Scenario practice questions

Your organization requires the migration of 300 TB of backup archives from an on-premises data center to OCI Object Storage. The local internet connection is limited to 100 Mbps, and corporate compliance mandates that data cannot traverse the public internet unencrypted. Which solution should you select to meet these constraints?

Trap 1: Deploy an OCI Storage Gateway on-premises and cache all 300 TB…

Caching all 300 TB locally requires equivalent on-premises storage and still transfers the full volume across the constrained 100 Mbps link, so it fails the bandwidth constraint. It is tempting because Storage Gateway does provide hybrid cloud integration, but that suits ongoing tiering, not one-off bulk migration.

Trap 2: Use Oracle GoldenGate to replicate backup files block-by-block to…

GoldenGate replicates database transactions, not backup archive files, so it cannot move 300 TB of static objects into Object Storage. It is tempting because GoldenGate does perform continuous, encrypted data movement, but that applies to database migration or replication scenarios, not bulk file transfer.

Trap 3: Stream the backups continuously over a secure IPsec VPN tunnel…

A 100 Mbps link would take roughly 300 days to transfer 300 TB, so streaming over IPsec VPN cannot meet the migration window despite satisfying the encryption mandate. It is tempting because VPN tunnels do protect data in transit, but bandwidth, not encryption, is the disqualifying constraint here.

A
Order an OCI Data Transfer Appliance, load the encrypted backup data locally, and ship the appliance to the designated Oracle data center.
The 100 Mbps link makes 300 TB transfer impractical, and compliance forbids unencrypted public internet transit. An OCI Data Transfer Appliance sidesteps both constraints: data is encrypted locally, shipped physically, and never traverses the public internet.
B
Deploy an OCI Storage Gateway on-premises and cache all 300 TB locally while syncing in real-time.
Why it fails: Caching all 300 TB locally requires equivalent on-premises storage and still transfers the full volume across the constrained 100 Mbps link, so it fails the bandwidth constraint. It is tempting because Storage Gateway does provide hybrid cloud integration, but that suits ongoing tiering, not one-off bulk migration.
C
Use Oracle GoldenGate to replicate backup files block-by-block to Object Storage.
Why it fails: GoldenGate replicates database transactions, not backup archive files, so it cannot move 300 TB of static objects into Object Storage. It is tempting because GoldenGate does perform continuous, encrypted data movement, but that applies to database migration or replication scenarios, not bulk file transfer.
D
Stream the backups continuously over a secure IPsec VPN tunnel using rclone.
Why it fails: A 100 Mbps link would take roughly 300 days to transfer 300 TB, so streaming over IPsec VPN cannot meet the migration window despite satisfying the encryption mandate. It is tempting because VPN tunnels do protect data in transit, but bandwidth, not encryption, is the disqualifying constraint here.

Question 2mediummulti select

When configuring OCI Service Connector Hub to move logs from OCI Logging to OCI Object Storage, which THREE components must be defined?

Trap 1: A manual SSH tunnel between the source and target regions

Service Connector Hub communicates between OCI services over the Oracle backbone, so no SSH tunnel is provisioned or required. Configuration needs only source, target, and task definitions. A manual tunnel would be used to reach a private host outside OCI, which is not this scenario.

Trap 2: An active Kubernetes cluster in OKE to host the connector daemon

Service Connector Hub is a fully managed service; it runs no customer-hosted daemon, so an OKE cluster is irrelevant to connector configuration. The required components are a source, a target, and a task or schema. OKE would be chosen when you must run custom transformation code that the service cannot perform.

A
Target (e.g., OCI Object Storage bucket)
A target defines the destination the connector delivers to, satisfying the requirement to move logs into OCI Object Storage. Service Connector Hub needs an explicit target resource — here a bucket — so it knows where to write the collected log objects. Without a target, no delivery occurs.
B
A manual SSH tunnel between the source and target regions
Why it fails: Service Connector Hub communicates between OCI services over the Oracle backbone, so no SSH tunnel is provisioned or required. Configuration needs only source, target, and task definitions. A manual tunnel would be used to reach a private host outside OCI, which is not this scenario.
C
An active Kubernetes cluster in OKE to host the connector daemon
Why it fails: Service Connector Hub is a fully managed service; it runs no customer-hosted daemon, so an OKE cluster is irrelevant to connector configuration. The required components are a source, a target, and a task or schema. OKE would be chosen when you must run custom transformation code that the service cannot perform.
D
Source (e.g., OCI Logging service)
Service Connector Hub requires a source as one of its three mandatory components, and OCI Logging satisfies this by supplying the log data to be moved. Without a defined source, no logs enter the connector's pipeline, so the Object Storage target receives nothing. This directly meets the stem's requirement to define the origin of the transferred logs.
E
IAM policies granting the service connector permission to read from source and write to target
IAM policies authorise the service connector's principal to read from the source and write to the target. Without these grants, the connector cannot move logs from OCI Logging into the Object Storage bucket, so policies are a required component.

