Knowledge + Practice

CCNA High Availability And Disaster Recovery Questions

39 questions · High Availability And Disaster Recovery topic · All types, answers revealed

Practice these questions Exam hub All questions

1

Multi-Selecthard

When designing high availability for an Oracle RAC (Real Application Clusters) database deployed on OCI Exadata Database Service, which THREE architectural characteristics ensure fault tolerance and uptime? (Choose three.)

Select 3 answers

A.Running the entire cluster on a single Oracle Linux compute instance without Grid Infrastructure

B.Storing all database data on a single local NVMe drive on node 1

C.Multi-node database clustering across distinct Fault Domains or Availability Domains

D.Application Continuity or Transparent Application Failover (TAF) for seamless session recovery

E.Redundant Exadata Storage Servers (Storage Cells) providing clustered grid storage

AnswersC, D, E

Spreading RAC nodes across distinct Fault Domains or Availability Domains isolates each instance from a single hardware or datacentre failure, so surviving nodes continue serving the database. This directly satisfies the fault-tolerance and uptime requirement by removing any single point of failure at the infrastructure layer.

Why this answer

Option C is correct because Oracle RAC achieves fault tolerance by distributing cluster nodes across distinct Fault Domains or Availability Domains, so the failure of one domain does not take down the entire database. Option D is correct because Application Continuity and Transparent Application Failover (TAF) mask instance or node failures by replaying or failing over in-flight sessions, preserving application uptime during outages. Option E is correct because Exadata Storage Cells use Exadata Smart Flash Cache and ASM redundancy across multiple Storage Servers, so a failed cell does not cause data loss or database downtime.

Option A is wrong because a single Oracle Linux instance without Grid Infrastructure cannot form a RAC cluster and provides no node-level redundancy. Option B is wrong because a single local NVMe drive on one node is a single point of failure and is not shared clustered storage, which RAC requires.

Exam trap

The trap is confusing 'high availability' with 'backup' or 'performance' — candidates may pick options that sound resilient (single powerful node) but actually remove redundancy, missing that HA requires eliminating every single point of failure across compute, storage, and sessions.

Practice this question →

2

MCQeasy

Which OCI networking component is required to securely connect a VCN in one OCI region to a VCN in another OCI region for cross-region Data Guard database replication?

A.Dynamic Routing Gateway (DRG) with Remote VCN Peering

B.Internet Gateway (IGW)

D.Local Peering Gateway (LPG)

AnswerA

A Dynamic Routing Gateway with remote VCN peering links VCNs across OCI regions over Oracle's private backbone, providing the routing required for cross-region Data Guard traffic. This satisfies the stem's requirement for secure inter-region connectivity without traversing the public internet.

Why this answer

Remote VCN Peering in OCI uses a Dynamic Routing Gateway (DRG) attached to each VCN, with the two DRGs connected over OCI's private backbone to link VCNs in different regions. This provides private, encrypted-in-transit connectivity suitable for cross-region Data Guard redo transport without traversing the public internet. The DRG is the required routing anchor for any inter-VCN or on-premises connectivity in OCI.

Exam trap

1Z0-997-26 often tests the confusion between Local Peering Gateway (same-region VCN peering) and DRG-based Remote VCN Peering (cross-region), catching candidates who assume any peering gateway works across regions.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway provides public inbound/outbound internet access for a VCN and routes over the public internet — it is not a private cross-region VCN-to-VCN path and is unsuitable for Data Guard replication security requirements. Option C is wrong because a NAT Gateway only allows outbound internet access for private subnets and cannot peer two VCNs. Option D is wrong because a Local Peering Gateway (LPG) connects VCNs only within the same region (and same tenancy), not across regions.

Practice this question →

3

Multi-Selecthard

Which THREE factors should an architect evaluate when determining Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for an OCI database disaster recovery solution? (Choose three.)

Select 3 answers

A.Level of automation configured for failover (e.g., Fast-Start Failover vs. manual scripts)

B.Network bandwidth and latency between the primary and DR regions

C.Business criticality and acceptable data loss window during unexpected outages

D.The color scheme and layout of the OCI Console dashboard

E.The default tenant tenancy OCID string length

AnswersA, B, C

Failover automation directly governs RTO: Fast-Start Failover with Data Guard broker completes role transitions in seconds to minutes, whereas manual scripts add detection and human execution delays. It does not change RPO, which depends on redo transport mode and apply lag.

Why this answer

Option A is correct because the degree of failover automation directly determines how quickly the standby can take over, which sets the achievable RTO — Oracle Data Guard Fast-Start Failover with an observer can cut RTO to seconds or minutes, whereas manual switchover scripts add human detection and execution time. Option B is correct because network bandwidth and latency between primary and DR regions govern how fast redo/archive logs can be shipped and applied; high latency or insufficient bandwidth increases data-loss exposure (RPO) and delays synchronization, especially for synchronous or far-sync configurations. Option C is correct because RPO and RTO are business-driven targets: the criticality of the workload and the tolerable data-loss window during an outage define what values the architecture must meet, and thus what replication mode and topology are required.

Option D is incorrect because OCI Console dashboard colors and layout are cosmetic UI preferences with no bearing on data replication or recovery metrics. Option E is incorrect because the length of a tenancy OCID string is a fixed identifier characteristic and has no relationship to RPO or RTO design decisions.

Exam trap

1Z0-997-26 often tests whether candidates can distinguish business drivers (criticality, data-loss tolerance) from technical enablers (bandwidth, automation) when selecting RPO/RTO factors, while including obviously irrelevant distractors.

Practice this question →

4

Multi-Selecthard

When designing an enterprise-grade disaster recovery architecture on OCI, which THREE practices are recommended to ensure a successful failover and minimize operational risk during a disaster event? (Choose three.)

Select 3 answers

A.Disable all health checks on load balancers to prevent false alarms during failover.

B.Automate failover orchestration using tools like OCI Full Stack Disaster Recovery.

C.Conduct regular disaster recovery drills using non-disruptive testing features like Snapshot Standby.

D.Rely solely on manual documentation stored on local laptops for failover steps.

E.Ensure adequate compute and database capacity is provisioned or reserved in the target DR region.

AnswersB, C, E

OCI Full Stack Disaster Recovery automates failover orchestration across compute, database, and networking tiers, removing manual steps that introduce error during a disaster. This satisfies the stem's requirement to minimise operational risk and ensure successful failover.

Why this answer

Option B is correct because OCI Full Stack Disaster Recovery provides automated orchestration of failover and switchover across compute, databases, and storage, reducing human error and failover time during a disaster. Option C is correct because regular DR drills validate runbooks and RTO/RPO assumptions, and non-disruptive testing features such as Snapshot Standby (for Autonomous Database) allow validation without impacting production. Option E is correct because the target DR region must have sufficient compute shapes and database capacity (or reserved capacity) provisioned in advance; otherwise failover will fail or be throttled due to capacity shortages.

Option A is incorrect because disabling load balancer health checks removes automatic traffic redirection and failure detection, increasing risk rather than minimizing it. Option D is incorrect because relying solely on manual documentation stored on local laptops is fragile, error-prone, and unavailable if local systems are lost during a disaster.

Exam trap

1Z0-997-26 often tests DR best practices, and candidates may incorrectly select options that suggest disabling health checks or relying on manual documentation; the trap is choosing seemingly simple but risky practices over automation and testing.

Practice this question →

5

Multi-Selecteasy

Which TWO features of OCI Object Storage contribute to its high durability and reliability for disaster recovery workflows? (Choose two.)

Select 2 answers

A.Restricting bucket access exclusively to local console sessions.

B.Storing all objects on a single physical disk inside a single compute instance.

C.Object versioning support to protect against accidental deletion or overwriting.

D.Requiring manual user replication scripts for every individual file uploaded.

E.Data is automatically replicated across multiple fault domains and availability domains.

AnswersC, E

Object versioning retains prior copies of every object, so an accidental deletion or overwrite does not destroy the only copy. This directly supports the stem's durability and reliability requirement for disaster recovery workflows, since earlier versions remain recoverable after human error or corruption.

Why this answer

Option C is correct because OCI Object Storage supports object versioning, which retains prior versions of an object when it is overwritten or deleted, enabling recovery from accidental deletion or corruption and supporting point-in-time restore in disaster recovery workflows. Option E is correct because OCI Object Storage automatically replicates data across multiple fault domains and availability domains within a region, providing redundancy that protects against hardware and datacenter failures without user intervention. Option A is incorrect because Object Storage access is controlled through IAM policies, pre-authenticated requests, and API/SDK access, not restricted to local console sessions.

