP traffic at Layer 4 and does not perform DNS hostname rewriting or name resolution for VMs.

Full explanation →
246
MCQhard

You are configuring a Data Guard association between two Oracle Base Database Systems in different OCI regions. The primary database encounters an unplanned outage, and you perform a manual failover. What action must you take afterward if you wish to restore the original architecture with the old primary as the new standby?

A.Run a simple 'SWITCHOVER' command to reverse roles without any data synchronization checks.
B.Modify the listener.ora file manually via SSH and restart the clusterware.
C.Delete the standby database and provision a brand-new VCN in the primary region.
D.Recreate or reinstate the former primary database (using Flashback Database or backup restoration) to convert it into a valid standby.
AnswerD

After failover the old primary is in an unresolved state and cannot automatically resume its standby role. Flashback Database or backup restoration reinstates it to a consistent SCN, converting it into a valid standby that satisfies the requirement to restore the original architecture.

Why this answer

After a manual failover, the old primary is no longer a valid standby because its data files and control file reflect a different point in time. To restore the original architecture, you must reinstate or recreate the former primary as a standby, typically using Flashback Database to the point of the last redo it transmitted, or by restoring from backup and re-establishing the Data Guard association. Only then can redo transport resume in the reverse direction.

Exam trap

1Z0-997-26 often tests the assumption that roles can be reversed with a simple switchover after a failover, ignoring the need to reinstate or recreate the old primary as a standby first.

How to eliminate wrong answers

Option A is wrong because a simple SWITCHOVER command cannot be run after a failover without first reinstating the old primary; switchover requires both databases to be in valid, synchronized roles. Option B is wrong because manually editing listener.ora and restarting clusterware does not address the data divergence between the old primary and the new primary. Option C is wrong because deleting the standby and provisioning a new VCN is destructive, unnecessary, and does not restore the original architecture.

Full explanation →
247
MCQmedium

You need to migrate an on-premises Oracle Database to OCI Exadata Database Service using Oracle GoldenGate for zero-downtime migration with bi-directional replication. Which critical design consideration must be addressed regarding table design on both databases?

A.Primary keys must be omitted to allow duplicate row insertion across databases
B.Tables must have primary keys or unique identifiers, and Conflict Detection and Resolution (CDR) must be configured
C.Tables must not contain any indexes, triggers, or constraints
D.All tables must be converted to temporary unlogged tables
AnswerB

Bi-directional GoldenGate replication requires primary keys or unique identifiers so each row can be uniquely matched across sites; without them, updates and deletes cannot be applied deterministically. CDR then resolves conflicting changes from both directions, preventing data divergence.

Why this answer

For bi-directional replication with Oracle GoldenGate, tables must have primary keys or unique identifiers to ensure that each row can be uniquely identified for conflict detection and resolution. Conflict Detection and Resolution (CDR) must be configured to handle conflicts that arise when the same row is modified on both databases. This is critical for zero-downtime migration with bi-directional replication.

Exam trap

The trap is thinking that primary keys can be omitted for replication or that constraints must be removed; candidates may also overlook the need for CDR in bi-directional setups, leading to data conflicts.

How to eliminate wrong answers

Option A is wrong because omitting primary keys would prevent GoldenGate from uniquely identifying rows, leading to duplicate rows and data corruption; primary keys are essential for replication. Option C is wrong because tables can and often do contain indexes, triggers, and constraints; GoldenGate supports these, and they do not need to be removed. Option D is wrong because converting tables to temporary unlogged tables is not a requirement and would be inappropriate for a production migration; GoldenGate replicates standard tables.

Full explanation →
248
MCQeasy

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

A.RIP (Routing Information Protocol)
B.BGP (Border Gateway Protocol)
C.EIGRP (Enhanced Interior Gateway Routing Protocol)
D.OSPF (Open Shortest Path First)
AnswerB

BGP is the dynamic routing protocol that both OCI FastConnect and Site-to-Site VPN use to exchange prefixes with on-premises routers. It satisfies the stem's requirement for dynamic route exchange, advertising learned routes automatically rather than relying on static configuration, and supports path selection across redundant FastConnect or VPN connections.

Why this answer

Both OCI FastConnect and Site-to-Site VPN use BGP to dynamically exchange routes between the on-premises customer edge router and the OCI Dynamic Routing Gateway. BGP is the standard exterior gateway protocol for hybrid cloud routing and supports dynamic failover and prefix advertisement.

Exam trap

1Z0-997-26 often tests the assumption that OSPF or EIGRP might be used for hybrid routing, but OCI standardizes on BGP for both FastConnect and Site-to-Site VPN route exchange.

How to eliminate wrong answers

Option A is wrong because RIP is a legacy distance-vector interior protocol with a 15-hop limit and slow convergence, and OCI does not use it for FastConnect or VPN route exchange. Option C is wrong because EIGRP is a Cisco-proprietary interior gateway protocol not supported by OCI for hybrid routing. Option D is wrong because OSPF is an interior gateway protocol for within an autonomous system, not for exchanging routes between an enterprise and OCI's autonomous system.

Full explanation →
249
MCQmedium

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

A.On the OCI Bastion service configuration page.
B.In the DRG route table import/export distribution or static route configuration for the VPN attachment.
C.Inside the OCI Identity and Access Management (IAM) policy console.
D.By modifying the VCN DHCP options.
AnswerB

The DRG route table controls import and export route distribution for the IPSec VPN attachment, letting you filter which on-premises subnet prefixes are advertised or accepted. This satisfies the requirement to restrict which on-premises subnets can reach the VCN.

Why this answer

To restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN, you must control route propagation on the OCI side. This is done by configuring the DRG route table associated with the VPN attachment, specifically the import distribution and static route configuration, to filter which routes are accepted from on-premises.

