Knowledge + Practice

CCNA Observability Questions

41 questions · Observability · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selectmedium

When configuring OCI Stack Monitoring to discover and monitor an Oracle WebLogic Server environment, which THREE prerequisites or configuration steps are required?

Select 3 answers

A.Attach a public IP address directly to the WebLogic administration console port.

B.Install OCI Management Agent on the host running the WebLogic Server.

C.Configure a BGP peering session between WebLogic and the OCI Control Plane.

D.Provide valid WebLogic administrator credentials and JMX connection details.

E.Run the Stack Monitoring discovery wizard via the OCI Console or CLI.

AnswersB, D, E

Stack Monitoring discovers WebLogic Server resources through the Management Agent, which must be installed on the WebLogic host to collect metrics and topology data. Without this agent, no discovery or monitoring of the WebLogic domain is possible, making it a mandatory prerequisite.

Why this answer

Option B is correct because Stack Monitoring relies on the OCI Management Agent installed on the WebLogic host to collect metrics and communicate with the OCI Monitoring service. Option D is correct because discovery requires valid WebLogic administrator credentials plus JMX connection details (host, port, protocol) so the agent can query the WebLogic MBeans. Option E is correct because the Stack Monitoring discovery wizard, run from the OCI Console or CLI, is the mechanism that creates the WebLogic resource and associates it with the agent.

Option A is not required, as the administration console does not need a public IP and exposing it would be a security risk. Option C is not required, since BGP peering is a networking concept unrelated to WebLogic discovery and monitoring.

Exam trap

The trap is assuming network-level prerequisites like BGP peering or public IP exposure are needed for Stack Monitoring, when in fact discovery relies entirely on the outbound Management Agent plus JMX credentials.

Practice this question →

2

MCQhard

A healthcare company must prove to auditors that no one, including tenancy administrators, could have altered or deleted a specific month of application logs stored in OCI Object Storage. Logs arrive continuously from OCI Logging via Service Connector Hub. Which combination of settings guarantees this?

A.Apply an Object Storage retention rule with a time-bound retention duration to the bucket, then lock the rule

B.Configure a lifecycle policy that transitions the logs to Archive Storage after 30 days and keeps them there indefinitely

C.Create a pre-authenticated request for the bucket and share it only with the audit team

D.Enable Object Versioning on the bucket and store the logs in a Standard tier bucket

AnswerA

A retention rule prevents objects from being overwritten or deleted until the retention period expires, and locking the rule makes it irrevocable so even tenancy administrators cannot shorten or remove it. This delivers the immutability and non-repudiation the auditors demand for the specified month of logs.

Why this answer

Object Storage retention rules block overwrite and deletion of objects until the retention period ends. Locking the rule removes the ability to modify or delete it, even for tenancy administrators, which is the property auditors need for non-repudiation. Versioning, lifecycle transitions, and pre-authenticated requests manage access or cost but do not enforce immutability.

Exam trap

The trap here is treating Object Versioning as equivalent to immutability, when versioning still permits deletion of all versions by a privileged user.

Practice this question →

3

Multi-Selecthard

Which TWO of the following statements are correct regarding the architecture and capabilities of OCI Application Performance Monitoring (APM)?

Select 2 answers

A.OCI APM can only monitor applications deployed inside OCI Compute instances and cannot trace traffic originating from API Gateways.

B.OCI APM supports ingestion of standard OpenTelemetry traces from applications running on-premises, in OCI, or in other clouds.

C.OCI APM alerting is strictly limited to SMS notifications and cannot integrate with external incident management systems like PagerDuty.

D.OCI APM provides Real User Monitoring (RUM) capabilities to track end-user performance, page load times, and browser errors.

E.OCI APM requires the user to manually provision and manage an underlying Autonomous Transaction Processing database to store trace spans.

AnswersB, D

OCI APM natively accepts OpenTelemetry Protocol (OTLP) trace data, so instrumented applications can send spans regardless of where they run — on-premises, in OCI, or on rival clouds. This satisfies the stem's cross-environment ingestion requirement, since no OCI-only agent or network-bound collector is mandated for trace submission.

Why this answer

Option B is correct because OCI APM natively supports the OpenTelemetry protocol (OTLP) for trace ingestion, allowing instrumented applications running on-premises, in OCI, or in other clouds to send distributed tracing data to the APM domain via the public OTLP endpoint. Option D is correct because OCI APM includes Real User Monitoring (RUM), which uses a JavaScript agent injected into web pages to capture end-user metrics such as page load times, AJAX calls, and browser-side errors. Option A is incorrect because APM is not limited to OCI Compute: it can trace traffic from API Gateways, load balancers, functions, and external sources through OpenTelemetry instrumentation.

Option C is incorrect because APM alarms integrate with OCI Notifications, which in turn can fan out to email, SMS, Slack, PagerDuty, and other HTTPS endpoints, so alerting is not restricted to SMS. Option E is incorrect because APM is a fully managed service; Oracle provisions and manages the underlying storage for trace spans, and no Autonomous Transaction Processing database needs to be created or maintained by the customer.

Exam trap

1Z0-997-26 often tests the misconception that APM is limited to OCI-hosted applications or that it requires self-managed databases; candidates should remember APM is multi-cloud and fully managed, with RUM and OpenTelemetry support.

Practice this question →

4

MCQeasy

An administrator wants to inspect the operational health and performance metrics of an OCI Exadata Database Service instance using the default platform metrics provided out-of-the-box by OCI. Where should the administrator navigate in the OCI Console to view these metrics?

A.Navigate to Compute > Instances, select the Exadata VM cluster, and open the Performance tab.

B.Navigate to Observability and Management > Monitoring, then select the Database service namespace.

C.Navigate to Governance and Administration > Audit, then select the Database compartment.

D.Navigate to Identity & Security > Policies to enable the DB telemetry poller.

AnswerB

OCI Monitoring's Database service namespace exposes the platform metrics that Exadata Database Service emits automatically, with no agent deployment required. Selecting that namespace surfaces compute, storage and database health telemetry, satisfying the stem's requirement to inspect default out-of-the-box metrics directly from the OCI Console.

Why this answer

OCI Exadata Database Service emits default platform metrics (CPU utilization, storage utilization, node status, etc.) into the OCI Monitoring service under the 'oci_database' or Exadata-specific namespace. Administrators view these by navigating to Observability and Management > Monitoring in the OCI Console, then selecting the appropriate Database service namespace and filtering by the Exadata resource. This is the standard path for out-of-the-box platform metrics.

Exam trap

The trap is navigating to Compute > Instances for Exadata metrics because Exadata runs on compute-like hardware — candidates must remember that Exadata Database Service metrics live under Observability and Management > Monitoring in the Database namespace.

How to eliminate wrong answers

Option A is wrong because Compute > Instances shows VM-level metrics for compute instances, not the Exadata Database Service platform metrics — Exadata VM clusters are managed under Database services, not Compute. Option C is wrong because Governance and Administration > Audit shows API activity logs, not performance metrics, and has no Database compartment metric view. Option D is wrong because Identity & Security > Policies is for IAM authorization, and there is no 'DB telemetry poller' to enable — metrics are emitted automatically by the service.

Practice this question →

5

MCQhard

An enterprise application running on OCI is instrumented with the OCI APM Java agent. Developers notice that certain sensitive header tokens and credit card numbers are appearing in trace spans. How can they prevent sensitive data from being collected by the APM agent?

A.Set up an OCI Vault encryption key to automatically encrypt span attribute strings in transit.

B.Configure IAM policies to redact payload strings at the APM domain boundary.

C.Modify the OCI Monitoring alarm expression to filter out PII strings.

D.Configure APM Data Masking rules or agent configuration properties to exclude or scrub sensitive attributes.

AnswerD

Configuring APM data masking rules or agent properties directly intercepts sensitive attributes before span export, satisfying the requirement to stop header tokens and credit card numbers appearing in traces. Masking operates at collection time within the Java agent, so scrubbed values never reach OCI APM, unlike post-collection filtering which leaves data exposed in storage.

Why this answer

OCI APM provides data masking rules that can be configured at the APM domain level to scrub or exclude sensitive attributes from trace spans before they are stored. Additionally, the APM Java agent supports configuration properties that allow developers to exclude specific headers, parameters, or payload fields from being captured. Using these built-in masking and exclusion mechanisms is the correct way to prevent PII from entering APM trace data.

Exam trap

1Z0-997-26 often tests whether candidates confuse encryption (which protects data but does not remove it) with masking or exclusion (which prevents sensitive data from being collected), leading them to pick Vault-based answers for PII redaction questions.

