75 of 240 questions · Page 2/4 · Core Oci Services · Answers revealed
You are deploying a microservices architecture on OKE. You need to ensure that the control plane is managed by OCI to reduce management overhead. Which OKE deployment model is best?
OKE manages the control plane for the user.
Why this answer
OKE is a managed Kubernetes service where the control plane is managed by Oracle.
An administrator must configure DNS resolution so that instances within a VCN can resolve custom internal domain names managed by an on-premises DNS server connected via FastConnect. Which OCI DNS feature should be used?
Private DNS resolver supports custom views and forwarding rules to on-premises resolvers.
Why this answer
OCI Private DNS resolver allows conditional forwarding rules to forward queries for specific domains to designated on-premises DNS servers.
You need to deploy a microservice application in OCI using serverless containers that start in seconds without provisioning Kubernetes clusters or virtual machines. Which OCI service should you use?
Container Instances provides serverless container execution.
Why this answer
OCI Container Instances allows you to run containerized applications serverlessly without managing compute or Kubernetes.
What is the purpose of a Pre-Authenticated Request in Object Storage?
PARs provide limited-time access.
Why this answer
PARs allow temporary, time-bound access to objects without requiring user credentials.
A company is running multiple web servers behind an OCI Public Load Balancer. They notice that client IP addresses are appearing in web server logs as the internal private IP address of the load balancer rather than the actual client's public IP address. How can this be resolved?
The X-Forwarded-For header contains the original client IP address when using a load balancer.
Why this answer
OCI Load Balancer adds standard HTTP headers such as 'X-Forwarded-For' to pass the original client IP address to backend web servers.
Which OCI service is used to host containerized applications and manage clusters?
OKE is the managed Kubernetes service.
Why this answer
Oracle Container Engine for Kubernetes (OKE) is the service for container orchestration.
You want to automate object lifecycle management in an OCI Object Storage bucket so that files older than 90 days are automatically transitioned to Archive storage. What should you configure?
Lifecycle rules automate object tier transitions and deletions natively.
Why this answer
Object Storage Lifecycle Rules allow you to define automated actions to transition objects to different storage tiers or delete them after a specified time period.
When using an OCI Load Balancer, which protocol is recommended for securing traffic?
HTTPS ensures encryption.
Why this answer
HTTPS (via SSL/TLS certificates) is the standard for securing traffic.
Which TWO OCI networking components are required to successfully enable private communication between two separate VCNs residing in the same OCI region? (Choose two.)
VCN route tables must be updated to route traffic destined for the peered VCN CIDR block through the LPG.
Why this answer
Local Peering connects two VCNs in the same region, requiring a Local Peering Gateway (LPG) in each VCN and corresponding routing rule updates in the VCN route tables.
Which TWO OCI features are associated with OCI Object Storage? (Choose two.)
PARs provide temporary URL access to objects.
Why this answer
Object Storage supports bucket lifecycle rules and pre-authenticated requests (PARs).
Which OCI storage service is best suited for storing database backups that require high durability and lowest cost without immediate file system mounting requirements?
Object Storage is ideal for durable, low-cost backup storage.
Why this answer
OCI Object Storage provides highly durable, low-cost object storage ideal for backups.
Which THREE features or capabilities are associated with OCI Virtual Cloud Network (VCN) Security Lists?
Security lists are stateful by default, meaning return traffic is automatically permitted regardless of inbound or outbound rules.
Why this answer
Security lists are stateful by default, act as virtual firewall rules at the subnet level, and apply to all compute instances in the associated subnet.
What is the default maximum size of a single Object Storage bucket in OCI?
Object Storage buckets scale automatically to store virtually unlimited data.
Why this answer
OCI Object Storage buckets have no practical size limit and can store an unlimited amount of data.
Which TWO OCI compute shape categories offer flexible sizing where you can independently select the number of OCPUs and memory? (Choose two.)
Flexible VMs allow custom OCPU and memory allocation.