Exam trap

The trap is selecting IAM or security lists, which control access but not route propagation; candidates must remember that route filtering for hybrid connections is done at the DRG route table level.

How to eliminate wrong answers

Option A is wrong because the OCI Bastion service provides secure SSH access to compute instances and does not control network routing. Option C is wrong because IAM policies manage access to OCI resources, not network route filtering. Option D is wrong because DHCP options configure DNS and search domains for instances, not routing or subnet-level access control.

Full explanation →
250
MCQeasy

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

A.OCI Events Service
B.OCI Audit Service
C.OCI Logging Analytics
D.Database Audit Vault
AnswerB

OCI Audit Service automatically records API calls, console sign-ins and resource changes across the tenancy and retains them for the compliance window. That native, immutable event log is precisely the evidence the auditor requested for the past 365 days.

Why this answer

OCI Audit Service automatically records all API calls and console actions across the tenancy, including administrative actions, logins, and resource modifications, and retains them for 365 days by default. It is the native auditing capability that satisfies compliance and forensic requirements without additional configuration. Auditors can access events via the Console, API, or CLI.

Exam trap

1Z0-997-26 often tests the distinction between Audit Service (immutable 365-day API audit trail) and Logging/Logging Analytics (configurable operational logs) — candidates pick Logging Analytics because it sounds like it covers auditing, missing that Audit Service is the native, always-on record.

How to eliminate wrong answers

Option A is wrong because OCI Events Service is a pub/sub mechanism that reacts to state changes by triggering Functions, Notifications, or Streaming — it does not store a historical audit trail. Option C is wrong because Logging Analytics is a log ingestion and analysis platform for operational and security logs, but it is not the native audit record of API activity and requires configuration to ingest audit logs. Option D is wrong because Database Audit Vault is a database-specific auditing solution for Oracle Database, not a tenancy-wide API audit service.

Full explanation →
251
MCQmedium

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

A.Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.
B.The FastConnect virtual circuit is disabled.
C.The OCI VCN does not have an Internet Gateway attached.
D.The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.
AnswerA

A 'Tunnel Up' state confirms only IKE and IPSec negotiation succeeded; it does not prove traffic passes. Security Lists, NSGs or instance OS firewalls commonly drop ICMP, so ping fails while the tunnel remains up, matching the stem's symptom.

Why this answer

A 'Tunnel Up' status only confirms that IKE Phase 1 and Phase 2 completed and the IPSec SA is established; it does not guarantee that traffic is permitted or routed. The most common cause of ping failure with an up tunnel is that Security Lists, NSGs, or the instance's OS firewall are dropping ICMP or the relevant traffic.

Exam trap

1Z0-997-26 often tests the misconception that 'Tunnel Up' means end-to-end connectivity works, when it only proves the IPSec control plane is established — the data plane can still be blocked by security rules.

How to eliminate wrong answers

Option B is wrong because FastConnect is a separate dedicated connection and is not involved in an IPSec VPN tunnel; disabling it would not explain this issue. Option C is wrong because an Internet Gateway is not required for Site-to-Site VPN traffic, which traverses the DRG and the VPN tunnel, not the internet gateway. Option D is wrong because a misconfigured BGP ASN would typically prevent the tunnel or route exchange from coming up, but the question states the tunnel is already Up, so the control plane is functioning.

Full explanation →
252
MCQeasy

Your organization has completed migrating a database to OCI Base Database Service. To ensure compliance with corporate data protection policies, you must verify that all database backups stored in OCI Object Storage are automatically encrypted using customer-managed encryption keys. Where should you configure this key management integration?

A.OCI Vault service (Key Management)
B.OCI Database Migration service connection profiles
C.OCI Audit log configuration
D.OCI Identity and Access Management (IAM) password policies
AnswerA

OCI Vault (Key Management) stores and manages customer-managed encryption keys, and Base Database Service integrates with it to encrypt backups written to Object Storage. Configuring the key here satisfies the policy requiring customer-managed keys rather than Oracle-managed encryption.

Why this answer

OCI Base Database Service integrates with OCI Vault (Key Management) to allow customer-managed encryption keys (CMKs) for backups stored in Object Storage. When you configure the database's backup destination to use a customer-managed key, the service automatically encrypts backups with that key. This ensures compliance with policies requiring customer-controlled encryption rather than Oracle-managed keys.

Exam trap

1Z0-997-26 often tests the confusion between encryption key management and other security services like IAM or Audit, so candidates might incorrectly choose IAM password policies or Audit logs when asked about customer-managed encryption keys.

How to eliminate wrong answers

Option B is wrong because OCI Database Migration service connection profiles are used to define source and target database connectivity for migration, not for encryption key management. Option C is wrong because OCI Audit log configuration captures API activity for auditing purposes; it does not control encryption of backups. Option D is wrong because IAM password policies govern user password complexity and rotation, not data encryption keys.

Full explanation →
253
Multi-Selecthard

You are designing a secure network architecture for migrating production workloads into an OCI Virtual Cloud Network (VCN). Compliance standards require strict traffic inspection, isolation, and secure administrative access. Which THREE OCI networking and security features should you incorporate into your design? (Choose three.)

Select 3 answers
A.Implement stateful Security Lists and Network Security Groups (NSGs) to enforce least-privilege traffic filtering at the subnet and VNIC levels.
B.Disable all VCN route tables and allow all subnets to broadcast traffic freely across the public internet.
C.Deploy OCI Bastion service to provide secure, ephemeral, and audited SSH/RDP access to private compute instances without public IP addresses.
D.Attach public IP addresses to all database and application backend servers to ensure direct administrator troubleshooting capability.
E.Deploy OCI Network Firewall to inspect inter-subnet and east-west traffic within the VCN.
AnswersA, C, E

Security Lists filter at the subnet boundary, while Network Security Groups filter at the VNIC level, together enforcing least-privilege traffic filtering across both tiers. This layered stateful control satisfies the isolation and strict inspection requirements in the stem.

