1Z0-997-25 sample questions

Question 1

A developer is building a serverless application using OCI Functions. The function requires access to a legacy database that runs on a Compute instance in a private subnet. The function code needs the database credentials, but security policy strictly prohibits hardcoding secrets in the code or environment variables.

Which sequence of steps implements the most secure and compliant solution?

Accepted Answer

Create a Dynamic Group for the function. Create an IAM policy allowing the Dynamic Group to read secrets in the OCI Vault. Store credentials in OCI Vault. In the function code, use the OCI SDK with Resource Principal authentication to retrieve the secret.

Answer

Enable the 'Private Endpoint' option for the OCI Function. Configure the function to read the credentials directly from a file mounted from OCI File Storage Service.

Answer

Use OCI KMS to encrypt the credentials and paste the ciphertext into the function code. Use the master key to decrypt them at runtime.

Answer

Create a dedicated IAM User with read-only access to the Vault. Generate an API Key for this user. Store the API Key in the function's configuration variables and use it to authenticate the OCI SDK.

Question 2

Case Study: **Company Background:** TechFin Global is migrating its core banking platform to OCI. The platform consists of a Web Tier (OCI Container Engine for Kubernetes), an App Tier (OCI Functions), and a Database Tier (Autonomous Transaction Processing). **Requirement:** The security team mandates that all application secrets (API keys, DB passwords) must be automatically rotated every 60 days. The rotation process must be fully automated without human intervention. The database password rotation must update the Autonomous Database user password and the secret stored in OCI Vault simultaneously to avoid downtime. **Current Status:** You have configured OCI Vault to store the DB password. You have a function code ready to perform the rotation logic. **Question:** Which architectural component should you configure to trigger and execute this secret rotation securely according to OCI best practices?

Accepted Answer

Define a Secret Rotation Rule in OCI Vault that targets a specific OCI Function. Configure the Function to use Resource Principal to update the password in the Autonomous Database and then update the Secret version in the Vault.

Answer

Use a CronJob in the OKE cluster to run a pod every 60 days that executes a script to update the database and the vault.

Answer

Configure the Autonomous Database 'Password Management' profile to auto-expire passwords every 60 days and send a notification to OCI Vault to generate a new one.

Answer

Create an OCI Events rule that triggers on 'Vault Secret Retrieval'. Set the action to invoke a Function that checks the age of the secret and rotates it if necessary.

Question 3

Your organization is deploying a multi-cloud solution using Oracle Database@Azure. The application tier runs in an Azure VNet in the East US region, and the database service is an Oracle Exadata Database Service hosted in the OCI East US region, physically co-located in the Azure data center. You need to ensure the lowest possible latency between the Azure application and the Oracle database.

Which networking component is automatically provisioned and utilized to facilitate this direct connectivity?

Accepted Answer

Azure Delegated Subnet

Answer

OCI FastConnect Direct Public Peering

Answer

OCI Remote Peering Connection (RPC)

Answer

Azure ExpressRoute Local

Question 4

True or False: When configuring OCI Cache with Redis, you can distribute the primary and replica nodes across different OCI regions to achieve active-active cross-region read/write consistency.

Accepted Answer

False

Answer

True

Question 5

You are managing a large-scale migration of virtual machines from an on-premises VMware environment to OCI using the OCI Cloud Migrations service. During the 'Replication' phase, you notice that the replication bandwidth is saturating your corporate VPN connection, impacting other business traffic. You need to limit the bandwidth used by the replication process without stopping the migration.

What action should you take?

Accepted Answer

Deploy the OCI Remote Agent Appliance in the on-premises environment and configure bandwidth throttling parameters on the appliance gateway.

Answer

Configure a Traffic Management Steering Policy in OCI to throttle the incoming replication traffic.

Answer

Modify the replication schedule in the OCI Cloud Migrations asset source settings to only replicate during off-peak hours.

Answer

Increase the 'Replication Interval' in the migration project settings to reduce frequency.

Question 6

A customer is using OCI Application Performance Monitoring (APM) to troubleshoot a slow microservice. They want to trace a user request from the browser through the API Gateway, into the OKE cluster, and finally to the Autonomous Database.

Which OCI APM feature enables the visualization of this end-to-end flow and the identification of the high-latency hop?

Accepted Answer

Distributed Tracing

Answer

Logging Analytics

Answer

Synthetic Monitoring

Answer

Stack Monitoring

Question 7

You are designing a solution to migrate a 50 TB Oracle Data Warehouse from on-premises to an Oracle Autonomous Data Warehouse (ADW) on OCI. The on-premises data center has a 1 Gbps internet connection which is heavily used by other business applications. You have a strict deadline to complete the data transfer within 7 days.

Which data migration approach meets the deadline with the LEAST impact on the existing internet connection?

Accepted Answer

Use OCI Data Transfer Appliance (Import). Export the data to the appliance, ship it to Oracle, and then load into ADW.

Answer

Establish a Site-to-Site VPN and use Oracle Data Pump to push data directly over the internet.

Answer

Use OCI Storage Gateway to mount an OCI Object Storage bucket on-premises and copy files.

Answer

Use Oracle GoldenGate On-Premises to replicate data to GoldenGate for Big Data in OCI.

Question 8

An architect is designing a high-availability architecture for a web application. The design involves deploying web servers across two OCI regions: US East (Ashburn) and US West (Phoenix). The requirement is to route users to the region with the lowest latency. If the US East region becomes completely unavailable, all traffic must automatically failover to US West.

Which OCI Traffic Management Steering Policy type should be used?

Accepted Answer

Geolocation Steering Policy

Answer

Load Balancer Steering Policy

Answer

ASN Steering Policy

Answer

Failover Steering Policy

1Z0-997-25 Sample Questions & Answers

Ready for the real thing?

1Z0-997-25 Sample Questions & Answers

Related practice tests

Ready for the real thing?