Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) 1Z0-997-26 Questions 301–344 | Page 5/5

301

MCQmedium

Your development team wants to connect securely to an Autonomous Database (Serverless) instance using mutual TLS (mTLS) authentication. Where must the client application obtain the required credentials to establish this secure connection?

A.Download the database connection wallet zip file from the OCI Console or CLI and extract it on the client host

B.Generate a Kerberos ticket granting service token via the IAM security console

C.Retrieve the master encryption key directly from OCI Vault using an API key

D.Configure a public SSL certificate issued by Let's Encrypt in the database parameter settings

AnswerA

Correct. The mTLS wallet contains the necessary keystores, truststores, and tnsnames.ora configuration files.

Why this answer

Clients connecting via mTLS to an Autonomous Database must download the wallet file (credentials zip) generated from the OCI Console or CLI.

Full explanation →

302

MCQeasy

What is the primary purpose of OCI Database Actions (SQL Developer Web) when working with an Oracle Autonomous Database?

A.To configure physical Exadata storage cell disks and flash cache parameters

B.To monitor physical VCN packet drops and firewall logs

C.To manage OCI IAM user groups and federation settings across enterprise identity providers

D.To provide a web-based development and management interface for executing SQL, querying data, and managing database users

AnswerD

Correct. Database Actions is built directly into Autonomous Database for web-based SQL development and management.

Why this answer

OCI Database Actions provides a web-based interface for running SQL queries, developing PL/SQL, managing users, and loading data into Autonomous Database.

Full explanation →

303

MCQeasy

An architect is planning the migration of a large enterprise application repository stored in an on-premises NFS filer to OCI. The application requires POSIX-compliant shared file storage accessible by multiple compute instances simultaneously across different availability domains. Which OCI storage service should be deployed?

A.OCI Archive Storage

B.OCI Object Storage standard tier

C.OCI File Storage Service (FSS)

D.OCI Block Volume service

AnswerC

FSS is a shared, POSIX-compliant network file system accessible simultaneously by multiple instances.

Why this answer

OCI File Storage Service (FSS) provides a durable, scalable, enterprise-grade, network file system that supports the Network File System version 3.0 (NFSv3) protocol and POSIX-compliant locking, accessible across multiple Availability Domains.

Full explanation →

304

MCQhard

You are designing a multi-database architecture where applications require read-scaling across different geographic regions with minimal replication lag. You decide to deploy Autonomous Data Warehouse (ADW) instances across three regions connected via GoldenGate. Which feature of Autonomous Database can be leveraged alongside GoldenGate to prevent sequence cache duplication conflicts across regions?

A.Setting the database character set to AL32UTF8 to handle multi-region strings

B.Configuring autonomous database global sequences with specific increment and offset parameters

C.Using Oracle Autonomous Health Framework to automatically resolve distributed deadlocks

D.Enabling Autonomous Data Guard in Snapshot Standby mode in all regions simultaneously

AnswerB

Correct. Using SEQUENCE ... INCREMENT BY <num_regions> START WITH <offset> avoids primary key conflicts across distributed multi-master or replicated nodes.

Why this answer

When deploying multi-region distributed writes or replication architectures, utilizing Oracle Database features such as sequence caching with ORDER and NOORDER or scaling ranges prevents primary key collisions across nodes.

Full explanation →

305

MCQeasy

When creating an Oracle Base Database system, which database edition options are available for licensing on OCI?

A.Oracle Database Express Edition (XE) exclusively

B.Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance

C.Microsoft SQL Server Enterprise Edition

D.MySQL Enterprise Edition and PostgreSQL Community Edition only

AnswerB

Correct. These are the standard supported Oracle Database editions available when provisioning Base Database systems on OCI.

Why this answer

Oracle Base Database systems support Standard Edition 2, Enterprise Edition, Enterprise Edition High Performance, and Enterprise Edition Extreme Performance.

Full explanation →

306

MCQeasy

Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?