Why this answer

Option A is correct because OCI Security Lists provide stateful, subnet-level filtering while Network Security Groups (NSGs) apply stateful rules at the VNIC level, together enabling least-privilege micro-segmentation required for strict isolation and compliance. Option C is correct because the OCI Bastion service creates ephemeral, time-limited SSH/RDP sessions to private instances that have no public IP, with all sessions audited, satisfying the secure administrative access requirement. Option E is correct because OCI Network Firewall is a managed next-generation firewall that inspects inter-subnet (east-west) traffic inside the VCN, providing the traffic inspection layer the compliance standards demand.

Option B is wrong because removing route tables and allowing free public broadcast destroys network segmentation, routing control, and isolation. Option D is wrong because exposing database and backend servers with public IPs violates least privilege and isolation, and direct public administrative access is exactly what the Bastion service is meant to avoid.

Exam trap

1Z0-997-26 often tests whether candidates recognize that public IPs and open routing are anti-patterns in secure designs, so picking options that expose backends or disable routing fails the isolation requirement.

Full explanation →
254
MCQmedium

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

A.Install an external Squid proxy on an on-premises server connected via IPsec VPN.
B.Set up a NAT Gateway and forward all traffic to the internet.
C.Attach a Public IP address to every worker node in the OKE cluster.
D.Configure an OCI Service Gateway in your VCN and add a route rule for OCI Services to the private subnet's route table.
AnswerD

A Service Gateway provides private access to OCI services, including OCIR, without traversing the internet. Adding a route rule for OCI Services to the private subnet's route table directs image-pull traffic through this gateway, satisfying the no-outbound-internet constraint while keeping worker nodes unexposed.

Why this answer

An OCI Service Gateway provides private access from a VCN to OCI public services like OCIR without traversing the internet. By adding a route rule in the private subnet's route table pointing OCI Services traffic to the Service Gateway, pods can pull images securely while worker nodes remain isolated from the public internet.

Exam trap

1Z0-997-26 often tests the distinction between NAT Gateway (internet-bound) and Service Gateway (OCI-services-only), causing candidates to choose NAT when the requirement is private access to OCI services like OCIR.

How to eliminate wrong answers

Option A is wrong because an on-premises Squid proxy over IPsec VPN adds unnecessary complexity, latency, and an external dependency — it is not the OCI-native secure solution. Option B is wrong because a NAT Gateway routes traffic to the public internet, which violates the requirement of not exposing worker nodes and is unnecessary for OCI-internal service access. Option C is wrong because attaching public IPs to worker nodes directly exposes them to the internet, contradicting the security requirement.

Full explanation →
255
MCQeasy

Your company is planning to migrate 50 TB of unstructured file data from an on-premises Network Attached Storage (NAS) appliance to OCI File Storage Service (FSS). The target RTO/RPO allows for a phased baseline copy followed by incremental syncs. Which tool should you use to transfer the data efficiently over your dedicated OCI FastConnect link?

A.OCI Streaming Service
B.OCI Data Transfer Appliance
C.Parallelized rsync or custom multithreaded copy scripts via an OCI Compute instance acting as a migration gateway mounted to the FSS target
D.Oracle Data Pump
AnswerC

Parallelised rsync over a FastConnect-attached Compute gateway exploits FSS's NFSv3 mount, running concurrent streams to saturate the dedicated link during the phased baseline, then re-running rsync to copy only changed blocks for incremental syncs. This satisfies the RTO/RPO tolerance for staged transfer without shipping appliances.

Why this answer

For migrating large unstructured file data to OCI File Storage Service (FSS) over a dedicated FastConnect link, the recommended approach is to mount the FSS target on an OCI Compute instance acting as a migration gateway and use parallelized rsync or multithreaded copy scripts. This leverages the high bandwidth of FastConnect and the parallelism needed for 50 TB, while supporting incremental syncs for phased cutover.

Exam trap

1Z0-997-26 often tests whether candidates confuse offline transfer appliances with online transfer tools — the trap is picking Data Transfer Appliance when a dedicated FastConnect link makes online parallel copy the faster, recommended option.

How to eliminate wrong answers

Option A is wrong because OCI Streaming is a Kafka-compatible messaging service, not a file transfer tool. Option B is wrong because OCI Data Transfer Appliance is for offline bulk data transfer (shipping a physical appliance), which is unnecessary and slower when a dedicated FastConnect link is available. Option D is wrong because Oracle Data Pump is a database export/import utility for Oracle Database, not for unstructured NAS file data.

Full explanation →
256
MCQhard

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

A.In the same subnet, pinned to a single physical host.
B.Inside the OCI Control Plane root compartment.
C.On bare metal instances without any virtual cloud networks.
D.Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.
AnswerD

Placing the SD-WAN appliances across separate Availability Domains or Fault Domains within the region isolates them from a single domain failure, satisfying the high-availability constraint. BGP or clustering then provides failover and path selection between the instances.

Why this answer

To achieve high availability across availability domains, the SD-WAN instances in OCI should be deployed in different Availability Domains (or Fault Domains) within the region and configured with BGP or clustering for failover. This ensures that a single AD or fault domain failure does not take down the SD-WAN overlay connecting OCI to AWS. BGP provides dynamic route failover between the instances.

Exam trap

The trap is thinking that a single subnet or a single physical host provides high availability; the exam expects you to know that AD or FD separation plus BGP/clustering is required for true HA.

How to eliminate wrong answers

Option A is wrong because placing both instances in the same subnet pinned to a single physical host creates a single point of failure; it does not provide AD-level redundancy. Option B is wrong because the OCI Control Plane root compartment is a logical IAM construct, not a deployment location for compute instances; you cannot place SD-WAN appliances there. Option C is wrong because bare metal instances still require a VCN and subnet for networking; deploying without a VCN is not possible, and it does not address AD redundancy.