Why this answer
Flexible shapes are available for standard virtual machines and certain specialized compute families.
A company is deploying an application that requires a shared storage filesystem across multiple OCI Compute instances. The performance requirements dictate sub-millisecond latency and high IOPS for heavy database logging. Which OCI storage service is most appropriate?
iSCSI attached Block Volumes with high performance tiers deliver sub-millisecond latency and high IOPS.
Why this answer
High-performance Block Volumes attached via iSCSI or local NVMe storage provide the necessary high IOPS and sub-millisecond latency required for database workloads.
An application team is deploying microservices on OCI Container Engine for Kubernetes (OKE). They want to expose multiple HTTP services using a single public IP address and route traffic based on URL path routing rules. Which OCI service should they integrate with their Kubernetes Ingress controller?
OCI Load Balancer provides layer 7 load balancing, including HTTP/HTTPS routing based on paths.
Why this answer
OCI Load Balancer supports path-based routing and integrates seamlessly with OKE through the OCI Load Balancer Ingress controller to manage external HTTP/HTTPS traffic.
An auditor is reviewing security controls for OCI Virtual Cloud Networks. Which THREE characteristics differentiate Security Lists from Network Security Groups (NSGs)? (Choose three.)
OCI enforces distinct resource quotas and limits for Security Lists versus NSGs within a VCN.
Why this answer
Security lists are subnet-wide with stateful/stateless rules and have strict limits per VCN, whereas NSGs are VNIC-specific and have different service limits.
An administrator needs to configure custom DNS resolution for instances within a VCN so they can resolve hostnames pointing to an internal on-premises corporate directory server over a FastConnect link. Which OCI DNS feature should be configured?
Private DNS resolver forwarding rules allow routing queries for specific domains to internal DNS servers via a DRG.
Why this answer
Private DNS resolver rules, specifically forward zones, allow VCN instances to forward DNS queries for custom domains to designated on-premises name servers.
An administrator needs to configure autoscaling for a compute instance pool so that instances scale out when CPU usage exceeds 80% and scale in when CPU usage drops below 20%. Where is this autoscaling configuration applied?
Autoscaling configurations are attached to Instance Pools.
Why this answer
Autoscaling configurations in OCI are linked directly to an Instance Pool to automatically manage the number of instances.
An enterprise application running on OCI requires high availability across two Availability Domains within a single region. The database backend needs to be securely isolated from public internet traffic while maintaining high-speed, low-latency communication with the application servers. How should the Virtual Cloud Network (VCN) be structured?
Private subnets protect the database from direct external access, while multi-AD deployment ensures high availability.
Why this answer
Deploying the application servers in public subnets behind a Load Balancer and the database in private subnets across multiple ADs ensures high availability and security.
Which THREE of the following are valid OCI File Storage Service (FSS) characteristics?
Storage scales automatically.
Why this answer
FSS is NFS-based, multi-AD accessible, and highly scalable.
You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the rule in the database NSG?
Reference the web server NSG as the source for precise tier-to-tier security rules.
Why this answer
OCI NSGs allow you to reference another NSG as the source in security rules for fine-grained access control.
An administrator is setting up an OCI File Storage (FSS) mount target in a specific subnet. When attempting to mount the file system from a compute instance in a different subnet within the same VCN, the mount command hangs. What must be configured to allow this connection?
NFS requires specific ports open in the security lists or NSGs associated with the mount target subnet.
Why this answer
Access to File Storage requires security rules allowing TCP and UDP ports 111, 2048, 2049, and 2050 for NFS traffic between the compute instance and the FSS mount target.
Which OCI compute feature allows you to run virtual machines on dedicated physical servers allocated exclusively to your organization?
Dedicated hosts provide physical server isolation for your VMs.
Why this answer
Dedicated Virtual Machine Hosts provide physical servers dedicated solely to your tenancy for compliance and isolation requirements.
Which TWO metrics can be monitored using OCI Monitoring service for compute instances? (Choose two.)
Memory utilization is tracked (often requiring the monitoring agent).