A.OCI API Gateway

B.OCI Streaming Service

C.OCI Events Service

D.OCI Notifications Service

AnswerD

Correct. Notifications service manages subscriptions to deliver alarm alerts to email, SMS, PagerDuty, and HTTPS endpoints.

Why this answer

OCI Notifications service broadcasts messages to distributed endpoints such as HTTPS endpoints, PagerDuty, Slack, email, and SMS.

Full explanation →

307

MCQmedium

You are migrating a legacy application that relies on hardcoded IP addresses for inter-service communication. During the migration to OCI VCNs, you need to ensure that virtual machines can resolve each other's hostnames dynamically without maintaining manual /etc/hosts files. What OCI networking feature should you configure?

A.OCI API Gateway DNS forwarding rules

B.OCI Default VCN Resolver with assigned hostname prefixes

C.OCI Streaming service message brokers

D.OCI Network Load Balancer hostname rewriting

AnswerB

The default VCN resolver automatically assigns and resolves DNS hostnames for instances within the VCN.

Why this answer

OCI provides default VCN DNS resolution and custom DNS resolver settings, allowing instances within a VCN or peered VCNs to resolve hostnames automatically via Internet and VCN Resolver.

Full explanation →

308

MCQhard

You are configuring a Data Guard association between two Oracle Base Database Systems in different OCI regions. The primary database encounters an unplanned outage, and you perform a manual failover. What action must you take afterward if you wish to restore the original architecture with the old primary as the new standby?

A.Run a simple 'SWITCHOVER' command to reverse roles without any data synchronization checks.

B.Modify the listener.ora file manually via SSH and restart the clusterware.

C.Delete the standby database and provision a brand-new VCN in the primary region.

D.Recreate or reinstate the former primary database (using Flashback Database or backup restoration) to convert it into a valid standby.

AnswerD

A failover breaks the replication chain and diverges timelines; the old primary must be reinstated or rebuilt to serve as a standby.

Why this answer

After a failover, the old primary database is no longer in sync and cannot act as a standard standby without being reinstated or rebuilt (e.g., using Flashback Database or re-creating the standby).

Full explanation →

309

MCQeasy

Your organization wants to deploy an ephemeral, event-driven data processing task that runs for less than 3 minutes whenever a new object is uploaded to an OCI Object Storage bucket. Which serverless combination is the most cost-effective and operationally efficient solution?

A.Use an OCI Database with PL/SQL triggers to download files from Object Storage.

B.Configure an OCI Events rule to trigger an OCI Function upon object creation in Object Storage.

C.Deploy a Kubernetes deployment with 10 replicas on an OKE cluster to monitor bucket logs.

D.Provision an Always Free Compute VM running a cron job that polls Object Storage every minute.

AnswerB

This native serverless pattern requires zero server management and incurs costs only when the function executes.

Why this answer

OCI Events service can listen to Object Storage bucket creation events and directly trigger an OCI Function without requiring dedicated virtual machines to run continuously.

Full explanation →

310

MCQmedium

You need to migrate an on-premises Oracle Database to OCI Exadata Database Service using Oracle GoldenGate for zero-downtime migration with bi-directional replication. Which critical design consideration must be addressed regarding table design on both databases?

A.Primary keys must be omitted to allow duplicate row insertion across databases

B.Tables must have primary keys or unique identifiers, and Conflict Detection and Resolution (CDR) must be configured

C.Tables must not contain any indexes, triggers, or constraints

D.All tables must be converted to temporary unlogged tables

AnswerB

Correct. Bi-directional replication requires unique row identifiers and CDR to resolve update conflicts.

Why this answer

In bi-directional GoldenGate replication, tables must have a primary key or unique identifier, and conflict detection and resolution (CDR) strategies must be implemented to handle concurrent updates.

Full explanation →

311

MCQeasy

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

A.RIP (Routing Information Protocol)

B.BGP (Border Gateway Protocol)

C.EIGRP (Enhanced Interior Gateway Routing Protocol)

D.OSPF (Open Shortest Path First)

AnswerB

BGP is the industry standard protocol used for dynamic routing in OCI hybrid connections.