Full explanation →
257
MCQhard

An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?

A.OCI Health Checks Ping Monitors
B.APM Synthetic Monitoring Browser Monitors using Dedicated Vantage Points
C.Logging Analytics synthetic agent extensions
D.OCI Monitoring service Synthetic Probes
AnswerB

Browser monitors execute Selenium-style scripts in real Chrome instances from dedicated vantage points, satisfying the requirement for periodic, multi-geographic testing of user-facing login workflows. Dedicated vantage points provide controlled, authenticated origins, unlike public vantage points, and capture full page-load timing plus DOM-level failures that simpler HTTP monitors cannot detect.

Why this answer

OCI APM Synthetic Monitoring Browser Monitors execute scripted browser workflows (e.g., login flows) from multiple geographic locations using Dedicated Vantage Points, which are managed vantage points that run the scripts. This directly matches the requirement to periodically run browser-based synthetic scripts from multiple locations to validate user-facing login workflows.

Exam trap

1Z0-997-26 often tests the distinction between network-level health checks (Ping/HTTP monitors) and application-level browser synthetic monitoring, so candidates must match 'browser-based scripts' to APM Synthetic Monitoring Browser Monitors.

How to eliminate wrong answers

Option A is wrong because OCI Health Checks Ping Monitors only test network reachability/latency to an endpoint and cannot execute browser-based scripts or validate login workflows. Option C is wrong because Logging Analytics synthetic agent extensions are not a browser-based synthetic monitoring feature; Logging Analytics is for log ingestion and analysis. Option D is wrong because OCI Monitoring service Synthetic Probes is not the correct APM feature for browser-based scripted workflows; the APM Synthetic Monitoring Browser Monitor with Dedicated Vantage Points is the purpose-built capability.

Full explanation →
258
MCQeasy

An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?

A.OCI Logging Analytics
B.OCI Audit Service
C.OCI Health Checks
D.OCI Object Storage
AnswerA

OCI Logging Analytics indexes ingested log data, enabling complex SQL-like queries through its query language and dashboards for visualisation. It satisfies the stem's requirement to analyse logs from various OCI resources, unlike OCI Logging, which only collects and stores logs without analytical querying or dashboard visualisation capabilities.

Why this answer

OCI Logging Analytics is a machine-learning-driven log analysis service that ingests logs from many sources and lets users run SQL-like queries (Log Explorer query language), build dashboards, and detect anomalies. It is purpose-built for deep log analytics and visualization, unlike basic Logging which focuses on collection and search.

Exam trap

The trap is conflating OCI Logging (collection/search) with OCI Logging Analytics (query/dashboard/ML); the exam tests whether you know which service actually provides SQL-like analytics and visualization.

How to eliminate wrong answers

Option B is wrong because OCI Audit Service records control-plane API activity for compliance and auditing, not for running analytical queries over application logs. Option C is wrong because OCI Health Checks monitors endpoint availability and latency via probes; it does not analyze log data. Option D is wrong because OCI Object Storage is a raw object store; while logs can be archived there, it provides no query engine or visualization layer.

Full explanation →
259
MCQhard

An architect is designing an Oracle Exadata Database Service on Dedicated Infrastructure deployment with multiple VM clusters on a single Exadata rack. Which architectural feature allows secure isolation of CPU, memory, and database workloads between these distinct VM clusters?

A.OCI Block Volume volume group replicas synchronized via block replication
B.Software-defined VLAN tagging enforced by the OCI Virtual Cloud Network (VCN) hypervisor only
C.Autonomous Database container database resource pools sharing a single OS kernel
D.Hard partitioning using Oracle VM (dom0/domU) hypervisor virtualization on the database servers
AnswerD

Oracle VM hard partitioning assigns dedicated CPU, memory, and I/O resources to each VM cluster through the dom0/domU hypervisor, providing strict isolation between workloads on the same Exadata rack. This prevents one cluster's activity from consuming another's resources, satisfying the secure isolation requirement.

Why this answer

Exadata Database Service on Dedicated Infrastructure uses Oracle VM (OVM) with dom0/domU architecture to provide hard partitioning between VM clusters. Each VM cluster runs in its own set of domU guests on the database servers, with CPU, memory, and I/O isolated by the hypervisor. This hard partitioning is what allows multiple VM clusters to coexist securely on a single Exadata rack.

Exam trap

1Z0-997-26 often tests whether candidates confuse network isolation (VLANs) or storage replication with compute isolation; the trap is picking a network or storage feature when the question asks about CPU and memory partitioning.

How to eliminate wrong answers

Option A is wrong because Block Volume volume group replicas are storage-level replication for data durability, not a mechanism for isolating CPU and memory between VM clusters. Option B is wrong because VLAN tagging is a network isolation feature, not CPU/memory isolation, and it does not partition compute resources. Option C is wrong because Autonomous Database resource pools share a single OS kernel within a container database, which is the opposite of hard partitioning and does not apply to Exadata VM clusters.

Full explanation →
260
MCQeasy

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

A.Ability to route traffic over public cellular networks
B.Zero configuration required on the on-premises router
C.Automatic encryption of all traffic at Layer 2 by default
D.Higher bandwidth, lower latency, and predictable performance
AnswerD

FastConnect provides a dedicated private physical circuit, bypassing the public internet entirely. This yields higher, more consistent bandwidth and lower, predictable latency than an IPSec VPN, whose encrypted tunnels traverse variable internet paths and are subject to congestion and jitter.

Why this answer

FastConnect is a dedicated private physical connection between on-premises and OCI, bypassing the public internet. This yields higher, more consistent bandwidth, lower and more predictable latency, and reduced jitter compared to an IPSec VPN, which traverses the public internet and is subject to variable paths and congestion. That predictability is the primary reason enterprises choose FastConnect for latency-sensitive or high-throughput workloads.

