CCNA Cloud Native Architecture Questions

You are implementing distributed tracing across multiple microservices running on OKE. You need to capture trace data from incoming API Gateway requests, through service mesh sidecars, down to the application pods, and export it to an open-standards tracing backend. Which architectural components should you configure?

When designing cloud-native architectures on OCI using OCI Events and OCI Notifications, which THREE delivery endpoints are natively supported by OCI Notifications for publishing alert or event messages?

You are designing a high-throughput event-driven system on OCI where OCI Functions are invoked asynchronously via OCI Events. A specific function experiences intermittent database connection timeouts during traffic spikes, resulting in dropped events. How should you architect the invocation pipeline to ensure reliable, at-least-once delivery and smooth out spikes?

When designing an API Gateway implementation on OCI to expose backend microservices running on OKE, which THREE features or capabilities can you configure directly within the API Gateway deployment? (Choose three.)

Your OKE cluster uses Calico for Kubernetes network policy enforcement. You need to write a network policy that allows Pod A in namespace 'frontend' to communicate with Pod B in namespace 'backend', while blocking all other ingress traffic to Pod B. How should you implement this?

Your OCI Function needs to write audit logs or custom debugging information that can be easily searched and analyzed alongside other cloud logs. Which OCI service should your function log to?

You are troubleshooting an OCI Functions application that fails to pull container images from a private Oracle Cloud Infrastructure Registry (OCIR) repository during deployment. The function application is configured correctly, but the build/invoke fails with authentication errors. What is the most likely missing configuration?

Your microservices architecture on OKE uses mTLS (Mutual TLS) for secure pod-to-pod communication. You notice that certificate rotation is causing intermittent connection drops because pods are not reloading the new certificates without a restart. Which OCI Service Mesh feature automatically manages certificate issuance and rotation without requiring pod restarts?

You are managing an OKE cluster where developer teams frequently deploy new microservice versions. You need to implement a canary deployment strategy where 10% of production traffic is automatically routed to the new version while 90% goes to the stable version, without rewriting your application code. Which tool or pattern should you use?

You are designing a disaster recovery strategy for a stateful microservices application running on OKE across two OCI regions. Persistent data is stored on OCI Block Volumes. What is the recommended approach to replicate persistent storage data across regions for stateful workloads?

Which TWO methods can developers use to interact with OCI Registry (OCIR) for pushing and pulling container images?

An OCI Function in your serverless architecture needs to process large files (up to 5GB) uploaded to an OCI Object Storage bucket. Due to ephemeral storage limits inside the function container (/tmp), the function crashes when attempting to download the entire file locally. How should you redesign this function processing flow?

You are designing a serverless event-driven architecture on OCI using OCI Events, OCI Notifications, and OCI Functions. Which THREE actions are valid capabilities when integrating these services? (Choose three.)

Your serverless OCI Function written in Python is failing to process payloads because it exceeds the default execution timeout limit when calling a third-party REST API. How should you resolve this issue while adhering to best practices?

You are designing an OKE-based cloud-native microservices architecture and want to ensure high availability and robust security isolation. Which THREE architectural best practices should you implement?

When configuring an OCI API Gateway deployment to protect and route traffic to backend services, which THREE authentication or authorization mechanisms are natively supported?

You are designing a multi-tenant microservices platform on OKE. You need to ensure that tenant workloads are strictly isolated at the kernel level, preventing potential container breakout vulnerabilities from affecting other tenants. Which OCI Container Engine for Kubernetes node configuration should you choose?

Your development team needs to build and push container images to a secure, private registry hosted on OCI before deploying them to OKE. Which OCI service should they use?

You need to store sensitive configuration data, such as database connection strings and API keys, for your OCI Functions application. Where should you securely store these values so they can be injected as environment variables or retrieved securely?

Which TWO of the following are key architectural benefits of adopting serverless OCI Functions compared to managing traditional container clusters for event-driven tasks?

You need to trigger an OCI Function asynchronously whenever an object is uploaded to an OCI Object Storage bucket. Which OCI service acts as the event router between Object Storage and the Function?

You are designing a serverless data ingestion pipeline where OCI Functions are triggered by messages arriving in an OCI Stream. Under peak load, messages arrive faster than the functions can process them, causing invocation failures due to concurrency limits. How can you reliably buffer and throttle the event flow before invoking the functions?

Which TWO of the following are valid methods to trigger an OCI Function execution?

Your OKE cluster is running microservices that require rapid horizontal scaling based on custom application metrics (such as active queue length) rather than standard CPU or memory utilization. Which Kubernetes component should you deploy to achieve this?

You need to secure your OCI API Gateway deployment by ensuring that only authenticated requests containing a valid JSON Web Token (JWT) issued by an identity provider can access your backend microservices. Which API Gateway feature should you implement?

Your OKE cluster has multiple worker node pools. You want to ensure that a specific set of resource-intensive machine learning microservices pods are scheduled *only* on dedicated GPU worker nodes, preventing them from running on standard CPU worker nodes. Which Kubernetes feature should you apply to your pods and node pools?