Why this answer

Border Gateway Protocol (BGP) is the routing protocol used to dynamically exchange routes over FastConnect and dynamic routing VPN tunnels.

Full explanation →

312

MCQmedium

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

A.On the OCI Bastion service configuration page.

B.In the DRG route table import/export distribution or static route configuration for the VPN attachment.

C.Inside the OCI Identity and Access Management (IAM) policy console.

D.By modifying the VCN DHCP options.

AnswerB

Route filtering and propagation control for hybrid attachments are managed via DRG route tables and route distributions.

Why this answer

In OCI DRGs using DRG route tables and import/export route distributions, you can control which routes are accepted or advertised, or you can manage prefixes in the CPE/VPN static route configurations.

Full explanation →

313

MCQeasy

An auditor requests a log of all administrative API actions, console logins, and resource modifications performed across your OCI tenancy over the past 365 days. Which OCI service provides this native auditing capability?

A.OCI Events Service

B.OCI Audit Service

C.OCI Logging Analytics

D.Database Audit Vault

AnswerB

The Audit service automatically records API events for governance, compliance, and security investigations.

Why this answer

OCI Audit service automatically records calls to all supported Oracle Cloud Infrastructure public API endpoints as log events for security and compliance tracking.

Full explanation →

314

MCQmedium

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

A.Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.

B.The FastConnect virtual circuit is disabled.

C.The OCI VCN does not have an Internet Gateway attached.

D.The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.

AnswerA

Even with a working VPN tunnel, OCI security rules and OS firewalls must permit the traffic.

Why this answer

If the tunnel is up, Layer 3/IPsec is established. Failure to ping usually stems from VCN Security Lists, Route Tables, or OS-level host firewalls (iptables/firewalld) blocking ICMP or return traffic.

Full explanation →

315

MCQeasy

Your organization has completed migrating a database to OCI Base Database Service. To ensure compliance with corporate data protection policies, you must verify that all database backups stored in OCI Object Storage are automatically encrypted using customer-managed encryption keys. Where should you configure this key management integration?

A.OCI Vault service (Key Management)

B.OCI Database Migration service connection profiles

C.OCI Audit log configuration

D.OCI Identity and Access Management (IAM) password policies

AnswerA

OCI Vault enables the creation of master encryption keys that can be assigned to databases, block volumes, and object storage buckets for customer-managed encryption.

Why this answer

OCI Vault service allows customers to create and manage master encryption keys. Both database backups and block volumes can be encrypted using keys stored in OCI Vault (KMS).

Full explanation →

316

Multi-Selecthard

You are designing a secure network architecture for migrating production workloads into an OCI Virtual Cloud Network (VCN). Compliance standards require strict traffic inspection, isolation, and secure administrative access. Which THREE OCI networking and security features should you incorporate into your design? (Choose three.)

Select 3 answers

A.Implement stateful Security Lists and Network Security Groups (NSGs) to enforce least-privilege traffic filtering at the subnet and VNIC levels.

B.Disable all VCN route tables and allow all subnets to broadcast traffic freely across the public internet.

C.Deploy OCI Bastion service to provide secure, ephemeral, and audited SSH/RDP access to private compute instances without public IP addresses.

D.Attach public IP addresses to all database and application backend servers to ensure direct administrator troubleshooting capability.

E.Deploy OCI Network Firewall to inspect inter-subnet and east-west traffic within the VCN.

AnswersA, C, E

Security lists and NSGs provide granular firewall control over ingress and egress traffic.

Why this answer

Secure OCI architectures utilize network isolation via private subnets, Network Security Groups (NSGs) or Security Lists for micro-segmentation, and OCI Bastion service or Cloud Guard for secure administrative access and posture monitoring.

Full explanation →

317

MCQmedium

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

A.Install an external Squid proxy on an on-premises server connected via IPsec VPN.

B.Set up a NAT Gateway and forward all traffic to the internet.

C.Attach a Public IP address to every worker node in the OKE cluster.

D.Configure an OCI Service Gateway in your VCN and add a route rule for OCI Services to the private subnet's route table.

