Knowledge + Practice

CCNA Workload Migration Questions

38 questions · Workload Migration topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

You are migrating a custom web application from an on-premises Linux server to OCI Compute. The application is packaged as a standard Docker container. Your management wants to avoid managing underlying operating systems, kernel patching, and VM scaling. Which OCI service should you select for this containerized workload migration?

A.OCI Container Instances

B.OCI Functions

C.Oracle Container Engine for Kubernetes (OKE)

D.OCI Compute Standard virtual machine instances

AnswerA

Container Instances runs containers directly without exposing or requiring you to manage the host operating system, so kernel patching and VM scaling are handled by OCI. That serverless container execution satisfies the stated constraint of avoiding OS administration for a standard Docker image.

Why this answer

OCI Container Instances is a serverless compute service that runs containers directly without requiring you to manage the underlying host OS, kernel patching, or VM scaling. It is purpose-built for running single containers or small groups of tightly coupled containers, making it the ideal fit for migrating a standard Docker container with minimal operational overhead. Unlike OKE, it abstracts away the Kubernetes control plane and worker nodes, so you don't manage any cluster infrastructure.

This directly satisfies the requirement to avoid OS management and VM scaling.

Exam trap

1Z0-997-26 often tests the distinction between serverless container services and orchestration platforms, so candidates mistakenly choose OKE because they assume Kubernetes is required for all containerized workloads, overlooking that Container Instances eliminates cluster management entirely.

How to eliminate wrong answers

Option B is wrong because OCI Functions is a Function-as-a-Service (FaaS) platform that executes event-driven code snippets, not long-running containerized web applications; it has execution time limits and does not support arbitrary Docker containers. Option C is wrong because OKE is a managed Kubernetes service that still requires you to manage worker nodes, cluster scaling, and Kubernetes objects—adding operational overhead rather than removing it. Option D is wrong because OCI Compute Standard VM instances require you to manage the guest OS, apply kernel patches, and configure autoscaling yourself, which contradicts the goal of avoiding OS and VM management.

Practice this question →

2

MCQmedium

You are planning the network cutover for a large-scale migration to OCI. The on-premises data center is connected to OCI via an OCI FastConnect circuit configured with private virtual circuits. During cutover, DNS records must be updated so that client traffic resolves to OCI load balancers. Which OCI service should you use to manage internal and external DNS authoritative resolution smoothly?

A.OCI API Gateway

B.OCI Traffic Management Steering

C.OCI Network Firewall

D.OCI DNS (Public and Private Zones)

AnswerD

Public and private zones provide authoritative DNS resolution for both internet-facing and internal names, letting you update records so clients resolve to OCI load balancers during cutover. This satisfies the stem's requirement to manage internal and external authoritative resolution smoothly.

Why this answer

OCI DNS provides both public and private authoritative zones, allowing you to manage internal and external name resolution from a single service during cutover. It integrates with the VCN resolver so private zones resolve inside OCI while public zones serve external clients, making it the right tool for updating DNS records to point at OCI load balancers.

Exam trap

1Z0-997-26 often tests the distinction between DNS hosting (OCI DNS) and DNS-based traffic steering (Traffic Management Steering), so candidates who pick the steering service for authoritative resolution lose the point.

How to eliminate wrong answers

Option A is wrong because API Gateway is an API management and traffic-routing service, not an authoritative DNS service — it cannot host or serve DNS zones. Option B is wrong because Traffic Management Steering is a policy-based routing service that directs traffic among endpoints; it depends on DNS but does not itself provide authoritative zone hosting for internal and external resolution. Option C is wrong because Network Firewall inspects and filters network traffic; it has no role in DNS record management or name resolution.

Practice this question →

3

Multi-Selecthard

You are designing a high-performance computing (HPC) workload migration to OCI. The application consists of tightly coupled MPI (Message Passing Interface) jobs that require extreme low latency and high throughput. Which THREE OCI architecture components must you deploy to satisfy these HPC requirements? (Choose three.)

Select 3 answers

A.Standard OCI Archive Storage for runtime application data files

B.OCI Shared micro-tenant burstable VM instances connected via public internet gateways

C.OCI Cluster Networks with RDMA (Remote Direct Memory Access) capable bare metal compute shapes

D.OCI Compute Placement Groups configured with cluster strategy

E.High-performance local NVMe storage attached directly to the bare metal compute instances

AnswersC, D, E

Cluster Networks with RDMA-capable bare metal shapes bypass the kernel and TCP/IP stack, delivering the microsecond latency and high bandwidth MPI jobs demand. This directly satisfies the stem's extreme low latency and high throughput requirement for tightly coupled communication.

Why this answer

Option C is correct because OCI Cluster Networks with RDMA-capable bare metal shapes (e.g., BM.HPC2.36 or GPU HPC shapes) provide the low-latency, high-bandwidth, kernel-bypass interconnect that tightly coupled MPI jobs require for collective operations like MPI_Allreduce. Option D is correct because a Compute Placement Group with the cluster strategy packs instances into the same low-latency, high-bandwidth network proximity within an availability domain, minimizing inter-node hop latency for MPI traffic. Option E is correct because directly attached high-performance local NVMe storage delivers the very high IOPS and throughput needed for HPC scratch/checkpoint data without network storage overhead.

Option A is not appropriate because Archive Storage is a cold, low-cost archival tier with retrieval latency measured in hours, unsuitable for runtime application data. Option B is not appropriate because micro-tenant burstable VMs are CPU-credit-limited, non-RDMA, and public internet gateways add latency, jitter, and security exposure that violate HPC requirements.

Exam trap

1Z0-997-26 often tests HPC architecture — candidates pick generic compute or storage options, missing that RDMA cluster networks, cluster placement groups, and local NVMe are the specific trio required for MPI performance.

Practice this question →

4

MCQhard

Your engineering team is troubleshooting an issue where migrated Linux virtual machines in OCI are experiencing severe disk I/O performance bottlenecks. The instances were migrated using raw block-level cloning from on-premises SAN storage. The volumes in OCI are provisioned as Lower Cost (Balanced) block volumes. What action should you take to resolve the performance bottleneck while maintaining data integrity?

A.Format the attached block volumes with ext3 file systems instead of ext4.

B.Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.

C.Modify the OCI block volume performance tier or increase the assigned Volume Performance Units (VPUs) per GB.

D.Attach an OCI File Storage Service (FSS) mount target as the primary root volume.

AnswerC

Lower Cost (Balanced) volumes cap IOPS and throughput, so the raw block-level clone's I/O demand exceeds the provisioned limits. Raising the performance tier or VPUs per GB lifts those caps without altering the volume's data, preserving integrity. This directly resolves the bottleneck while keeping the migrated Linux instances' existing block content intact.

Why this answer

Lower Cost (Balanced) block volumes deliver a baseline of 10 VPUs per GB, which caps IOPS and throughput well below what a migrated SAN-backed workload typically expects. OCI lets you change a volume's performance tier or increase its VPUs per GB online without detaching or reformatting, so the data and file system remain intact while I/O limits rise. This directly resolves the bottleneck while preserving data integrity.

Exam trap

1Z0-997-26 often tests whether candidates know that OCI block volume performance can be changed online without data loss — the trap is choosing a destructive option like reformatting or recreating instances when a non-disruptive tier change is the correct answer.

How to eliminate wrong answers

Option A is wrong because ext3 is an older, less capable file system than ext4 and would not improve I/O throughput — it would likely reduce performance and offers no benefit for a raw block clone. Option B is wrong because recreating VMs on dense AMD shapes with local NVMe changes the compute and storage architecture entirely, risks data loss, and local NVMe is ephemeral — it does not preserve the migrated block volume data. Option D is wrong because FSS is a shared NFS file system, not a bootable root volume, and cannot serve as the primary root device for these instances.

Practice this question →

5

Multi-Selecteasy

During the post-migration validation phase of an application migration to OCI, your team needs to verify security compliance and resource configuration posture. Which TWO OCI services should you use to assess security posture and detect misconfigurations? (Choose two.)

Select 2 answers

A.OCI Vulnerability Scanning Service

B.OCI Cost Estimator

C.OCI Streaming Service

D.OCI Cloud Guard

E.OCI Resource Manager

AnswersA, D

The Vulnerability Scanning Service inspects compute instances and container images for known CVEs and insecure packages. It satisfies the security compliance verification requirement by producing findings that evidence host-level vulnerability posture after migration, complementing configuration-focused assessment.

Why this answer

OCI Vulnerability Scanning Service (A) is correct because it scans compute instances and container images for vulnerabilities and also checks host and application configurations against CIS benchmarks, directly supporting security-compliance verification and misconfiguration detection during post-migration validation. OCI Cloud Guard (D) is correct because it continuously monitors the tenancy for risky configurations and insecure activities, using detectors and responder recipes to identify misconfigured resources and security posture problems. Together these two services provide the vulnerability and configuration-posture assessment the scenario requires.

OCI Cost Estimator (B) only estimates costs for planned resources and has no security-assessment capability. OCI Streaming Service (C) is a publish-subscribe messaging platform for real-time data ingestion, unrelated to security posture. OCI Resource Manager (E) is a Terraform-based infrastructure-as-code provisioning service, not a security or misconfiguration assessment tool.