How to eliminate wrong answers

Option A is wrong because OCI Vault encrypts data at rest or in transit at the storage layer, but it does not selectively redact sensitive strings within trace spans; encryption would not prevent the data from being visible in APM. Option B is wrong because IAM policies control access to APM resources, not the content of trace spans; they cannot redact payload strings. Option C is wrong because OCI Monitoring alarms evaluate metrics and trigger notifications, and they have no capability to filter or redact PII from APM trace data.

Practice this question →

6

MCQeasy

An organization wants to monitor their cloud spend trends and receive a weekly email summary of top spending services without manually logging into the OCI Console. Which OCI feature can accomplish this?

A.OCI Cost Analysis Scheduled Reports

B.OCI Events service scheduled triggers

C.OCI Audit log exports

D.OCI Monitoring service billing alarms

AnswerA

OCI Cost Analysis scheduled reports let you define a recurring schedule that emails cost breakdowns by service directly to recipients, satisfying the weekly summary requirement without console logins. Cost Analysis aggregates actual spend data, so the report reflects top spending services automatically rather than requiring manual export or querying.

Why this answer

OCI Cost Analysis Scheduled Reports allow you to define a recurring schedule (daily, weekly, monthly) that emails a cost breakdown — including top spending services — directly to specified recipients. This is purpose-built for automated spend trend monitoring without requiring console login, unlike alarms or event rules which are not designed for cost reporting.

Exam trap

1Z0-997-26 often tests the confusion between cost-reporting tools (Cost Analysis Scheduled Reports) and operational alerting tools (Monitoring alarms, Events), so candidates pick alarms thinking they can deliver scheduled spend summaries.

How to eliminate wrong answers

Option B is wrong because OCI Events service triggers react to state-change events (e.g., resource creation, bucket update) and cannot generate scheduled cost/spend summaries. Option C is wrong because Audit log exports capture API activity and user actions for compliance, not billing or cost trend data. Option D is wrong because OCI Monitoring billing alarms only fire threshold-based notifications on a single metric (e.g., estimated cost exceeding a value) and cannot produce a weekly multi-service spend summary.

Practice this question →

7

MCQhard

Your organization runs a multi-tier microservices application deployed across multiple OCI regions. You are tasked with implementing OCI Application Performance Monitoring (APM) to trace distributed transactions across different API gateways and containerized services. To correlate user browser sessions with backend database queries, what is the required configuration step on the client-facing application tier?

A.Inject the APM Browser Agent (JavaScript tracer) into the web pages and ensure trace context propagation headers are enabled.

B.Deploy the APM Java asynchronous agent to the client browser using a browser extension.

C.Enable OCI Audit logs on the client subnets and stream the audit records into the APM Data Domain.

D.Configure the OCI API Gateway to natively intercept and inject synthetic monitoring payloads into the user cookies.

AnswerA

Injecting the APM Browser Agent into the web pages captures browser-side spans, while enabling trace context propagation headers lets those spans flow through the API gateways and containerised services down to the database queries. This satisfies the stem's requirement to correlate user browser sessions with backend database queries across OCI regions.

Why this answer

To correlate user browser sessions with backend database queries, the client-facing application tier must inject the APM Browser Agent (JavaScript tracer) into web pages and ensure trace context propagation headers are enabled. The Browser Agent captures browser-side performance and injects trace context into requests, which backend services then propagate to database calls, enabling end-to-end correlation.

Exam trap

1Z0-997-26 often tests the specific component needed for browser-to-backend correlation; candidates may choose backend agents or API Gateway features, but the key is the Browser Agent and trace context propagation headers.

How to eliminate wrong answers

Option B is wrong because the APM Java asynchronous agent is for JVM applications, not browsers, and cannot be deployed via a browser extension. Option C is wrong because OCI Audit logs capture control-plane API calls, not application-level user sessions, and streaming them to APM Data Domain does not provide trace correlation. Option D is wrong because OCI API Gateway does not natively intercept and inject synthetic monitoring payloads into user cookies; trace context propagation is handled by the application and APM agents.

Practice this question →

8

MCQhard

Your organization has set strict budgets in OCI to monitor cloud expenditure. A finance team member needs to receive an alert when forecasted spending reaches 100% of the monthly budget. How should you configure this alert?

A.Create an OCI Monitoring alarm on the Billing namespace with a metric expression for forecasted cost.

B.Use OCI Cost Analysis scheduled reports with an integrated SMTP relay.

C.Set up an OCI Events rule listening for billing threshold exceedance events.

D.Configure an OCI Budget alert rule with threshold type set to 'FORECASTED' and threshold value set to 100.

AnswerD

Setting the threshold type to FORECASTED makes OCI evaluate projected month-end spend rather than actuals, so the finance team is warned before the budget is breached. A threshold value of 100 triggers the alert when forecasted spending reaches 100% of the monthly budget, satisfying the stem's proactive notification requirement.

Why this answer

OCI Budgets allow you to set alert rules based on actual or forecasted spend. Setting the threshold type to 'FORECASTED' and the threshold value to 100 triggers an alert when the forecasted spend for the budget period reaches 100% of the budget amount. This directly meets the finance team's requirement to be alerted when forecasted spending hits the monthly budget.

Exam trap

1Z0-997-26 often tests the distinction between Budgets (which support forecasted alerts) and Monitoring alarms (which do not have a forecasted cost metric); candidates may incorrectly assume Monitoring can alert on forecasted billing data.

How to eliminate wrong answers

Option A is wrong because OCI Monitoring alarms on the Billing namespace do not support forecasted cost metrics; they work on actual usage and cost metrics, and the Billing namespace does not expose a forecasted cost metric. Option B is wrong because Cost Analysis scheduled reports can be emailed but do not provide threshold-based alerting on forecasted spend, and they require an SMTP relay configuration that is not native to OCI. Option C is wrong because OCI Events does not emit billing threshold exceedance events; budget alerts are handled by the Budgets service, not Events.

Practice this question →

9

MCQhard

You are designing an alerting strategy in OCI Monitoring. You want to avoid alert storms by ensuring that if a metric fluctuates above a threshold repeatedly, the alarm notification is sent only once every 30 minutes until the condition clears. How should you configure this?

A.Set the alarm evaluation window to 30 minutes and enable metric smoothing.

B.Create an OCI Events rule with a batch window of 30 minutes.

C.Configure the 'Repeat Notification' setting in the OCI Monitoring alarm definition to 30 minutes.

D.Configure a notification suppression window in the Notifications service topic settings.

AnswerC

The Repeat Notification interval suppresses duplicate alarm notifications, sending only one per 30 minutes while the metric stays in breach. This directly prevents the alert storms the stem describes, and notifications resume normally once the condition clears.

Why this answer

OCI Monitoring alarms have a 'Repeat Notification' setting that controls how often the notification is re-sent while the alarm remains in the firing state. Setting it to 30 minutes ensures that if the metric stays above threshold, the notification is sent only once every 30 minutes, preventing alert storms. This is the correct mechanism for suppressing repeated notifications.

Exam trap

The trap is confusing the alarm evaluation window with the notification repeat interval; candidates often pick the evaluation window, but that controls when the alarm fires, not how often it notifies.

How to eliminate wrong answers

Option A is wrong because the evaluation window determines how long the metric is evaluated before triggering, not how often notifications repeat; metric smoothing affects the metric stream, not notification frequency. Option B is wrong because OCI Events rules with a batch window are for event-driven actions, not for controlling alarm notification repetition. Option D is wrong because the Notifications service does not have a per-topic 'notification suppression window' setting; suppression is configured on the alarm via Repeat Notification.

Practice this question →

10

MCQeasy

You want to monitor the health and performance of your Oracle Autonomous Database in OCI. Which built-in metric namespace in OCI Monitoring should you query?

A.oci_autonomous_metrics

B.oci_database

C.oci_apm_metrics

D.oci_compute_infra

AnswerB

The `oci_database` namespace exposes Autonomous Database health and performance metrics, including CPU utilisation, storage consumption, session counts and transaction throughput. Querying it in OCI Monitoring satisfies the requirement for built-in database telemetry without custom agents or additional instrumentation.

Why this answer

OCI Monitoring organizes metrics into namespaces, and all Autonomous Database metrics (CPU utilization, session counts, transaction rates, storage usage, etc.) are published under the oci_database namespace. This namespace covers both Autonomous Transaction Processing (ATP) and Autonomous Data Warehouse (ADW) instances, so querying it returns the health and performance metrics needed for dashboards and alarms.

Exam trap

The trap here is that candidates assume a service-specific namespace like 'oci_autonomous_metrics' exists, when OCI actually consolidates all database metrics under the generic oci_database namespace.