AnswerD

Correct. Service Gateways allow private access to regional OCI services (like OCIR and Object Storage) without traversing the public internet.

Why this answer

To enable private subnets to access OCI services like OCIR without public internet access, you must configure Service Gateways along with route table rules pointing to the OCI Services network.

Full explanation →

318

MCQeasy

Your company is planning to migrate 50 TB of unstructured file data from an on-premises Network Attached Storage (NAS) appliance to OCI File Storage Service (FSS). The target RTO/RPO allows for a phased baseline copy followed by incremental syncs. Which tool should you use to transfer the data efficiently over your dedicated OCI FastConnect link?

A.OCI Streaming Service

B.OCI Data Transfer Appliance

C.Parallelized rsync or custom multithreaded copy scripts via an OCI Compute instance acting as a migration gateway mounted to the FSS target

D.Oracle Data Pump

AnswerC

Using a compute instance with high network throughput and parallelized rsync streams directly to the FSS mount target maximizes the FastConnect bandwidth utilization.

Why this answer

Data Transfer Appliance is for offline physical shipping, but over FastConnect, rsync or specialized multithreaded file transfer utilities mounted directly to the FSS mount target are ideal for network-based parallelized data ingestion.

Full explanation →

319

MCQhard

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

A.In the same subnet, pinned to a single physical host.

B.Inside the OCI Control Plane root compartment.

C.On bare metal instances without any virtual cloud networks.

D.Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.

AnswerD

Deploying across ADs/FDs prevents a single point of failure for the multicloud connectivity tier.

Why this answer

To ensure high availability and fault tolerance against infrastructure failures, SD-WAN appliance instances should be deployed across different Availability Domains (ADs) or Fault Domains (FDs) behind an OCI Load Balancer or using BGP failover.

Full explanation →

320

MCQhard

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

A.OCI API Gateway configured with a mock backend routing to OCI Functions.

B.OCI Notifications Service publishing directly to an OCI Object Storage bucket.

C.OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

D.OCI Events Service rule routing to an OCI Stream, which then invokes OCI Functions with a custom consumer group and a configured DLQ.

AnswerD

Correct. OCI Streaming provides offset management, at-least-once delivery, and custom consumer logic allowing implementation of dead-letter handling.

Why this answer

OCI Events Service allows filtering and routing of events, but to guarantee handling with a dead-letter queue and retry capabilities, routing events through OCI Streaming or OCI Queue with OCI Notifications/Events integration is required. Specifically, OCI Events can publish to OCI Streaming, or OCI Queue can be integrated with Functions and a DLQ.

Full explanation →

321

MCQhard

An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?

A.OCI Health Checks Ping Monitors

B.APM Synthetic Monitoring Browser Monitors using Dedicated Vantage Points

C.Logging Analytics synthetic agent extensions

D.OCI Monitoring service Synthetic Probes

AnswerB

Correct. Browser monitors execute scripts to simulate user interactions from various geographic vantage points.

Why this answer

APM Synthetic Monitoring supports browser monitors that execute Selenium-based scripts from public or dedicated Vantage Points globally.

Full explanation →

322

Multi-Selecthard

An observability architect is designing a high-availability alerting and incident response strategy in OCI. Which THREE best practices should be incorporated?

Select 3 answers

A.Set appropriate evaluation periods and repeat intervals to prevent alarm flapping.

B.Use composite alarms to combine multiple conditions and reduce alert fatigue from cascading failures.

C.Rely exclusively on manual polling of the OCI Metrics Explorer console by the on-call engineer.

D.Configure multiple notification endpoints (e.g., PagerDuty, Email, HTTPS) on OCI Notifications topics for redundancy.

E.Disable all IAM security policies during alarm firing to allow unrestricted troubleshooting access.

AnswersA, B, D

Correct. Tuning evaluation windows avoids rapid state-switching (flapping).

Why this answer

Good alerting strategies include using composite alarms to reduce noise, routing alerts through Notifications to multiple endpoints (like PagerDuty or email), and setting appropriate evaluation windows to prevent flapping.