Option B is incorrect because storing objects on a single physical disk in a single compute instance offers no redundancy and is the opposite of a durable, replicated storage design. Option D is incorrect because replication is handled automatically by the service; manual per-file replication scripts are neither required nor a durability feature.

Exam trap

The trap is confusing access control with durability — candidates may pick 'restrict access to console' thinking security equals reliability, but durability comes from replication and versioning, not from limiting who can reach the data.

Practice this question →

6

MCQmedium

An OCI architect is setting up a disaster recovery environment where compute instances in the DR region need identical network configurations (private IPs, VNICs, security lists) to the primary region. Which OCI capability assists in deploying reproducible network topologies across regions?

A.OCI File Storage Network File System (NFS) exports

B.OCI Resource Manager with Terraform configurations

C.OCI IAM Domain Federation wizard

D.OCI Streaming service partition replication

AnswerB

OCI Resource Manager with Terraform configurations codifies VNICs, private IPs and security lists as declarative infrastructure-as-code, then provisions that identical topology in the DR region. This satisfies the reproducibility constraint directly: Terraform state and plan ensure the same network configuration is deployed across regions without manual rebuild.

Why this answer

OCI Resource Manager is a managed Terraform service that lets architects define network topologies (VCNs, subnets, security lists, VNICs, private IP assignments) as code and deploy them repeatedly across regions. Because the same Terraform configuration can be applied to a DR region, it guarantees identical, reproducible network configurations without manual drift. This is the canonical OCI answer for infrastructure-as-code and cross-region DR topology replication.

Exam trap

1Z0-997-26 often tests whether candidates confuse storage or identity services with infrastructure-as-code tooling; the trap is picking a data-plane service (File Storage, Streaming) when the question asks about reproducible topology deployment.

How to eliminate wrong answers

Option A is wrong because File Storage NFS exports provide shared file-level storage, not network topology definitions, and cannot recreate VCNs, subnets, or security lists. Option C is wrong because IAM Domain Federation is an identity/authentication feature for federating users from external IdPs, not an infrastructure deployment mechanism. Option D is wrong because OCI Streaming is a Kafka-compatible message ingestion service; partition replication concerns stream data durability, not network configuration cloning.

Practice this question →

7

Multi-Selecteasy

Which TWO of the following statements are correct regarding OCI Load Balancer features for high availability? (Choose two.)

Select 2 answers

A.OCI Load Balancers are restricted to a single Availability Domain and cannot cross AD boundaries.

B.An OCI Load Balancer can be deployed as either public (internet-facing) or private (internal).

C.OCI Load Balancers are regional services that span multiple Availability Domains.

D.OCI Load Balancers only support Layer 3 packet routing.

E.OCI Load Balancers require manual customer-managed keepalived failover clustering.

AnswersB, C

OCI Load Balancer supports both internet-facing public shapes and internal private shapes. A private load balancer receives only VCN-internal traffic, letting architects keep backend tiers unreachable from the internet while still balancing across healthy backends.

Why this answer

Option B is correct because OCI Load Balancer supports two deployment types: a public (internet-facing) load balancer with a public IP for external traffic, and a private (internal) load balancer with only private IPs for internal traffic within a VCN. Option C is correct because the OCI Load Balancer is a regional service: when you create it, you select a region and it can span multiple Availability Domains, with the service provisioning the load balancer across the ADs you choose for high availability. Option A is incorrect because the load balancer is not restricted to a single AD; it is regional and can be deployed across multiple ADs.

Option D is incorrect because OCI Load Balancer operates at Layer 4 (TCP) and Layer 7 (HTTP/HTTPS), not only Layer 3 packet routing. Option E is incorrect because OCI Load Balancer is a fully managed service that handles failover automatically, so no customer-managed keepalived clustering is required.

Exam trap

1Z0-997-26 often tests OCI Load Balancer features, and candidates may incorrectly believe it is AD-specific or requires manual clustering, confusing it with self-managed solutions.

Practice this question →

8

MCQeasy

When configuring an OCI Network Load Balancer (NLB) for high availability across availability domains, what is a key architectural characteristic of the NLB service?

A.It requires manual setup of keepalived and IP failover scripts on backend compute instances.

B.It is a regional service that automatically provisions endpoints across availability domains.

C.It terminates SSL/TLS connections before forwarding traffic to backend servers.

D.It can only route HTTP and HTTPS traffic.

AnswerB

The Network Load Balancer is a regional construct that automatically provisions endpoints across availability domains, providing inherent high availability without manual per-AD configuration. This satisfies the requirement for availability domain redundancy in the NLB architecture.

Why this answer

OCI Network Load Balancer is a regional, Layer 4 (TCP/UDP) load balancing service that automatically provisions endpoints across multiple Availability Domains within a region. It provides high availability by distributing traffic across healthy backend instances in different ADs without requiring manual failover scripts or keepalived. This regional, multi-AD design is a key architectural characteristic that differentiates it from a zonal load balancer.

Exam trap

1Z0-997-26 often tests whether candidates confuse the Layer 4 NLB (regional, TCP/UDP, no SSL termination) with the Layer 7 Load Balancer (flexible shapes, HTTP/HTTPS, SSL termination), so the trap is picking an L7 characteristic for an NLB question.

How to eliminate wrong answers

Option A is wrong because NLB is a managed service — OCI handles failover automatically via health checks and multi-AD endpoints; you do not install keepalived or write IP failover scripts, which is a self-managed HA pattern for compute instances. Option C is wrong because NLB operates at Layer 4 and does not terminate SSL/TLS; SSL termination is a feature of the Layer 7 OCI Load Balancer (flexible shapes), not NLB. Option D is wrong because NLB handles TCP and UDP traffic, not just HTTP/HTTPS — HTTP/HTTPS is the domain of the Layer 7 Load Balancer, while NLB is protocol-agnostic at L4.

Practice this question →

9

MCQhard

An application deployed across two OCI regions uses a DNS-based traffic management steering policy. A database failure occurs in the primary region, and the application must failover to the secondary region. What is the primary limitation of relying solely on DNS Traffic Management for disaster recovery failover?

A.DNS steering policies cannot route traffic across different geographic regions.

B.DNS records are permanently immutable once created in OCI.

C.Client-side caching and DNS TTL expiration delays can cause continued traffic routing to the failed region.

D.DNS routing requires public IP addresses to be configured on the database backends.

AnswerC

DNS resolvers and clients cache records until TTL expiry, so some traffic keeps hitting the failed region after failover. This latency, inherent to DNS-based steering, is the core limitation when DNS alone must redirect clients during a regional database failure.

Why this answer

DNS-based traffic management only influences which endpoint a client resolves to; it cannot force clients to stop using an address they have already cached. When the primary region fails, clients and recursive resolvers that cached the old record continue sending traffic to the failed region until the TTL expires and they re-query, so failover is inherently delayed and not instantaneous.

Exam trap

The trap is treating DNS traffic management as an instant failover mechanism; candidates forget that client-side and resolver caching plus TTL expiration introduce unavoidable delay, so DNS alone cannot guarantee immediate redirection to the healthy region.

How to eliminate wrong answers

Option A is wrong because OCI DNS steering policies absolutely can route traffic across geographic regions using geolocation and failover steering policies; cross-region routing is a core capability. Option B is wrong because DNS records in OCI are fully editable and versioned; they are not immutable, and you can update or delete them at any time. Option D is wrong because DNS steering operates at the name-resolution layer and does not require public IPs on database backends; the database is typically private and reached through the application tier, not directly by DNS clients.

Practice this question →

10

Multi-Selectmedium

When designing a disaster recovery plan using OCI Full Stack Disaster Recovery (FSDR), which THREE resource types can be managed and orchestrated within a DR Protection Group? (Choose three.)

Select 3 answers

A.OCI Load Balancers and Network Load Balancers

B.Oracle Database systems (Base Database and Exadata Database Service)

C.OCI Compute instances (including boot and block volumes)

D.OCI Key Management service Vault encryption keys

E.OCI Identity and Access Management (IAM) global policies

AnswersA, B, C

Load Balancers and Network Load Balancers are supported members of an FSDR Protection Group, so their configuration and traffic steering can be orchestrated during a switchover or failover. They are among the resource types the DR plan can manage.