Exam trap

The trap is confusing FastConnect's private, dedicated nature with automatic encryption; candidates often pick 'automatic encryption at Layer 2' when FastConnect is actually unencrypted by default and encryption must be added separately.

How to eliminate wrong answers

Option A is wrong because FastConnect is a dedicated fiber/partner-provided private circuit, not a cellular or public-network routing mechanism; cellular is irrelevant to this comparison. Option B is wrong because FastConnect requires configuration on the customer edge router (BGP peering, VLAN, cross-connect), so 'zero configuration' is false. Option C is wrong because FastConnect does not automatically encrypt traffic at Layer 2 by default; encryption is optional (e.g., MACsec on some partners, or IPSec over FastConnect), and the default is a private but unencrypted Layer 2/3 path.

Full explanation →
261
MCQmedium

You are performing maintenance on an OCI Load Balancer backend set. You want to temporarily stop sending traffic to a specific backend server without immediately dropping active persistent connections. What feature should you use?

A.Set the backend server weight to zero without enabling draining.
B.Delete the backend server from the backend set immediately.
C.Enable Connection Draining on the backend server.
D.Modify the security list to drop all TCP packets on port 443.
AnswerC

Connection draining places the backend in a draining state, so the load balancer stops routing new requests while allowing established persistent connections to complete. This satisfies the requirement to halt new traffic without abruptly dropping active sessions.

Why this answer

Connection Draining is the OCI Load Balancer feature that gracefully removes a backend from rotation while allowing in-flight persistent connections to complete. When enabled, the backend is marked as draining, existing sessions continue until they finish or the drain timeout expires, and no new connections are routed to it. This matches the requirement to stop new traffic without abruptly dropping active persistent connections.

Exam trap

The trap here is confusing weight=0 with draining — candidates assume zero weight gracefully stops traffic, but it only affects new connection distribution and can still drop persistent sessions.

How to eliminate wrong answers

Option A is wrong because setting weight to zero only affects new connection distribution and does not guarantee graceful termination of existing persistent connections; without draining, active sessions may be reset or abruptly cut. Option B is wrong because deleting the backend immediately removes it from the backend set and terminates active connections, causing client disruption. Option D is wrong because modifying security lists to drop TCP/443 traffic is a network-level block that kills all connections, including active ones, and is not a load balancer maintenance feature.

Full explanation →
262
MCQhard

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

A.Enable OCI Audit logs and configure automated notifications via OCI Notifications service.
B.Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.
C.Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.
D.Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.
AnswerC

WAF protection rules inspect inbound HTTP traffic at the edge, blocking XSS and SQL injection payloads before they reach the application, and attaching the policy to the Load Balancer enforces this without modifying application code.

Why this answer

OCI Web Application Firewall (WAF) is a cloud-native service that protects web applications from common exploits like SQL injection and XSS. By configuring a WAF policy with protection rules and attaching it to the Load Balancer, you can inspect incoming traffic at the edge and block malicious requests without modifying application code. This directly addresses the requirement.

Exam trap

1Z0-997-26 often tests the difference between network firewall (L3/L4) and WAF (L7); candidates may choose Network Firewall with SSL decryption, but that does not provide application-layer protection against XSS and SQL injection.

How to eliminate wrong answers

Option A is wrong because OCI Audit logs and Notifications are for auditing and alerting, not for preventing application-layer attacks. Option B is wrong because OCI Network Firewall operates at layers 3-4 and, even with SSL decryption, is not designed to detect and block application-layer attacks like XSS and SQL injection; it lacks the deep packet inspection for HTTP payloads. Option D is wrong because OCI Cloud Guard Security Zones enforce security policies on resources but do not remediate application code flaws or protect against runtime application attacks.

Full explanation →
263
MCQmedium

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

A.Local Peering Gateway
B.Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit
C.NAT Gateway
D.Internet Gateway
AnswerB

A Virtual Circuit attachment on the DRG terminates the FastConnect dedicated circuit and runs BGP with your on-premises routers, enabling automatic route propagation. The DRG itself cannot peer directly over the physical cross-connect; the Virtual Circuit provides the Layer 3 BGP session satisfying the dynamic routing requirement.

Why this answer

To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Exam trap

The trap is confusing the DRG attachment type with other gateways; candidates may think any gateway attached to the DRG enables BGP, but only a Virtual Circuit attachment supports dynamic routing over FastConnect.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway connects VCNs within the same region and does not support BGP or FastConnect. Option C is wrong because a NAT Gateway provides outbound internet access for private subnets and is unrelated to dynamic routing over FastConnect. Option D is wrong because an Internet Gateway enables public internet connectivity and does not participate in BGP route exchange with on-premises networks.

Full explanation →
264
MCQeasy

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

A.NAT Gateway
B.Service Gateway
C.Customer-Premises Equipment (CPE)
D.Virtual Cloud Network (VCN)
AnswerC

The Customer-Premises Equipment object represents your on-premises VPN device in OCI, supplying its public IP address and vendor details so OCI can build the IPSec tunnels; it must exist before you create the IPSec connection referencing it.

Why this answer

The Customer-Premises Equipment (CPE) object represents the on-premises VPN device in OCI. Before creating an IPSec connection, you must create a CPE object that specifies the public IP address of the on-premises device. This allows OCI to establish the IPSec tunnels to that endpoint.

Exam trap

The trap is confusing the CPE object with other OCI networking components like NAT Gateway or Service Gateway, which serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is an OCI resource for outbound internet access from a VCN, not for representing on-premises devices. Option B is wrong because a Service Gateway provides private access to OCI services, not on-premises connectivity. Option D is wrong because a VCN is the virtual network itself, not a representation of the on-premises device.