Full explanation →

323

MCQeasy

An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?

A.OCI Logging Analytics

B.OCI Audit Service

C.OCI Health Checks

D.OCI Object Storage

AnswerA

Correct. Logging Analytics enables searching, parsing, and running advanced analytics queries on log data.

Why this answer

OCI Logging Analytics provides powerful log exploration, parsing, ML-driven clustering, and SQL-like query capabilities for deep log analysis.

Full explanation →

324

MCQhard

An architect is designing an Oracle Exadata Database Service on Dedicated Infrastructure deployment with multiple VM clusters on a single Exadata rack. Which architectural feature allows secure isolation of CPU, memory, and database workloads between these distinct VM clusters?

A.OCI Block Volume volume group replicas synchronized via block replication

B.Software-defined VLAN tagging enforced by the OCI Virtual Cloud Network (VCN) hypervisor only

C.Autonomous Database container database resource pools sharing a single OS kernel

D.Hard partitioning using Oracle VM (dom0/domU) hypervisor virtualization on the database servers

AnswerD

Correct. Dom0/domU virtualization isolates CPU and memory resources across separate VM clusters on the same Exadata rack.

Why this answer

Exadata VM clusters utilize Oracle Virtual Machine (dom0/domU) virtualization architecture to completely isolate resources between different clusters on the same physical rack.

Full explanation →

325

MCQeasy

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

A.Ability to route traffic over public cellular networks

B.Zero configuration required on the on-premises router

C.Automatic encryption of all traffic at Layer 2 by default

D.Higher bandwidth, lower latency, and predictable performance

AnswerD

FastConnect bypasses the public internet for dedicated, high-performance connectivity.

Why this answer

FastConnect provides higher bandwidth, lower latency, and more predictable network performance compared to internet-based IPSec VPNs.

Full explanation →

326

MCQmedium

You are performing maintenance on an OCI Load Balancer backend set. You want to temporarily stop sending traffic to a specific backend server without immediately dropping active persistent connections. What feature should you use?

A.Set the backend server weight to zero without enabling draining.

B.Delete the backend server from the backend set immediately.

C.Enable Connection Draining on the backend server.

D.Modify the security list to drop all TCP packets on port 443.

AnswerC

Connection draining finishes ongoing requests before taking the backend server offline.

Why this answer

Draining allows a load balancer to stop sending *new* requests to a backend server while allowing existing persistent connections to complete gracefully.

Full explanation →

327

MCQhard

Your security team has discovered that an application running in OCI is susceptible to Cross-Site Scripting (XSS) and SQL injection attacks at the edge. Which OCI service and configuration should you implement to protect the web application without rewriting the core application code?

A.Enable OCI Audit logs and configure automated notifications via OCI Notifications service.

B.Deploy an OCI Network Firewall with an SSL decryption profile in front of the application subnet.

C.Configure an OCI Web Application Firewall (WAF) policy with protection rules and attach it to the Load Balancer.

D.Implement OCI Cloud Guard Security Zones to automatically remediate application code flaws.

AnswerC

OCI WAF integrates directly with OCI Load Balancers or can run edge enforcement to protect applications against web vulnerabilities.

Why this answer

OCI Web Application Firewall (WAF) provides centralized protection against web application attacks, such as SQL injection, XSS, and other OWASP Top 10 vulnerabilities, by inspecting HTTP/HTTPS traffic.

Full explanation →

328

MCQmedium

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

A.Local Peering Gateway

B.Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit

C.NAT Gateway

D.Internet Gateway

AnswerB

FastConnect virtual circuits terminate at the DRG, enabling BGP session establishment.

Why this answer

A Virtual Circuit must be created and associated with the FastConnect provider/colocation port, and the DRG must be attached to a Virtual Cloud Network (VCN) via DRG attachments, but for BGP peering, the FastConnect virtual circuit terminates directly on the DRG.

Full explanation →

329

MCQeasy

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

A.NAT Gateway

B.Service Gateway

C.Customer-Premises Equipment (CPE)

D.Virtual Cloud Network (VCN)

AnswerC

A CPE object represents your on-premises router or firewall in OCI.