Why this answer

OCI Full Stack Disaster Recovery (FSDR) DR Protection Groups support several OCI resource types that can be added as members and orchestrated during switchover/failover. Option A is correct because OCI Load Balancers and Network Load Balancers are supported member types that FSDR can manage as part of the DR plan. Option B is correct because Oracle Base Database and Exadata Database Service systems are supported members, allowing FSDR to orchestrate database-level DR operations.

Option C is correct because OCI Compute instances, along with their attached boot and block volumes, are supported members that FSDR can move and start in the standby region. Option D is not correct because KMS Vault encryption keys are not a manageable member type in a DR Protection Group; key replication is handled separately via KMS key replication, not FSDR orchestration. Option E is not correct because IAM global policies are account-wide and not a regional resource that can be added to or orchestrated by a DR Protection Group.

Exam trap

1Z0-997-26 often tests the misconception that any OCI resource can be added to a DR Protection Group — candidates incorrectly assume global services like IAM or KMS are orchestrated alongside regional compute, database, and load balancer resources.

Practice this question →

11

MCQhard

Your organization has deployed an enterprise workload on OCI Exadata Database Service. You are configuring Data Guard with Fast-Start Failover (FSFO). To prevent split-brain scenarios where both primary and standby databases assume primary roles simultaneously, where must the Data Guard Observer be placed?

A.Directly on the primary database compute node to ensure low-latency communication.

B.Inside an OCI Object Storage bucket as a serverless function.

C.Inside the same Oracle Grid Infrastructure clusterware home on the standby database.

D.In a separate fault domain or external location independent of both the primary and standby database nodes.

AnswerD

Placing the Observer in a separate fault domain or external location isolates it from both database nodes, so it retains quorum and can arbitrate failover even if one site fails. This directly prevents the split-brain scenario described in the stem.

Why this answer

The Data Guard Observer must run on a host that is independent of both the primary and standby database systems so it can act as an impartial third-party arbitrator during Fast-Start Failover. Placing it in a separate fault domain or external location ensures that a failure affecting either database node does not also take down the Observer, allowing it to reliably detect failures and issue the failover command without risking split-brain.

Exam trap

1Z0-997-26 often tests the misconception that placing the Observer on the primary (for low latency) or on the standby (for convenience) is acceptable, when the exam's key point is that the Observer must be independent of both databases to prevent split-brain.

How to eliminate wrong answers

Option A is wrong because running the Observer on the primary node means a primary outage also kills the Observer, defeating its purpose as an independent arbiter. Option B is wrong because OCI Object Storage serverless functions cannot host the Oracle Data Guard Observer binary, which requires a persistent Oracle client/observer process with direct network connectivity to both databases. Option C is wrong because co-locating the Observer inside the standby's Grid Infrastructure home ties its fate to the standby — if the standby fails, the Observer cannot arbitrate, and it also violates the independence requirement.

Practice this question →

12

MCQeasy

An Oracle Cloud Infrastructure (OCI) architect is designing a high-availability web tier across multiple Availability Domains (ADs) within a single region. Which component should be used to distribute incoming client traffic evenly across web server instances residing in different ADs?

A.An OCI Dynamic Routing Gateway (DRG) configured with equal-cost multi-path routing.

B.A Network Load Balancer restricted to a single Availability Domain subnet.

C.A primary Local Peering Gateway (LPG) connected to multiple VCNs.

D.An OCI Public Load Balancer configured with backend sets spanning multiple ADs.

AnswerD

A public load balancer with backend sets spanning multiple ADs distributes client traffic across web servers in different fault domains, satisfying the cross-AD high-availability requirement. Regional public load balancers are AD-aware and health-check backends per AD.

Why this answer

An OCI Public Load Balancer can be configured with backend sets that include web server instances in multiple Availability Domains within a region, distributing traffic evenly and providing high availability. It operates at Layer 7 (HTTP/HTTPS) and supports health checks to route traffic only to healthy instances. This design ensures that if one AD fails, traffic is automatically routed to instances in other ADs, meeting the high-availability requirement.

Exam trap

1Z0-997-26 often tests high-availability design, and candidates may confuse network components like DRG or LPG with load balancing; the trap is selecting a network gateway instead of a load balancer for traffic distribution.

How to eliminate wrong answers

Option A is wrong because a Dynamic Routing Gateway (DRG) is used for connectivity between a VCN and on-premises networks or other VCNs, not for distributing client traffic across web servers; equal-cost multi-path routing is a network routing concept, not load balancing. Option B is wrong because a Network Load Balancer restricted to a single AD subnet cannot distribute traffic across multiple ADs, defeating the high-availability goal. Option C is wrong because a Local Peering Gateway (LPG) connects VCNs within the same region, not for load balancing client traffic to web servers.

Practice this question →

13

MCQeasy

Which OCI service can be used to monitor the health and performance of your load balancers and backend compute instances across multiple availability domains, triggering alarms if health checks fail?

A.OCI Monitoring service with Alarm definitions

B.OCI DNS Traffic Management

C.OCI Audit service

D.OCI Vault service

AnswerA

OCI Monitoring collects load balancer and backend health metrics across availability domains, and alarm definitions evaluate those metrics to trigger notifications when health checks fail. This directly satisfies the cross-AD health monitoring and alarm requirement.

Why this answer

The OCI Monitoring service ingests metrics from load balancers, compute instances, and other resources, and lets you define alarms on those metrics that fire when thresholds (such as unhealthy backend count or health check failures) are breached. Alarms can trigger notifications via OCI Notifications and can drive autoscaling or Functions. This is the native OCI service for health and performance monitoring with alarm definitions.

Exam trap

1Z0-997-26 often tests the overlap between OCI Monitoring (metrics and alarms) and OCI DNS Traffic Management (DNS-level health checks and steering), catching candidates who pick the DNS service for general health monitoring.

How to eliminate wrong answers

Option B is wrong because OCI DNS Traffic Management handles DNS-based traffic steering and failover (e.g., steering policies, health checks at the DNS layer) but is not the general-purpose metric monitoring and alarm service for load balancers and compute. Option C is wrong because OCI Audit records API activity and control-plane events for compliance and forensics — it does not monitor runtime health metrics or trigger performance alarms. Option D is wrong because OCI Vault stores and manages encryption keys and secrets; it has no monitoring or alarm capability.

Practice this question →

14

MCQeasy

When designing high availability across multiple Availability Domains in an OCI region, how should database or application subnets be configured to ensure fault tolerance?

A.Restrict all subnets to a single Availability Domain to prevent cross-AD latency.

B.Create regional subnets so that instances can be placed across multiple Availability Domains.

C.Disable security lists on subnets to allow uninterrupted cross-AD replication traffic.

D.Attach all VNICs directly to the Dynamic Routing Gateway without using subnets.

AnswerB

Regional subnets in OCI are not bound to a single Availability Domain, so instances can be launched across all three ADs within the region. This satisfies the fault-tolerance constraint directly: an AD outage leaves instances in surviving ADs reachable, unlike AD-specific subnets, which confine placement and defeat cross-AD high availability.

Why this answer

Regional subnets in OCI are not scoped to a single availability domain, so instances launched in them can be placed in any AD within the region. This allows you to spread database and application instances across multiple ADs for fault tolerance while keeping them in the same subnet and VCN.

Exam trap

The trap is thinking subnets must be tied to a single AD for performance or simplicity; the exam expects you to know that regional subnets are the recommended way to enable multi-AD placement for high availability.

How to eliminate wrong answers

Option A is wrong because restricting subnets to a single AD concentrates all resources in one failure domain, which defeats the purpose of multi-AD high availability. Option C is wrong because disabling security lists removes network access controls and creates a security risk; security lists do not block legitimate cross-AD replication when configured correctly, and disabling them is never a recommended HA practice. Option D is wrong because VNICs must reside in a subnet; attaching them directly to a DRG is not a valid OCI configuration, and the DRG is a routing gateway, not a subnet substitute.

Practice this question →

15

MCQhard

An enterprise application uses an Oracle Exadata Database Service on Dedicated Infrastructure with Maximum Availability Architecture (MAA). A catastrophic regional disaster occurs, and you must initiate a failover to the standby region. What is the expected behavior of Active Data Guard during this process?

A.The standby database converts to the primary role, opens for read/write operations, and stops applying redo from the old primary.

B.The standby database automatically initiates a flashback database operation to sync with object storage backups before opening.

C.Active Data Guard remains in read-only mode until a manual database restore command is issued.

D.The database becomes inaccessible until Full Stack Disaster Recovery automatically reprovisions the storage cells.