Why this answer
OCI Monitoring tracks standard metrics such as CPU utilization and Memory utilization for compute instances.
A network engineer is configuring a Site-to-Site VPN between an on-premises data center and an OCI VCN. To ensure high availability, the setup requires multiple customer-premises equipment (CPE) public IP addresses communicating with distinct Oracle VPN tunnel endpoints on the DRG. How many default tunnels does each OCI VPN connection provision per DRG attachment?
OCI Site-to-Site VPN provides two distinct tunnels per connection by default for high availability.
Why this answer
Each OCI Site-to-Site VPN connection automatically provisions two redundant tunnels terminating on distinct OCI gateway hardware endpoints for high availability.
When creating a block volume backup, where is the data stored?
Backups are automatically offloaded to Object Storage.
Why this answer
Block volume backups are stored in OCI Object Storage.
Which OCI Object Storage tier is optimized for storing active data that requires fast and frequent access with lowest latency?
Standard storage is optimized for frequent, fast access to active data.
Why this answer
Standard storage tier is the default tier for hot data that is accessed frequently.
Which OCI Object Storage tier is recommended for storing data that is accessed infrequently, but requires rapid access when needed with lower retrieval costs than Archive?
Infrequent Access is optimized for data accessed less often with rapid retrieval.
Why this answer
Infrequent Access storage tier is designed for data accessed less frequently, offering lower storage costs than Standard and faster retrieval than Archive.
You need to automatically increase the number of compute instances in your cluster when CPU utilization exceeds 80%. Which service should you use?
Autoscaling monitors and scales instance pools.
Why this answer
Autoscaling allows automatic adjustment of instance counts based on performance metrics.
Which OCI service provides a managed Domain Name System (DNS) to manage your domain records?
The OCI DNS service is the native managed DNS solution.
Why this answer
OCI DNS service manages public and private DNS zones.
Which THREE of the following statements about OCI Object Storage lifecycle management rules are true? (Choose three.)
Rules can target specific folders or prefixes rather than the entire bucket.
Why this answer
Lifecycle rules can automatically transition objects to Archive/Infrequent Access or delete them based on age, and can target specific object name prefixes.
An administrator has configured a Dynamic Routing Gateway (DRG) to connect an on-premises datacenter to an OCI VCN using an IPsec VPN. However, on-premises servers cannot communicate with instances in the VCN. Which VCN routing configuration is missing?
Subnets must have a route pointing to the DRG for traffic originating from the on-premises network.
Why this answer
Traffic coming from the DRG needs a route rule in the VCN route table pointing to the DRG as the target for the on-premises CIDR block.
A company requires a dedicated, private connection between their on-premises data center and OCI that provides consistent bandwidth. Which service is recommended?
FastConnect is a dedicated physical link.
Why this answer
FastConnect provides private, dedicated connectivity between on-premises and OCI.
An application developer needs to trigger a data-processing script immediately whenever a new object is uploaded to an OCI Object Storage bucket. Which OCI service should be used to execute the script in a serverless manner?
OCI Events detect object creation in Object Storage and invoke OCI Functions serverlessly.
Why this answer
OCI Events service captures changes to cloud resources and can automatically trigger OCI Functions in response to Object Storage uploads.
An administrator is configuring autoscaling on an OCI Instance Pool. They notice that the autoscaling configuration is not triggering scale-out actions despite high CPU utilization. What is a likely cause?
Improper metric thresholds or active cooldown periods prevent trigger actions.
Why this answer
Autoscaling requires a co-configured scaling policy with defined thresholds and cooldown periods linked to the instance pool. If the cooldown period is active or thresholds are improperly configured, scaling won't occur.
A security administrator wants to implement stateful packet filtering at the individual instance level within a VCN subnet, allowing different rules to apply to different groups of instances in the same subnet. Which OCI feature should be used?
NSGs allow fine-grained, instance-level security rules for specific VNICs within a subnet.