Your containerized microservices running on OKE need to securely connect to an Oracle Autonomous Database without embedding plain-text database credentials inside Kubernetes Secrets. Which OCI feature integrates OKE service accounts with OCI IAM to provide secure, credential-less access?

You are implementing zero-trust network security for an OKE microservices application using OCI Service Mesh. Which THREE capabilities does OCI Service Mesh provide to secure service-to-service communication?

You are deploying a microservices application on Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE). You need to expose multiple internal services externally using a single public IP address and enforce URL path-based routing. Which OCI networking and container component should you use?

You are architecting a multi-region cloud-native application where OCI API Gateway is deployed in Region A and Region B. You need to ensure that global users are automatically routed to the closest healthy API Gateway endpoint with automatic failover if an entire OCI region experiences an outage. Which OCI service should you use in front of the API Gateways?

You are managing an enterprise OKE cluster that runs multi-tenant workloads. Certain sensitive pods must run on dedicated worker nodes to comply with strict isolation mandates. Which combination of Kubernetes scheduling features should you configure on OCI to enforce this requirement reliably?

Which TWO characteristics distinguish OCI Container Engine for Kubernetes (OKE) as a managed Kubernetes service?

When configuring OCI API Gateway, which THREE types of backends are natively supported for routing incoming API requests?

You have deployed an OCI Function and want to test its HTTP trigger endpoint without writing custom client code. Which OCI service or feature should you use to invoke the function directly via an HTTP URL?

You are building a high-throughput event-processing pipeline where multiple consumer instances need to read messages from an OCI Stream concurrently. Each consumer instance must maintain its own independent cursor position and process every message in the stream without interfering with other consumer instances. How should you configure your consumers?

You are deploying an application on OKE using Helm charts. You need to ensure that Helm release secrets and deployment state are stored securely and persistently within the cluster so that failed tiller/helm operations do not corrupt deployment tracking. Where does Helm v3 store its release state in OKE by default?

When designing a container build and deployment pipeline using OCI DevOps and OCI Registry (OCIR), which THREE tasks can be automated within the CI/CD build pipeline stage?

You are troubleshooting a microservice on OKE that is experiencing intermittent 502 Bad Gateway errors when communicating with another internal service. The application uses Kubernetes ClusterIP services for discovery. You suspect DNS resolution failure within the cluster. Which diagnostic tool and approach should you use inside the OKE cluster?

You are configuring an OCI API Gateway deployment to route requests to backend microservices running on OKE. You need to ensure that if a backend microservice takes longer than 3 seconds to respond, the API Gateway cancels the request and returns a 504 Gateway Timeout error to the client. Where should you configure this timeout?

An enterprise application deployed on Oracle Container Engine for Kubernetes (OKE) requires low-latency, secure, private connectivity between microservices residing in different Virtual Cloud Network (VCN) subnets without exposing traffic to the public internet. Which OKE add-on or feature should a Solutions Architect implement?

You are using Fn Project CLI to deploy an OCI Function. Which command is used to build, push, and deploy the function to your application in OCI in a single streamlined step?

You are configuring an OCI API Gateway deployment to secure a backend microservice running on OKE. You need to implement token-based authentication where the API Gateway validates a JSON Web Token (JWT) issued by an external identity provider before routing the request. Where should you configure this validation?

You need to automate the build, test, and deployment phases of your microservices application whenever developers push code changes to a Git repository on OCI. Which OCI service provides native CI/CD pipelines?

Your OKE cluster has autoscaling enabled using the Kubernetes Cluster Autoscaler. However, during peak hours, new pods remain in 'Pending' state for 15 minutes before the cluster autoscaler provisions new worker nodes. How can you reduce this provisioning delay?

Which TWO architectural best practices should you follow when designing cloud-native microservices on Oracle Container Engine for Kubernetes (OKE) to ensure high availability and resilience? (Choose two.)

You are migrating a monolithic application to microservices on OKE and implementing resilient design patterns. Which THREE resiliency patterns should you implement to handle transient failures gracefully?

Your organization wants to deploy an ephemeral, event-driven data processing task that runs for less than 3 minutes whenever a new object is uploaded to an OCI Object Storage bucket. Which serverless combination is the most cost-effective and operationally efficient solution?

Your OKE cluster is deployed in a private subnet with no direct outbound internet access. However, your pods need to pull container images from OCI Registry (OCIR). How should you enable this secure image pull without exposing worker nodes to the public internet?

You are designing an event-driven architecture on OCI where events from Object Storage bucket creations need to trigger an OCI Function. However, you require guaranteed at-least-once delivery, event filtering based on object name prefixes, and a dead-letter queue mechanism for failed function invocations. Which OCI service combination meets these requirements?

You are troubleshooting performance bottlenecks in an event-driven architecture using OCI Streaming. Which THREE metrics or indicators should you monitor to detect consumer lag and partitioning issues?

You have deployed an API on OCI API Gateway and want to protect it from common web attacks such as SQL injection, cross-site scripting (XSS), and bad bots. Which OCI service should you integrate with API Gateway?