Exam trap

1Z0-997-26 often tests the distinction between configuration-posture tools (Cloud Guard) and vulnerability-scanning tools (VSS) versus provisioning/cost tools — candidates pick Resource Manager because it sounds like a governance service, but it only deploys Terraform stacks.

Practice this question →

6

MCQmedium

You are migrating a multi-tier web application to OCI. The web tier consists of Apache HTTP servers that need to be auto-scaled based on CPU utilization. Which combination of OCI services should you configure to achieve automated horizontal scaling?

A.OCI Resource Manager and Terraform apply schedules

B.OCI Events Service and OCI Notifications triggered by Object Storage uploads

C.OCI Instance Pools and OCI Auto-Scaling Configurations

D.OCI Cloud Guard and OCI Vulnerability Scanning

AnswerC

Instance Pools supply the identical, replaceable compute instances, while Auto-Scaling Configurations apply CPU-utilisation thresholds to add or remove pool members horizontally. Together they satisfy the auto-scaling requirement for the Apache web tier without manual intervention.

Why this answer

OCI Instance Pools let you manage a group of identical compute instances as a single entity, and Auto-Scaling Configurations define scaling policies (e.g., CPU utilization thresholds) that automatically adjust the pool size. Together they provide horizontal auto-scaling for the web tier based on CPU metrics. This is the native OCI solution for automated horizontal scaling.

Exam trap

1Z0-997-26 often tests the confusion between infrastructure automation tools (Resource Manager, Events) and actual auto-scaling services — candidates pick event-driven or IaC tools when the question asks for metric-based horizontal scaling.

How to eliminate wrong answers

Option A is wrong because Resource Manager and Terraform apply schedules are infrastructure-as-code deployment tools — they can run scheduled applies but do not provide dynamic, metric-driven auto-scaling. Option B is wrong because Events Service and Notifications triggered by Object Storage uploads are event-driven automation for storage events, not compute scaling based on CPU utilization. Option D is wrong because Cloud Guard and Vulnerability Scanning are security posture management and vulnerability assessment services — they do not scale compute resources.

Practice this question →

7

MCQhard

Your company is migrating a large PostgreSQL database from AWS RDS to OCI Database with PostgreSQL. The database is 4 TB in size, and write operations continue 24/7. To ensure zero data loss and minimal downtime during cutover, which migration strategy should you employ?

A.Establish AWS Direct Connect to OCI FastConnect and mount an AWS EBS volume directly to an OCI VM running PostgreSQL.

B.Take an AWS RDS snapshot, download the snapshot files via AWS CLI, and restore them onto an OCI Compute instance running PostgreSQL.

C.Stop the application writes, take a pg_dump file, transfer it via SCP, and restore it into OCI during a scheduled 12-hour outage window.

D.Configure PostgreSQL logical replication (or use OCI GoldenGate / DMS equivalents) to stream ongoing transaction logs after performing an initial consistent dump and restore.

AnswerD

Logical replication streams ongoing changes after an initial consistent dump and restore, keeping the target synchronised while the source stays live. This achieves near-zero data loss and minimal cutover downtime, unlike physical backup or export/import approaches.

Why this answer

Logical replication (or OCI GoldenGate/DMS) performs an initial consistent dump and restore, then continuously streams transaction logs from the source to the target, keeping the OCI database in sync with near-zero data loss. At cutover, you stop writes briefly, apply remaining changes, and redirect the application — achieving zero data loss and minimal downtime. This is the standard approach for large, continuously written databases.

Exam trap

1Z0-997-26 often tests the assumption that snapshot or dump-and-restore is sufficient for zero data loss — candidates must recognize that continuous replication (logical replication/GoldenGate) is required when writes continue 24/7.

How to eliminate wrong answers

Option A is wrong because mounting an AWS EBS volume directly to an OCI VM is not technically feasible — EBS volumes are tied to AWS EC2 and cannot be attached across clouds, and Direct Connect/FastConnect only provide network connectivity, not block storage sharing. Option B is wrong because a snapshot-based migration captures a point-in-time copy; any writes after the snapshot are lost, violating zero data loss, and restoring 4 TB takes hours, exceeding minimal downtime. Option C is wrong because stopping writes for a 12-hour outage window directly contradicts the minimal downtime requirement and risks data loss if writes cannot be cleanly stopped.

Practice this question →

8

MCQmedium

You are migrating an Oracle Database 19c on-premises to OCI Exadata Database Service on Dedicated Infrastructure using Oracle Zero Downtime Migration (ZDM) in offline mode. The target database is already provisioned. Which ZDM migration phase configures the target database and initiates the data transfer via Oracle Data Pump?

A.DEPLOY

B.MIGRATE

C.POST-MIGRATE

D.PRE-MIGRATE

AnswerB

MIGRATE is the phase that configures the target database and starts the Oracle Data Pump transfer. In offline mode, ZDM runs the migration job after validation, applying target configuration and moving data directly, satisfying the requirement to initiate transfer without requiring the source to remain online continuously.

Why this answer

In ZDM's workflow, the MIGRATE phase is where the target database is configured and data transfer is initiated via Oracle Data Pump. It follows PRE-MIGRATE (validation and setup) and precedes POST-MIGRATE (cleanup and validation), making it the phase that actually moves the data.

Exam trap

1Z0-997-26 often tests the ZDM phase sequence, so candidates who confuse PRE-MIGRATE (preparation) with MIGRATE (actual data transfer) pick the wrong phase.

How to eliminate wrong answers

Option A is wrong because DEPLOY is not a ZDM migration phase in the standard workflow; ZDM phases are PRE-MIGRATE, MIGRATE, and POST-MIGRATE. Option C is wrong because POST-MIGRATE handles post-transfer validation, cleanup, and switching over, not the data transfer itself. Option D is wrong because PRE-MIGRATE performs prerequisite checks, creates the target database if needed, and prepares the environment, but does not initiate the Data Pump transfer.

Practice this question →

9

Multi-Selecthard

An enterprise is executing a large-scale database migration to OCI using Oracle Data Pump. To ensure optimal performance and minimize the duration of the data load phase, which THREE best practices should the database administrator implement? (Choose three.)

Select 3 answers

A.Disable secondary indexes, foreign key constraints, and database triggers on target tables before import, and rebuild them afterward.

B.Use high-performance OCI Block Volume performance tiers (such as Higher Performance) or temporary NVMe scratch space for the database staging directories.

C.Configure the PARALLEL parameter in Data Pump to utilize multiple worker processes simultaneously.

D.Route all Data Pump network links strictly through the public internet without compression to maximize packet inspection.

E.Set the database compatibility parameter to a legacy version from 10g to disable modern optimizer features.

AnswersA, B, C

Dropping secondary indexes, foreign key constraints and triggers removes the per-row maintenance overhead Data Pump would otherwise incur during direct-path inserts, so the load phase completes faster; these objects are recreated once the import finishes, satisfying the requirement to minimise load duration.

Why this answer

Option A is correct because disabling secondary indexes, foreign key constraints, and triggers on the target tables before import eliminates the overhead of maintaining those objects row-by-row during the load, and rebuilding/re-enabling them afterward is far faster than incremental maintenance during a bulk insert. Option B is correct because Data Pump performance is heavily I/O-bound, so placing the database staging directories (DATA_PUMP_DIR and the datafile destinations) on high-performance OCI Block Volume tiers such as Higher Performance, or on temporary NVMe scratch space, increases throughput and reduces the data load window. Option C is correct because setting the Data Pump PARALLEL parameter spawns multiple worker processes that read and write in parallel, which is the primary mechanism for scaling a large import and shortening the load phase.

Option D does not belong because routing Data Pump links over the public internet without compression adds latency and exposes traffic unnecessarily; private endpoints or FastConnect with compression are preferred. Option E does not belong because setting COMPATIBLE to a legacy 10g value disables modern optimizer and feature capabilities and does not improve Data Pump load performance.

Exam trap

1Z0-997-26 often tests the misconception that Data Pump tuning is purely a database-side parameter exercise, luring candidates away from the equally important storage-tier and object-maintenance levers that actually determine load duration.

Practice this question →

10

MCQhard

Your organization is performing a zero-downtime database migration from an Oracle Database on-premises to OCI Exadata Database Service using Oracle Zero Downtime Migration (ZDM). During the migration job execution, the workflow pauses during the dataguard broker configuration step. Reviewing the ZDM logs, you find a network timeout error communicating between the ZDM service host and the OCI database listener. What is the most likely cause?

A.OCI Object Storage bucket policies prevent ZDM from reading temporary backup files.

B.OCI VCN Security Lists or Network Security Groups block incoming TCP port 1521 or SSH port 22 from the ZDM client subnet.

C.The Exadata database service requires Autonomous Database credentials to establish connection.

D.OCI IAM quotas restrict the creation of more than 10 Data Guard associations per tenancy.

AnswerB

ZDM reaches the OCI database listener on TCP 1521 and the host over SSH on port 22. If VCN security lists or NSGs omit inbound rules from the ZDM client subnet, the dataguard broker step times out, matching the logged network timeout.

Why this answer

The ZDM workflow pauses at Data Guard broker configuration because the ZDM service host cannot reach the OCI database listener. This is almost always caused by network security rules (Security Lists or NSGs) blocking inbound TCP 1521 (database listener) or SSH port 22 from the ZDM client subnet to the Exadata Database Service.

