1z0-997-20 practice test

1. Question 1 · 1

   Which three scenarios are suitable for the use of Oracle Cloud Infrastructure (OCI) Autonomous Transaction Processing "" Serverless (ATP-S) deployment? (Choose three.)

   Choose all answers that apply.

   • A manufacturing company is running Oracle E-Business Suite application on-premises. They are looking to move this application to OCI and they want to use a managed database offering for their database tier.
   • A midsize company is considering migrating its legacy on-premises MongoDB database to Oracle Cloud Infrastructure (OCI). The database has significantly higher workloads on weekends than weekdays.
   • A small startup is deploying a new application for eCommerce and it requires a database to store customers' transactions. The team is unsure of what the load will look like since it is a new application.
   • A well-established, online auction marketplace is running an application where there is database usage 24x7, but also has peaks of activity that are hard to predict. When the peaks happen, the total activities may reach 3 times the normal activity level.
   • A developer working on an internal project needs to use a database during work hours but doesn't need it during nights or weekends. The project budget requires her to keep costs low.

2. Question 2 · 1

   You designed and deployed your Autonomous Data Warehouse (ADW) so that it is accessible from your on-premise data center and servers running on both private and public networks in Oracle Cloud Infrastructure (OCI). As you are testing the connectivity to your ADW database from the different access paths, you notice that the server running on the private network is unable to connect to ADW. Which two steps do you need to take to enable connectivity from the server on the private network to ADW? (Choose two.)

   Choose all answers that apply.

   

   • Add an entry in the Security List of the ADW allowing ingress traffic for CIDR block 10.2.2.0/24
   • Add an entry in the route table (associated with the private subnet) with destination of 0.0.0.0/0; target type of NAT Gateway, add a stateful egress rule to the security list (associated with the private subnet) with destination of 0.0.0.0/0 and for all IP protocols.
   • Add an entry in the access control list of ADW for IP address 129.146.160.11
   • Add an entry in the route table (associated with the private subnet) with destination of 0.0.0.0/0; target type of Internet Gateway, add a stateful egress rule to the security list (associated with the private subnet) with destination of 0.0.0.0/0 and for all IP protocols.
   • Add an entry in the access control list of ADW for CIDR block 10.2.2.0/24.

3. Question 3 · 1

   Your company will soon start moving critical systems into Oracle Cloud Infrastructure (OCI) platform. These systems will reside in the us-phoenix-1 and us- ashburn-1 regions. As part of the migration planning, you are reviewing the company's existing security policies and written guidelines for the OCI platform usage within the company. Your security processes for critical systems require that all data is encrypted at rest using Customer-Managed Keys. Which two options ensure compliance with this policy? (Choose two.)

   Choose all answers that apply.

   • You do not need to perform any additional actions because the OCI Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption.
   • When you create a new OCI Object Storage bucket through OCI console, you need to choose "ENCRYPT USING CUSTOMER-MANAGED KEYS" option.
   • When you create a new block volume through OCI console, select "Encrypt using Customer-Managed Keys" checkbox and use encryption keys generated and stored in OCI Vault.
   • When you create a new compute instance through OCI console, you use the default options for "configure boot volume" to speed up the process to create this compute instance.
   • When you create a new compute instance through OCI console, you use the default shape to speed up the process to create this compute instance.

4. Question 4 · 1

   A hospital in Austin has hosted its web-based medical records portal entirely in Oracle Cloud Infrastructure (OCI) using compute instances for its web-tier and DB System database for its data tier. To validate compliance with Health Insurance Portability and Accountability (HIPAA), the hospital hired an IT security professional to check their systems. It was found that there were a lot of unauthorized requests coming from a set of IP addresses originating from a county in Southeast Asia. Which option can mitigate this type of attack? (Choose the best answer.)

   Choose one answer.

   • Block the attacking IP addresses by creating a Security List rule to deny access to the subnet where the web server is running.
   • Block the attacking IP addresses by creating a Network Security Group rule to deny access to the compute instance where the web server is running.
   • Implementing an OCI Web Application Firewall Bot Management policy to identify the attacking IP addresses and mitigate the threat.
   • Block the attacking IP addresses by implementing an OCI Web Application Firewall policy using Access Control Rules.

5. Question 5 · 1

   You work for a large bank where your main application is a payment processing gateway API. You deployed the application on Oracle Container Engine for Kubernetes (OKE) and used API Gateway with several policies to control the access of the API endpoint. However, your customers are complaining about the unavailability of the API endpoint. Upon checking, you noticed that the Gateway URL is throwing Service Unavailable error. You need to check the backend latency and backend responses when this error started last night. What should you do to get this data? (Choose the best answer.)

   Choose one answer.