Full explanation →
265
Multi-Selecthard

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Select 2 answers
A.Routing all log data to unencrypted public FTP servers.
B.OCI Audit service to capture all control plane API activities and resource modifications.
C.Disabling all logging services to save storage costs.
D.Relying solely on user memory dumps for audit compliance.
E.OCI Logging service to ingest, store, and analyze log data from VCN flow logs and compute instances.
AnswersB, E

OCI Audit service records every control plane API call and resource modification across the tenancy, providing the immutable audit trail the stem demands for security auditing and threat detection. It captures who did what, when, and from where, satisfying the comprehensive audit-trail requirement that data-plane-only logging cannot fulfil.

Why this answer

Option B is correct because the OCI Audit service automatically records all control plane API calls and resource modifications across the tenancy, providing an immutable, tamper-evident audit trail that is essential for security investigations and compliance. Option E is correct because the OCI Logging service ingests, stores, and analyzes log data from sources such as VCN flow logs and compute instances, enabling centralized visibility and threat detection across the environment. Option A is wrong because routing log data to unencrypted public FTP servers exposes sensitive audit information to interception and tampering, violating security best practices.

Option C is wrong because disabling logging eliminates the audit trail entirely, making threat detection and compliance impossible. Option D is wrong because relying on user memory dumps is not a reliable or comprehensive audit mechanism and does not provide the continuous, structured logging required for security monitoring.

Exam trap

1Z0-997-26 often tests the confusion between OCI Audit (control plane API activity) and OCI Logging (data plane and service logs), expecting candidates to know both are needed for comprehensive security.

Full explanation →
266
MCQhard

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

A.OCI Health Checks ping monitors
B.OCI VCN Flow Logs
C.OCI Monitoring service VNIC packet counters
D.OCI Network Firewall system logs
AnswerB

VCN Flow Logs capture per-packet metadata at the VNIC, recording accepted and rejected traffic against security list and network security group rules. This directly satisfies the requirement to verify whether packets are being dropped at the VNIC level, which security list metrics alone cannot show.

Why this answer

OCI VCN Flow Logs capture metadata about traffic flowing through VNICs, including source/destination IPs, ports, protocol, and whether the packet was accepted or rejected by security rules. Enabling flow logs on the subnet or VNIC lets you verify if security lists or NSGs are dropping packets to the external endpoint.

Exam trap

The trap is confusing flow logs (per-flow accept/reject metadata) with Monitoring counters (aggregate statistics) or Health Checks (external reachability probes).

How to eliminate wrong answers

Option A is wrong because Health Checks ping monitors test reachability from OCI's vantage points, not whether security rules on a specific VNIC accept or reject packets. Option C is wrong because OCI Monitoring VNIC packet counters show aggregate traffic volumes, not per-flow accept/reject decisions. Option D is wrong because Network Firewall system logs pertain to the firewall appliance's own operations, not to security list or NSG evaluation on a VNIC.

Full explanation →
267
MCQeasy

An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?

A.An Autonomous Database on Shared Infrastructure instance
B.A standard Oracle Base Database system
C.A Virtual Cloud Network with a default database subnet only
D.An Autonomous Exadata Infrastructure resource
AnswerD

Autonomous Exadata Infrastructure provisions the dedicated Exadata hardware and networking that hosts the container database, delivering the physical isolation the security mandate demands. It is the prerequisite layer: no Autonomous Container Database can be created until this infrastructure exists in the tenancy.

Why this answer

To deploy an Autonomous Database on Dedicated Infrastructure, the foundational resource is the Autonomous Exadata Infrastructure (AEI). This is a dedicated Exadata system in OCI that provides the hardware and infrastructure for hosting Autonomous Container Databases (ACDs). The AEI must be provisioned first because it supplies the compute, storage, and network resources that the ACDs and subsequent Autonomous Databases will use.

Without an AEI, you cannot create an ACD or any dedicated autonomous databases.

Exam trap

1Z0-997-26 often tests the distinction between shared and dedicated infrastructure, and candidates may mistakenly think that a VCN or a Base Database system is the foundational resource, but the correct answer is the Autonomous Exadata Infrastructure.

How to eliminate wrong answers

Option A is wrong because an Autonomous Database on Shared Infrastructure is a completely different deployment model that does not provide the dedicated, isolated infrastructure required for dedicated autonomous databases. Option B is wrong because a standard Oracle Base Database system is a different service (Base Database Service) and is not used as the foundation for Autonomous Database on Dedicated Infrastructure. Option C is wrong because a Virtual Cloud Network with a default database subnet is a networking component that is necessary but not sufficient; it does not provide the dedicated Exadata infrastructure required.

The AEI is the specific foundational resource that must be provisioned first.

Full explanation →
268
Multi-Selecthard

An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?

Select 3 answers
A.Attach a public load balancer directly to the internal database to route synthetic traffic.
B.Deploy APM Dedicated Vantage Points (DVPs) on Compute instances inside the private OCI VCN.
C.Disable all VCN security lists to allow inbound SSH from public APM nodes.
D.Ensure network connectivity (such as service gateways or NAT gateways) allows DVPs to communicate with the APM service endpoint.
E.Configure synthetic monitors in APM to target the Dedicated Vantage Point instead of public locations.
AnswersB, D, E

Dedicated Vantage Points are deployed on Compute instances inside the private OCI VCN, executing synthetic scripts from within the private network. This satisfies the constraint that corporate networks cannot be reached from public internet vantage points.

Why this answer

Option B is correct because APM Dedicated Vantage Points (DVPs) are the mechanism for running synthetic monitoring scripts from inside a private OCI VCN, allowing tests against resources that are not reachable from the public internet. Option D is correct because DVPs must be able to reach the APM service endpoint to upload results and receive configuration, which requires appropriate egress connectivity such as a service gateway or NAT gateway in the VCN. Option E is correct because synthetic monitors must be explicitly configured to use the DVP as their execution location rather than the default public vantage points, otherwise the scripts would still run from the internet.