How to eliminate wrong answers

Option A is wrong because oci_autonomous_metrics is not a real OCI Monitoring namespace — it is a plausible-sounding distractor invented to mimic the naming convention. Option C is wrong because oci_apm_metrics relates to Application Performance Monitoring (APM) trace and span data, not database health metrics. Option D is wrong because oci_compute_infra covers compute instance metrics (CPU, memory, network on VMs/bare metal), not Autonomous Database metrics.

Practice this question →

11

Multi-Selecteasy

Which TWO destinations can receive messages dispatched from an OCI Notifications service topic?

Select 2 answers

A.OCI Internet Gateway route tables

B.OCI Dynamic Routing Gateway (DRG)

C.HTTPS / Webhook endpoints (e.g., Slack, PagerDuty)

D.Email endpoints and SMS

E.OCI Block Volume backup policies

AnswersC, D

OCI Notifications publishes to HTTPS endpoints, delivering JSON payloads to webhook URLs such as Slack or PagerDuty. This satisfies the stem's requirement for a valid subscription destination, since webhook subscriptions are natively supported alongside email, SMS, and Function.

Why this answer

Option C is correct because OCI Notifications topics support HTTPS subscriptions, which deliver the published message as a JSON POST to a webhook URL, enabling integrations such as Slack or PagerDuty. Option D is correct because OCI Notifications natively supports Email and SMS subscriptions, sending the message content directly to the subscribed address or phone number. The other options are incorrect because Internet Gateway route tables, Dynamic Routing Gateway (DRG), and Block Volume backup policies are networking and storage constructs, not subscription protocols or delivery destinations for a Notifications topic.

Exam trap

1Z0-997-26 often tests whether candidates confuse OCI networking components (IGW, DRG) or storage policies with Notifications subscription targets — the trap is assuming any OCI service can be a notification destination.

Practice this question →

12

MCQmedium

A DevOps engineer wants to monitor custom application metrics (such as active shopping cart count) emitted by microservices running on OCI Container Engine for Kubernetes (OKE). Which OCI service provides the necessary API to ingest and query these custom metrics?

A.Events Service

B.OCI Monitoring Service

C.OCI Logging Analytics

D.Application Performance Monitoring (APM)

AnswerB

OCI Monitoring Service exposes the PostMetricData API for ingesting custom metrics and the Metrics API for querying them, so OKE microservices can publish cart counts as custom namespace metrics. It satisfies the requirement for a native API to ingest and query application metrics.

Why this answer

The OCI Monitoring Service provides the API (PostMetricData) to ingest custom metrics and the QueryMetrics API to retrieve them. It is the native service for storing and querying both built-in and custom metrics emitted by OKE workloads.

Exam trap

1Z0-997-26 often tests the confusion between Monitoring (metrics), Logging Analytics (logs), and APM (traces), so candidates select APM or Logging Analytics for custom metric ingestion when only Monitoring provides the PostMetricData API.

How to eliminate wrong answers

Option A is wrong because the Events Service handles state-change events and triggers, not metric ingestion or querying. Option C is wrong because OCI Logging Analytics is for log ingestion, indexing, and analysis, not for custom metric time-series data. Option D is wrong because APM focuses on application performance tracing and synthetic monitoring, not on ingesting arbitrary custom metrics like cart counts.

Practice this question →

13

Multi-Selecthard

An administrator wants to configure OCI Logging Analytics to parse custom application log formats that do not match out-of-the-box parsers. Which THREE steps or tools are involved in creating a custom parser?

Select 3 answers

A.Associate the newly created custom parser with a custom Log Source in Logging Analytics.

B.Provide a sample log message to test and validate pattern matching.

C.Define extraction rules using regular expressions or parser builder tools to map fields (e.g., timestamp, severity, message).

D.Modify the hypervisor kernel parameters on all compute instances.

E.Compile a C++ binary package and upload it to an OCI Function.

AnswersA, B, C

A custom parser only takes effect once bound to a custom Log Source, which governs ingestion and field mapping for the non-standard application logs. This step satisfies the stem's requirement by linking the parser to the specific log stream so out-of-the-box parsers are bypassed.

Why this answer

Option A is correct because a custom parser in OCI Logging Analytics must be attached to a custom Log Source so that the service knows which parser to apply when ingesting that log type. Option B is correct because the parser creation workflow requires supplying sample log messages to test and validate that the pattern matching and field extraction work against real data. Option C is correct because the core of a custom parser is defining extraction rules, typically via regular expressions or the parser builder, to map fields such as timestamp, severity, and message.

Option D is incorrect because hypervisor kernel parameters are unrelated to Logging Analytics parsing and cannot influence log field extraction. Option E is incorrect because Logging Analytics parsers are configured declaratively in the service, not by compiling and deploying C++ binaries to OCI Functions.

Exam trap

1Z0-997-26 often tests whether candidates know that custom parsing is a declarative, service-side configuration (regex/parser builder + Log Source association) rather than code compilation or agent-side changes.

Practice this question →

14

Multi-Selecteasy

Which TWO of the following services are native components of the Oracle Cloud Infrastructure Observability and Management platform?

Select 2 answers

A.OCI Autonomous Database

B.OCI Container Engine for Kubernetes

C.OCI Application Performance Monitoring (APM)

D.OCI File Storage Service

E.OCI Logging Analytics

AnswersC, E

OCI Application Performance Monitoring is a native pillar of the OCI Observability and Management platform, providing distributed tracing and synthetic monitoring. It satisfies the stem's requirement for a native component, integrating directly with OCI telemetry rather than requiring third-party agents or separate licensing.

Why this answer

OCI Application Performance Monitoring (APM) (option C) is a native Observability and Management service that provides distributed tracing, synthetic monitoring, and real-user monitoring to diagnose application performance issues. OCI Logging Analytics (option E) is also a native Observability and Management service that uses machine-learning-driven log indexing, correlation, and visualization to analyze log data across the environment. Both belong to the OCI Observability and Management platform, which also includes services such as Monitoring, Notifications, Events, and Operations Insights.

In contrast, OCI Autonomous Database (A), OCI Container Engine for Kubernetes (B), and OCI File Storage Service (D) are core data and compute/storage services, not observability or management components, so they do not qualify.

Exam trap

1Z0-997-26 often tests whether candidates can distinguish core OCI services (database, storage, Kubernetes) from the Observability and Management portfolio — the trap is assuming any OCI service with 'monitoring-like' features belongs to the platform.

Practice this question →

15

Multi-Selecthard

An enterprise is designing a comprehensive cost observability and governance strategy in OCI. Which THREE practices or features should be implemented?

Select 3 answers

A.Route all VCN flow logs through OCI Logging Analytics to calculate cloud infrastructure billing.

B.Enforce defined tags for resource creation using IAM policy conditions or tag defaults.

C.Analyze spending patterns and spot cost anomalies using OCI Cost Analysis dashboards.

D.Configure OCI Budgets with both actual and forecasted spending alert thresholds.

E.Install APM Java agents on all block storage volumes to track storage encryption costs.

AnswersB, C, D

IAM policy conditions and tag defaults enforce defined tags at resource creation, making cost allocation reliable across compartments and preventing untagged spend from obscuring governance reporting. This underpins accurate cost observability by guaranteeing consistent tagging metadata.

Why this answer

Option B is correct because enforcing defined tags via IAM policy conditions (e.g., request.tag.definedTag) or tag defaults ensures consistent cost allocation and governance across compartments and resources. Option C is correct because OCI Cost Analysis provides dashboards and filtering to analyze spending trends and detect cost anomalies by service, compartment, or tag. Option D is correct because OCI Budgets support alert rules on both actual spend and forecasted spend, enabling proactive governance before thresholds are breached.

Option A is incorrect because VCN flow logs capture network traffic metadata, not billing data, and Logging Analytics does not calculate OCI infrastructure charges. Option E is incorrect because APM Java agents monitor application performance, not block volume storage encryption costs, and encryption at rest is included in OCI storage pricing.

Exam trap

1Z0-997-26 often tests the misconception that network or application monitoring tools can directly provide cost data, confusing observability with billing.

Practice this question →

16

MCQmedium

An auditor requests a complete historical record of all console sign-ins, IAM policy modifications, and compartment deletions across your OCI tenancy for the past 365 days. Which OCI service provides this data natively?

A.OCI Events Service

B.OCI Audit Service

C.OCI Cloud Guard Activity Tracking

D.OCI Logging Analytics

AnswerB

OCI Audit Service automatically records all console sign-ins, API calls, IAM policy changes and compartment deletions, retaining events for 365 days and exposing them via console, API and CLI. This satisfies the auditor's demand for a complete native historical record.