Question 3easymulti select

During the post-migration validation phase of an application migration to OCI, your team needs to verify security compliance and resource configuration posture. Which TWO OCI services should you use to assess security posture and detect misconfigurations? (Choose two.)

Trap 1: OCI Cost Estimator

Cost Estimator produces forward-looking spend projections for planned architectures; it inspects no live resource configuration and holds no security rules, so it cannot report compliance drift. It would be the right tool when budgeting a migration before deployment, not for post-migration posture assessment.

Trap 2: OCI Streaming Service

Streaming ingests and distributes high-volume event data for real-time processing; it evaluates no configuration baselines and applies no security controls. It would be correct when building telemetry pipelines feeding analytics, not when assessing resource posture against compliance rules.

Trap 3: OCI Resource Manager

Resource Manager provisions infrastructure as code through Terraform stacks; it reports drift against its own state, not security posture or misconfiguration findings. It is tempting because it inventories deployed resources, which would be correct when the task is automating or replicating deployments rather than assessing compliance.

A
OCI Vulnerability Scanning Service
The Vulnerability Scanning Service inspects compute instances and container images for known CVEs and insecure packages. It satisfies the security compliance verification requirement by producing findings that evidence host-level vulnerability posture after migration, complementing configuration-focused assessment.
B
OCI Cost Estimator
Why it fails: Cost Estimator produces forward-looking spend projections for planned architectures; it inspects no live resource configuration and holds no security rules, so it cannot report compliance drift. It would be the right tool when budgeting a migration before deployment, not for post-migration posture assessment.
C
OCI Streaming Service
Why it fails: Streaming ingests and distributes high-volume event data for real-time processing; it evaluates no configuration baselines and applies no security controls. It would be correct when building telemetry pipelines feeding analytics, not when assessing resource posture against compliance rules.
D
OCI Cloud Guard
Cloud Guard continuously monitors OCI resources against security zones and detector recipes, flagging misconfigured buckets, open ports and risky identities. It satisfies the misconfiguration detection requirement by surfacing posture problems and enabling automated remediation responses.
E
OCI Resource Manager
Why it fails: Resource Manager provisions infrastructure as code through Terraform stacks; it reports drift against its own state, not security posture or misconfiguration findings. It is tempting because it inventories deployed resources, which would be correct when the task is automating or replicating deployments rather than assessing compliance.

Question 4mediummulti select

An administrator needs to implement secure, administrative access to private OCI compute instances without exposing them to the public internet. Which TWO methods can be utilized?

Trap 1: Configure a public load balancer pointing directly to port 22 of…

A public load balancer exposes SSH on port 22 to the internet, directly violating the requirement. It is tempting because load balancers distribute traffic to private backends, but they are for application traffic, not private administrative access.

Trap 2: Attach ephemeral public IP addresses to every target instance and…

Ephemeral public IPs place the instances on the public internet, which the scenario forbids. It is tempting because security lists can restrict source addresses, but the instances still become publicly reachable, so this fails the isolation requirement.

Trap 3: Create an API Gateway with an unauthenticated public endpoint…

An unauthenticated API Gateway endpoint exposes the service publicly, contradicting the requirement for secure administrative access without public exposure. API Gateway is intended for publishing REST APIs to external consumers, not for private instance administration.

A
Configure a public load balancer pointing directly to port 22 of all backend private compute instances.
Why it fails: A public load balancer exposes SSH on port 22 to the internet, directly violating the requirement. It is tempting because load balancers distribute traffic to private backends, but they are for application traffic, not private administrative access.
B
Attach ephemeral public IP addresses to every target instance and restrict access using strict security lists.
Why it fails: Ephemeral public IPs place the instances on the public internet, which the scenario forbids. It is tempting because security lists can restrict source addresses, but the instances still become publicly reachable, so this fails the isolation requirement.
C
Create an API Gateway with an unauthenticated public endpoint linked to the internal compute instances.
Why it fails: An unauthenticated API Gateway endpoint exposes the service publicly, contradicting the requirement for secure administrative access without public exposure. API Gateway is intended for publishing REST APIs to external consumers, not for private instance administration.
D
Deploy an OCI Bastion service configured for the target private subnet, allowing managed, timed SSH sessions.
OCI Bastion provisions a managed jump host inside the target private subnet, so sessions reach instances over the private network without any public IP or internet gateway. Its timed, session-based SSH access with IAM-controlled permissions satisfies the administrative-access-without-public-exposure constraint directly.
E
Establish an OCI Site-to-Site VPN or FastConnect circuit from the on-premises datacenter to the VCN, enabling direct administrative access.
A Site-to-Site VPN or FastConnect circuit provides private connectivity from on-premises to the VCN, so administrators reach compute instances over the internal network rather than the public internet. This satisfies the no-public-exposure constraint by routing traffic through a dedicated IPSec tunnel or private dedicated link.

Question 5hardmultiple choice

Your organization has deployed an enterprise workload on OCI Exadata Database Service. You are configuring Data Guard with Fast-Start Failover (FSFO). To prevent split-brain scenarios where both primary and standby databases assume primary roles simultaneously, where must the Data Guard Observer be placed?