AnswerA

Active Data Guard failover transitions the standby to primary, opening it read/write and halting redo apply from the former primary. This restores service in the standby region, matching the MAA disaster-recovery requirement in the stem.

Why this answer

During a Data Guard failover, the standby database transitions from the standby role to the primary role, opens for read/write operations, and stops applying redo from the former primary. This is the defining behavior of a role transition: the standby ends its redo apply process and becomes the new source of truth. Active Data Guard's read-only workload is replaced by full read/write capability once the failover completes.

Exam trap

1Z0-997-26 often tests the confusion between failover and switchover, and between Data Guard role transition and storage-level recovery—candidates may incorrectly expect flashback or storage reprovisioning to be part of the failover itself.

How to eliminate wrong answers

Option B is wrong because Data Guard failover does not automatically perform a flashback to sync with Object Storage backups; flashback is a manual or scripted reinstate step used later to convert the old primary into a standby. Option C is wrong because the standby does not remain read-only after failover—it must open read/write to serve the application. Option D is wrong because the database does not become inaccessible pending storage cell reprovisioning; Exadata storage cells are already part of the standby infrastructure and do not need to be reprovisioned for a Data Guard role transition.

Practice this question →

16

Multi-Selecteasy

Which TWO OCI networking features help achieve high availability for applications accessing external services or on-premises datacenters? (Choose two.)

Select 2 answers

A.Disabling Dynamic Routing Gateway route propagation.

B.Redundant FastConnect virtual circuits terminating on separate DRG ports or diverse provider locations.

C.Redundant IPSec VPN tunnels configured on the Dynamic Routing Gateway.

D.Single public Internet Gateway attached without backup routes.

E.Using local peering gateways for on-premises connections.

AnswersB, C

Two FastConnect virtual circuits terminating on separate DRG ports or diverse provider locations remove the single point of failure at the physical and provider layers. If one circuit or location fails, traffic fails over to the other, sustaining on-premises connectivity.

Why this answer

Option B is correct because redundant FastConnect virtual circuits that terminate on separate DRG ports or diverse provider locations eliminate single points of failure in the private dedicated connectivity between OCI and on-premises datacenters, allowing traffic to fail over and maintain high availability. Option C is correct because configuring redundant IPSec VPN tunnels on the Dynamic Routing Gateway provides multiple encrypted paths over the internet; if one tunnel or its underlying network path fails, BGP or static routing can shift traffic to the surviving tunnel, preserving connectivity to on-premises or external services. Option A is incorrect because disabling DRG route propagation removes learned routes and would break reachability rather than improve availability.

Option D is incorrect because a single Internet Gateway with no backup routes is itself a single point of failure and does not provide redundancy. Option E is incorrect because local peering gateways connect VCNs within the same region and are not used for on-premises connections, which require FastConnect, IPSec VPN, or a DRG.

Exam trap

The trap is selecting options that sound like they improve networking but actually reduce availability (e.g., disabling route propagation) or are irrelevant (local peering). Candidates may also overlook that high availability requires redundancy in paths.

Practice this question →

17

Multi-Selecthard

Which THREE operational tasks should be included in a comprehensive disaster recovery runbook when utilizing OCI Full Stack Disaster Recovery for an enterprise application? (Choose three.)

Select 3 answers

A.Executing pre-checks in the target DR region to validate resource readiness and configurations

B.Manually deleting all IAM policies in the primary region during normal operations

C.Format-all commands on primary database storage volumes prior to initiating DR

D.Verifying database role transition and redo application status on the standby database

E.Orchestrating traffic rerouting via DNS or Load Balancers to point clients to the DR region

AnswersA, D, E

Pre-checks validate that target-region compute, networking and dependencies are provisioned and correctly configured before failover begins, catching gaps that would otherwise abort the switchover. This satisfies the runbook requirement by making readiness verification an explicit, repeatable step ahead of the DR plan execution.

Why this answer

Option A is correct because OCI Full Stack Disaster Recovery (FSDR) runbooks should begin with pre-checks in the target DR region to confirm that compute, networking, storage, and configuration prerequisites are met before any switchover or failover is attempted. Option D is correct because for database-inclusive DR plans, the runbook must verify that the standby database has transitioned to the primary role and that redo/apply lag is resolved so no committed transactions are lost. Option E is correct because a complete DR runbook includes the client-facing cutover step, rerouting traffic through DNS (e.g., OCI DNS steering policies) or Load Balancer changes so users reach the DR region after the backend is promoted.

Option B is wrong because deleting IAM policies in the primary region during normal operations would break authentication and authorization and is not a DR task. Option C is wrong because formatting primary database storage volumes would destroy production data and is never part of a disaster recovery runbook.

Exam trap

The trap is including destructive or irrelevant tasks in the DR runbook, such as deleting IAM policies or formatting storage. Candidates may think these are part of cleanup but they are not appropriate for DR.

Practice this question →

18

MCQeasy

Which OCI storage service provides massively scalable, highly durable regional object storage that is ideal for storing database backups and disaster recovery artifacts?

A.OCI Object Storage

B.OCI Block Volume

C.Local NVMe Scratch Disks

D.OCI Boot Volumes

AnswerA

Object Storage delivers regional, replicated object durability across Availability Domains, satisfying the backup and disaster recovery requirement. Unlike block or file storage, its flat namespace and REST API scale to exabyte volumes, making it the designated target for database backup artefacts and cross-region DR copies.

Why this answer

OCI Object Storage is a regional, internet-scale service designed for massive scalability and eleven-nines durability, making it the standard target for database backups, disaster recovery artifacts, and long-term retention. Its regional nature means data is redundantly stored across availability domains within a region, which is exactly what DR artifacts need.

Exam trap

The trap is confusing block and object storage: candidates pick Block Volume because backups feel like disk images, but the question's keywords 'massively scalable, highly durable, regional' point specifically to Object Storage.

How to eliminate wrong answers

Option B is wrong because Block Volume is block-level storage attached to a single compute instance within one availability domain; it is not a massively scalable regional object store and is not shared across ADs. Option C is wrong because local NVMe scratch disks are ephemeral, instance-local storage that is lost on instance termination and unsuitable for durable backups. Option D is wrong because Boot Volumes are block volumes that host the OS for a compute instance; they are instance-bound and not a regional object storage service.

Practice this question →

19

MCQmedium

A financial services company runs its mission-critical application on OCI. The application uses a regional public subnet with a fleet of compute instances behind a flexible load balancer. The architect must ensure the application remains available even if an entire availability domain (AD) fails, without introducing cross-region latency for the primary traffic. What should the architect do to meet this requirement?

A.Place the compute instances in a private subnet across multiple availability domains and use a NAT gateway to provide inbound access from the internet to the load balancer.

B.Create a separate regional public subnet in each availability domain and peer them using a local VCN peering gateway so the load balancer can reach instances in all ADs.

C.Deploy the compute instances in a single availability domain and use a backup region with a standby load balancer that is activated only when the primary AD fails.

D.Deploy the compute instances in multiple availability domains within the region, attach them to the same regional public subnet, and configure the load balancer to distribute traffic across all instances.

AnswerD

A regional public subnet spans all availability domains in a region, so instances in different ADs can share the same subnet and be behind a single flexible load balancer. If one AD fails, the load balancer health checks route traffic to instances in the surviving ADs. This meets the requirement without cross-region latency because everything stays within the same region.

Why this answer

The correct design uses a regional public subnet that spans all availability domains in a region. Compute instances are placed in multiple ADs within that subnet, and a flexible load balancer distributes traffic across them. If one AD fails, health checks remove the failed instances from rotation, and the remaining ADs continue serving traffic.

This provides AD-level high availability without cross-region latency.

Exam trap

The trap here is assuming that a separate subnet per availability domain is required for multi-AD deployment, when a regional subnet already spans all ADs and simplifies the architecture.

Practice this question →

20

MCQeasy

Your company requires automated daily backups of block volumes attached to critical production compute instances in OCI. Which OCI service feature should you configure?

A.Custom Oracle Autonomous Linux scripts cron-scheduled to push to Object Storage.

B.OCI File Storage service snapshot schedules.

C.OCI Block Volume Vaults with automated cross-region replication policies.

D.OCI Volume Backup Policies attached to the block volumes.

AnswerD

Volume backup policies bind a schedule directly to the block volume, so OCI automatically creates incremental backups at the defined frequency and retention. This satisfies the daily automated backup requirement without custom scripting or manual intervention.