Why this answer

OCI Audit Service automatically records all control plane API activities, including console sign-ins, IAM policy modifications, and compartment deletions, and retains these events for 365 days natively. This is the authoritative source for historical audit records across the tenancy, and it can be queried via the Console, API, or CLI.

Exam trap

1Z0-997-26 often tests the confusion between OCI Audit Service (historical control plane audit) and OCI Events Service (real-time event routing), expecting candidates to know Audit is the native 365-day audit record.

How to eliminate wrong answers

Option A is wrong because OCI Events Service is a near-real-time event routing service that reacts to state changes; it does not store historical audit records for 365 days. Option C is wrong because OCI Cloud Guard is a security posture management service that detects misconfigurations and threats; it does not provide a complete historical audit trail of all API activities. Option D is wrong because OCI Logging Analytics is a log analysis platform that can ingest and analyze logs, but it does not natively capture all control plane API activities for 365 days without additional configuration and ingestion.

Practice this question →

17

MCQeasy

An Oracle Cloud Infrastructure (OCI) Administrator needs to collect log data from custom applications running on Compute instances. Which OCI service should be configured to ship these logs to OCI Logging?

A.OS Management Hub

B.OCI Service Connector Hub

C.OCI Logging Agent

D.OCI Streaming Service

AnswerC

The OCI Logging Agent runs on Compute instances and ships custom application log files to OCI Logging. It satisfies the requirement to collect logs from custom applications, since platform services cannot read application log files directly.

Why this answer

The OCI Logging Agent is a lightweight agent installed on Compute instances that collects custom application logs (and system logs) from the instance and ships them to the OCI Logging service via the Unified Monitoring Agent framework. It is the designated mechanism for ingesting instance-originated custom logs into OCI Logging.

Exam trap

The trap is confusing Service Connector Hub (service-to-service data movement) with the Logging Agent (instance-to-service log collection); 1Z0-997-26 frequently tests this boundary because both involve 'moving logs' but operate at different layers.

How to eliminate wrong answers

Option A is wrong because OS Management Hub is for patching, package management, and OS lifecycle operations on managed instances, not log ingestion. Option B is wrong because Service Connector Hub moves data between OCI services (e.g., Logging to Object Storage or Streaming); it does not collect logs from inside a Compute instance. Option D is wrong because OCI Streaming is a Kafka-compatible message bus for real-time data streams, not an agent-based log collector for Compute instances.

Practice this question →

18

MCQhard

An enterprise is designing a cost observability architecture in OCI. They want to attribute cloud spend dynamically to different business units based on resource metadata tags, and they need historical trend analysis with anomaly detection. Which combination of features and tools provides the most robust solution?

A.Use Logging Analytics custom parsers on generated invoice PDFs stored in Object Storage.

B.Use native OCI Tag Defaults and OCI Monitoring alarms on the 'Billing' metric namespace.

C.Deploy OCI APM Java agents to every compute node and query the JVM memory usage to estimate spend.

D.Use OCI Cost Analysis with defined tags, export Cost Reports to Object Storage, and configure Budgets with alert rules.

AnswerD

Defined tags drive cost attribution to business units, Cost Analysis provides historical trends, Object Storage exports enable long-term retention, and Budgets with alert rules deliver anomaly detection. Together these satisfy both dynamic tagging-based attribution and trend analysis requirements.

Why this answer

OCI Cost Analysis supports filtering and grouping by defined tags, enabling dynamic attribution of spend to business units based on resource metadata. Exporting Cost Reports to Object Storage provides durable historical data for trend analysis, and Budgets with alert rules deliver anomaly detection and threshold-based notifications. This combination directly satisfies the requirements for tag-based attribution, historical trends, and anomaly detection.

Exam trap

1Z0-997-26 often tests whether candidates confuse performance monitoring tools (APM, Monitoring) with cost management tools (Cost Analysis, Budgets), and whether they recognize that tag-based attribution requires defined tags plus Cost Analysis grouping.

How to eliminate wrong answers

Option A is wrong because parsing invoice PDFs with Logging Analytics is a brittle, indirect method that lacks real-time tag-based attribution and does not provide native anomaly detection or budget alerts. Option B is wrong because Tag Defaults and Monitoring alarms on the Billing namespace do not provide historical trend analysis or robust cost attribution by business unit; Monitoring alarms are threshold-based, not anomaly-detection oriented for spend. Option C is wrong because APM Java agents measure application performance (JVM memory, traces), not cloud spend, and cannot attribute costs to business units.

Practice this question →

19

MCQeasy

You want to quickly visualize CPU utilization across 50 Compute instances on a single pane of glass without creating complex custom dashboards. Which OCI Monitoring feature allows you to view pre-packaged metrics grouped by resource?

A.OCI Logging Analytics Dashboards

B.OCI APM Dashboards

C.OCI Stack Monitoring

D.OCI Metrics Explorer

AnswerD

OCI Metrics Explorer provides pre-packaged, resource-grouped metric charts without custom dashboard construction, satisfying the single-pane-of-glass requirement across 50 Compute instances. It queries the Monitoring service directly, aggregating CPU utilisation by resource, so no manual widget configuration is needed for rapid visualisation.

Why this answer

OCI Metrics Explorer lets you query and visualize any OCI Monitoring metric (e.g., CpuUtilization) across many resources at once, with grouping by resource or dimension, giving a single-pane view without building a custom dashboard. It is the fastest way to chart 50 instances' CPU on one graph.

Exam trap

1Z0-997-26 often tests the distinction between Metrics Explorer (ad-hoc metric visualization) and Monitoring Dashboards (saved, curated views), so candidates pick the dashboard option when the question asks for quick, no-dashboard visualization.

How to eliminate wrong answers

Option A is wrong because Logging Analytics Dashboards visualize log-derived data, not native OCI Monitoring metrics like CPU utilization. Option B is wrong because APM Dashboards focus on application traces, spans, and RUM/synthetic data, not infrastructure CPU metrics. Option C is wrong because Stack Monitoring is for discovering and monitoring application stacks (e.g., WebLogic, Tomcat) and their components, not for ad-hoc cross-resource metric visualization.

Practice this question →

20

Multi-Selectmedium

When configuring alarms in OCI Monitoring, which THREE parameters or settings must be specified?

Select 3 answers

A.Evaluation window (time interval and period)

B.Metric namespace and metric name

C.OCI Vault Master Encryption Key OCID

D.Virtual Cloud Network (VCN) CIDR block

E.Threshold value and trigger operator (e.g., greater than)

AnswersA, B, E

Every alarm requires an evaluation window, defined by the interval and period over which the metric query runs, determining how frequently the threshold is assessed. Without it, OCI cannot decide when the metric stream breaches the configured trigger rule.

Why this answer

Option A is correct because an OCI Monitoring alarm requires an evaluation window, defined by the interval (for example, 1m, 5m, 1h) and the period over which the metric is aggregated, so OCI knows how often and over what span to evaluate the metric. Option B is correct because every alarm must reference the metric to monitor, which is identified by its metric namespace (such as oci_computeagent) and metric name (such as CpuUtilization). Option E is correct because an alarm must define the trigger condition, consisting of the threshold value and the operator (for example, greater than, less than, or equal to) that determines when the alarm fires.

Option C is not required because a Vault Master Encryption Key OCID is used for encrypting data at rest, not for defining alarm evaluation logic. Option D is not required because a VCN CIDR block is a networking construct unrelated to specifying which metric and threshold an alarm should evaluate.

Exam trap

1Z0-997-26 often tests the required parameters for alarms; candidates may incorrectly include encryption keys or network details, but the core three are metric, evaluation window, and threshold/operator.

Practice this question →

21

MCQmedium

An OCI administrator wants to ingest application logs stored in an Object Storage bucket into OCI Logging Analytics for complex log searching and parsing. What is the recommended way to ingest these logs?

A.Write a custom Python script using OCI SDK to read the bucket and insert logs into Logging Analytics via REST API.

B.Mount the Object Storage bucket as a file system using OCI File Storage Service and install the Logging Agent.

C.Configure an Object Storage source in OCI Logging Analytics to automatically discover and ingest log files from the bucket.

D.Use OCI Streaming to stream bucket objects directly to the Logging Analytics console.

AnswerC

An Object Storage source in Logging Analytics discovers and ingests log files from the bucket automatically, handling parsing and indexing for complex searches. This is the native, supported ingestion path, avoiding manual downloads or custom upload scripts.

Why this answer

OCI Logging Analytics provides a native Object Storage source type that allows you to configure a bucket as a log source. Once configured, Logging Analytics automatically discovers new log files, parses them using built-in or custom parsers, and ingests them for indexing and search. This eliminates the need for custom code or agents, and is the documented best practice for ingesting logs from Object Storage.