Why this answer
Network Security Groups (NSGs) act as virtual firewalls that provide security rules applied to a specified set of VNICs, unlike security lists which apply to entire subnets.
Which TWO statements are true regarding OCI Flexible Compute shapes? (Choose two.)
Flexible shapes allow independent custom selection of OCPUs and RAM.
Why this answer
Flexible compute shapes allow independent scaling of OCPUs and memory, and are available for both virtual machine and certain bare metal or specialized instance families.
An application running on an Oracle Cloud Infrastructure (OCI) compute instance needs secure, private access to Object Storage in the same region without traversing the public internet. Which architecture should you implement?
A Service Gateway allows your VCN to securely access OCI services like Object Storage privately over OCI's internal network backbone.
Why this answer
To securely access OCI Object Storage privately from a VCN without public internet, you should configure a Service Gateway and a corresponding route table rule targeting the Object Storage service.
An enterprise application deployed across multiple OCI subnets requires a Layer 4 load balancer that can handle millions of packets per second with ultra-low latency and preserve client source IP addresses. Which service should you deploy?
Network Load Balancer provides Layer 4 high-performance TCP/UDP load balancing preserving source IPs.
Why this answer
Network Load Balancer (NLB) operates at Layer 4, handles high throughput and packet rates with low latency, and preserves source IPs.
A database administrator needs to share a multi-gigabyte Oracle Database backup file stored in an OCI Object Storage bucket with an external auditor who does not have an OCI account. How can this be achieved securely without granting IAM console access?
PARs allow secure, time-limited external access to a single object or bucket without an OCI account.
Why this answer
Pre-authenticated requests (PARs) provide a unique URL to download or upload a specific object or bucket without requiring user credentials.
You are troubleshooting intermittent packet drops between two subnets in different VCNs connected via a Local Peering Gateway (LPG). Both VCNs have non-overlapping CIDR blocks. What is a common misconfiguration that could cause this issue?
Without route table entries pointing to the LPG, traffic cannot find its way across the peering connection.
Why this answer
VCN route tables must have rules pointing traffic destined for the peer VCN CIDR block to the Local Peering Gateway.
Which TWO networking services or gateways in OCI can be used to route traffic from a VCN to the public internet? (Choose two.)
Internet Gateway allows bidirectional public internet traffic.
Why this answer
Internet Gateway and NAT Gateway both facilitate traffic flowing from a VCN out to the public internet.
You need to allow your OKE cluster to access a private database. Where should the database be placed for the best security practice?
Private subnets prevent direct public access.
Why this answer
Placing the database in a private subnet and using NSGs to allow traffic from the OKE nodes is best practice.
An engineer needs to deploy flexible compute instances on OCI. Which TWO parameters can be independently adjusted when configuring a flexible compute shape? (Choose two.)
Memory can be allocated independently of OCPUs within supported shape limits.
Why this answer
Flexible shapes allow users to customize the number of OCPUs and the amount of memory independently to fit workload requirements.
Your development team needs to deploy microservices orchestrated via Kubernetes with automated worker node scaling and managed control plane upgrades. Which OCI service should you provision?
OKE is the managed Kubernetes service in OCI.
Why this answer
Oracle Container Engine for Kubernetes (OKE) is a fully managed, scalable, and highly available service where you can deploy your containerized applications.
You need to deploy a batch processing job that can tolerate sudden termination by OCI if compute capacity is reclaimed, significantly reducing your compute costs. Which instance type should you choose?
Preemptible instances offer discounted compute capacity subject to reclamation.
Why this answer
Preemptible instances are spare compute capacity offered at a lower price that can be reclaimed by OCI when capacity is needed.
A cloud architect needs to deploy a lightweight web application in OCI that requires rapid provisioning without managing underlying virtual machine infrastructure, operating systems, or cluster orchestration. Which OCI service should be selected?
Container Instances are serverless containers that let you run applications instantly without managing underlying VMs.
Why this answer
OCI Container Instances provide a serverless experience to run containers quickly without needing to manage servers or clusters like OKE.
