1Z0-997-26 · domain
Observability
The Observability domain covers OCI Logging, Logging Analytics, Audit, Monitoring, Notifications, Events, and Service Connector Hub. Questions are scenario-based: you must pick the right log source, metric, or pipeline to detect, investigate, or export operational and security telemetry across compartments and regions.
Focused practice
Practice Observability questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Observability
Be able to map an observability requirement to the correct OCI service: Audit for API activity, Logging for service and custom logs, Monitoring for metrics and alarms, and Service Connector Hub for real-time export to SIEM or storage.
Selecting OCI Audit logs to trace API calls and user actions on resources
Using Service Connector Hub to stream logs to Object Storage, Functions, or Streaming
Configuring Monitoring alarms, metrics, and Notifications for resource health
Ingesting heterogeneous sources into Logging Analytics with agents and parsers
Watch out for
Common Observability exam traps
- ▸Confusing Audit logs with Logging service logs; Audit captures API activity, while Logging holds service and custom application logs
- ▸Assuming Logging Analytics ingests data automatically; it requires agents, connectors, or uploads to collect sources
- ▸Treating Service Connector Hub as a compute service rather than a data-movement pipeline between sources and targets
Question index
All Observability questions (41)
Click any question to see the full explanation, or start a practice session above.
When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?
Medium2A healthcare company must prove to auditors that no one, including tenancy administrators, could have altered or deleted a specific month of application logs stored in OCI Object Storage. Logs arrive continuously from OCI Logging via Service Connector Hub. Which combination of settings guarantees this?
Hard3Which TWO of the following statements are correct regarding the architecture and capabilities of OCI Application Performance Monitoring (APM)?
Hard4An administrator wants to inspect the operational health and performance metrics of an OCI Exadata Database Service instance using the default platform metrics provided out-of-the-box by OCI. Where should the administrator navigate in the OCI Console to view these metrics?
Easy5An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?
Hard6An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?
Easy7Your organization runs a multi-tier microservices application deployed across multiple OCI regions. You are tasked with implementing OCI Application Performance Monitoring (APM) to trace distributed transactions across different API gateways and containerized services. To correlate user browser sessions with backend database queries, what is the required configuration step on the client-facing application tier?
Hard8Your organization has set strict budgets in OCI to monitor cloud expenditure. A finance team member needs to receive an alert when forecasted spending reaches 100% of the monthly budget. How should you configure this alert?
Hard9You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?
Hard10You want to monitor the health and performance of your Oracle Autonomous Database in OCI. Which built-in metric namespace in OCI Monitoring should you query?
Easy11Which TWO destinations can receive messages dispatched from an OCI Notifications service topic?
Easy12A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?
Medium13An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?
Hard14Which TWO of the following services are native components of the Oracle Cloud Infrastructure Observability and Management platform?
Easy15An enterprise is designing a comprehensive cost observability and governance strategy in OCI. Which THREE practices or features should be implemented?
Hard16An auditor requests a complete historical record of all console sign-ins, IAM policy modifications, and compartment deletions across your OCI tenancy for the past 365 days. Which OCI service provides this data natively?
Medium17An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?
Easy18An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?
Hard19You want to quickly visualize CPU utilization across 50 Compute instances on a single pane of glass without creating complex custom dashboards. Which OCI Monitoring feature allows you to view pre-packaged metrics grouped by resource?
Easy20When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?
Medium21An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?
Medium22An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?
Medium23Your organization has strict security policies requiring all log data in OCI Logging to be encrypted using a customer-managed encryption key (CMK) stored in OCI Vault. How should you implement this?
Hard24Which TWO types of logs are natively generated and accessible within OCI Logging without requiring agent installation on compute instances?
Easy25An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?
Medium26Your finance department requires detailed cost visibility and granular chargeback reporting for multiple cloud environments spanning different business units, departments, and environments (Prod/Dev). Tagging is strictly enforced via OCI Tag Defaults. To analyze historical cost trends and forecast future cloud spend across these business dimensions, which OCI native feature should you use?
Medium27Your organization is implementing strict compliance requirements for log retention and auditing in OCI. Which THREE architectural implementations ensure secure, long-term log governance?
Hard28When configuring OCI Service Connector Hub to move logs from OCI Logging to OCI Object Storage, which THREE components must be defined?
Medium29A financial services firm runs a three-tier application in OCI. Compliance requires that all audit-relevant log entries be retained for seven years in immutable storage, while the Security team needs near-real-time search across the same logs for the last 30 days. The architect must design a single ingestion path that satisfies both needs without modifying application code. Which approach is correct?
Hard30You need to export OCI Audit logs to a third-party SIEM tool (such as Splunk or Elastic) in real-time. Which OCI architecture is best suited for this requirement?
Easy31You want to track API calls made by a specific user who deleted a critical production database in OCI. Which OCI service log should you examine?
Easy32An OCI Administrator needs to set up proactive alerting when the CPU utilization of a production Compute instance exceeds 90% for a sustained period of 15 minutes. Which OCI service should be configured to evaluate this metric and trigger notifications via an email endpoint?
Easy33Which THREE features are supported within OCI Cost Analysis to help administrators analyze and report on cloud spending?
Medium34An enterprise architect is designing a centralized log management solution in Oracle Cloud Infrastructure (OCI) Logging Analytics. The team needs to ingest logs from various heterogeneous sources, including custom applications, Oracle databases, and third-party firewalls, while ensuring that the log data is properly parsed and enriched without requiring custom regex development for every vendor format. Which feature should the architect leverage to meet this requirement?
Medium35Which THREE features are provided by OCI Application Performance Monitoring (APM)?
Medium36Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?
Easy37An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?
Hard38An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?
Easy39You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?
Hard40An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?
Hard41An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?
MediumOther domains
All 1Z0-997-26 exam domains
Frequently asked questions
- What does the Observability domain cover on the 1Z0-997-26 exam?
- Be able to map an observability requirement to the correct OCI service: Audit for API activity, Logging for service and custom logs, Monitoring for metrics and alarms, and Service Connector Hub for real-time export to SIEM or storage.
- How many questions are in this domain?
- This page lists all 41 Observability questions in the 1Z0-997-26 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Observability questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.