Exam trap

1Z0-997-26 often tests the misconception that you need to write custom code or use other OCI services to move data into Logging Analytics, when in fact native source types exist for common sources like Object Storage.

How to eliminate wrong answers

Option A is wrong because while it's technically possible to use the OCI SDK and REST API, it requires custom development, maintenance, and doesn't leverage Logging Analytics' native discovery and parsing capabilities. Option B is wrong because OCI File Storage Service cannot mount an Object Storage bucket as a file system; that's a fundamental misunderstanding of the two services. Option D is wrong because OCI Streaming is a publish-subscribe service for real-time data streams, not a direct ingestion path for Object Storage objects into Logging Analytics; it would require additional integration and is not the recommended approach.

Practice this question →

22

MCQmedium

An enterprise wants to monitor an enterprise application stack consisting of Oracle WebLogic Server and Oracle Database, tracking their deep internal health metrics, resource utilization, and dependency topology. Which OCI service is specifically designed for full-stack enterprise application monitoring?

A.OCI Application Performance Monitoring (APM)

B.OCI Logging Analytics

C.OCI Stack Monitoring

D.OCI Monitoring Service

AnswerC

Stack Monitoring discovers and models WebLogic Server and Oracle Database components together, collecting deep internal health metrics, resource utilisation and dependency topology across the full stack, which generic infrastructure monitoring cannot provide for these enterprise tiers.

Why this answer

OCI Stack Monitoring is purpose-built to monitor enterprise application stacks such as WebLogic Server and Oracle Database, providing deep internal health metrics, resource utilization, and dependency topology discovery. It is the only OCI service specifically designed for full-stack enterprise application monitoring.

Exam trap

1Z0-997-26 often tests the overlap between APM, Logging Analytics, and Stack Monitoring, so candidates choose APM for enterprise stack monitoring when Stack Monitoring is the service explicitly designed for WebLogic and Database deep health.

How to eliminate wrong answers

Option A is wrong because OCI APM focuses on application performance tracing and synthetic monitoring for custom applications, not deep WebLogic or Database stack health. Option B is wrong because OCI Logging Analytics analyzes log data for troubleshooting and security, but does not provide the topology and deep stack health metrics that Stack Monitoring offers. Option D is wrong because OCI Monitoring Service handles generic infrastructure and custom metrics, not the specialized enterprise stack discovery and health modeling that Stack Monitoring provides.

Practice this question →

23

MCQhard

Your organization has strict security policies requiring all log data in OCI Logging to be encrypted using a customer-managed encryption key (CMK) stored in OCI Vault. How should you implement this?

A.Configure the OCI Logging Agent on compute instances with local disk encryption enabled via IAM policies.

B.Attach the master encryption key directly to each individual log object stored in Object Storage.

C.Assign a customer-managed master encryption key from OCI Vault to the Log Group in OCI Logging.

D.Use OCI Streaming to intercept logs and apply customer-managed keys before writing to OCI Logging.

AnswerC

Assigning a customer-managed master encryption key from OCI Vault to the Log Group enforces CMK encryption across all logs within that group, satisfying the policy. Log Group is the level at which Logging accepts a Vault key assignment.

Why this answer

OCI Logging allows you to assign a customer-managed master encryption key from OCI Vault at the Log Group level. All logs stored in that log group are then encrypted with the specified CMK, satisfying the policy without per-object configuration. This is the native, supported mechanism for CMK encryption of log data in OCI Logging.

Exam trap

1Z0-997-26 often tests the misconception that encryption keys can be attached to individual log objects or that compute-level disk encryption secures logs in OCI Logging; the correct scope is the Log Group.

How to eliminate wrong answers

Option A is wrong because the OCI Logging Agent and IAM policies do not provide CMK encryption of log data; local disk encryption on compute instances is unrelated to encryption of logs at rest in OCI Logging. Option B is wrong because you cannot attach a Vault master encryption key directly to individual log objects in Object Storage; encryption keys are applied at the bucket or log group level, not per object. Option D is wrong because OCI Streaming is a data streaming service, not an encryption layer, and it cannot apply customer-managed keys to logs before they reach OCI Logging.

Practice this question →

24

Multi-Selecteasy

Which TWO types of logs are natively generated and accessible within OCI Logging without requiring agent installation on compute instances?

Select 2 answers

A.Custom database trace files generated inside a self-managed MySQL database on a VM

B.Custom application log files stored in /var/log/app.log inside a compute instance

C.OCI Audit logs

D.Third-party firewall logs running on local virtual appliances

E.OCI VCN Flow logs

AnswersC, E

OCI Audit logs are emitted automatically by the OCI control plane, capturing API activity across tenancies. They flow into OCI Logging natively, so no agent installation on compute instances is needed, satisfying the stem's agentless constraint.

Why this answer

OCI Audit logs (C) are natively generated by the OCI platform itself and are automatically available in OCI Logging without any agent, since they record API activity against OCI resources at the control-plane level. OCI VCN Flow logs (E) are also natively produced by the OCI networking layer for subnets, VNICs, or VCNs and are ingested directly into OCI Logging without requiring an agent on compute instances. In contrast, custom database trace files (A) and custom application log files such as /var/log/app.log (B) reside on the instance's filesystem and require the OCI Logging agent (or Unified Monitoring agent) to be installed and configured to collect them.

Third-party firewall logs from local virtual appliances (D) are likewise external to OCI's native telemetry and need an agent or custom ingestion path, so they are not natively available.

Exam trap

1Z0-997-26 often tests the distinction between service-generated logs (Audit, VCN Flow) that need no agent and custom/application logs that require the Unified Monitoring Agent — candidates assume all logs need an agent.

Practice this question →

25

MCQmedium

An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?

A.OCI Application Performance Monitoring (APM) Distributed Tracing

B.OCI Network Visualizer

C.OCI Logging Analytics with out-of-the-box system parsers

D.OCI Monitoring service anomaly detection

AnswerA

OCI Application Performance Monitoring's distributed tracing propagates a trace context across service boundaries, stitching each microservice span into a single end-to-end transaction view. This directly satisfies the requirement to trace requests across regions, exposing which hop introduces the intermittent latency spikes that isolated per-service metrics cannot localise.

Why this answer

OCI APM Distributed Tracing is designed to trace requests end-to-end across microservices and regions. It captures spans from each service, correlates them into a single trace, and provides a visual service map, making it the right tool for troubleshooting intermittent latency spikes across service boundaries.

Exam trap

1Z0-997-26 often tests the difference between APM Distributed Tracing (application-level, request tracing) and network or log analytics tools; candidates may confuse network monitoring with application tracing.

How to eliminate wrong answers

Option B is wrong because OCI Network Visualizer provides network topology and connectivity information, not application-level request tracing. Option C is wrong because OCI Logging Analytics with system parsers can analyze logs but does not provide end-to-end distributed tracing with span correlation. Option D is wrong because OCI Monitoring anomaly detection identifies anomalies in metrics, not request-level tracing across services.

Practice this question →

26

MCQmedium

Your finance department requires detailed cost visibility and granular chargeback reporting for multiple cloud environments spanning different business units, departments, and environments (Prod/Dev). Tagging is strictly enforced via OCI Tag Defaults. To analyze historical cost trends and forecast future cloud spend across these business dimensions, which OCI native feature should you use?

A.OCI Logging Analytics custom dashboards querying the Usage Report log stream.

B.OCI Budgets with scheduled CSV report exports sent to an Object Storage bucket.

C.OCI Cost Analysis dashboards filtered by Cost-Tracking Tags.

D.OCI Resource Manager stack drift reports mapped against IAM compartment hierarchies.

AnswerC

Cost Analysis dashboards aggregate historical spend and forecast future costs, and filtering by Cost-Tracking Tags slices data across business units, departments and Prod/Dev environments. This satisfies the stem's requirement for granular chargeback visibility and trend analysis using enforced tag defaults.

Why this answer

OCI Cost Analysis is the native cost visibility and chargeback tool that supports filtering by Cost-Tracking Tags, which are the tags enforced by Tag Defaults. It provides historical trend analysis and forecasting across business dimensions like business unit, department, and environment. Unlike Budgets, which are for threshold alerts, Cost Analysis is designed for granular cost exploration and reporting.

Exam trap

1Z0-997-26 often tests the confusion between OCI Budgets and Cost Analysis, where candidates pick Budgets for detailed cost visibility, but Budgets are only for alerts and thresholds, not for granular analysis.

How to eliminate wrong answers

Option A is wrong because Logging Analytics is for log data, not cost data; the Usage Report log stream is not a native cost analysis tool. Option B is wrong because Budgets are for tracking spend against a threshold and sending alerts, not for granular chargeback or historical trend analysis. Option D is wrong because Resource Manager drift reports are for infrastructure as code state comparison, not cost analysis.