Why this answer

You must create a Customer-Premises Equipment (CPE) object in OCI representing the public IP address and routing parameters of your on-premises router.

Full explanation →

330

MCQmedium

You are migrating an on-premises Oracle Database (version 19c) to Oracle Autonomous Database (Serverless) using Oracle Data Pump. Which action is mandatory to ensure compatibility before generating the Data Pump export dump file?

A.Disable Automatic Workload Repository (AWR) collection on the source database

B.Convert the source database into an Oracle Multitenant Container Database with a single pluggable database

C.Run the DBMS_CLOUD.PREPARE_FOR_AUTONOMOUS PL/SQL package on the source database

D.Manually drop all custom triggers and indexes to prevent import failures

AnswerC

Correct. This package performs necessary pre-checks and transformations to ensure compatibility with Autonomous Database.

Why this answer

When migrating to Autonomous Database using Data Pump, you must run the DBMS_CLOUD.PREPARE_FOR_AUTONOMOUS procedure or use the Autonomous Database Migration tool to check and convert incompatible tablespaces, segments, and objects.

Full explanation →

331

Multi-Selecthard

When configuring OCI Security Zones, which TWO restrictions are automatically enforced on resources within that zone? (Choose two.)

Select 2 answers

A.Resources are strictly prohibited from having public IP addresses.

B.All VCNs must have Internet Gateways attached by default.

C.All Object Storage buckets must be private and cannot allow public access.

D.IAM administrators are prohibited from creating any compartments.

E.All compute instances must use unencrypted local boot volumes.

AnswersA, C

Security Zones prevent any resource from acquiring a public IP address.

Why this answer

Security Zones prohibit public IP addresses on compute instances and require all storage buckets to be private.

Full explanation →

332

Multi-Selecthard

Which TWO logging and monitoring features in OCI are essential for maintaining comprehensive security audit trails and threat detection? (Choose two.)

Select 2 answers

A.Routing all log data to unencrypted public FTP servers.

B.OCI Audit service to capture all control plane API activities and resource modifications.

C.Disabling all logging services to save storage costs.

D.Relying solely on user memory dumps for audit compliance.

E.OCI Logging service to ingest, store, and analyze log data from VCN flow logs and compute instances.

AnswersB, E

OCI Audit records all API calls for accountability and forensics.

Why this answer

OCI Audit and OCI Logging are core services for capturing control plane and data plane events for security analysis.

Full explanation →

333

MCQhard

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

A.OCI Health Checks ping monitors

B.OCI VCN Flow Logs

C.OCI Monitoring service VNIC packet counters

D.OCI Network Firewall system logs

AnswerB

Correct. VCN Flow Logs capture metadata about traffic flowing to and from VNICs, including whether packets were accepted or rejected.

Why this answer

OCI VCN Flow Logs record accepted and rejected traffic flowing through VNICs, helping troubleshoot security list and NSG rules.

Full explanation →

334

Multi-Selecthard

You are troubleshooting performance bottlenecks in an event-driven architecture using OCI Streaming. Which THREE metrics or indicators should you monitor to detect consumer lag and partitioning issues?

Select 3 answers

A.OCI VCN Internet Gateway packet drop count due to BGP routing failures

B.Consumer Lag (difference between latest message offset and consumer committed offset)

C.Partition-level throughput (bytes/messages per second against stream limits)

D.GetMessages Latency

E.OCI Object Storage bucket public download bandwidth

AnswersB, C, D

Correct. Consumer lag indicates how far behind consumers are processing messages.

Why this answer

Key metrics for OCI Streaming include GetMessages latency, Consumer Lag (offset lag), and partition throughput/utilization.

Full explanation →

335

MCQeasy

An enterprise requires deploying an Oracle Autonomous Database on Dedicated Infrastructure to meet stringent data isolation and security mandates. Which foundational resource must be provisioned first before creating the Autonomous Container Database?