   • Check with the application owner and search the log file for the container to get the metrics from the log file.
   • Go to Governance Menu and click on Audit to see the Audit log for the API Gateway. Filter it using Start and End date with a 503 response status.
   • Go to Developer Services and click on API Gateway. Go to the detail page of the gateway and select Metrics. Change the Start and End time to filter the metrics.
   • Go to Monitoring and click on Service Metrics. Choose the Metric Namespace as oci_apigateway. Change the Start and End time accordingly. Add a Dimension and select httpStatusCode: 503. Check the backend latency and backend responses metric.

6. Question 6 · 1

   You are running a legacy application in a compute instance on Oracle Cloud Infrastructure (OCI). To provide enough space for it to store internal data, a block volume is attached to the instance in paravirtualized mode. Your application is not resilient to crash-consistent backup. What should you do to backup the block volume in a secure and cost effective way? (Choose the best answer.)

   Choose one answer.

   • Save your application data, detach the block volume and create a clone.
   • Create a volume group, add the boot volume and then run the volume group backup.
   • Create a backup, detach the block volume and save your application data.
   • Save your application data, detach the block volume and create a backup.

7. Question 7 · 1

   You work for a retail company and they developed a Microservices based shopping application that needs to access Oracle Autonomous Database from the application. As an Architect, you have been tasked to treat all of the application components as Kubernetes native objects, such as the microservices, Oracle Autonomous database, Kubernetes services, etc. What should you do to make sure that you can use Kubernetes constructs to manage the life cycle of the application components, including Oracle Autonomous Database? (Choose the best answer.)

   Choose one answer.

   • Create an Oracle Cloud Infrastructure (OCI) Service Gateway and connect to the Oracle Autonomous Database using the private IP address from the microservice.
   • Provision an Oracle Autonomous Database and then use OCI Service Broker to access the database as a native component to your Kubernetes cluster.
   • Create a service from the Kubernetes cluster and point to the Oracle Autonomous Database using its FQDN.
   • Install and secure the OCI Service Broker for Kubernetes. Then provision and bind to the required Oracle Cloud Infrastructure services.

8. Question 8 · 1

   A large London based eCommerce company is running Oracle DB Systems Virtual Machine RAC database on Oracle Cloud Infrastructure (OCI) for their eCommerce application in the uk-london-1 region. They are currently taking automatic backups of the database, as configured during the database provisioning activity. They are launching a new product soon, which is expected to sell in large quantities all over the world. The application architecture should have minimal cost, no data loss, no performance impacts during the database backup windows and should have minimal downtime. What is the most efficient and cost-effective mechanism of modifying the database deployment architecture to meet these application goals? (Choose the best answer.)

   Choose one answer.

   • Launch a new VM RAC database in another availability domain, launch a compute instance, deploy Oracle GoldenGate on it and then configure it to replicate the data from the eCommerce Database over to the new VM RAC database using GoldenGate. Take backups from the new VM RAC database.
   • Turn off automatic backups from the eCommerce database, implement Oracle Active Data Guard with the standby database deployed on another availability domain, and take backups from the standby database.
   • Launch a new VM RAC database in another availability domain, launch a compute instance, deploy Oracle GoldenGate on it and then configure bi-directional replication from the eCommerce Database over to the new VM RAC database using GoldenDate. Take backup from the new VM RAC database.
   • Turn off automatic backups from the eCommerce database, implement Oracle Data Guard with the standby database deployed on another availability domain, take backups from the standby database.

9. Question 9 · 1

   You are the Solution Architect that designed this Oracle Cloud Infrastructure (OCI) compartment layout for your organization: The development team has deployed quite a few instances under "˜Compute' Compartment and the operations team needs to list the instances under the same compartment for their testing. Both teams, development and operations are part of a group called "˜Eng-group'. You have been looking for an option to allow the operations team to list the instances without access any confidential information or metadata of the resources. Which IAM policy should you write based on these requirements? (Choose the best answer.)

   Choose one answer.

   

   • Allow group Eng-group to inspect instance-family in compartment Dev-Team:Compute and attach the policy to "˜SysTest-Team' Compartment.
   • Allow group Eng-group to read instance-family in compartment Dev-Team:Compute and attach the policy to "˜Dev-Team' Compartment.
   • Allow group Eng-group to inspect instance-family in compartment Dev-Team:Compute and attach the policy to "˜Engineering' Compartment.
   • Allow group Eng-group to read instance-family in compartment Compute and attach the policy to "˜Engineering' Compartment.

10. Question 10 · 1

    You have multiple IAM users who launch different types of compute instances and block volumes every day. As a result, your Oracle Cloud Infrastructure (OCI) tenancy quickly hit the service limit and you can no longer create any new instances. As you are cleaning up the environment, you notice that the majority of the instances and block volumes are untagged. Therefore, it is difficult to pinpoint the owner of these resources and verify if they are safe to terminate. Because of this, your company has issued a new mandate, which requires adding a predefined set of tags to identify owners before launching compute instances. Which option is the simplest way to implement this new requirement? (Choose the best answer.)