Exam trap

1Z0-997-26 often tests the tendency to blame storage or IAM for migration failures, so candidates overlook that a network timeout during Data Guard configuration points to blocked ports 1521/22 rather than Object Storage or quota issues.

How to eliminate wrong answers

Option A is wrong because Object Storage bucket policy issues would cause failures in backup or file transfer steps, not a network timeout during Data Guard broker configuration. Option C is wrong because Exadata Database Service does not require Autonomous Database credentials — it uses standard Oracle Database credentials and wallet-based connectivity. Option D is wrong because IAM quotas on Data Guard associations would produce an authorization or limit error, not a network timeout between the ZDM host and the database listener.

Practice this question →

11

Multi-Selectmedium

Your organization is planning a phased workload migration to OCI. To minimize risk, you decide to use a canary deployment and traffic splitting strategy for web applications. Which TWO OCI services or features can assist in routing fractional traffic percentages between on-premises and OCI environments during migration? (Choose two.)

Select 2 answers

A.OCI Vault master encryption keys

B.OCI Load Balancer backend set weight configurations

C.OCI IAM dynamic groups

D.OCI Block Volume backup policies

E.OCI Traffic Management Steering (Weighted or Load Limiting traffic steering policies)

AnswersB, E

OCI Load Balancer backend set weights let you distribute a fixed percentage of requests across backends, so you can send a small fraction to OCI while the remainder stays on-premises. This satisfies the canary requirement for fractional traffic splitting during phased migration, with weights adjusted as confidence grows.

Why this answer

Option B is correct because an OCI Load Balancer backend set can contain multiple backends (for example, an on-premises web server and an OCI web server) and each backend is assigned a weight; the load balancer distributes incoming requests proportionally to those weights, so setting weights like 90/10 or 95/5 lets you route fractional traffic percentages between on-premises and OCI during a canary migration. Option E is correct because OCI Traffic Management Steering supports Weighted traffic steering policies, which answer DNS queries with different answers according to assigned weights, and Load Limiting policies, which can direct a controlled fraction of users to a target; both enable fractional traffic splitting across on-premises and OCI endpoints. Option A is not relevant because OCI Vault master encryption keys provide key management and encryption for data at rest, not traffic routing.

Option C is not relevant because IAM dynamic groups grant permissions to compute instances based on matching rules, which is authorization, not traffic distribution. Option D is not relevant because Block Volume backup policies define scheduled backups of block volumes, which has nothing to do with routing fractional web traffic.

Practice this question →

12

Multi-Selecthard

You are tasked with migrating a large enterprise database to OCI Exadata Database Service. To ensure minimal downtime and high reliability during cutover, which TWO Oracle migration tools or features are specifically designed for this purpose? (Choose two.)

Select 2 answers

A.Windows Robocopy utility

B.OCI File Storage CLI upload utility

C.Oracle Zero Downtime Migration (ZDM)

D.OCI Streaming Service Kafka producer APIs

E.Oracle Data Guard

AnswersC, E

Oracle Zero Downtime Migration automates the migration of on-premises or cloud databases to OCI Exadata Database Service, using Data Guard-based physical migration with automated cutover and rollback. This directly satisfies the stem's requirement for minimal downtime and high reliability during cutover.

Why this answer

Oracle Zero Downtime Migration (ZDM) (C) is purpose-built for migrating Oracle databases to OCI with near-zero downtime, using Oracle Data Guard or logical/physical methods and automated orchestration to keep the source online until cutover. Oracle Data Guard (E) is the core Oracle high-availability and disaster-recovery feature that maintains a synchronized standby database, enabling a fast switchover with minimal downtime during the cutover to Exadata Database Service. The other options do not fit: Robocopy (A) is a Windows file-copy utility with no database awareness, the OCI File Storage CLI (B) only uploads files to a file system, and OCI Streaming Kafka APIs (D) are for event-streaming ingestion, none of which provide Oracle database migration or cutover reliability.

Exam trap

1Z0-997-26 often tests the distinction between generic file-transfer tools and Oracle-native migration tools — candidates may pick Robocopy or File Storage CLI thinking 'copy the files' is sufficient, but database migration requires transaction-aware replication and cutover orchestration that only ZDM and Data Guard provide.

Practice this question →

13

MCQhard

You are migrating a 50 TB Oracle Database from an on-premises Sun Solaris SPARC server to OCI Exadata Database Service on X9M hardware (Linux x86-64 architecture). Because the source and target platforms have different endianness and operating system architectures, standard RMAN backup restoration is not possible. Which migration strategy should you implement?

A.Perform a cold OS-level tar/gzip copy of the Oracle home and data directories from Solaris to Linux.

B.Use OCI Zero Downtime Migration (ZDM) physical offline migration mode without endian conversion parameters.

C.Take an RMAN incremental backup on Solaris SPARC, copy the backup pieces to OCI Object Storage, and restore them directly onto the Exadata target.

D.Use Transportable Tablespaces with RMAN `CONVERT DATAFILE` or Oracle Data Pump to transfer and convert data between different endian architectures.

AnswerD

Transportable Tablespaces with RMAN CONVERT DATAFILE or Data Pump performs byte-order conversion between big-endian SPARC and little-endian x86-64, which plain RMAN restore cannot do. This directly satisfies the stem's endianness and cross-platform constraint for the 50 TB migration.

Why this answer

Transportable Tablespaces (TTS) with RMAN CONVERT DATAFILE or Data Pump is the standard Oracle-supported method for cross-platform, cross-endian migration because it performs the required byte-order conversion of datafiles during transport. It moves only the tablespace data plus metadata rather than the entire database, and it is explicitly designed for heterogeneous source/target platforms such as Solaris SPARC (big-endian) to Linux x86-64 (little-endian).

Exam trap

The trap here is assuming any RMAN backup is portable — candidates pick the incremental backup/restore option because RMAN is Oracle's flagship backup tool, forgetting that RMAN restores are platform- and endianness-bound unless an explicit CONVERT step is used.

How to eliminate wrong answers

Option A is wrong because a cold OS-level tar/gzip copy of Oracle home and datafiles cannot work across different operating systems and endianness — the binaries are platform-specific and the datafile byte order would be unreadable on Linux x86-64. Option B is wrong because ZDM physical offline migration still relies on RMAN backup/restore mechanics and requires endian conversion to be handled; running it without conversion parameters on a cross-endian pair will fail. Option C is wrong because RMAN backup pieces taken on Solaris SPARC cannot be restored directly onto a Linux x86-64 Exadata target — RMAN restore requires matching platform/endianness unless a CONVERT step is performed.

Practice this question →

14

MCQeasy

Your organization is designing a disaster recovery strategy as part of a workload migration project to OCI. The business requirement states that in the event of a regional outage in OCI region A, workloads must fail over to OCI region B with a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of less than 15 minutes. Which OCI networking feature should you deploy to interconnect the two regions for database replication?

A.OCI Local Peering Gateway (LPG)

B.OCI Dynamic Routing Gateway (DRG) with Remote Peering Connection (RPC)

C.OCI Service Gateway

D.OCI Internet Gateway with IPsec VPN tunnels over the public internet

AnswerB

A DRG with a Remote Peering Connection links two VCNs across regions over Oracle's private backbone, providing the low-latency, high-bandwidth path needed for synchronous database replication. This satisfies the zero-RPO and sub-15-minute RTO targets, which internet-based connectivity cannot reliably meet.

Why this answer

A DRG attached to VCNs in both regions, connected via a Remote Peering Connection (RPC), provides private, low-latency, high-bandwidth interconnect between OCI regions over Oracle's backbone. This is the standard OCI mechanism for cross-region database replication (e.g., Data Guard, GoldenGate) needed to achieve RPO=0 and RTO<15 minutes. RPC traffic stays on Oracle's private network, avoiding public internet variability that would jeopardize the aggressive RTO.

Exam trap

1Z0-997-26 often tests the assumption that any private connectivity option works for cross-region DR — candidates pick LPG (same-region only) or IPsec VPN (public internet) without recognizing that only DRG+RPC provides private, backbone-grade cross-region interconnect.

How to eliminate wrong answers

Option A is wrong because an LPG only connects two VCNs within the same region — it cannot span regions and therefore cannot support cross-region DR replication. Option C is wrong because a Service Gateway provides private access to OCI public services (Object Storage, etc.) from within a VCN; it does not interconnect VCNs or regions. Option D is wrong because an Internet Gateway with IPsec VPN over the public internet introduces variable latency, jitter, and bandwidth limits that cannot reliably meet RPO=0/RTO<15min, and it exposes replication traffic to the public internet rather than Oracle's private backbone.

Practice this question →

15

MCQhard

You are leading a multi-cloud migration project where 200 virtual machines from an on-premises data center are being assessed for migration to OCI. You have deployed the OCI Migration discovery agent, but some Linux VMs are failing inventory collection due to SSH authentication failures and lack of root privileges. How should you resolve this issue without compromising security?

A.Grant root access directly to the default 'opc' user across all on-premises enterprise Linux servers via group policy objects.

B.Disable password authentication globally on all target VMs and configure the OCI Migration appliance with the root password in plain text.

C.Create a dedicated migration user account on each Linux VM, grant passwordless sudo access for the specific discovery commands, and distribute the OCI Migration SSH key pair to that user.