What happens to an Ephemeral Public IP when you stop a compute instance?
Ephemeral IPs do not persist.
Why this answer
Ephemeral public IPs are released when the instance is stopped or terminated.
Which THREE storage tiers are available in OCI Object Storage? (Choose three.)
Standard storage is for frequent access.
Why this answer
OCI Object Storage offers Standard, Infrequent Access, and Archive storage tiers.
How does OCI ensure that high-availability requirements are met within a single region?
ADs are isolated data centers within a region.
Why this answer
Availability Domains (ADs) and Fault Domains (FDs) provide physical isolation.
Which OCI storage service is best suited for sharing configuration files across multiple Linux virtual machine instances simultaneously?
FSS allows concurrent multi-instance NFS mounting.
Why this answer
OCI File Storage Service (FSS) provides a shared network file system that can be mounted simultaneously by multiple instances.
An administrator needs to store infrequently accessed backups in OCI Object Storage that require long-term retention and can tolerate a retrieval time of up to several hours. Which storage tier is most cost-effective?
Archive Storage provides the lowest storage cost for long-term retention with a multi-hour retrieval time.
Why this answer
Archive Storage is designed for data that is rarely accessed and has a multi-hour retrieval latency, offering the lowest cost.
Which TWO of the following statements are correct regarding OCI Compute flexible shapes? (Choose two.)
OCI supports flexible VM shapes on AMD, Intel, and Ampere processors.
Why this answer
Flexible shapes allow independent customization of OCPUs and memory, and they are available across multiple modern compute families (such as AMD and Intel).
Which THREE of the following are features of OCI Load Balancer?
Offloads encryption.
Why this answer
SSL termination, path-based routing, and weighted round robin are key features.
A database administrator must establish a high-throughput, highly reliable hybrid connection between an on-premises data center and OCI. The connection must bypass the public internet and guarantee steady throughput with SLA-backed performance. Which networking service combination meets these criteria?
FastConnect provides dedicated private connectivity, terminating on a DRG attached to the VCN.
Why this answer
FastConnect provides a dedicated, private connection with higher speeds and SLAs, bypassing the public internet, paired with a Dynamic Routing Gateway (DRG) on the VCN side.
Which TWO of the following are valid OCI Object Storage storage tiers? (Choose two.)
Archive Storage Tier is for long-term cold storage.
Why this answer
OCI Object Storage provides Standard and Archive storage tiers (along with Infrequent Access).
Which THREE of the following OCI services are considered serverless?
Fully serverless.
Why this answer
Functions, Container Instances, and Object Storage (managed) are effectively serverless.
An enterprise application running on OCI Compute instances requires shared block storage that can be attached in read/write mode across multiple virtual machines simultaneously. What is the recommended OCI solution?
FSS provides concurrent multi-instance read/write shared file storage via NFS.
Why this answer
Standard block volumes cannot be attached read/write to multiple instances. Clustered databases or specialized clustered file systems using shared block volumes with clustered device mapping or File Storage Service are required. (File Storage Service provides standard concurrent shared file storage).
You are configuring security rules for a multi-tier application. You want to allow web servers in a specific Network Security Group (NSG) to communicate with database servers in another NSG. How should you define the ingress rule in the database NSG?
Reference the web server NSG as the source for precise tier-to-tier security rules.
Why this answer
OCI NSGs allow you to reference another NSG as the source in security rules, enabling tight access control between tiers without managing IP addresses.
A web application deployed across multiple compute instances experiences fluctuating traffic loads throughout the day. The infrastructure needs to automatically add or remove compute instances based on CPU utilization metrics. Which OCI service combination provides this capability?
Instance pools group similar instances, and autoscaling adjusts the pool size based on rules.
Why this answer
Compute Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics such as CPU utilization.
You are configuring a VCN and need to ensure that instances in a private subnet can access the internet to download updates without exposing them to incoming traffic. Which component is required?
NAT Gateway provides secure outbound-only internet access.