Practice this question →

27

Multi-Selecthard

Your organization is implementing strict compliance requirements for log retention and auditing in OCI. Which THREE architectural implementations ensure secure, long-term log governance?

Select 3 answers

A.Store unencrypted log backups on public Object Storage buckets for easy developer access.

B.Encrypt log groups in OCI Logging using Customer-Managed Keys (CMK) from OCI Vault.

C.Apply IAM least-privilege policies to restrict who can read, modify, or delete log groups and archival buckets.

D.Use Service Connector Hub to archive logs from OCI Logging to Object Storage buckets configured with Object Lock (WORM).

E.Disable OCI Audit service logging to prevent unauthorized users from viewing API history.

AnswersB, C, D

Customer-Managed Keys from OCI Vault encrypt log groups at rest, giving the organisation control over key rotation and revocation rather than relying on Oracle-managed keys. This satisfies the compliance requirement for secure, long-term log governance.

Why this answer

Option B is correct because encrypting OCI Logging log groups with Customer-Managed Keys (CMK) from OCI Vault gives the organization control over the encryption lifecycle, satisfies compliance mandates for data-at-rest protection, and allows key rotation and revocation independent of Oracle-managed keys. Option C is correct because IAM least-privilege policies ensure that only authorized principals can read, modify, or delete log groups and archival buckets, which is essential for tamper-resistant audit trails and separation of duties under compliance frameworks. Option D is correct because Service Connector Hub reliably moves logs from OCI Logging to Object Storage, and configuring the bucket with Object Lock (WORM) enforces immutability for the retention period, preventing deletion or alteration and meeting long-term log governance requirements.

Option A is not appropriate because storing unencrypted log backups in public Object Storage buckets exposes sensitive audit data and violates encryption, access-control, and confidentiality requirements. Option E is not appropriate because disabling OCI Audit service logging destroys the API activity history needed for auditing and incident investigation, directly undermining compliance rather than improving security.

Exam trap

The trap is that candidates focus only on encryption and forget that immutability (Object Lock/WORM) and least-privilege IAM are equally required for true compliance-grade log governance.

Practice this question →

28

Multi-Selectmedium

When configuring OCI Service Connector Hub to move logs from OCI Logging to OCI Object Storage, which THREE components must be defined?

Select 3 answers

A.Target (e.g., OCI Object Storage bucket)

B.A manual SSH tunnel between the source and target regions

C.An active Kubernetes cluster in OKE to host the connector daemon

D.Source (e.g., OCI Logging service)

E.IAM policies granting the service connector permission to read from source and write to target

AnswersA, D, E

A target defines the destination the connector delivers to, satisfying the requirement to move logs into OCI Object Storage. Service Connector Hub needs an explicit target resource — here a bucket — so it knows where to write the collected log objects. Without a target, no delivery occurs.

Why this answer

Option A (Target, e.g., OCI Object Storage bucket) is correct because Service Connector Hub requires a target resource to which the connector delivers the data, and for this scenario that target is an Object Storage bucket. Option D (Source, e.g., OCI Logging service) is correct because a service connector must specify the source service whose data it reads, here OCI Logging log groups. Option E (IAM policies granting the service connector permission to read from source and write to target) is correct because the Service Connector Hub service principal needs explicit IAM policy statements authorizing it to read from the Logging source and write to the Object Storage target.

Option B is incorrect because Service Connector Hub is a fully managed OCI service that does not require any manual SSH tunnel between regions. Option C is incorrect because no OKE Kubernetes cluster or connector daemon is needed; the service runs as a managed OCI resource.

Exam trap

The trap is over-engineering the answer by adding infrastructure (SSH tunnels, OKE clusters) that OCI's managed Service Connector Hub explicitly does not require; 1Z0-997-26 tests whether you know it is serverless and policy-driven.

Practice this question →

29

MCQhard

A financial services firm runs a three-tier application in OCI. Compliance requires that all audit-relevant log entries be retained for seven years in immutable storage, while the Security team needs near-real-time search across the same logs for the last 30 days. The architect must design a single ingestion path that satisfies both needs without modifying application code. Which approach is correct?

A.Enable the Logging service's built-in archive option, which automatically copies every log to Object Storage and keeps a searchable index for 30 days

B.Configure the OCI Logging agent to write logs directly to an Object Storage bucket with a retention rule, and query that bucket with Logging Analytics

C.Create a log group, enable a Service Connector Hub connector from Logging to Logging Analytics and another to Object Storage, and apply an Object Storage retention rule with immutable time-bound retention

D.Deploy a third-party syslog server on a Compute instance that receives logs and writes both to a database and to archival tape

AnswerC

A single log group receives agent-forwarded logs. Two Service Connector Hub connectors fan the same stream out: one to Logging Analytics for near-real-time indexed search, another to Object Storage where a retention rule enforces the seven-year immutability. This satisfies both compliance and security needs without application changes, since ingestion is centralized in OCI Logging.

Why this answer

Logs flow into a log group, and Service Connector Hub can fan out one source to multiple targets. Pointing one connector at Logging Analytics delivers indexed, near-real-time search, while a second connector writes to Object Storage where a retention rule enforces immutability for seven years. Both requirements are met from a single ingestion path with no application code changes.

Exam trap

The trap here is believing that Logging Analytics or OCI Logging natively archives logs to immutable Object Storage, when that fan-out requires Service Connector Hub.

Practice this question →

30

MCQeasy

You need to export OCI Audit logs to a third-party SIEM tool (such as Splunk or Elastic) in real-time. Which OCI architecture is best suited for this requirement?

A.Schedule an OCI Resource Manager job to FTP log files every night.

B.Install the OCI Logging Agent directly on the OCI Audit service control plane.

C.Configure OCI Health Checks to poll the Audit API.

D.Use OCI Service Connector Hub to route logs from OCI Audit to OCI Streaming or Object Storage for SIEM consumption.

AnswerD

Service Connector Hub moves Audit log data to OCI Streaming or Object Storage, from which the SIEM consumes it. This provides the near-real-time, continuous pipeline the third-party SIEM integration requires, unlike manual exports or polling.

Why this answer

OCI Service Connector Hub is the native service for routing logs from OCI Audit to destinations like OCI Streaming or Object Storage. For real-time SIEM integration, Service Connector Hub can stream Audit logs to OCI Streaming, which can then be consumed by Splunk or Elastic via a connector, providing near real-time export.

Exam trap

The trap is choosing manual or agent-based methods for log export; candidates must know that Service Connector Hub is the designated service for routing OCI logs to external SIEMs.

How to eliminate wrong answers

Option A is wrong because scheduled FTP jobs are batch-oriented and not real-time, and Resource Manager is for infrastructure-as-code, not log export. Option B is wrong because you cannot install a Logging Agent on the OCI Audit service control plane; the Audit service is a managed service and logs are accessed via the API or Service Connector Hub. Option C is wrong because Health Checks monitor endpoint availability and do not poll Audit APIs for log export.

Practice this question →

31

MCQeasy

You want to track API calls made by a specific user who deleted a critical production database in OCI. Which OCI service log should you examine?

A.OCI Audit Log

B.OCI VCN Flow Log

C.OCI APM Transaction Log

D.OCI Database Alert Log

AnswerA

Audit Log records every API call against OCI resources, capturing the principal, source IP, timestamp and action. A database deletion is an API operation, so it appears there, letting you attribute the action to the specific user.

Why this answer

OCI Audit Log records all API calls made against OCI resources, including the identity of the caller, source IP, timestamp, request action, and target resource. A database deletion is an API operation (e.g., DeleteAutonomousDatabase or TerminateDbSystem), so the Audit Log is the authoritative source to identify which user performed it.

Exam trap

The trap is assuming network or database logs capture user identity — only the OCI Audit Log records the principal behind a control-plane API call like a database deletion.

How to eliminate wrong answers

Option B is wrong because VCN Flow Logs capture network traffic metadata (source/dest IP, ports, accept/reject) at the VNIC level, not user API activity. Option C is wrong because APM Transaction Logs trace application-level transactions and spans, not OCI control-plane API calls. Option D is wrong because the Database Alert Log is an Oracle database-internal log for errors and events, not an OCI audit trail of who invoked the delete API.

Practice this question →

32

MCQeasy

An OCI Administrator needs to set up proactive alerting when the CPU utilization of a production Compute instance exceeds 90% for a sustained period of 15 minutes. Which OCI service should be configured to evaluate this metric and trigger notifications via an email endpoint?

A.OCI Health Checks configured with custom ICMP ping probes targeting the private IP of the instance.