D.Switch the OCI Migration discovery mechanism from agent-based SSH to agentless SNMPv1 polling across the internal firewall.

AnswerC

Passwordless sudo scoped to the specific discovery commands satisfies the root-privilege constraint without granting full root or embedding credentials, while the dedicated account and OCI Migration SSH key pair resolve the SSH authentication failures securely.

Why this answer

The OCI Migration discovery agent needs SSH access to Linux VMs to inventory packages, services, and configurations. The secure best practice is to create a dedicated, least-privilege migration user, grant passwordless sudo only for the specific discovery commands (via a sudoers entry), and deploy the OCI Migration SSH key pair to that user. This avoids sharing root credentials, avoids plaintext passwords, and limits the blast radius if the key is compromised.

Exam trap

1Z0-997-26 often tests the temptation to choose the 'quick fix' of granting root or embedding plaintext passwords, when the correct answer is always a least-privilege dedicated account with scoped sudo and key-based SSH.

How to eliminate wrong answers

Option A is wrong because granting root access to the default 'opc' user across all servers violates least privilege and dramatically expands the attack surface — it is not a security-preserving solution. Option B is wrong because disabling password authentication globally and then embedding the root password in plain text on the appliance is both insecure and contradictory (plaintext secrets defeat the purpose of disabling passwords). Option D is wrong because SNMPv1 polling is agentless, unencrypted, and does not provide the deep inventory data the OCI Migration agent collects; it also requires opening firewall ports and is not the supported discovery mechanism for this scenario.

Practice this question →

16

MCQmedium

You are planning the final cutover for a critical production database migrating from an on-premises Oracle Real Application Clusters (RAC) database to OCI Base Database Service using Oracle Data Guard for replication. To minimize application downtime during the cutover window, which sequence of steps must be executed?

A.Stop source application, shut down source database immediately, open standby database in read-write mode, and update DNS.

B.Delete the source database home, re-run ZDM pre-migration checks, and deploy a fresh Autonomous Database instance.

C.Take an offline Data Pump export on premises, ship the dump via FastConnect, import it into OCI, and keep the source running indefinitely.

D.Ensure zero data lag on the Data Guard standby, perform a switchover/failover to promote the OCI standby database to primary, and update application connection strings to point to the new OCI primary listener.

AnswerD

Zero data lag on the standby guarantees no committed transaction is lost before promotion, satisfying the minimal-downtime constraint. A Data Guard switchover cleanly reverses primary and standby roles with no data divergence, then repointing connection strings to the OCI primary listener completes cutover. Skipping the lag check risks data loss during failover.

Why this answer

The correct cutover sequence for a Data Guard-based migration is to first confirm the standby has zero (or near-zero) data lag, then promote the OCI standby to primary via switchover (preferred) or failover, and finally repoint the application connection strings to the new OCI primary listener. This minimizes downtime because the standby is already synchronized and only the connection endpoint needs to change.

Exam trap

1Z0-997-26 often tests the distinction between switchover (planned, zero data loss) and failover (unplanned, possible data loss), and candidates incorrectly pick options that skip lag verification or confuse Data Guard with Data Pump-based migration.

How to eliminate wrong answers

Option A is wrong because shutting down the source database immediately without confirming zero lag or performing a controlled role transition risks data loss and an inconsistent standby that cannot be opened read-write cleanly. Option B is wrong because deleting the source database home and deploying a fresh Autonomous Database is unrelated to a Data Guard cutover and would destroy the source before migration completes. Option C is wrong because an offline Data Pump export/import is a completely different migration method that causes extended downtime and does not leverage the existing Data Guard replication already in place.

Practice this question →

17

MCQeasy

An administrator needs to transfer 80 TB of unstructured file backup data from an on-premises Network Attached Storage (NAS) device to OCI Object Storage. The available internet bandwidth is only 50 Mbps, which would take months to upload. Which OCI service should be utilized to complete this physical migration efficiently?

A.OCI Data Transfer Service using physical Data Transfer Appliances.

B.OCI FastConnect with a dedicated 1 Gbps partner circuit.

C.OCI Storage Gateway deployed on an edge server compressing and streaming over the 50 Mbps line.

D.Parallelized multi-part uploads using the OCI CLI over public internet connections.

AnswerA

Data Transfer Service ships physical appliances to your site, you load the 80 TB, and Oracle uploads it to Object Storage. This bypasses the 50 Mbps internet link entirely, satisfying the bandwidth constraint that would otherwise take months.

Why this answer

OCI Data Transfer Service using physical Data Transfer Appliances is designed for exactly this scenario: moving very large datasets (tens to hundreds of TB) when internet bandwidth is insufficient. You copy data to an encrypted appliance, ship it to Oracle, and Oracle uploads it to Object Storage, bypassing the 50 Mbps bottleneck entirely.

Exam trap

1Z0-997-26 often tests the threshold where physical transfer beats network transfer, so candidates who pick FastConnect or Storage Gateway underestimate how long 80 TB takes over a 50 Mbps link.

How to eliminate wrong answers

Option B is wrong because provisioning a 1 Gbps FastConnect circuit still requires time to install and may not be feasible for a one-time 80 TB transfer, and it does not address the physical migration requirement efficiently. Option C is wrong because OCI Storage Gateway compresses and streams data over the existing 50 Mbps line, which would still take months and defeats the purpose of an efficient physical migration. Option D is wrong because parallelized multipart uploads over the public internet are still constrained by the 50 Mbps uplink, so they cannot overcome the bandwidth limitation.

Practice this question →

18

Multi-Selecthard

You are tasked with migrating a mission-critical three-tier enterprise application from an on-premises environment to OCI. The database tier uses Oracle RAC, and the application tier consists of stateless Java applications running on JBoss. Which TWO strategies or tools should be incorporated into the migration plan to ensure high availability and minimal downtime during cutover? (Choose two.)

Select 2 answers

A.Utilize Oracle Zero Downtime Migration (ZDM) to automate the database migration from on-premises RAC to OCI Exadata Database Service.

B.Rely exclusively on manual Oracle SQL*Plus scripts to perform a cold backup and restore across all tiers simultaneously.

C.Configure an OCI Load Balancer in front of the stateless application tier instances deployed across multiple fault domains to allow seamless traffic redirection during cutover.

D.Migrate the application tier using physical block-level cloning of the running JBoss server memory states.

E.Convert the database architecture immediately to MySQL HeatWave during the cutover window without schema validation.

AnswersA, C

ZDM automates the physical migration of Oracle RAC databases to OCI Exadata Database Service, using Data Guard and zero-downtime cutover workflows. This directly satisfies the stem's minimal-downtime constraint for the RAC database tier, avoiding manual rebuilds or export/import.

Why this answer

Option A is correct because Oracle Zero Downtime Migration (ZDM) is purpose-built to automate and orchestrate migrations of Oracle databases—including RAC sources—to OCI Database services such as Exadata Database Service, using techniques like Data Guard and GoldenGate to minimize downtime during cutover. Option C is correct because placing an OCI Load Balancer in front of stateless JBoss application instances spread across multiple fault domains enables seamless traffic redirection and rolling cutover, so users experience minimal disruption while instances are switched over. Options B, D, and E are not appropriate: manual SQL*Plus cold backup/restore across all tiers would cause significant downtime and lacks automation; physical block-level cloning of running JBoss memory states is not a supported or reliable migration method for stateless Java applications; and converting to MySQL HeatWave during cutover without schema validation is risky, unsupported for an Oracle RAC-based mission-critical system, and would introduce unacceptable downtime and data integrity issues.

Exam trap

1Z0-997-26 often tests the misconception that manual backup/restore or memory cloning can achieve minimal downtime, when the correct tools are ZDM for the database and a Load Balancer across fault domains for the app tier.

Practice this question →

19

Multi-Selectmedium

Your organization is preparing to migrate several large Oracle databases to OCI using Oracle Data Pump. Which THREE best practices should you follow to optimize the export and import performance over network connections? (Choose three.)

Select 3 answers

A.Use the `PARALLEL` parameter during both export and import operations to utilize multiple worker processes.

B.Execute all Data Pump jobs from a local laptop connected via public Wi-Fi without compression.

C.Enable data compression using the `COMPRESS` parameter to minimize network transfer times.

D.Disable database undo tablespaces entirely during the Data Pump import phase.

E.Use network-linked Data Pump (`NETWORK_LINK`) to stream data directly from source to target database without generating intermediate dump files on disk.

AnswersA, C, E

The PARALLEL parameter starts multiple worker processes that read and write Data Pump files concurrently, so export and import throughput scales with available CPU and I/O rather than running single-threaded. This directly addresses the performance-optimisation constraint for large database migrations over network connections.

Why this answer

Option A is correct because the PARALLEL parameter in Oracle Data Pump starts multiple worker processes for both export (expdp) and import (impdp), allowing the job to read and write multiple data files concurrently and thereby maximizing throughput over the network. Option C is correct because the COMPRESS parameter (e.g., COMPRESS=DATA_ONLY or ALL) reduces the size of the dump file set, which directly lowers the volume of bytes transferred across the network and shortens transfer time, especially for large Oracle databases. Option E is correct because NETWORK_LINK lets Data Pump read directly from the source database over a database link and write into the target database, eliminating the intermediate dump file on disk and the associated file transfer step, which is ideal for network-based migrations.