Why this answer
A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound connections.
You have two VCNs in the same region that need to communicate privately. Which component must be configured?
LPGs enable VCN-to-VCN communication within a region.
Why this answer
Local Peering Gateways (LPG) are required for VCN peering within the same region.
An administrator needs to route internet-bound traffic from private compute instances through a NAT Gateway. What route table configuration is required in the private subnet?
Directing 0.0.0.0/0 to the NAT Gateway routes all outbound internet traffic through it.
Why this answer
A private subnet route table must have a rule directing destination CIDR 0.0.0.0/0 to the NAT Gateway target.
You need to migrate a legacy application to OCI that requires a specific IP address to be retained for compliance. Which OCI networking feature allows you to attach a specific public IP to an instance?
Reserved Public IPs are persistent and can be assigned to VNICs.
Why this answer
Reserved Public IPs are long-lived public IP addresses that can be assigned to resources and retained after the resource is deleted.
Which THREE of the following are components of an OCI Load Balancer?
The entry point for client requests.
Why this answer
Backend sets, listeners, and policies are core components of an OCI Load Balancer.
Which TWO of the following networking components are used to control traffic flow between subnets?
VNIC-level traffic rules.
Why this answer
Security Lists and Network Security Groups are the primary traffic filtering tools.
An administrator needs to attach a Block Volume to a Compute instance using the paravirtualized attachment type. However, the application requires maximum possible IOPS and throughput performance. What is the recommended approach to resolve this requirement?
iSCSI attachments deliver maximum IOPS and throughput, bypassing paravirtualized virtualization overhead.
Why this answer
To achieve maximum performance (such as up to 75,000 IOPS and 800 MB/s per volume), the administrator should use an ISCSI attachment type instead of paravirtualized, alongside a Higher Performance volume performance unit.
An enterprise application running on Oracle Cloud Infrastructure requires block storage that dynamically scales performance levels up to 300 IOPS per GB with a maximum performance target independent of volume capacity scaling. Which Block Volume performance tier should the administrator configure?
Higher Performance provides up to 300 IOPS per GB for demanding databases and high-transaction applications.
Why this answer
The Higher Performance tier is designed for workloads requiring up to 300 IOPS/GB, allowing high performance independent of capacity.
Which TWO features are characteristic of OCI Network Load Balancers (NLB)? (Choose two.)
NLB preserves source IP addresses without requiring proxy headers.
Why this answer
Network Load Balancer operates at Layer 4, handles millions of requests with low latency, and preserves client source IP addresses.
What is the container image registry service provided natively by Oracle Cloud Infrastructure for storing and sharing OCI container images?
OCIR is the native container image registry service.
Why this answer
Oracle Cloud Infrastructure Registry (OCIR) is an Oracle-managed registry that enables you to store and manage your development container images.
Which TWO statements are true regarding OCI File Storage Service (FSS)? (Choose two.)
All OCI File Storage file systems are encrypted at rest using keys managed by Oracle or customers.
Why this answer
FSS provides a managed file system accessible via NFSv3 that automatically scales and encrypts data at rest by default.
You need to run a stateless containerized background processing job that executes periodically and terminates immediately upon completion without managing servers. Which OCI serverless service is ideal?
OCI Functions is ideal for event-driven, short-lived containerized code execution.
Why this answer
OCI Functions is a serverless, pay-as-you-go platform built on Fn Project that runs code in response to events or schedules.
You need to route traffic privately from your VCN to Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which components must be configured?
A Service Gateway allows private connectivity to regional Oracle services using a service destination route.
Why this answer
A Service Gateway combined with a route table entry pointing to the service destination allows private traffic routing to regional Oracle services.
How do you improve the performance of a block volume attached to a compute instance?
OCI allows dynamic adjustment of volume performance.
Why this answer
Changing the performance tier of a block volume (e.g., to Higher Performance) increases IOPS and throughput.
Ready to test yourself?
Try a timed practice session using only Core Oci Services questions.