Why this answer

OCI Block Volume Backup Policies are the native, automated mechanism for scheduling backups of block volumes. You create a backup policy (e.g., Bronze/Silver/Gold or a custom policy) defining backup frequency and retention, then attach it to the block volume or its compartment. OCI then automatically creates volume backups on the defined schedule, which can be restored to new volumes or used for cloning.

Exam trap

1Z0-997-26 often tests whether candidates confuse Block Volume Backup Policies (the scheduler) with Block Volume Vaults (the storage/replication destination) or with File Storage snapshots, so the trap is picking a related but incorrect service.

How to eliminate wrong answers

Option A is wrong because custom cron scripts on Autonomous Linux pushing to Object Storage is a manual, self-managed approach — it is not an OCI service feature, requires custom scripting and monitoring, and does not leverage OCI's native backup/restore tooling. Option B is wrong because OCI File Storage snapshot schedules apply to file systems (NFS), not block volumes; using them for block volume backup is a category error. Option C is wrong because OCI Block Volume Vaults with cross-region replication policies provide backup storage and replication, but the automated daily backup schedule itself is defined by a Backup Policy, not by the vault — the vault is the destination, not the scheduler.

Practice this question →

21

Multi-Selecteasy

Which TWO methods are valid for protecting OCI Compute instance boot volumes against data loss or corruption? (Choose two.)

Select 2 answers

A.Attaching the boot volume to an Internet Gateway.

B.Creating manual or scheduled boot volume backups.

C.Configuring cross-region boot volume replication.

D.Storing OS files in an OCI Streaming queue.

E.Using local NVMe scratch disks for OS persistence.

AnswersB, C

Scheduled or manual boot volume backups capture point-in-time copies stored independently of the instance, so corruption or accidental deletion of the original volume does not propagate to the backup. This directly satisfies the stem's requirement to protect boot volumes against data loss, since backups can restore the volume or create a new instance.

Why this answer

Option B is correct because OCI Block Volume service supports both manual and policy-driven scheduled backups of boot volumes, which create point-in-time copies stored in Object Storage that can be used to restore or clone the boot volume after data loss or corruption. Option C is correct because cross-region boot volume replication asynchronously copies the boot volume to a volume in another OCI region, providing protection against region-level failures and enabling recovery or disaster-recovery failover. Option A is wrong because an Internet Gateway is a VCN networking component for public connectivity, not a data-protection mechanism for boot volumes.

Option D is wrong because OCI Streaming is a Kafka-compatible messaging service for streaming data, not a storage or backup target for OS boot volumes. Option E is wrong because local NVMe scratch disks are ephemeral, non-persistent instance storage that is wiped on reboot or termination, so they cannot provide OS persistence or protection.

Exam trap

The trap is mixing networking or ephemeral storage options into a data-protection question, so candidates pick plausible-sounding but functionally unrelated services.

Practice this question →

22

MCQhard

You are managing an Oracle Base Database Service instance configured with Data Guard in OCI. Due to a severe networking anomaly, the standby database falls significantly behind in applying redo. You decide to rebuild the standby database from an incremental backup taken on the primary. Which Recovery Manager (RMAN) command or process is used to synchronize the standby with the new incremental backup?

A.Execute a complete cold restore of all datafiles using FTP over port 21.

B.Reboot the OCI compute host using the OCI console 'Reset' button.

C.Apply an incremental backup from SCN on the primary database to the standby database using RMAN.

D.Run 'ALTER DATABASE CONVERT TO SNAPSHOT STANDBY' and drop all tablespaces.

AnswerC

RMAN incremental backup roll-forward synchronises a lagging standby by applying only the changed blocks from the primary's incremental backup, starting at the standby's current SCN. This avoids a full rebuild and restores Data Guard synchronisation efficiently.

Why this answer

To synchronize a standby database with a new incremental backup taken on the primary, you use RMAN to apply an incremental backup from a specific SCN on the primary to the standby. This process involves taking an incremental backup on the primary, transferring it to the standby, and then using RMAN to recover the standby using that incremental backup. This is a standard method to roll forward a standby database that has fallen behind, without performing a full restore.

Exam trap

1Z0-997-26 often tests Data Guard synchronization methods, and candidates may confuse incremental backup recovery with other operations like snapshot standby or full restore.

How to eliminate wrong answers

Option A is wrong because a complete cold restore using FTP is not a valid or efficient method for synchronizing a standby database; it would require downtime and is not how Data Guard operates. Option B is wrong because rebooting the OCI compute host does not address the redo gap and could cause further issues. Option D is wrong because converting to a snapshot standby and dropping tablespaces is not a synchronization method and would result in data loss.

The correct approach is to use RMAN to apply an incremental backup from SCN, which efficiently brings the standby up to date.

Practice this question →

23

MCQeasy

When designing high availability for stateless web servers in OCI, which combination of services provides automatic scaling and load distribution across multiple Availability Domains?

A.OCI Streaming and OCI Notifications service

B.OCI Database Backup Policies and Local Peering Gateways

C.OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer

D.OCI Vaults and OCI Key Management service

AnswerC

Instance Pools supply the identical stateless compute, Autoscaling Configurations add or remove instances against metrics, and a regional Load Balancer spreads traffic across multiple Availability Domains, satisfying the stem's automatic scaling and cross-AD distribution requirement.

Why this answer

The combination of OCI Instance Pools, Autoscaling Configurations, and a regional OCI Load Balancer provides automatic scaling and load distribution across multiple Availability Domains for stateless web servers. Instance Pools allow you to manage a group of identical instances, Autoscaling Configurations automatically adjust the number of instances based on metrics, and a regional Load Balancer distributes traffic across those instances in multiple ADs, ensuring high availability.

Exam trap

1Z0-997-26 often tests high availability architectures, and candidates may choose services that are not related to scaling or load balancing, such as streaming or vaults.

How to eliminate wrong answers

Option A is wrong because OCI Streaming and OCI Notifications are messaging and notification services, not for scaling or load balancing web servers. Option B is wrong because OCI Database Backup Policies and Local Peering Gateways are for database backups and network connectivity, not for web server scaling. Option D is wrong because OCI Vaults and OCI Key Management are for managing secrets and encryption keys, not for scaling or load distribution.

The correct combination is Instance Pools, Autoscaling, and a regional Load Balancer.

Practice this question →

24

MCQhard

Your organization has a strict Recovery Point Objective (RPO) of 5 minutes and Recovery Time Objective (RTO) of 15 minutes for a multi-tier application. The database tier uses Oracle Data Guard. During a test drill, you notice that redo transport lag spikes to 8 minutes. What is the most likely architectural bottleneck causing this issue?

A.Exceeded OCI Block Volume IOPS limits on the standby database's local NVMe scratchpad.

B.Misconfigured OCI IAM policy allowing read-only access to database backups.

C.Incorrect OCI Load Balancer SSL certificate configuration on the web tier.

D.Inadequate cross-region network bandwidth or high latency causing redo transport congestion.

AnswerD

Inadequate cross-region bandwidth or latency directly throttles Data Guard redo transport, since every archived redo log must traverse that link synchronously or asynchronously. The 8-minute transport lag exceeds the 5-minute RPO, confirming the network path—not the database—is the bottleneck. Provisioning dedicated, low-latency connectivity restores the required RPO.

Why this answer

A redo transport lag spike to 8 minutes most likely indicates a network bottleneck between the primary and standby regions. Data Guard redo transport depends on sufficient cross-region bandwidth and low latency; if bandwidth is constrained or latency is high, the standby cannot receive and apply redo fast enough, causing the lag to exceed the 5-minute RPO. This is an architectural issue, not a database or application configuration issue.

Exam trap

1Z0-997-26 often tests the tendency to blame database or storage components for redo transport lag, when the root cause in a multi-region Data Guard setup is usually network bandwidth or latency.

How to eliminate wrong answers

Option A is wrong because the standby database's local NVMe scratchpad is not used for redo transport; redo is written to standby redo logs on block volumes, and IOPS limits there would not directly cause transport lag. Option B is wrong because IAM policies for read-only backup access do not affect redo transport performance. Option C is wrong because load balancer SSL certificate configuration on the web tier is unrelated to database redo transport lag.

Practice this question →

25

MCQhard

Your organization uses OCI Full Stack Disaster Recovery to manage failovers between Region A and Region B. During a DR drill, you notice that a custom user-defined step failed because the dependent compute instance in Region B was not yet fully running. How should you resolve this dependency issue in the FSDR plan?

A.Manually SSH into each instance during the drill to run the script.