Option A is incorrect because attaching a public load balancer to an internal database would expose the database and is not how synthetic monitoring reaches private targets. Option C is incorrect because disabling VCN security lists and allowing inbound SSH from public APM nodes is insecure and unnecessary; DVPs run locally inside the VCN and do not require inbound SSH from public APM infrastructure.

Exam trap

1Z0-997-26 often tests the misconception that synthetic monitoring requires public exposure of private endpoints — candidates pick options that open public access instead of using DVPs.

Full explanation →
269
MCQmedium

An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?

A.Configure an OCI Notifications service topic subscription with a logical filter rule.
B.Create two separate alarms and define an OCI Monitoring Composite Alarm using the logical AND operator.
C.Use OCI Events service with a custom JSON payload condition.
D.Create a single standard alarm with a compound mathematical metric expression joining CPU and latency.
AnswerB

A composite alarm evaluates child alarm states using a logical expression, so combining two separate metric alarms with AND fires only when both CPU and latency thresholds breach simultaneously. A single metric alarm cannot span two namespaces.

Why this answer

OCI Monitoring Composite Alarms are designed to combine multiple underlying metric alarms using logical operators (AND, OR, etc.). To trigger only when both CPU > 90% and latency > 500ms occur simultaneously, you create two standard metric alarms and then a composite alarm that ANDs them together.

Exam trap

The trap is assuming OCI Notifications or Events can perform logical filtering; 1Z0-997-26 tests whether you know composite alarms are the only native construct for AND/OR across metric alarms.

How to eliminate wrong answers

Option A is wrong because OCI Notifications subscriptions deliver messages to endpoints (email, PagerDuty, etc.) and do not evaluate logical conditions across alarms. Option C is wrong because OCI Events reacts to state-change events (e.g., resource creation) and cannot natively AND two metric thresholds. Option D is wrong because a single standard alarm evaluates one metric expression; while Monitoring supports some metric math, it does not provide the cross-alarm logical AND semantics that composite alarms do.

Full explanation →
270
MCQmedium

Your organization runs a multi-tenant Oracle Base Database Service and you need to monitor the storage utilization of individual Pluggable Databases (PDBs) within a Container Database (CDB). Which OCI native service and metric should you review?

A.OCI Logging Analytics with custom log parsers for alert.log.
B.OCI Database Management service PDB storage metrics.
C.Compute Instance metrics via OCI Monitoring service agent.
D.Autonomous Health Framework (AHF) health check reports.
AnswerB

Database Management surfaces PDB-level storage metrics, including allocated and used space per pluggable database, rather than only CDB-wide figures. This granularity is what the multi-tenant scenario demands, since container-level metrics cannot isolate which PDB is consuming storage.

Why this answer

The OCI Database Management service provides native monitoring for Oracle databases, including PDB-level storage metrics. It collects and displays metrics such as tablespace usage, datafile size, and storage utilization for each PDB within a CDB. This is the correct OCI-native service for monitoring individual PDB storage.

Exam trap

1Z0-997-26 often tests the assumption that host-level monitoring or log analytics can provide PDB storage metrics — candidates must remember that OCI Database Management is the native service for database-level metrics.

How to eliminate wrong answers

Option A is wrong because OCI Logging Analytics with custom log parsers for alert.log is a log analysis tool, not a metrics service for PDB storage utilization; it would require custom parsing and does not provide native storage metrics. Option C is wrong because Compute Instance metrics via the OCI Monitoring service agent report host-level metrics (CPU, memory, disk I/O) but not PDB-level storage metrics inside the database. Option D is wrong because the Autonomous Health Framework (AHF) health check reports are diagnostic tools for Oracle databases, not a continuous monitoring service for PDB storage metrics in OCI.

Full explanation →
271
MCQmedium

Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?

A.Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.
B.Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.
C.Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.
D.Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.
AnswerC

OCVS runs the native vSphere hypervisor on bare metal, so guest OS configurations, custom kernel modules and security policies remain untouched. HCX performs live migration with minimal downtime, satisfying the requirement to preserve exact OS configurations and network consistency without re-platforming.

Why this answer

Oracle Cloud VMware Solution (OCVS) provides a native VMware SDDC environment in OCI, including vSphere, vSAN, and NSX-T, so existing VMs can be migrated without modifying the guest OS, kernel modules, or security policies. VMware HCX enables live migration (vMotion, cold, and bulk) with network extension, preserving IP addresses and network consistency. This is the only option that maintains the exact OS configurations and hypervisor layer while automating the migration.

Exam trap

1Z0-997-26 often tests the misconception that any VM can be migrated to OCI by simply exporting a VMDK and importing it as a custom image, but this ignores the need for hypervisor-level compatibility and the preservation of VMware-specific configurations, which only OCVS with HCX provides.

How to eliminate wrong answers

Option A is wrong because rsync copying a root filesystem to a bare metal instance does not preserve the VM's hardware abstraction, kernel modules, or boot configuration, and it requires manual reconfiguration of network and security policies. Option B is wrong because rebuilding from scratch with Terraform and redeploying binaries does not maintain exact OS configurations, custom kernel modules, or strict security policies, and it is not a migration but a re-architecture. Option D is wrong because exporting a VMDK and importing it as a generic OCI custom image does not retain VMware-specific drivers, kernel modules, or network settings, and the resulting instance runs on OCI's native hypervisor, not vSphere, breaking the requirement for an unchanged hypervisor layer.

Full explanation →
272
MCQeasy

You have deployed an API on OCI API Gateway and want to protect it from common web attacks such as SQL injection, cross-site scripting (XSS), and bad bots. Which OCI service should you integrate with API Gateway?