Option B is not appropriate because running Data Pump jobs from a laptop on public Wi-Fi is unreliable and insecure, and omitting compression increases transfer volume. Option D is not appropriate because undo tablespaces are required for read consistency and transaction rollback during import; disabling them would break the import and is not a supported performance practice.

Exam trap

1Z0-997-26 often tests Data Pump tuning — candidates forget NETWORK_LINK and pick only PARALLEL and COMPRESS, or they choose invalid options like disabling undo, which is never a performance best practice.

Practice this question →

20

MCQeasy

Your company is migrating static web assets and user-uploaded media files from an on-premises web server to OCI. The web application requires high durability, low latency, and global content delivery. Which OCI service should you use to store and serve these assets?

A.OCI Archive Storage

B.OCI File Storage Service

C.OCI Block Volume service

D.OCI Object Storage (Standard Tier)

AnswerD

Object Storage Standard Tier provides eleven-nines durability and serves assets directly, while OCI's CDN integration delivers low-latency global caching. This satisfies the stem's durability, latency and global delivery constraints without managing block volumes or file systems.

Why this answer

OCI Object Storage Standard Tier is designed for frequently accessed data and provides high durability (11 nines), low latency, and native integration with OCI CDN for global content delivery. It is the canonical service for serving static web assets and user-uploaded media because it supports HTTP/HTTPS access via pre-authenticated requests or public buckets. Archive Storage is for rarely accessed data with retrieval delays, File Storage is a shared NFS filesystem not optimized for web serving, and Block Volume is raw block storage attached to a single compute instance.

Exam trap

1Z0-997-26 often tests the distinction between storage services by pairing 'durability + low latency + global delivery' — candidates wrongly pick File Storage or Block Volume because they think of 'files' rather than HTTP-served objects.

How to eliminate wrong answers

Option A is wrong because Archive Storage is for long-term cold data with retrieval times measured in minutes to hours and is not suitable for low-latency web serving. Option B is wrong because OCI File Storage Service is an NFS-based shared filesystem designed for lift-and-shift enterprise apps, not for globally distributed HTTP content delivery. Option C is wrong because Block Volumes are raw block devices attached to a single compute instance and cannot natively serve HTTP content or scale globally.

Practice this question →

21

MCQhard

An architect is designing a database migration from an on-premises Oracle Database (Non-CDB structure) to an OCI Autonomous Database (Serverless). Which migration method is mandatory because of the architectural constraints of Autonomous Database?

A.Logical migration using Oracle Data Pump or Oracle Zero Downtime Migration (logical workflow)

B.Direct block-level storage snapshot replication using OCI Block Volume replication

C.RMAN transportable tablespaces with physical file conversion

D.Physical standby database via Oracle Data Guard broker

AnswerA

Autonomous Database Serverless does not permit direct OS-level or physical access, ruling out transportable tablespaces and physical replication. Only logical migration via Oracle Data Pump or Zero Downtime Migration's logical workflow can move a non-CDB into the serverless architecture.

Why this answer

Autonomous Database (Serverless) is a fully managed, sealed platform that does not expose the OS, filesystem, or SYSDBA-level access needed for physical migration techniques, so migration must be logical. Oracle Data Pump (expdp/impdp) or ZDM's logical workflow moves schemas and data over a database link or dump files, which is the only supported path into Autonomous Database.

Exam trap

The trap is assuming any Oracle migration tool works with Autonomous Database — candidates pick RMAN TTS or Data Guard because they are standard Oracle migration methods, forgetting that Autonomous Database's sealed architecture forbids physical access entirely.

How to eliminate wrong answers

Option B is wrong because OCI Block Volume replication operates at the storage layer and cannot place datafiles into an Autonomous Database, which does not expose its underlying storage. Option C is wrong because RMAN transportable tablespaces requires filesystem-level access to copy and convert datafiles, which Autonomous Database does not permit. Option D is wrong because Data Guard physical standby requires SYSDBA control and OS-level redo transport, neither of which is available on Autonomous Database Serverless.

Practice this question →

22

MCQmedium

Your organization requires the migration of 300 TB of backup archives from an on-premises data center to OCI Object Storage. The local internet connection is limited to 100 Mbps, and corporate compliance mandates that data cannot traverse the public internet unencrypted. Which solution should you select to meet these constraints?

A.Order an OCI Data Transfer Appliance, load the encrypted backup data locally, and ship the appliance to the designated Oracle data center.

B.Deploy an OCI Storage Gateway on-premises and cache all 300 TB locally while syncing in real-time.

C.Use Oracle GoldenGate to replicate backup files block-by-block to Object Storage.

D.Stream the backups continuously over a secure IPsec VPN tunnel using rclone.

AnswerA

The 100 Mbps link makes 300 TB transfer impractical, and compliance forbids unencrypted public internet transit. An OCI Data Transfer Appliance sidesteps both constraints: data is encrypted locally, shipped physically, and never traverses the public internet.

Why this answer

The OCI Data Transfer Appliance is designed for exactly this scenario: migrating large volumes of data (typically >10 TB) when network bandwidth is insufficient. With only 100 Mbps, transferring 300 TB would take over 300 days, making it impractical. The appliance allows you to load encrypted data locally and ship it to Oracle, where data is uploaded to Object Storage, meeting both the bandwidth and compliance (encryption) requirements.

Exam trap

1Z0-997-26 often tests the misconception that a VPN or secure network transfer is sufficient for large data migrations, but the key constraint here is the limited bandwidth (100 Mbps) making network transfer impractical, so the offline appliance is the correct choice.

How to eliminate wrong answers

Option B is wrong because an OCI Storage Gateway is not a physical device for bulk offline transfer; it provides a file interface to Object Storage but still requires network connectivity to sync, and caching 300 TB locally is not its primary use case. Option C is wrong because Oracle GoldenGate is a real-time data replication tool for databases, not for bulk file transfer to Object Storage; it does not handle block-level replication of backup archives. Option D is wrong because streaming 300 TB over a 100 Mbps IPsec VPN would take an impractically long time (over 300 days) and does not address the bandwidth constraint; rclone over VPN is a network-based solution, not suitable for large offline migrations.

Practice this question →

23

Multi-Selecteasy

An architect is designing a lift-and-shift migration strategy for an enterprise running diverse workloads on-premises. Which TWO of the following factors should be evaluated when deciding whether to choose a lift-and-shift (rehost) approach versus a re-architect approach? (Choose two.)

Select 2 answers

A.Migration timeline urgency and available project budget

B.Whether the on-premises facility uses carpeted floors

C.The physical color of the server bezels in the on-premises rack

D.The brand of office coffee machine currently installed in the data center

E.Availability of source application source code and developer resources

AnswersA, E

Rehosting moves workloads unchanged, so it suits compressed timelines and constrained budgets; re-architecting demands more time and spend. Evaluating schedule pressure and funding directly determines which approach is feasible, satisfying the factor-selection criterion in the stem.

Why this answer

Option A is correct because rehost (lift-and-shift) migrations are typically chosen when time-to-migration is short and budget is limited, since they avoid the cost and duration of rewriting code; re-architecting demands significantly more time, skilled staff, and investment. Option E is correct because re-architecting requires access to the application's source code and sufficient developer resources to refactor it into a cloud-native design (e.g., microservices, managed services); if source code is unavailable or developers are scarce, rehosting becomes the practical choice. The remaining options (B, C, and D) are irrelevant to migration strategy decisions, as carpeted floors, server bezel colors, and coffee machine brands have no bearing on whether to rehost or re-architect a workload.

Exam trap

1Z0-997-26 often tests whether candidates can distinguish business/technical decision factors from obviously irrelevant distractors — the trap is overthinking and selecting a plausible-sounding but non-decisive factor instead of the two that truly drive rehost vs. re-architect.

Practice this question →

24

MCQhard

An enterprise is migrating a legacy Java application that requires sticky sessions and complex path-based routing rules to OCI. The migration plan requires zero dropped connections during backend server updates. Which OCI Load Balancer configuration feature should you implement?

A.Enable IP Hash load balancing policy without health checks.

B.Use OCI Web Application Firewall (WAF) rate limiting rules to drop incoming traffic during maintenance.

C.Configure backend server draining with a specified timeout period in the backend set.

D.Configure a Layer 4 TCP Network Load Balancer with TCP session persistence disabled.

AnswerC

Backend server draining lets in-flight requests complete before a backend is removed, with the timeout bounding how long draining waits. This satisfies the zero-dropped-connections requirement during updates, since traffic shifts to healthy backends while sticky sessions and path-based routing remain intact.

Why this answer

Backend server draining (connection draining) in an OCI Load Balancer backend set lets in-flight requests complete before a backend is removed from rotation, which is exactly what prevents dropped connections during backend updates. You configure it per backend set with a drain timeout, and the load balancer stops sending new requests to the draining backend while allowing existing sessions to finish.

Exam trap

The trap is conflating 'no dropped connections' with load-balancing policy or WAF controls — candidates pick IP Hash or WAF because they sound like traffic-management features, but only backend draining explicitly preserves in-flight connections during backend removal.