Trap 1: Directly on the primary database compute node to ensure low-latency…

Placing the Observer on the primary node means it shares fate with that node, so it cannot independently arbitrate when the primary fails or becomes isolated, defeating split-brain protection. It is tempting because co-locating the Observer gives the low-latency heartbeat connectivity that FSFO configuration normally benefits from.

Trap 2: Inside an OCI Object Storage bucket as a serverless function.

An Object Storage serverless function cannot run the persistent observer process that maintains continuous connectivity to both databases and issues failover commands. It is tempting because serverless functions genuinely suit event-driven automation tasks, and would be correct where the requirement is reacting to storage events rather than continuously arbitrating Data Guard roles.

Trap 3: Inside the same Oracle Grid Infrastructure clusterware home on the…

Placing the Observer inside the standby's clusterware home means it shares fate with the standby it monitors, so a standby-site outage removes the arbiter needed to adjudicate failover, permitting split-brain. The Observer belongs on an independent third site. It is tempting because co-locating simplifies deployment, and this would suffice only when no separate arbitration host exists.

A
Directly on the primary database compute node to ensure low-latency communication.
Why it fails: Placing the Observer on the primary node means it shares fate with that node, so it cannot independently arbitrate when the primary fails or becomes isolated, defeating split-brain protection. It is tempting because co-locating the Observer gives the low-latency heartbeat connectivity that FSFO configuration normally benefits from.
B
Inside an OCI Object Storage bucket as a serverless function.
Why it fails: An Object Storage serverless function cannot run the persistent observer process that maintains continuous connectivity to both databases and issues failover commands. It is tempting because serverless functions genuinely suit event-driven automation tasks, and would be correct where the requirement is reacting to storage events rather than continuously arbitrating Data Guard roles.
C
Inside the same Oracle Grid Infrastructure clusterware home on the standby database.
Why it fails: Placing the Observer inside the standby's clusterware home means it shares fate with the standby it monitors, so a standby-site outage removes the arbiter needed to adjudicate failover, permitting split-brain. The Observer belongs on an independent third site. It is tempting because co-locating simplifies deployment, and this would suffice only when no separate arbitration host exists.
D
In a separate fault domain or external location independent of both the primary and standby database nodes.
Placing the Observer in a separate fault domain or external location isolates it from both database nodes, so it retains quorum and can arbitrate failover even if one site fails. This directly prevents the split-brain scenario described in the stem.

Question 6easymultiple choice

An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?

Trap 1: OCI FastConnect with a dedicated 1 Gbps partner circuit.

FastConnect provides dedicated private connectivity but requires circuit provisioning lead time, and 1 Gbps still moves 80 TB in roughly a week, not the physical shipment timescale the scenario implies. It is tempting because dedicated bandwidth beats the congested internet link, and FastConnect would be correct for ongoing hybrid connectivity rather than one-off bulk migration.

Trap 2: OCI Storage Gateway deployed on an edge server compressing and…

Compression cannot overcome the 50 Mbps ceiling for already-compressed backup data, and streaming through the gateway still takes months. It is tempting because a storage gateway caches and tiers data to object storage, and it would be correct for ongoing hybrid access to frequently used files rather than a one-off 80 TB migration.

Trap 3: Parallelized multi-part uploads using the OCI CLI over public…

Multi-part uploads still traverse the same 50 Mbps internet link, so the transfer duration is unchanged; parallelism only improves throughput utilisation, not available bandwidth. It is tempting because multi-part upload is the standard method for large objects, and it would be correct where bandwidth is adequate but single-stream throughput is the bottleneck.

A
OCI Data Transfer Service using physical Data Transfer Appliances.
Data Transfer Service ships physical appliances to your site, you load the 80 TB, and Oracle uploads it to Object Storage. This bypasses the 50 Mbps internet link entirely, satisfying the bandwidth constraint that would otherwise take months.
B
OCI FastConnect with a dedicated 1 Gbps partner circuit.
Why it fails: FastConnect provides dedicated private connectivity but requires circuit provisioning lead time, and 1 Gbps still moves 80 TB in roughly a week, not the physical shipment timescale the scenario implies. It is tempting because dedicated bandwidth beats the congested internet link, and FastConnect would be correct for ongoing hybrid connectivity rather than one-off bulk migration.
C
OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.
Why it fails: Compression cannot overcome the 50 Mbps ceiling for already-compressed backup data, and streaming through the gateway still takes months. It is tempting because a storage gateway caches and tiers data to object storage, and it would be correct for ongoing hybrid access to frequently used files rather than a one-off 80 TB migration.
D
Parallelized multi-part uploads using the OCI CLI over public internet connections.
Why it fails: Multi-part uploads still traverse the same 50 Mbps internet link, so the transfer duration is unchanged; parallelism only improves throughput utilisation, not available bandwidth. It is tempting because multi-part upload is the standard method for large objects, and it would be correct where bandwidth is adequate but single-stream throughput is the bottleneck.