    Choose one answer.

    • Create tag variables to automatically tag a resource with the user name.
    • Create a policy to automatically tag a resource with the user name.
    • Create a policy using IAM requiring users to tag specific resources. This will allow a user to launch compute instances only if certain tags were defined.
    • Create tag variables for each compartment to automatically tag a resource with the user name.
    • Create a default tag for each compartment, which ensures that appropriate tags are applied at resource creation.

11. Question 11 · 1

    You have an Oracle database system in a virtual cloud network (VCN) that needs to be accessible on port 1521 from your on-premises network CIDR 172.17.0.0/24. You have the following configuration currently: ✑ Virtual cloud network (VCN) is associated with a Dynamic Routing Gateway (DRG), and DRG has an active IPSec connection with your on-premises data center. ✑ Oracle database system is hosted in a private subnet. ✑ The private subnet route table has following configuration. ✑ The private subnet security list has following INGRESS security rule. ✑ The Oracle database system is part of a network security group with following security rules. However, you are still unable to connect to the Oracle Database system. Which action will resolve this issue? (Choose the best answer.)

    Choose one answer.

    

    

    

    • Add an EGRESS rule in private subnet security list as following.
    • Add an EGRESS rule in network security group as following.
    • Add a route rule in the private subnet route table as following.
    • Add an Egress rule in private subnet security list as following.

12. Question 12 · 1

    Your team is conducting a root cause analysis (RCA) following a recent, unplanned outage. One of the block volumes attached to your production WebLogic server was deleted and you have been tasked with identifying the source of the action. You search the Audit logs and find several Delete actions that occurred in the previous 24 hours. Given the sample excerpt of this event: Which item from the event log helps you identify the individual or service that initiated the DeleteVolume API call? (Choose the best answer.)

    Choose one answer.

    

    • eventId
    • requestAgent
    • eventource
    • requestOrigin
    • principalId

13. Question 13 · 1

    You are responsible for migrating your on-premises legacy databases on 11.2.0.4 version to Autonomous Transaction Processing "" Dedicated (ATP""D) in Oracle Cloud Infrastructure (OCI). As a solution architect, you need to plan your migration approach. Which two options do you need to implement together to migrate your on-premises databases to OCI? (Choose two.)

    Choose all answers that apply.

    • Use Oracle GoldenGate replication to keep on-premises database online during migration.
    • Convert on-premises databases to PDB, upgrade to 19c, and encrypt.
    • Use Oracle Data Guard to keep on-premises database always active during migration.
    • Retain changes to Oracle shipped privileges, stored procedures or views in the on-premises databases.
    • Retain all legacy structures and unsupported features (e.g. legacy LOBs) in the on-premises databases for migration.

14. Question 14 · 1

    An online stock trading application is deployed to multiple Availability Domains in the us-phoenix-1 region. Considering the high volume of financial transactions that the trading application handles, the company has hired you to ensure that the data stored by the application is scalable, highly-available, and disaster resilient. In the event of failure, the Recovery Time Objective (RTO) must be less than 2 hours to meet regulatory compliance requirements. Which Disaster Recovery strategy should be used to achieve the RTO requirement in the event of system failure? (Choose the best answer.)

    Choose one answer.

    • Configure your application to use synchronous master-slave data replication between Availability Domains.
    • Configure hourly block volumes backups through the Storage Gateway service.
    • Store hourly block volumes backup to NVME device under a compute instance and generate a custom image every 5 minutes.
    • Configure hourly block volumes backups using the Oracle Cloud Infrastructure (OCI) Command Line Interface (CLI).

15. Question 15 · 1

    An organization has its IT infrastructure in a hybrid setup with an on-premises environment and an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) in the us-phoenix-1 region. The on-premises applications communicate with compute instances inside the VCN over a hardware VPN connection. They are looking to implement an Intrusion Detection and Prevention (IDS/IPS) system for their OCI environment. This platform should have the ability to scale to thousands of compute instances running inside the VCN. How should they architect their solution on OCI to achieve this goal? (Choose the best answer.)

    Choose one answer.

    • Set up an OCI Private Load Balancer and configure IDS/IPS related health checks at TCP and/or HTTP level to inspect traffic.
    • Configure autoscaling on a compute instance pool and set vNIC to promiscuous mode to collect traffic across the VCN and send it to the IDS/IPS platform for inspection.
    • Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform for inspection.
    • There is no need to implement an IPS/IDS system as traffic coming over IPSec VPN tunnels is already encrypted.

Paid access to all 29 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.