How to eliminate wrong answers

Option A is wrong because IP Hash without health checks would keep routing traffic to unhealthy or updating backends and provides no graceful removal mechanism — it actually increases the chance of dropped connections. Option B is wrong because WAF rate limiting drops traffic rather than gracefully draining it, directly contradicting the zero-dropped-connections requirement. Option D is wrong because a Layer 4 TCP Network Load Balancer with session persistence disabled breaks the sticky-session requirement and L4 NLB does not provide the HTTP path-based routing the application needs.

Practice this question →

25

MCQmedium

You are designing a hybrid cloud architecture during a phased workload migration to OCI. On-premises applications must securely communicate with migrated OCI workloads over a private, dedicated connection with high throughput and encryption. Which OCI networking service combination provides this capability?

A.OCI Local Peering Gateway with public IP addressing

B.OCI NAT Gateway combined with Service Gateway

C.OCI Internet Gateway with SSL/TLS certificates

D.OCI FastConnect with MACsec encryption or an IPsec VPN tunnel over FastConnect

AnswerD

FastConnect provides the private, dedicated, high-throughput link the migration demands, bypassing the public internet. MACsec encrypts at layer 2, while an IPsec VPN tunnel over FastConnect adds layer 3 encryption, so either satisfies the mandated encryption requirement.

Why this answer

OCI FastConnect provides a dedicated private connection from on-premises to OCI, and pairing it with MACsec (Layer 2 encryption) or running an IPsec VPN over the FastConnect virtual circuit delivers the required encryption and high throughput. This is the standard hybrid pattern for private, dedicated, encrypted connectivity.

Exam trap

1Z0-997-26 often tests whether candidates know FastConnect is not encrypted by default — assuming 'dedicated' equals 'secure' leads to picking a non-encrypting option.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway connects VCNs within the same region and does not provide on-premises connectivity; public IP addressing also violates the private-connection requirement. Option B is wrong because NAT Gateway and Service Gateway serve outbound internet and OCI-service access from within a VCN — neither establishes a dedicated on-premises link. Option C is wrong because Internet Gateway with SSL/TLS uses the public internet, not a private dedicated connection, and TLS terminates at the application layer rather than securing the transport path end-to-end.

Practice this question →

26

MCQeasy

An enterprise is planning to migrate a large on-premises Oracle Database of 15 TB to Oracle Cloud Infrastructure (OCI) Exadata Database Service. The maintenance window for the final cutover is extremely short (less than 2 hours). Which migration method should you recommend to minimize application downtime?

A.Set up an Oracle Data Guard standby database in OCI from an on-premises primary database using RMAN duplication over FastConnect, then perform a switchover during the maintenance window.

B.Use Oracle Database Actions to export all schemas to a local staging server and import them into the new database.

C.Migrate the database using OCI Database Migration service with a standard full database backup without incremental backups.

D.Perform a cold backup on-premises, upload it to OCI Object Storage, and restore it using RMAN during the maintenance window.

AnswerA

Data Guard maintains a synchronised standby via redo transport, so the on-premises primary keeps serving until cutover. RMAN duplication over FastConnect seeds the standby without shipping tapes, and switchover completes in minutes, satisfying the sub-two-hour maintenance window.

Why this answer

Oracle Data Guard with an OCI standby built via RMAN duplication over FastConnect keeps the standby continuously synchronized with the on-premises primary. During the short maintenance window, a switchover promotes the OCI standby to primary in minutes, achieving minimal downtime. This is the standard Oracle-recommended approach for large databases with tight cutover windows.

Exam trap

1Z0-997-26 often tests the assumption that backup/restore or export/import can meet tight cutover windows — candidates must recognize that Data Guard switchover is the only method that keeps the target continuously synchronized for a sub-2-hour cutover.

How to eliminate wrong answers

Option B is wrong because exporting schemas via Database Actions and importing through a staging server is slow for 15 TB, error-prone, and cannot meet a sub-2-hour cutover. Option C is wrong because OCI Database Migration with a full backup only (no incremental) requires a full restore during the window, which for 15 TB far exceeds 2 hours and does not provide continuous sync. Option D is wrong because a cold backup requires taking the database offline, uploading 15 TB, and restoring during the window — the upload and restore alone would exceed 2 hours and the cold backup itself causes downtime.

Practice this question →

27

MCQeasy

An organization is preparing to migrate 500 virtual machines to OCI. To govern resource creation, budget allocation, and access control effectively, how should the OCI tenancy be structured prior to starting resource migrations?

A.Deploy all migrated virtual machines into the tenancy root compartment with a single administrator policy.

B.Create a separate OCI tenancy for every single virtual machine being migrated.

C.Rely entirely on tags without creating compartments or IAM policies.

D.Create a structured hierarchy of compartments (e.g., Prod, Non-Prod, Networking) beneath the root tenancy and apply least-privilege IAM policies to each compartment.

AnswerD

Compartments are the fundamental OCI isolation and policy boundary; IAM policies and budgets attach at compartment level. Building the Prod, Non-Prod and Networking hierarchy before migration lets least-privilege policies and cost tracking apply automatically to every resource created afterwards.

Why this answer

OCI governance is built on a compartment hierarchy under the tenancy root, with IAM policies attached at the compartment level to grant least-privilege access. Creating a structured hierarchy such as Prod, Non-Prod, and Networking before migration lets you apply budgets, quotas, and policies consistently as resources are onboarded. This is the foundational step for governing 500 VMs at scale.

Exam trap

1Z0-997-26 often tests the misconception that tags alone provide governance — the trap is overlooking that compartments plus IAM policies are the actual enforcement mechanism, and tags are only for organization and cost allocation.

How to eliminate wrong answers

Option A is wrong because placing all VMs in the root compartment with a single administrator policy violates least privilege, makes budgeting and access control impossible to scope, and creates a single blast radius for any mistake. Option B is wrong because creating a separate tenancy per VM is operationally absurd — it multiplies cost, breaks centralized governance, and prevents shared networking and identity. Option C is wrong because tags are metadata for organization and cost tracking, not an access-control or governance mechanism; without compartments and IAM policies there is no enforcement boundary.

Practice this question →

28

Multi-Selectmedium

Your organization is planning to migrate file shares from an on-premises Windows environment (SMB protocol) to OCI. Which THREE factors or options should you consider when selecting the appropriate OCI storage architecture for Windows file shares? (Choose three.)

Select 3 answers

A.Deploying Windows Server instances on OCI Compute attached to high-performance OCI Block Volumes to act as native SMB file servers.

B.Using OCI Object Storage as a direct replacement for active SMB shared network drives requiring file locking.

C.Attaching OCI Archive Storage directly to Windows clients via USB cable simulation.

D.Evaluating OCI Marketplace partner solutions that provide enterprise NAS appliances with native SMB protocol support on OCI.

E.Standard OCI File Storage Service (FSS) natively speaks NFSv3 and does not support SMB/CIFS natively without third-party gateways or workarounds.

AnswersA, D, E

Windows Server on OCI Compute with attached Block Volumes provides native SMB shares, preserving NTFS permissions and Active Directory integration. This satisfies the SMB protocol constraint without re-architecting applications, unlike NFS-based File Storage or Object Storage.

Why this answer

Option A is correct because deploying Windows Server instances on OCI Compute with attached high-performance Block Volumes lets you run native SMB file servers, preserving SMB semantics such as file locking, ACLs, and Active Directory integration for Windows clients. Option D is correct because OCI Marketplace partner solutions offer enterprise NAS appliances that natively support SMB/CIFS on OCI, providing a managed, protocol-compatible alternative to self-managed Windows file servers. Option E is correct because OCI File Storage Service is an NFSv3-based service and does not natively speak SMB/CIFS, so it cannot directly serve Windows SMB shares without third-party gateways or workarounds.

Option B is incorrect because OCI Object Storage is an object store accessed via REST/S3 APIs, not a POSIX/SMB file system, and it does not provide the file locking and share semantics required for active SMB network drives. Option C is incorrect because OCI Archive Storage is a cloud archive tier accessed over the network via APIs, and there is no such thing as attaching it to Windows clients via USB cable simulation.

Exam trap

The trap is assuming OCI File Storage Service supports SMB because it is called 'File Storage' — candidates pick it for Windows shares, not realizing FSS is NFSv3-only and requires a gateway for SMB clients.

Practice this question →

29

Multi-Selecteasy

During a migration cutover weekend, your team encounters unexpected DNS resolution failures preventing users from reaching the newly migrated OCI application endpoints. Which TWO immediate troubleshooting steps should you perform? (Choose two.)

Select 2 answers

A.Check OCI VCN DNS resolver settings and custom resolver forwarders if integrating with on-premises DNS.

B.Verify that public DNS records (A and CNAME) have been updated with the correct OCI Load Balancer IP addresses and check TTL settings.

C.Change the tenant subscription currency from USD to EUR.

D.Reformat all backend database tables using SQL*Plus.

E.Delete all OCI compartments and recreate the tenancy root structure.

AnswersA, B

Checking the VCN resolver configuration and any custom forwarders verifies that OCI-side name resolution and on-premises DNS integration are functioning. Misconfigured forwarders or resolver settings are a common cause of resolution failures during cutover, so this isolates the fault quickly.