A.An Autonomous Database on Shared Infrastructure instance

B.A standard Oracle Base Database system

C.A Virtual Cloud Network with a default database subnet only

D.An Autonomous Exadata Infrastructure resource

AnswerD

Correct. The Autonomous Exadata Infrastructure must be created first as the foundational appliance layer.

Why this answer

Before you can provision an Autonomous Container Database (ACD) on Dedicated Infrastructure, you must provision an Autonomous Exadata Infrastructure resource which allocates the underlying physical Exadata compute and storage resources.

Full explanation →

336

MCQhard

During a database migration assessment from an on-premises Oracle Database (version 11.2.0.4) to OCI Base Database Service running Oracle Database 19c, you discover that the legacy database uses deprecated initialization parameters and character sets that are incompatible with 19c. How should you address this migration blocker?

A.Perform a direct binary block-level copy of the 11.2.0.4 datafiles to OCI and start the 19c instance using the old parameter file.

B.Migrate the database to an OCI Autonomous Database directly, as Autonomous Database automatically converts any legacy version and character set on the fly.

C.Run the Pre-Upgrade Information Tool (utlu19i.sql) on the source database, remediate reported issues, upgrade the database binaries locally, and then migrate using Oracle Data Pump or RMAN.

D.Use OCI GoldenGate to stream the 11.2.0.4 data directly into a 19c target database without any schema adjustments.

AnswerC

Running pre-upgrade checks, fixing deprecated parameters and character sets, and using supported upgrade paths ensure a successful migration.

Why this answer

Upgrading across multiple major versions (11.2 to 19c) requires reviewing upgrade paths, deprecations, and character set conversions. Oracle Data Pump or transportable methods along with the Database Upgrade Assistant (DBUA) or Pre-Upgrade Information Tool must be run on the source database to identify and remediate incompatibilities before migration.

Full explanation →

337

Multi-Selecthard

An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?

Select 3 answers

A.Attach a public load balancer directly to the internal database to route synthetic traffic.

B.Deploy APM Dedicated Vantage Points (DVPs) on Compute instances inside the private OCI VCN.

C.Disable all VCN security lists to allow inbound SSH from public APM nodes.

D.Ensure network connectivity (such as service gateways or NAT gateways) allows DVPs to communicate with the APM service endpoint.

E.Configure synthetic monitors in APM to target the Dedicated Vantage Point instead of public locations.

AnswersB, D, E

Correct. DVPs execute synthetic scripts from within private subnets.

Why this answer

Running private synthetic monitors requires deploying APM Dedicated Vantage Points (DVPs) inside the private VCN, configuring appropriate routing/firewall rules, and creating private synthetic monitors assigned to those DVPs.

Full explanation →

338

MCQmedium

An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?

A.Configure an OCI Notifications service topic subscription with a logical filter rule.

B.Create two separate alarms and define an OCI Monitoring Composite Alarm using the logical AND operator.

C.Use OCI Events service with a custom JSON payload condition.

D.Create a single standard alarm with a compound mathematical metric expression joining CPU and latency.

AnswerB

Correct. Composite alarms allow combining individual alarms using boolean logic such as AND and OR.

Why this answer

OCI Monitoring supports Composite Alarms, which allow combining multiple individual metric alarms using boolean operators (AND, OR, NOT).

Full explanation →

339

MCQmedium

Your organization runs a multi-tenant Oracle Base Database Service and you need to monitor the storage utilization of individual Pluggable Databases (PDBs) within a Container Database (CDB). Which OCI native service and metric should you review?

A.OCI Logging Analytics with custom log parsers for alert.log.

B.OCI Database Management service PDB storage metrics.

C.Compute Instance metrics via OCI Monitoring service agent.

D.Autonomous Health Framework (AHF) health check reports.

AnswerB

Database Management provides native visibility into individual PDB metrics including tablespace and storage usage.

Why this answer

Oracle Database Management service provides comprehensive monitoring capabilities for CDBs and PDBs, including detailed storage utilization metrics.

Full explanation →

340

MCQmedium

Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?

A.Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.

B.Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.

C.Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.

D.Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.