B.OCI Events Service configured with a rule filtering for Compute metric threshold violations.

C.OCI Logging Analytics with scheduled saved search alerts.

D.OCI Monitoring Service Alarms combined with OCI Notifications Service topics.

AnswerD

OCI Monitoring alarms evaluate metric streams against thresholds over a sustained duration, satisfying the 15-minute CPU-above-90% condition, then publish to an OCI Notifications topic whose email subscription delivers the alert. Metrics ingestion, threshold evaluation and delivery are distinct services, so both must be configured together.

Why this answer

OCI Monitoring Service alarms evaluate metric streams against thresholds (e.g., CPU utilization > 90% for 15 minutes) and trigger actions when the condition is met. The alarm publishes to an OCI Notifications Service topic, which delivers the alert to an email endpoint. This is the standard, native pattern for proactive metric-based alerting in OCI.

Exam trap

1Z0-997-26 often tests the distinction between Monitoring (metrics/alarms), Events (resource state changes), Logging Analytics (log analysis), and Health Checks (network probes) — candidates incorrectly pick Events or Health Checks for metric-threshold alerting.

How to eliminate wrong answers

Option A is wrong because OCI Health Checks perform network-level probes (HTTP, TCP, ICMP) to test reachability, not CPU metric evaluation — they cannot detect sustained CPU utilization thresholds. Option B is wrong because OCI Events Service reacts to state changes in OCI resources (e.g., instance created, bucket deleted), not to metric threshold violations; metrics are handled by Monitoring. Option C is wrong because OCI Logging Analytics analyzes log data with saved searches, not infrastructure metrics like CPU utilization — it is for log-based insights, not metric alarms.

Practice this question →

33

Multi-Selectmedium

Which THREE features are supported within OCI Cost Analysis to help administrators analyze and report on cloud spending?

Select 3 answers

A.Directly modifying customer credit card billing details without contacting Oracle Support

B.Grouping and filtering costs using OCI Defined Tags

C.Visualizing cumulative cost trends over customizable time ranges (e.g., daily, monthly)

D.Automatically executing database SQL queries against Autonomous Database instances

E.Exporting cost charts and tabular data to CSV format

AnswersB, C, E

Cost Analysis supports grouping and filtering spend by OCI defined tags, letting administrators break costs down by the tag keys applied to resources and compartments, which satisfies the reporting and analysis requirement in the stem.

Why this answer

Option B is correct because OCI Cost Analysis lets administrators group and filter cost data by dimensions including OCI Defined Tags, enabling chargeback and showback reporting by tag keys/values. Option C is correct because Cost Analysis provides interactive charts that visualize cumulative and non-cumulative cost trends across customizable time ranges such as daily or monthly granularity. Option E is correct because Cost Analysis allows exporting the displayed cost charts and tabular cost data to CSV for offline analysis and reporting.

Option A is incorrect because billing details such as credit card information are managed through Oracle Support or the account management/billing console, not by directly editing them in Cost Analysis. Option D is incorrect because Cost Analysis is a cost reporting and visualization tool; it does not execute SQL queries against Autonomous Database instances, which would be done via tools like SQL Developer, Database Actions, or OCI Data Science/APEX.

Exam trap

1Z0-997-26 often tests whether candidates confuse Cost Analysis (reporting/visualization/export) with billing administration (credit card changes) or database query tools — the trap is selecting options that sound like 'analysis' but belong to unrelated services.

Practice this question →

34

MCQmedium

An enterprise architect is designing a centralized log management solution in Oracle Cloud Infrastructure (OCI) Logging Analytics. The team needs to ingest logs from various heterogeneous sources, including custom applications, Oracle databases, and third-party firewalls, while ensuring that the log data is properly parsed and enriched without requiring custom regex development for every vendor format. Which feature should the architect leverage to meet this requirement?

A.OCI Telemetry Data Plane auto-extractors that automatically normalize all logs into a unified OpenTelemetry schema.

B.OCI Object Storage lifecycle rules configured with transformation policies to convert raw text logs into structured JSON formats.

C.OCI Logging Analytics out-of-the-box parsers and source configurations along with custom parsers built via the Log Parser Workbench.

D.OCI Streaming Service combined with Oracle Functions to manually parse every raw log payload prior to storage.

AnswerC

Out-of-the-box parsers and source configurations handle Oracle databases, firewalls and common formats without bespoke regex, while the Log Parser Workbench builds custom parsers for proprietary application logs. Together they satisfy the heterogeneous ingestion requirement with minimal manual pattern authoring.

Why this answer

OCI Logging Analytics ships with a large library of out-of-the-box parsers and source configurations that recognize common vendor formats (Oracle DB, firewalls, OS logs, etc.), so heterogeneous logs are parsed and enriched without writing regex from scratch. When a format is not covered, the Log Parser Workbench provides a GUI to build and validate custom parsers, which is exactly the requirement stated. This combination delivers structured fields and enrichment (e.g., geo-location, threat intel) at ingest time.

Exam trap

The trap here is assuming OCI has a universal auto-normalization or OpenTelemetry-based extractor (Option A) when in reality Logging Analytics relies on explicit source/parser configuration plus the Log Parser Workbench for custom formats.

How to eliminate wrong answers

Option A is wrong because OCI Telemetry Data Plane does not provide 'auto-extractors' that normalize every log into a unified OpenTelemetry schema; OCI Logging Analytics uses its own parser/source model, and no such universal auto-normalization feature exists. Option B is wrong because Object Storage lifecycle rules only transition, archive, or delete objects — they cannot transform raw text logs into structured JSON; transformation would require Functions or Data Integration, not lifecycle policies. Option D is wrong because Streaming plus Functions requires you to write and maintain parsing code for every payload, which directly contradicts the requirement to avoid custom parsing per vendor format.

Practice this question →

35

Multi-Selectmedium

Which THREE features are provided by OCI Application Performance Monitoring (APM)?

Select 3 answers

A.Distributed Tracing across microservices

B.Automatic provisioning of bare metal database backups

C.Real User Monitoring (RUM) to track end-user browser performance

D.Management of BGP routing tables for FastConnect

E.Synthetic Monitoring using browser and script-based tests

AnswersA, C, E

Distributed tracing follows a request across microservice boundaries, capturing span timing and causal relationships to pinpoint latency bottlenecks. This satisfies the stem's requirement for an APM capability, since OCI APM natively ingests trace data from instrumented services, unlike infrastructure monitoring tools that report only host-level metrics.

Why this answer

OCI Application Performance Monitoring (APM) provides Distributed Tracing across microservices (A), which lets you follow a single request through multiple services and identify latency or errors in the call chain. It also provides Real User Monitoring (RUM) (C), which captures browser-side performance data from actual end users via a JavaScript agent. Additionally, APM offers Synthetic Monitoring (E) using browser and script-based tests to proactively simulate user interactions and measure availability and performance.

Options B and D are incorrect because automatic bare metal database backups are a database service capability, and BGP routing table management for FastConnect belongs to OCI networking, not APM.

Exam trap

1Z0-997-26 often tests whether candidates confuse APM (application-level tracing/RUM/synthetic) with infrastructure monitoring (Monitoring) or database services, so they pick backup or BGP options that belong elsewhere.

Practice this question →

36

MCQeasy

Your operations team needs to receive immediate notifications via PagerDuty and Slack whenever a high-severity alarm is triggered in OCI Monitoring. Which OCI service should be used as the intermediary to dispatch these notifications?

A.OCI API Gateway

B.OCI Streaming Service

C.OCI Events Service

D.OCI Notifications Service

AnswerD

OCI Notifications Service publishes alarm messages to topics, then delivers them through subscriptions such as PagerDuty and Slack, satisfying the immediate high-severity alerting requirement. OCI Monitoring alarms trigger the topic directly, so no polling or custom integration is needed to reach both endpoints.

Why this answer

OCI Notifications Service is the correct intermediary because it natively supports publishing messages to external endpoints such as PagerDuty and Slack via HTTPS subscriptions. When an OCI Monitoring alarm fires, it can publish to a Notifications topic, and the service delivers the message to all subscribed endpoints. This is the standard OCI pattern for alert fan-out to third-party incident management and chat tools.

Exam trap

1Z0-997-26 often tests the distinction between services that can trigger actions (Events) and services that actually deliver notifications (Notifications), causing candidates to pick Events Service when the requirement is specifically about dispatching messages to external endpoints like PagerDuty and Slack.