Why this answer

Option A is correct because during a migration cutover, DNS resolution failures often stem from the OCI VCN resolver configuration — specifically the Internet and VCN Resolver settings, custom resolver endpoints, and forwarding rules used when integrating with on-premises DNS (e.g., via IPSec VPN or FastConnect). Verifying these ensures the VCN's resolver is correctly forwarding queries and resolving OCI-internal names. Option B is correct because the most common cutover issue is stale or incorrect public DNS records; you must confirm the A records (and CNAMEs) point to the new OCI Load Balancer public IP addresses and check TTL values, since high TTLs can cause clients to cache old records long after the cutover.

Option C is irrelevant — changing tenant subscription currency from USD to EUR has no effect on DNS resolution. Option D is unrelated — reformatting backend database tables with SQL*Plus addresses data storage, not name resolution. Option E is destructive and nonsensical — deleting all OCI compartments and recreating the tenancy root would break the environment rather than troubleshoot DNS.

Exam trap

1Z0-997-26 often includes absurd distractors (currency, tenancy deletion) to test whether candidates stay focused on the actual failure domain — DNS, not billing or database.

Practice this question →

30

MCQeasy

During a lift-and-shift migration planning phase, your team needs to estimate the monthly running costs of various OCI Compute shapes, block storage volumes, and egress data transfer fees before provisioning resources. Which OCI tool should you use to generate this detailed cost breakdown?

A.OCI Budgets and Alerts

B.OCI Cost Estimator

C.OCI Resource Manager

D.OCI Migration Asset Inventory dashboard

AnswerB

OCI Cost Estimator models monthly spend for Compute shapes, block storage and egress before any tenancy exists, satisfying the pre-provisioning estimate requirement. Unlike Cost Analysis, which reports actual incurred charges from deployed resources, the Estimator works from a hypothetical configuration, letting you compare shapes and data-transfer volumes during lift-and-shift planning.

Why this answer

OCI Cost Estimator is a free, web-based planning tool that lets you model a full OCI environment — Compute shapes, Block Volume capacity/performance tiers, Object Storage, and outbound data transfer — and produces a detailed monthly cost breakdown before any resources are provisioned. It is purpose-built for pre-provisioning TCO/ROI analysis and lift-and-shift sizing exercises, and it can export the estimate to a spreadsheet for stakeholder review.

Exam trap

1Z0-997-26 often tests the confusion between forward-looking cost planning (Cost Estimator) and backward-looking cost governance (Budgets, Cost Analysis, Cost Reports) — candidates pick Budgets because it sounds cost-related, but Budgets cannot estimate unprovisioned resources.

How to eliminate wrong answers

Option A is wrong because OCI Budgets and Alerts only monitors spend against thresholds on resources that already exist — it cannot estimate costs for unprovisioned resources. Option C is wrong because OCI Resource Manager is a Terraform-based infrastructure-as-code provisioning service, not a pricing tool. Option D is wrong because the Migration Asset Inventory dashboard (part of OCI Cloud Migration Advisor) discovers and inventories on-premises assets for migration planning; it reports technical/usage metadata, not a modeled monthly cost breakdown.

Practice this question →

31

MCQhard

An enterprise is migrating a cluster of microservices running on Kubernetes from an on-premises data center to OCI Container Engine for Kubernetes (OKE). The cluster uses custom CNI (Container Network Interface) plugins and persistent storage backed by an on-premises Ceph cluster. During migration planning, how should you architect the persistent storage layer in OCI to support OKE stateful workloads?

A.Use ephemeral container scratch space for all persistent state requirements in OKE.

B.Mount the on-premises Ceph cluster directly inside OKE worker nodes using public IP addresses over an internet gateway.

C.Install the OCI Block Volume and OCI File Storage CSI drivers in the OKE cluster to dynamically provision persistent storage volumes.

D.Store all database and application state inside OCI Object Storage bucket folders mounted via local loop devices.

AnswerC

The OCI Block Volume and File Storage CSI drivers let OKE dynamically provision PersistentVolumes backed by OCI Block Volume and File Storage, replacing the on-premises Ceph layer. This satisfies the requirement for persistent storage supporting stateful workloads after migration.

Why this answer

OCI Block Volume and OCI File Storage CSI drivers integrate with OKE to dynamically provision PersistentVolumes backed by OCI Block Volume (for ReadWriteOnce block storage) and OCI File Storage (for ReadWriteMany NFS storage). This replaces the on-premises Ceph-backed persistent storage with native OCI storage that supports stateful workloads, snapshots, and dynamic provisioning. The CSI drivers are the supported mechanism for persistent storage in OKE and align with Kubernetes storage classes.

Exam trap

1Z0-997-26 often tests whether candidates assume Object Storage can serve as a POSIX-compliant persistent volume, leading them to pick the Object Storage loop-device option instead of the CSI drivers.

How to eliminate wrong answers

Option A is wrong because ephemeral container scratch space is non-persistent and is lost when the pod restarts or is rescheduled, which is unacceptable for stateful microservices. Option B is wrong because mounting an on-premises Ceph cluster over public IPs via an internet gateway is insecure, high-latency, and not a supported OCI architecture for OKE persistent storage. Option D is wrong because OCI Object Storage is an object store, not a block or file system, and mounting bucket folders via local loop devices is not a supported or reliable method for database and application state.

Practice this question →

32

MCQeasy

Your organization is migrating a high-throughput transactional database to OCI. During peak business hours, the database experiences massive I/O bursts. You want to ensure the underlying storage configuration can scale its IOPS independently of storage capacity. Which OCI block volume feature should you enable?

A.OCI Object Storage Infrequent Access tier

B.OCI File Storage Service snapshot policies

C.OCI Local NVMe RAID striping

D.OCI Block Volume Auto-Tune performance feature or manual VPU adjustment.

AnswerD

Auto-Tune lets you raise volume performance units (VPUs) independently of volume size, so IOPS scales without provisioning extra capacity. This directly satisfies the stem's requirement for independent IOPS scaling during peak I/O bursts, since capacity-based tiers would otherwise force you to over-provision storage to gain throughput.

Why this answer

OCI Block Volume's Auto-Tune feature (or manual VPU adjustment) allows you to change performance independently of capacity, scaling IOPS and throughput up or down without resizing the volume. This directly addresses the requirement for independent IOPS scaling during I/O bursts. Auto-Tune can be set to monitor and adjust VPUs based on demand, or you can manually set a higher VPU.

Exam trap

1Z0-997-26 often tests Block Volume performance — candidates confuse capacity with performance and pick storage tiers or instance-local NVMe instead of the VPU/Auto-Tune mechanism.

How to eliminate wrong answers

Option A is wrong because Object Storage Infrequent Access is an object storage tier for cold data, not block storage, and does not provide IOPS scaling for databases. Option B is wrong because File Storage snapshot policies are for data protection, not performance tuning. Option C is wrong because Local NVMe RAID striping is instance-local storage that is ephemeral and not a Block Volume feature; it also does not scale independently of the instance.

Practice this question →

33

MCQmedium

You are migrating a legacy application that relies on hardcoded IP addresses for inter-service communication. During the migration to OCI VCNs, you need to ensure that virtual machines can resolve each other's hostnames dynamically without maintaining manual /etc/hosts files. What OCI networking feature should you configure?

A.OCI API Gateway DNS forwarding rules

B.OCI Default VCN Resolver with assigned hostname prefixes

C.OCI Streaming service message brokers

D.OCI Network Load Balancer hostname rewriting

AnswerB

The default VCN resolver answers internal DNS queries for instances using their assigned hostname prefixes, removing the need for manual /etc/hosts entries. This satisfies dynamic name resolution between VMs, since hostnames are registered automatically when instances launch within the VCN.

Why this answer

OCI's Default VCN Resolver (part of the VCN's built-in DNS) automatically resolves instance hostnames when you assign a DNS hostname prefix to the subnet and enable hostname assignment on each VNIC. This eliminates manual /etc/hosts maintenance and lets instances resolve each other by FQDN such as <hostname>.<subnet-prefix>.oraclevcn.com. It is the native, zero-cost DNS service provided per VCN.

Exam trap

1Z0-997-26 often tests whether candidates confuse OCI's built-in VCN resolver with OCI DNS private zones or with load balancer DNS names — the key is that the Default VCN Resolver requires a hostname prefix on the subnet and hostname assignment on the VNIC.

How to eliminate wrong answers

Option A is wrong because OCI API Gateway is an HTTP/HTTPS ingress and API management service; it does not provide DNS forwarding or name resolution for compute instances. Option C is wrong because OCI Streaming is a Kafka-compatible publish/subscribe messaging service, not a DNS or hostname resolution mechanism. Option D is wrong because a Network Load Balancer distributes TCP/UDP traffic at Layer 4 and does not perform DNS hostname rewriting or name resolution for VMs.

Practice this question →

34

MCQeasy

Your organization has completed migrating a database to OCI Base Database Service. To ensure compliance with corporate data protection policies, you must verify that all database backups stored in OCI Object Storage are automatically encrypted using customer-managed encryption keys. Where should you configure this key management integration?

A.OCI Vault service (Key Management)

B.OCI Database Migration service connection profiles

C.OCI Audit log configuration

D.OCI Identity and Access Management (IAM) password policies

AnswerA

OCI Vault (Key Management) stores and manages customer-managed encryption keys, and Base Database Service integrates with it to encrypt backups written to Object Storage. Configuring the key here satisfies the policy requiring customer-managed keys rather than Oracle-managed encryption.