B.Increase the OCI Compute instance shape size in Region B to boot faster.

C.Edit the DR plan group and add a dependency or adjust the sequence order so that the start compute step completes before the custom script step.

D.Disable all pre-checks in the FSDR plan settings.

AnswerC

Full Stack DR plan groups support explicit dependencies and ordered steps, so adding a dependency ensures the start-compute step completes before the custom script runs. This satisfies the stem's dependency constraint by enforcing sequencing within the group rather than relying on timing.

Why this answer

OCI Full Stack Disaster Recovery (FSDR) plans are built from ordered groups of steps. When a custom user-defined step depends on a compute instance being fully running, the correct fix is to place the 'Start Compute' step in an earlier group or add an explicit dependency so the custom script executes only after the instance reaches the RUNNING state. This is the native sequencing mechanism FSDR provides.

Exam trap

The trap is treating a sequencing problem as a performance problem — candidates pick 'increase shape size' or 'disable pre-checks' instead of recognizing that FSDR plans need explicit step ordering or dependencies.

How to eliminate wrong answers

Option A is wrong because manual SSH is not part of an automated DR plan and defeats the purpose of FSDR orchestration; it is also not repeatable during a real failover. Option B is wrong because increasing the shape size does not guarantee the instance is running before the custom step — it only changes boot performance, not step ordering. Option D is wrong because disabling pre-checks removes safety validation and does not address the dependency between the compute start and the custom script.

Practice this question →

26

MCQmedium

An application running on OCI compute instances requires disaster recovery protection. You want to replicate boot volumes and block volumes to a secondary region. Which OCI Block Volume feature facilitates this?

A.OCI File Storage cross-mount replication policies

B.Manual Object Storage export of raw volume blocks using dd commands

C.Real-time synchronous block volume mirroring via software RAID

D.Asynchronous cross-region block volume replication

AnswerD

Asynchronous cross-region block volume replication copies boot and block volumes to a paired secondary region without impacting instance performance, satisfying the disaster recovery requirement. Replication is block-level and incremental, so only changed blocks transfer after the initial sync, keeping recovery point objectives tight for OCI compute workloads.

Why this answer

OCI Block Volume supports asynchronous cross-region replication, which continuously replicates block volumes (and their boot volumes) from a primary region to a secondary region for DR purposes. This is the native OCI feature designed for cross-region block volume DR. It operates at the block level and is configured per volume or volume group.

Exam trap

1Z0-997-26 often tests the misconception that OCI provides synchronous cross-region block replication — candidates confuse it with on-premises synchronous mirroring or assume File Storage replication applies to block volumes.

How to eliminate wrong answers

Option A is wrong because OCI File Storage does not provide cross-mount replication policies for block volumes — File Storage is a separate NFS service and does not replicate block volumes. Option B is wrong because manually exporting raw blocks via dd to Object Storage is not a supported or practical replication mechanism and does not provide continuous DR replication. Option C is wrong because OCI does not offer real-time synchronous block volume mirroring via software RAID across regions — cross-region replication in OCI is asynchronous, not synchronous.

Practice this question →

27

MCQhard

An architect is evaluating RTO and RPO requirements for an Oracle Exadata Database Service in OCI. The business demands an RPO of zero and an RTO of less than two minutes. Which configuration meets this requirement?

A.Active Data Guard with snapshot standby mode and automated cron-based switchovers.

B.Maximum Performance mode with asynchronous redo transport and a Data Guard Observer.

C.Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled.

D.Maximum Protection mode with asynchronous redo transport and manual failover scripts.

AnswerC

Synchronous redo transport guarantees zero data loss, delivering the required RPO of zero, while Fast-Start Failover automatically redirects the primary within seconds, meeting the sub-two-minute RTO. Maximum Availability mode permits synchronous transport without halting the primary when a standby is unavailable.

Why this answer

An RPO of zero requires synchronous redo transport so no committed transaction is lost, and an RTO under two minutes requires automated fast failover. Maximum Availability mode with synchronous redo transport and Fast-Start Failover (FSFO) enabled satisfies both: it guarantees zero data loss while the primary is available and enables automatic failover within seconds.

Exam trap

The trap is that candidates focus on the protection mode name and overlook the transport type; Maximum Performance sounds fast but uses asynchronous transport, which violates RPO zero, while Maximum Availability with SYNC and FSFO is the correct combination.

How to eliminate wrong answers

Option A is wrong because snapshot standby mode does not apply redo continuously and is used for testing, not for zero-RPO production failover; cron-based switchovers are also not fast enough for sub-two-minute RTO. Option B is wrong because Maximum Performance mode uses asynchronous redo transport, which can lose transactions and therefore cannot guarantee RPO zero. Option D is wrong because Maximum Protection mode requires synchronous transport, not asynchronous, and manual failover scripts cannot meet a sub-two-minute RTO reliably.

Practice this question →

28

MCQeasy

You are planning the backup retention strategy for critical Oracle Base Database Service instances in OCI. You want to retain weekly backups for 12 months and daily backups for 30 days. Where are these automated backups stored by default?

A.In an OCI File Storage Service (FSS) mount target.

B.In a customer-managed Block Volume attached to the database compute instance.

C.In local temporary NVMe drives on the database node.

D.In an Oracle-managed Object Storage bucket inaccessible to direct user manipulation.

AnswerD

Automated backups for Base Database Service land in an Oracle-managed Object Storage bucket that customers cannot browse or alter directly. Retention of 30 daily and 12 monthly copies is enforced by the service, satisfying the stated policy without user-managed buckets.

Why this answer

Automated backups for Oracle Base Database Service in OCI are stored in an Oracle-managed Object Storage bucket that is not directly accessible to customers. This design ensures backup integrity, security, and lifecycle management without requiring user intervention. The retention policies (weekly for 12 months, daily for 30 days) are applied to these backups automatically.

Exam trap

1Z0-997-26 often tests the default storage location for automated backups, and candidates may incorrectly assume backups are stored in customer-accessible storage like Block Volumes or FSS, when they are actually in an Oracle-managed Object Storage bucket.

How to eliminate wrong answers

Option A is wrong because OCI File Storage Service (FSS) is a shared file system, not the default storage for automated database backups. Option B is wrong because customer-managed Block Volumes are used for database data files, not for automated backups; backups are stored off-instance. Option C is wrong because local temporary NVMe drives are ephemeral and not used for persistent backup storage.

Practice this question →

29

MCQmedium

You are deploying OCI Full Stack Disaster Recovery (FSDR) to orchestrate a cross-region DR plan for a multi-tier application stack. Which component acts as the primary grouping mechanism for all application assets (databases, compute, load balancers) within a compartment?

A.Backup Policy Group

B.Disaster Recovery Protection Group (DR Protection Group)

C.OCI IAM Dynamic Group

D.Load Balancer Backend Set Group

AnswerB

The DR Protection Group is the compartment-scoped container that groups all application assets, such as databases, compute and load balancers, into one recoverable unit. FSDR plans and failover operations act on this grouping, making it the primary orchestration mechanism.

Why this answer

The Disaster Recovery Protection Group (DR Protection Group) is the primary grouping mechanism in OCI Full Stack Disaster Recovery. It logically groups all application assets—such as compute instances, databases, load balancers, and file systems—within a compartment so they can be managed and failed over together as a single unit. DR plans are then built on top of these protection groups to orchestrate cross-region failover and failback.

Exam trap

1Z0-997-26 often tests whether candidates confuse FSDR's DR Protection Group with other OCI grouping constructs like Backup Policy Groups or IAM Dynamic Groups, so the trap is picking a similarly named but functionally unrelated grouping mechanism.

How to eliminate wrong answers

Option A is wrong because Backup Policy Group is a separate OCI Backup service construct for scheduling backups, not for grouping DR assets in FSDR. Option C is wrong because OCI IAM Dynamic Group is used for granting permissions to a set of resources matching rules, not for DR orchestration. Option D is wrong because Load Balancer Backend Set Group is a load balancer construct for grouping backend servers, not a DR grouping mechanism.

Practice this question →

30

MCQmedium

You are designing a disaster recovery strategy for an Oracle Autonomous Database (Serverless) instance. You need to ensure the database can failover to a remote region with minimal RPO. Which feature should you configure?