AnswerC

OCVS retains the existing VMware tooling, network policies, and guest OS configurations, ensuring zero changes to custom kernel modules.

Why this answer

OCI Compute and OCI Migration tools support lifting and shifting complex VMware environments by using VMware HCX on Oracle Cloud VMware Solution (OCVS) or importing custom images, but for strict OS configurations and automation, OCI Migration with agent-based discovery or OCVS is ideal. OCVS provides native VMware compatibility.

Full explanation →

341

MCQeasy

You have deployed an API on OCI API Gateway and want to protect it from common web attacks such as SQL injection, cross-site scripting (XSS), and bad bots. Which OCI service should you integrate with API Gateway?

A.OCI Vulnerability Scanning Service

B.OCI Web Application Firewall (WAF)

C.OCI Bastion Service

D.OCI Cloud Guard

AnswerB

Correct. WAF provides protection against common web exploits and integrates natively with API Gateway.

Why this answer

OCI Web Application Firewall (WAF) integrates with OCI API Gateway to protect web applications and APIs from malicious attacks and unwanted traffic.

Full explanation →

342

MCQhard

During a database migration project using Oracle Zero Downtime Migration (ZDM), the pre-migration validation phase fails with an error indicating that the source database's time zone file version does not match the target OCI Database service time zone file version. How should you resolve this issue?

A.Use the DBMS_DST package on the source database to update the time zone file version to match the target database before restarting the ZDM workflow.

B.Manually downgrade the OCI Database service time zone binaries using root OS access.

C.Modify the ZDM response file parameter `SKIP_DST_CHECK=TRUE` to bypass the validation check.

D.Restart the ZDM migration job using the logical migration workflow instead of the physical workflow.

AnswerA

Updating the source database time zone file using DBMS_DST ensures version parity and passes ZDM pre-checks.

Why this answer

Zero Downtime Migration (ZDM) requires time zone file versions to match between source and target databases to prevent data corruption during transportable tablespace or RMAN migrations. You must update the time zone file version on the source database using DBMS_DST package or apply the appropriate DST patch.

Full explanation →

343

MCQhard

An enterprise application uses an Oracle Autonomous Transaction Processing database and encounters intermittent application-level timeouts during peak concurrency spikes. Upon investigating, you notice that queued statements are waiting due to resource limits. Which Autonomous Database feature should you adjust to manage concurrency and statement queuing behavior?

A.The physical memory size of the OCI Compute host instance running the application

B.Linux kernel swappiness parameters on the database host

C.OCI Virtual Cloud Network security list packet drop thresholds

D.Consumer groups and resource management rules via DBMS_RESOURCE_MANAGER or resource profile settings

AnswerD

Correct. Adjusting resource consumer groups and parallelism controls how queries are queued and executed under high concurrency.

Why this answer

Autonomous Database allows managing resource management rules and consumer groups, including setting parameters via DBMS_RESOURCE_MANAGER or adjusting CPU/concurrency profiles.

Full explanation →

344

MCQhard

An organization has strict regulatory requirements to ensure that encryption keys used to protect sensitive database volumes are stored outside of Oracle's managed infrastructure and can be immediately revoked if a security breach is suspected. Which OCI Key Management configuration satisfies this?

A.Use Oracle-managed encryption keys with automatic key rotation enabled.

B.Rely on OCI Database Vault to manage cloud-level master encryption keys.

C.Store plain-text keys in OCI Object Storage with restricted IAM policies.

D.Configure a Virtual Private Vault backed by dedicated hardware security module (HSM) partitions and manage master encryption keys.

AnswerD

Dedicated vaults provide isolated HSM partitions exclusively for a single tenant, meeting rigorous regulatory standards for key ownership and revocation.

Why this answer

Using an OCI Vault with external key management (or dedicated Virtual Private Vaults backed by dedicated HSM partitions) allows organizations to retain full control over their keys, including immediate revocation.

Full explanation →

Oracle Cloud Infrastructure 2026 Architect Professional (1Z0-997-26) (1Z0-997-26) (1Z0-997-26) — Questions 301–344