Why this answer

OCI Base Database Service integrates with OCI Vault (Key Management) to allow customer-managed encryption keys (CMKs) for backups stored in Object Storage. When you configure the database's backup destination to use a customer-managed key, the service automatically encrypts backups with that key. This ensures compliance with policies requiring customer-controlled encryption rather than Oracle-managed keys.

Exam trap

1Z0-997-26 often tests the confusion between encryption key management and other security services like IAM or Audit, so candidates might incorrectly choose IAM password policies or Audit logs when asked about customer-managed encryption keys.

How to eliminate wrong answers

Option B is wrong because OCI Database Migration service connection profiles are used to define source and target database connectivity for migration, not for encryption key management. Option C is wrong because OCI Audit log configuration captures API activity for auditing purposes; it does not control encryption of backups. Option D is wrong because IAM password policies govern user password complexity and rotation, not data encryption keys.

Practice this question →

35

Multi-Selecthard

You are designing a secure network architecture for migrating production workloads into an OCI Virtual Cloud Network (VCN). Compliance standards require strict traffic inspection, isolation, and secure administrative access. Which THREE OCI networking and security features should you incorporate into your design? (Choose three.)

Select 3 answers

A.Implement stateful Security Lists and Network Security Groups (NSGs) to enforce least-privilege traffic filtering at the subnet and VNIC levels.

B.Disable all VCN route tables and allow all subnets to broadcast traffic freely across the public internet.

C.Deploy OCI Bastion service to provide secure, ephemeral, and audited SSH/RDP access to private compute instances without public IP addresses.

D.Attach public IP addresses to all database and application backend servers to ensure direct administrator troubleshooting capability.

E.Deploy OCI Network Firewall to inspect inter-subnet and east-west traffic within the VCN.

AnswersA, C, E

Security Lists filter at the subnet boundary, while Network Security Groups filter at the VNIC level, together enforcing least-privilege traffic filtering across both tiers. This layered stateful control satisfies the isolation and strict inspection requirements in the stem.

Why this answer

Option A is correct because OCI Security Lists provide stateful, subnet-level filtering while Network Security Groups (NSGs) apply stateful rules at the VNIC level, together enabling least-privilege micro-segmentation required for strict isolation and compliance. Option C is correct because the OCI Bastion service creates ephemeral, time-limited SSH/RDP sessions to private instances that have no public IP, with all sessions audited, satisfying the secure administrative access requirement. Option E is correct because OCI Network Firewall is a managed next-generation firewall that inspects inter-subnet (east-west) traffic inside the VCN, providing the traffic inspection layer the compliance standards demand.

Option B is wrong because removing route tables and allowing free public broadcast destroys network segmentation, routing control, and isolation. Option D is wrong because exposing database and backend servers with public IPs violates least privilege and isolation, and direct public administrative access is exactly what the Bastion service is meant to avoid.

Exam trap

1Z0-997-26 often tests whether candidates recognize that public IPs and open routing are anti-patterns in secure designs, so picking options that expose backends or disable routing fails the isolation requirement.

Practice this question →

36

MCQeasy

Your company is planning to migrate 50 TB of unstructured file data from an on-premises Network Attached Storage (NAS) appliance to OCI File Storage Service (FSS). The target RTO/RPO allows for a phased baseline copy followed by incremental syncs. Which tool should you use to transfer the data efficiently over your dedicated OCI FastConnect link?

A.OCI Streaming Service

B.OCI Data Transfer Appliance

C.Parallelized rsync or custom multithreaded copy scripts via an OCI Compute instance acting as a migration gateway mounted to the FSS target

D.Oracle Data Pump

AnswerC

Parallelised rsync over a FastConnect-attached Compute gateway exploits FSS's NFSv3 mount, running concurrent streams to saturate the dedicated link during the phased baseline, then re-running rsync to copy only changed blocks for incremental syncs. This satisfies the RTO/RPO tolerance for staged transfer without shipping appliances.

Why this answer

For migrating large unstructured file data to OCI File Storage Service (FSS) over a dedicated FastConnect link, the recommended approach is to mount the FSS target on an OCI Compute instance acting as a migration gateway and use parallelized rsync or multithreaded copy scripts. This leverages the high bandwidth of FastConnect and the parallelism needed for 50 TB, while supporting incremental syncs for phased cutover.

Exam trap

1Z0-997-26 often tests whether candidates confuse offline transfer appliances with online transfer tools — the trap is picking Data Transfer Appliance when a dedicated FastConnect link makes online parallel copy the faster, recommended option.

How to eliminate wrong answers

Option A is wrong because OCI Streaming is a Kafka-compatible messaging service, not a file transfer tool. Option B is wrong because OCI Data Transfer Appliance is for offline bulk data transfer (shipping a physical appliance), which is unnecessary and slower when a dedicated FastConnect link is available. Option D is wrong because Oracle Data Pump is a database export/import utility for Oracle Database, not for unstructured NAS file data.

Practice this question →

37

MCQmedium

Your organization is migrating a 3-tier web application running on VMware vSphere to OCI Compute. The application requires exact operating system configurations, strict security policies, and custom kernel modules. You want to automate the migration process while maintaining network consistency. Which migration approach is most suitable?

A.Deploy new bare metal instances in OCI and use rsync to copy the root file systems over a secure IPsec VPN tunnel.

B.Rebuild the application from scratch using Terraform and OCI Resource Manager, then redeploy application binaries.

C.Migrate the workloads to Oracle Cloud VMware Solution (OCVS) using VMware HCX for seamless live migration without altering the hypervisor layer or guest OS configurations.

D.Export each virtual machine as a VMDK file, upload it to OCI Object Storage, and import it as a generic OCI custom image using the CLI.

AnswerC

OCVS runs the native vSphere hypervisor on bare metal, so guest OS configurations, custom kernel modules and security policies remain untouched. HCX performs live migration with minimal downtime, satisfying the requirement to preserve exact OS configurations and network consistency without re-platforming.

Why this answer

Oracle Cloud VMware Solution (OCVS) provides a native VMware SDDC environment in OCI, including vSphere, vSAN, and NSX-T, so existing VMs can be migrated without modifying the guest OS, kernel modules, or security policies. VMware HCX enables live migration (vMotion, cold, and bulk) with network extension, preserving IP addresses and network consistency. This is the only option that maintains the exact OS configurations and hypervisor layer while automating the migration.

Exam trap

1Z0-997-26 often tests the misconception that any VM can be migrated to OCI by simply exporting a VMDK and importing it as a custom image, but this ignores the need for hypervisor-level compatibility and the preservation of VMware-specific configurations, which only OCVS with HCX provides.

How to eliminate wrong answers

Option A is wrong because rsync copying a root filesystem to a bare metal instance does not preserve the VM's hardware abstraction, kernel modules, or boot configuration, and it requires manual reconfiguration of network and security policies. Option B is wrong because rebuilding from scratch with Terraform and redeploying binaries does not maintain exact OS configurations, custom kernel modules, or strict security policies, and it is not a migration but a re-architecture. Option D is wrong because exporting a VMDK and importing it as a generic OCI custom image does not retain VMware-specific drivers, kernel modules, or network settings, and the resulting instance runs on OCI's native hypervisor, not vSphere, breaking the requirement for an unchanged hypervisor layer.

Practice this question →

38

MCQhard

During a database migration project using Oracle Zero Downtime Migration (ZDM), the pre-migration validation phase fails with an error indicating that the source database's time zone file version does not match the target OCI Database service time zone file version. How should you resolve this issue?

A.Use the DBMS_DST package on the source database to update the time zone file version to match the target database before restarting the ZDM workflow.

B.Manually downgrade the OCI Database service time zone binaries using root OS access.

C.Modify the ZDM response file parameter `SKIP_DST_CHECK=TRUE` to bypass the validation check.

D.Restart the ZDM migration job using the logical migration workflow instead of the physical workflow.

AnswerA

ZDM validation compares source and target time zone file versions, so the source must be patched to match before migration proceeds. DBMS_DST performs this upgrade in place, satisfying the version-match constraint that blocks the workflow.

Why this answer

The DBMS_DST package is Oracle's supported mechanism for updating a database's time zone file version. When ZDM pre-migration validation detects a mismatch between source and target time zone file versions, the correct remediation is to upgrade the source database's DST version to match or exceed the target using DBMS_DST (typically via DBMS_DST.BEGIN_PREPARE, BEGIN_UPGRADE, and related procedures). This ensures data consistency for TIMESTAMP WITH TIME ZONE columns and allows the physical migration to proceed without errors.

Exam trap

1Z0-997-26 often tests the misconception that validation checks can be bypassed with hidden parameters like SKIP_DST_CHECK, when in reality Oracle requires proper remediation using DBMS_DST to ensure data integrity.

How to eliminate wrong answers

Option B is wrong because you cannot manually downgrade OCI Database service time zone binaries; OCI managed services do not grant root OS access, and time zone files are patched only through Oracle-supported maintenance. Option C is wrong because SKIP_DST_CHECK is not a valid ZDM response file parameter; ZDM does not provide a supported bypass for time zone validation, and attempting to skip it would risk data corruption. Option D is wrong because switching to logical migration does not resolve the underlying time zone file version mismatch; logical migration still requires compatible time zone data, and the validation would still fail or produce incorrect results.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Workload Migration questions.

Start 20-question session