A.OCI Block Volume cross-region replication

B.Cross-Region Autonomous Data Guard

C.Manual RMAN incremental backups copied to Object Storage in the remote region

D.Database Express Export/Import scheduled via cron

AnswerB

Cross-Region Autonomous Data Guard maintains a standby database in a remote region, continuously replicating changes to deliver minimal RPO during regional failover. This directly satisfies the stem's requirement for remote-region failover with minimal data loss, unlike backup-based approaches that incur higher RPO.

Why this answer

Cross-Region Autonomous Data Guard is the native OCI feature that creates a standby Autonomous Database in a remote region and provides automatic or manual failover with low RPO (typically seconds) and low RTO. It is purpose-built for ADB Serverless disaster recovery and requires no manual backup shipping.

Exam trap

1Z0-997-26 often tests DR feature selection for Autonomous Database, and candidates mistakenly choose storage-level replication (Block Volume) or manual RMAN, missing that ADB has a native Data Guard option.

How to eliminate wrong answers

Option A is wrong because Block Volume cross-region replication only replicates the underlying storage blocks — it does not understand Autonomous Database internals and cannot perform a database-level failover. Option C is wrong because manual RMAN incremental backups copied to Object Storage give a much higher RPO (hours) and require manual restore, not automatic failover. Option D is wrong because Data Pump export/import is a logical, slow, point-in-time operation with RPO measured in hours or days and no automated failover capability.

Practice this question →

31

MCQmedium

An architect is configuring an OCI Full Stack Disaster Recovery plan. The plan includes a step to run a custom script on an application server during a failover drill. Which OCI service executes this custom script?

A.Oracle Autonomous Linux Auto-Update Daemon

B.OCI Resource Manager Terraform apply jobs exclusively

C.OCI Functions or OCI Compute instance run-command actions orchestrated by Full Stack DR.

D.OCI Streaming Service consumer groups

AnswerC

Full Stack DR orchestrates run-command actions on Compute instances and invocations of OCI Functions, so the custom script executes on the application server without manual intervention. This satisfies the stem's requirement that the plan itself runs the script during the failover drill, rather than relying on external tooling or operator action.

Why this answer

OCI Full Stack Disaster Recovery orchestrates failover and drill plans that can include user-defined custom scripts. These scripts are executed either as OCI Functions invocations or as Compute instance run-command actions, which Full Stack DR calls as plan steps to run arbitrary logic on application servers during a drill or failover.

Exam trap

The trap is assuming any automation service (Resource Manager, Streaming, or OS daemons) can run DR scripts; the exam expects you to know that Full Stack DR specifically uses OCI Functions or Compute run-command actions for custom script steps.

How to eliminate wrong answers

Option A is wrong because the Autonomous Linux Auto-Update Daemon handles OS patching and updates, not DR plan script execution. Option B is wrong because Resource Manager runs Terraform apply jobs for infrastructure provisioning; it is not the mechanism Full Stack DR uses to run custom scripts on application servers during a failover drill. Option D is wrong because OCI Streaming is a publish-subscribe messaging service for data streams; consumer groups process stream data and have nothing to do with executing DR plan scripts.

Practice this question →

32

Multi-Selectmedium

When configuring an OCI Application Load Balancer (Layer 7) for high availability, which THREE settings or components must be properly configured? (Choose three.)

Select 3 answers

A.A direct physical connection between the load balancer and on-premises switches

B.Manual IP routing table hacks on every backend compute node

C.SSL/TLS certificates attached to HTTPS listeners if terminating secure traffic

D.Backend sets with defined health checks to monitor backend instance responsiveness

E.Listeners configured with appropriate port and protocol (e.g., HTTP or HTTPS)

AnswersC, D, E

HTTPS listeners require an attached SSL/TLS certificate to terminate encrypted client traffic; without it the listener cannot present a valid certificate chain. This satisfies the secure-termination requirement for the Layer 7 load balancer's high-availability configuration.

Why this answer

Option C is correct because an OCI Layer 7 load balancer that terminates HTTPS traffic requires an SSL/TLS certificate attached to the HTTPS listener, which enables the load balancer to decrypt incoming requests and re-encrypt or forward them to backends as configured. Option D is correct because backend sets must be defined and associated with health checks so the load balancer can monitor backend instance responsiveness and route traffic only to healthy instances, which is essential for high availability. Option E is correct because listeners must be configured with the appropriate port and protocol (for example, HTTP on port 80 or HTTPS on port 443) so the load balancer can accept and process client traffic correctly.

Option A is not required because OCI load balancers operate within the OCI VCN and do not need a direct physical connection to on-premises switches for high availability. Option B is not required because backend compute nodes do not need manual IP routing table modifications; OCI handles load balancer-to-backend routing through the VCN and backend set configuration.

Exam trap

1Z0-997-26 often tests the misconception that physical connections or manual routing are needed for load balancer high availability, but in cloud environments, these are handled by the service.

Practice this question →

33

MCQmedium

An architect is designing a multi-region disaster recovery architecture for an application running on OCI Compute. The database layer uses Oracle Data Guard. For the application tier, what is the recommended approach to handle stateless application servers in the DR region?

A.Run all application servers at full capacity in both regions simultaneously with active write locks.

B.Pre-provision compute instances in a stopped state or use instance pools with standby configuration, activating them during a disaster event.

C.Store application binaries solely in Object Storage and compile them on the fly using user-data scripts during failover.

D.Rely entirely on manual creation of compute instances via the OCI console after an outage occurs.

AnswerB

Pre-provisioning stopped instances or instance pools with standby configuration keeps the DR application tier ready without running costs, and activation during failover restores capacity quickly. This satisfies the stem's requirement for handling stateless application servers in the DR region.

Why this answer

For stateless application servers in a DR region, the recommended OCI approach is to pre-provision capacity that can be activated quickly without paying for full-time compute. Instance pools with a standby configuration (or stopped instances) let you maintain a warm standby that can be scaled up or started during a failover event, meeting RTO while controlling cost. Because the app tier is stateless, no data synchronization is needed—only the ability to bring compute online and point it at the newly promoted database.

Exam trap

1Z0-997-26 often tests the misconception that DR requires either full active-active duplication or fully manual rebuild, when the correct OCI answer is a cost-optimized warm standby using instance pools or stopped instances.

How to eliminate wrong answers

Option A is wrong because running all application servers at full capacity in both regions with active write locks is wasteful and unnecessary for stateless servers, and 'active write locks' is a database concept that does not apply to stateless app tiers. Option C is wrong because compiling application binaries on the fly from Object Storage during failover adds significant startup latency and operational risk, and is not a supported DR pattern for OCI Compute. Option D is wrong because relying on manual console creation after an outage cannot meet a tight RTO and introduces human error during a disaster.

Practice this question →

34

Multi-Selecthard

Which THREE strategies can be implemented in OCI to mitigate the impact of a regional availability outage on a multi-tier web application? (Choose three.)

Select 3 answers

A.Deploying application tiers across two OCI regions with DNS Traffic Management health checks for automated failover

B.Replicating critical block volumes and object storage data to the secondary region

C.Relying on a single Availability Domain deployment with automated daily backups

D.Configuring Oracle Data Guard between the primary database and a standby database in a secondary region

E.Running all database write operations simultaneously against both regions with synchronous multi-master locking over public internet

AnswersA, B, D

Multi-region deployment with DNS Traffic Management health checks provides automated failover: when the primary region's endpoints fail health probes, traffic is steered to the secondary region. This directly mitigates a full regional outage, which single-region fault domain or availability domain designs cannot survive.

Why this answer

Option A is correct because deploying the application tiers across two OCI regions and using OCI DNS Traffic Management with health checks enables automated failover: when health checks detect the primary region's endpoints as unhealthy, traffic is steered to the secondary region, keeping the multi-tier app reachable during a regional outage. Option B is correct because replicating critical block volumes (via block volume replication/Cross-Region Replication) and object storage data (via Object Storage replication policies or rclone/OCI CLI copy) to the secondary region ensures the data needed to run the application survives a regional failure and can be attached/accessed in the DR region. Option D is correct because Oracle Data Guard provides physical or logical standby databases in a secondary region with redo transport and role transitions (switchover/failover), which is the standard OCI approach to keep the database tier available when the primary region is lost.

Option C is not correct because a single Availability Domain deployment with daily backups offers no live failover capability and cannot mitigate a regional outage, since both the AD and the backups in the same region may be affected. Option E is not correct because synchronous multi-master writes over the public internet between regions introduce unacceptable latency and consistency/locking problems, and OCI does not support such a multi-master database topology as a viable HA/DR strategy.