A.OCI Vulnerability Scanning Service
B.OCI Web Application Firewall (WAF)
C.OCI Bastion Service
D.OCI Cloud Guard
AnswerB

OCI Web Application Firewall inspects inbound HTTP traffic at layer 7, applying managed rule sets that detect and block SQL injection, cross-site scripting and bot signatures before requests reach the gateway. Integrating it with API Gateway satisfies the stem's requirement to defend the deployed API against those common web attacks.

Why this answer

OCI Web Application Firewall (WAF) is designed to protect web applications and APIs from common web attacks like SQL injection, XSS, and bad bots by inspecting HTTP/HTTPS traffic and applying rule-based filtering. It integrates directly with OCI API Gateway, allowing you to attach a WAF policy to the gateway to enforce security rules at the edge. This integration provides layer 7 protection without modifying the backend API.

Exam trap

1Z0-997-26 often tests the distinction between security services that provide preventive traffic filtering (WAF) versus those that provide posture management (Cloud Guard) or vulnerability detection (Vulnerability Scanning Service), causing candidates to confuse their primary functions.

How to eliminate wrong answers

Option A is wrong because OCI Vulnerability Scanning Service identifies vulnerabilities in compute instances and containers, not in web traffic, and does not provide runtime protection against SQL injection or XSS. Option C is wrong because OCI Bastion Service provides secure SSH/RDP access to private subnets, not web application firewall capabilities. Option D is wrong because OCI Cloud Guard is a security posture management service that detects misconfigurations and threats across OCI resources, but it does not inspect or filter HTTP traffic to protect APIs from web attacks.

Full explanation →
273
MCQhard

During a database migration project using Oracle Zero Downtime Migration (ZDM), the pre-migration validation phase fails with an error indicating that the source database's time zone file version does not match the target OCI Database service time zone file version. How should you resolve this issue?

A.Use the DBMS_DST package on the source database to update the time zone file version to match the target database before restarting the ZDM workflow.
B.Manually downgrade the OCI Database service time zone binaries using root OS access.
C.Modify the ZDM response file parameter `SKIP_DST_CHECK=TRUE` to bypass the validation check.
D.Restart the ZDM migration job using the logical migration workflow instead of the physical workflow.
AnswerA

ZDM validation compares source and target time zone file versions, so the source must be patched to match before migration proceeds. DBMS_DST performs this upgrade in place, satisfying the version-match constraint that blocks the workflow.

Why this answer

The DBMS_DST package is Oracle's supported mechanism for updating a database's time zone file version. When ZDM pre-migration validation detects a mismatch between source and target time zone file versions, the correct remediation is to upgrade the source database's DST version to match or exceed the target using DBMS_DST (typically via DBMS_DST.BEGIN_PREPARE, BEGIN_UPGRADE, and related procedures). This ensures data consistency for TIMESTAMP WITH TIME ZONE columns and allows the physical migration to proceed without errors.

Exam trap

1Z0-997-26 often tests the misconception that validation checks can be bypassed with hidden parameters like SKIP_DST_CHECK, when in reality Oracle requires proper remediation using DBMS_DST to ensure data integrity.

How to eliminate wrong answers

Option B is wrong because you cannot manually downgrade OCI Database service time zone binaries; OCI managed services do not grant root OS access, and time zone files are patched only through Oracle-supported maintenance. Option C is wrong because SKIP_DST_CHECK is not a valid ZDM response file parameter; ZDM does not provide a supported bypass for time zone validation, and attempting to skip it would risk data corruption. Option D is wrong because switching to logical migration does not resolve the underlying time zone file version mismatch; logical migration still requires compatible time zone data, and the validation would still fail or produce incorrect results.

Full explanation →
274
MCQhard

An enterprise application uses an Oracle Autonomous Transaction Processing database and encounters intermittent application-level timeouts during peak concurrency spikes. Upon investigating, you notice that queued statements are waiting due to resource limits. Which Autonomous Database feature should you adjust to manage concurrency and statement queuing behavior?

A.The physical memory size of the OCI Compute host instance running the application
B.Linux kernel swappiness parameters on the database host
C.OCI Virtual Cloud Network security list packet drop thresholds
D.Consumer groups and resource management rules via DBMS_RESOURCE_MANAGER or resource profile settings
AnswerD

Consumer groups with DBMS_RESOURCE_MANAGER map sessions to resource profiles, letting you cap parallelism and set queuing thresholds per workload. This directly governs how statements wait when concurrency spikes exhaust resources, satisfying the requirement to manage statement queuing behaviour rather than merely scaling compute.

Why this answer

Autonomous Database uses Database Resource Manager (DBRM) consumer groups and resource plans to control how sessions share CPU, parallelism, and queued statements. When concurrency spikes cause statements to queue, the fix is to define or adjust consumer groups and resource management rules (via DBMS_RESOURCE_MANAGER or the built-in resource profiles) so that critical workloads get priority and queuing thresholds are tuned. This is the only option that directly addresses database-level concurrency and statement queuing.

Exam trap

The trap is assuming that application timeouts during concurrency spikes are an infrastructure sizing problem (compute memory, network, or OS tuning) when the actual control point in Autonomous Database is the Database Resource Manager consumer group configuration.

How to eliminate wrong answers

Option A is wrong because the physical memory of the OCI Compute host running the application has no bearing on how the Autonomous Database internally queues statements — ADB is a managed service and its resource governance is not controlled by client host sizing. Option B is wrong because Linux kernel swappiness on the database host is not customer-accessible in Autonomous Database; the service is fully managed and OS-level tuning is abstracted away. Option C is wrong because VCN security list packet drop thresholds relate to network filtering, not to database statement queuing or resource contention inside the database.

Full explanation →
Page 3

Page 4 of 4

All pages

1234

Practice 1Z0-997-26 by domain

Target a specific domain to shore up weak areas.

ObservabilityCloud Native ArchitectureMulticloud And HybridHigh Availability And Disaster RecoveryDatabasesWorkload MigrationSecurity
See all domains with question counts →