How to eliminate wrong answers

Option A is wrong because OCI API Gateway is designed to expose and manage APIs, not to dispatch alarm notifications to external services; it lacks native subscription and delivery mechanisms for PagerDuty or Slack. Option B is wrong because OCI Streaming Service is a high-throughput, durable message streaming platform for real-time data ingestion and processing, not a notification dispatch service; it does not directly integrate with PagerDuty or Slack. Option C is wrong because OCI Events Service reacts to state changes and can trigger actions, but it does not itself deliver notifications to external endpoints like PagerDuty or Slack; it would need to invoke another service such as Notifications to do so.

Practice this question →

37

MCQhard

An SRE team is configuring OCI Application Performance Monitoring (APM) synthetic monitoring. They need to run browser-based synthetic scripts periodically from multiple geographic locations to ensure user-facing login workflows function correctly. Which APM feature should they configure?

A.OCI Health Checks Ping Monitors

B.APM Synthetic Monitoring Browser Monitors using Dedicated Vantage Points

C.Logging Analytics synthetic agent extensions

D.OCI Monitoring service Synthetic Probes

AnswerB

Browser monitors execute Selenium-style scripts in real Chrome instances from dedicated vantage points, satisfying the requirement for periodic, multi-geographic testing of user-facing login workflows. Dedicated vantage points provide controlled, authenticated origins, unlike public vantage points, and capture full page-load timing plus DOM-level failures that simpler HTTP monitors cannot detect.

Why this answer

OCI APM Synthetic Monitoring Browser Monitors execute scripted browser workflows (e.g., login flows) from multiple geographic locations using Dedicated Vantage Points, which are managed vantage points that run the scripts. This directly matches the requirement to periodically run browser-based synthetic scripts from multiple locations to validate user-facing login workflows.

Exam trap

1Z0-997-26 often tests the distinction between network-level health checks (Ping/HTTP monitors) and application-level browser synthetic monitoring, so candidates must match 'browser-based scripts' to APM Synthetic Monitoring Browser Monitors.

How to eliminate wrong answers

Option A is wrong because OCI Health Checks Ping Monitors only test network reachability/latency to an endpoint and cannot execute browser-based scripts or validate login workflows. Option C is wrong because Logging Analytics synthetic agent extensions are not a browser-based synthetic monitoring feature; Logging Analytics is for log ingestion and analysis. Option D is wrong because OCI Monitoring service Synthetic Probes is not the correct APM feature for browser-based scripted workflows; the APM Synthetic Monitoring Browser Monitor with Dedicated Vantage Points is the purpose-built capability.

Practice this question →

38

MCQeasy

An administrator wants to analyze log data collected from various OCI resources by running complex SQL-like queries and creating visualization dashboards. Which OCI service is designed for this purpose?

A.OCI Logging Analytics

B.OCI Audit Service

C.OCI Health Checks

D.OCI Object Storage

AnswerA

OCI Logging Analytics indexes ingested log data, enabling complex SQL-like queries through its query language and dashboards for visualisation. It satisfies the stem's requirement to analyse logs from various OCI resources, unlike OCI Logging, which only collects and stores logs without analytical querying or dashboard visualisation capabilities.

Why this answer

OCI Logging Analytics is a machine-learning-driven log analysis service that ingests logs from many sources and lets users run SQL-like queries (Log Explorer query language), build dashboards, and detect anomalies. It is purpose-built for deep log analytics and visualization, unlike basic Logging which focuses on collection and search.

Exam trap

The trap is conflating OCI Logging (collection/search) with OCI Logging Analytics (query/dashboard/ML); the exam tests whether you know which service actually provides SQL-like analytics and visualization.

How to eliminate wrong answers

Option B is wrong because OCI Audit Service records control-plane API activity for compliance and auditing, not for running analytical queries over application logs. Option C is wrong because OCI Health Checks monitors endpoint availability and latency via probes; it does not analyze log data. Option D is wrong because OCI Object Storage is a raw object store; while logs can be archived there, it provides no query engine or visualization layer.

Practice this question →

39

MCQhard

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

A.OCI Health Checks ping monitors

B.OCI VCN Flow Logs

C.OCI Monitoring service VNIC packet counters

D.OCI Network Firewall system logs

AnswerB

VCN Flow Logs capture per-packet metadata at the VNIC, recording accepted and rejected traffic against security list and network security group rules. This directly satisfies the requirement to verify whether packets are being dropped at the VNIC level, which security list metrics alone cannot show.

Why this answer

OCI VCN Flow Logs capture metadata about traffic flowing through VNICs, including source/destination IPs, ports, protocol, and whether the packet was accepted or rejected by security rules. Enabling flow logs on the subnet or VNIC lets you verify if security lists or NSGs are dropping packets to the external endpoint.

Exam trap

The trap is confusing flow logs (per-flow accept/reject metadata) with Monitoring counters (aggregate statistics) or Health Checks (external reachability probes).

How to eliminate wrong answers

Option A is wrong because Health Checks ping monitors test reachability from OCI's vantage points, not whether security rules on a specific VNIC accept or reject packets. Option C is wrong because OCI Monitoring VNIC packet counters show aggregate traffic volumes, not per-flow accept/reject decisions. Option D is wrong because Network Firewall system logs pertain to the firewall appliance's own operations, not to security list or NSG evaluation on a VNIC.

Practice this question →

40

Multi-Selecthard

An SRE team is configuring synthetic monitoring using OCI Application Performance Monitoring (APM). To execute scripts across private corporate networks that cannot be accessed from the public internet, which THREE steps or components must be configured?

Select 3 answers

A.Attach a public load balancer directly to the internal database to route synthetic traffic.

B.Deploy APM Dedicated Vantage Points (DVPs) on Compute instances inside the private OCI VCN.

C.Disable all VCN security lists to allow inbound SSH from public APM nodes.

D.Ensure network connectivity (such as service gateways or NAT gateways) allows DVPs to communicate with the APM service endpoint.

E.Configure synthetic monitors in APM to target the Dedicated Vantage Point instead of public locations.

AnswersB, D, E

Dedicated Vantage Points are deployed on Compute instances inside the private OCI VCN, executing synthetic scripts from within the private network. This satisfies the constraint that corporate networks cannot be reached from public internet vantage points.

Why this answer

Option B is correct because APM Dedicated Vantage Points (DVPs) are the mechanism for running synthetic monitoring scripts from inside a private OCI VCN, allowing tests against resources that are not reachable from the public internet. Option D is correct because DVPs must be able to reach the APM service endpoint to upload results and receive configuration, which requires appropriate egress connectivity such as a service gateway or NAT gateway in the VCN. Option E is correct because synthetic monitors must be explicitly configured to use the DVP as their execution location rather than the default public vantage points, otherwise the scripts would still run from the internet.

Option A is incorrect because attaching a public load balancer to an internal database would expose the database and is not how synthetic monitoring reaches private targets. Option C is incorrect because disabling VCN security lists and allowing inbound SSH from public APM nodes is insecure and unnecessary; DVPs run locally inside the VCN and do not require inbound SSH from public APM infrastructure.

Exam trap

1Z0-997-26 often tests the misconception that synthetic monitoring requires public exposure of private endpoints — candidates pick options that open public access instead of using DVPs.

Practice this question →

41

MCQmedium

An administrator is setting up composite alarms in OCI Monitoring. They want an alarm to trigger ONLY if both Database CPU utilization is above 90% AND Application latency is above 500ms simultaneously. How should this be implemented?

A.Configure an OCI Notifications service topic subscription with a logical filter rule.

B.Create two separate alarms and define an OCI Monitoring Composite Alarm using the logical AND operator.

C.Use OCI Events service with a custom JSON payload condition.

D.Create a single standard alarm with a compound mathematical metric expression joining CPU and latency.

AnswerB

A composite alarm evaluates child alarm states using a logical expression, so combining two separate metric alarms with AND fires only when both CPU and latency thresholds breach simultaneously. A single metric alarm cannot span two namespaces.

Why this answer

OCI Monitoring Composite Alarms are designed to combine multiple underlying metric alarms using logical operators (AND, OR, etc.). To trigger only when both CPU > 90% and latency > 500ms occur simultaneously, you create two standard metric alarms and then a composite alarm that ANDs them together.

Exam trap

The trap is assuming OCI Notifications or Events can perform logical filtering; 1Z0-997-26 tests whether you know composite alarms are the only native construct for AND/OR across metric alarms.

How to eliminate wrong answers

Option A is wrong because OCI Notifications subscriptions deliver messages to endpoints (email, PagerDuty, etc.) and do not evaluate logical conditions across alarms. Option C is wrong because OCI Events reacts to state-change events (e.g., resource creation) and cannot natively AND two metric thresholds. Option D is wrong because a single standard alarm evaluates one metric expression; while Monitoring supports some metric math, it does not provide the cross-alarm logical AND semantics that composite alarms do.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Observability questions.

Start 20-question session