Exam trap

1Z0-997-26 often tests the misconception that a single-AD deployment with backups is sufficient for regional DR — candidates underestimate the scope of a regional outage and pick the backup-only option.

Practice this question →

35

Multi-Selecteasy

Which TWO actions can you take in OCI to ensure high availability of application data stored in Block Volumes? (Choose two.)

Select 2 answers

A.Store block volume backups locally on the compute instance root partition.

B.Enable asynchronous cross-region block volume replication.

C.Configure OCI Volume Backup Policies to automate regular snapshots.

D.Manually disconnect block volumes every night via the API.

E.Disable encryption on block volumes to speed up replication.

AnswersB, C

Asynchronous cross-region replication continuously copies block volume data to a volume in a second region, so a regional outage leaves a usable replica. This directly satisfies the high-availability requirement by removing dependence on a single region's storage infrastructure.

Why this answer

Option B is correct because OCI Block Volume cross-region replication asynchronously copies volume data to a volume replica in another region, so if the primary region or availability domain fails, the replica can be activated to keep application data available. Option C is correct because OCI Volume Backup Policies automate scheduled backups (crash-consistent or application-consistent snapshots) of block volumes, enabling point-in-time recovery and protecting data against corruption or accidental deletion. Option A is wrong because storing backups on the compute instance's root partition keeps the backup on the same failure domain as the instance, providing no real high-availability benefit.

Option D is wrong because disconnecting volumes nightly via the API causes downtime and does not improve availability. Option E is wrong because disabling encryption weakens security and does not meaningfully improve replication or availability.

Exam trap

The trap is confusing backup (point-in-time recovery) with replication (continuous DR) and picking options that sound like they improve availability but actually weaken security or cause downtime.

Practice this question →

36

MCQhard

An architect is configuring Oracle Autonomous Database Disaster Recovery with cross-region Data Guard. The primary database is in Ashburn, and the standby is in Phoenix. You execute a switchover operation. What happens to the connection strings (such as tnsnames.ora entries) used by client applications?

A.The database IP addresses change, requiring manual DNS A-record updates in OCI DNS.

B.Client connection strings remain valid; applications reconnect, and the regional endpoint automatically routes traffic to the new primary.

C.You must manually regenerate new wallet zip files and redeploy them to all application servers.

D.Client applications must be rewritten to use hardcoded IP addresses instead of TNS names.

AnswerB

Autonomous Database uses regional, Data Guard-aware connection strings, so the same tnsnames entry stays valid after switchover. The endpoint resolves to whichever database currently holds the primary role in Phoenix, and applications simply reconnect without editing configuration.

Why this answer

When using Oracle Autonomous Database with cross-region Data Guard, the connection strings (such as those in tnsnames.ora) remain valid after a switchover because the regional endpoint automatically routes traffic to the new primary database. Applications reconnect without any changes to their configuration. This is a key benefit of the managed service, which abstracts the underlying infrastructure changes.

Exam trap

1Z0-997-26 often tests Autonomous Database Data Guard behavior, and candidates may incorrectly assume that connection strings or wallets need manual updates; the trap is not realizing that the regional endpoint abstracts the failover.

How to eliminate wrong answers

Option A is wrong because the database IP addresses are managed by Oracle and do not require manual DNS updates; the regional endpoint handles routing. Option C is wrong because you do not need to manually regenerate wallet zip files; the wallet remains valid as it contains the regional endpoint information, and the service manages the certificates. Option D is wrong because applications should not use hardcoded IP addresses; they use TNS names, which remain unchanged.

Practice this question →

37

MCQmedium

An enterprise application hosted on OCI requires high availability across multiple fault domains within a single availability domain. Which resource placement strategy should you use for your application compute instances?

A.Distribute instances evenly across three different Fault Domains.

B.Configure a dedicated virtual cloud network for each fault domain.

C.Attach all instances to separate Internet Gateways.

D.Place all instances in Fault Domain 1 to optimize network latency.

AnswerA

Fault domains are independent groupings of hardware within a single availability domain, each with separate power and network. Spreading instances evenly across all three fault domains ensures that failure of one domain does not take down the application, satisfying the multi-fault-domain HA requirement.

Why this answer

Within a single availability domain, fault domains are independent groupings of hardware with separate power and network. Distributing compute instances evenly across the three fault domains ensures that a hardware failure in one fault domain does not take down the entire application, which is the correct HA strategy at the AD-internal level.

Exam trap

The trap is confusing fault domains with availability domains or thinking a single fault domain is sufficient; the exam expects you to know that within one AD, spreading across the three fault domains is the correct HA placement strategy.

How to eliminate wrong answers

Option B is wrong because creating a separate VCN per fault domain adds unnecessary complexity and does not improve fault tolerance; VCNs are regional constructs and fault domains are within an AD, so this mapping is neither required nor beneficial. Option C is wrong because attaching instances to separate Internet Gateways does not provide fault tolerance and is not a valid HA pattern; an Internet Gateway is a VCN-level component, and multiple IGWs per VCN are not the mechanism for fault-domain resilience. Option D is wrong because placing all instances in Fault Domain 1 concentrates risk in a single fault domain, so a failure there would take down the whole application, directly contradicting the HA requirement.

Practice this question →

38

MCQhard

You are configuring a Data Guard association between two Oracle Base Database Systems in different OCI regions. The primary database encounters an unplanned outage, and you perform a manual failover. What action must you take afterward if you wish to restore the original architecture with the old primary as the new standby?

A.Run a simple 'SWITCHOVER' command to reverse roles without any data synchronization checks.

B.Modify the listener.ora file manually via SSH and restart the clusterware.

C.Delete the standby database and provision a brand-new VCN in the primary region.

D.Recreate or reinstate the former primary database (using Flashback Database or backup restoration) to convert it into a valid standby.

AnswerD

After failover the old primary is in an unresolved state and cannot automatically resume its standby role. Flashback Database or backup restoration reinstates it to a consistent SCN, converting it into a valid standby that satisfies the requirement to restore the original architecture.

Why this answer

After a manual failover, the old primary is no longer a valid standby because its data files and control file reflect a different point in time. To restore the original architecture, you must reinstate or recreate the former primary as a standby, typically using Flashback Database to the point of the last redo it transmitted, or by restoring from backup and re-establishing the Data Guard association. Only then can redo transport resume in the reverse direction.

Exam trap

1Z0-997-26 often tests the assumption that roles can be reversed with a simple switchover after a failover, ignoring the need to reinstate or recreate the old primary as a standby first.

How to eliminate wrong answers

Option A is wrong because a simple SWITCHOVER command cannot be run after a failover without first reinstating the old primary; switchover requires both databases to be in valid, synchronized roles. Option B is wrong because manually editing listener.ora and restarting clusterware does not address the data divergence between the old primary and the new primary. Option C is wrong because deleting the standby and provisioning a new VCN is destructive, unnecessary, and does not restore the original architecture.

Practice this question →

39

MCQmedium

You are performing maintenance on an OCI Load Balancer backend set. You want to temporarily stop sending traffic to a specific backend server without immediately dropping active persistent connections. What feature should you use?

A.Set the backend server weight to zero without enabling draining.

B.Delete the backend server from the backend set immediately.

C.Enable Connection Draining on the backend server.

D.Modify the security list to drop all TCP packets on port 443.

AnswerC

Connection draining places the backend in a draining state, so the load balancer stops routing new requests while allowing established persistent connections to complete. This satisfies the requirement to halt new traffic without abruptly dropping active sessions.

Why this answer

Connection Draining is the OCI Load Balancer feature that gracefully removes a backend from rotation while allowing in-flight persistent connections to complete. When enabled, the backend is marked as draining, existing sessions continue until they finish or the drain timeout expires, and no new connections are routed to it. This matches the requirement to stop new traffic without abruptly dropping active persistent connections.

Exam trap

The trap here is confusing weight=0 with draining — candidates assume zero weight gracefully stops traffic, but it only affects new connection distribution and can still drop persistent sessions.

How to eliminate wrong answers

Option A is wrong because setting weight to zero only affects new connection distribution and does not guarantee graceful termination of existing persistent connections; without draining, active sessions may be reset or abruptly cut. Option B is wrong because deleting the backend immediately removes it from the backend set and terminates active connections, causing client disruption. Option D is wrong because modifying security lists to drop TCP/443 traffic is a network-level block that kills all connections, including active ones, and is not a load balancer maintenance feature.

Practice this question →

Ready to test yourself?

Try a timed practice session using only High Availability And Disaster Recovery questions.

Start 20-question session