1Z0-997-25 sample questions

Question 1

A global retail enterprise is designing a cloud-native e-commerce platform on Oracle Cloud Infrastructure (OCI). The application utilizes microservices deployed on Oracle Container Engine for Kubernetes (OKE). The architecture requires that pods have direct visibility of the client source IP addresses for geo-fencing and audit logging purposes without using `X-Forwarded-For` headers. The solution must also support mixed-protocol traffic (TCP and UDP) on the same load balancer IP. Which OCI Load Balancer configuration meets these strict networking requirements?

Accepted Answer

Deploy an OCI Flexible Network Load Balancer (NLB) with the 'Preserve Source IP' option enabled and configure the OKE service with `externalTrafficPolicy: Local`.

Answer

Deploy an OCI Flexible Load Balancer (Layer 7) with a TCP listener and enable the Proxy Protocol V2 header insertion.

Answer

Configure the OKE cluster to use the VCN-Native Pod Networking CNI and expose the pods directly using a Service of type ClusterIP.

Answer

Use an OCI Flexible Load Balancer (Layer 7) and configure an IP Hash session persistence rule to map client IPs to backend sets.

Question 2

You are the lead architect for a financial institution migrating a legacy high-frequency trading application to OCI. The application requires a database with single-digit millisecond latency, automated failover with zero data loss (RPO=0), and the ability to scale CPU resources up to 3x during market opening hours automatically. Which database solution and configuration should you select?

Accepted Answer

Oracle Autonomous Transaction Processing (ATP) on Shared Exadata Infrastructure with Auto Scaling enabled and Autonomous Data Guard enabled in the same region.

Answer

Oracle Base Database Service (2-Node RAC) with Data Guard configured in Async mode to a peer region.

Answer

Oracle Autonomous Data Warehouse (ADW) with manual scaling scripts triggered by OCI Events.

Answer

Oracle Exadata Database Service on Dedicated Infrastructure with CPU bursting enabled.

Question 3

A multinational corporation is implementing a hub-and-spoke network topology in OCI. They require a centralized inspection point for all North-South (Internet) and East-West (Spoke-to-Spoke) traffic. They have chosen OCI Network Firewall for this purpose. You need to configure the routing to ensure traffic flows correctly through the firewall in the Hub VCN.

Which THREE routing configurations are required to achieve this? (Select THREE)

Accepted Answer

In the Spoke VCN DRG attachment, associate a DRG Route Table that has a static rule sending all traffic (0.0.0.0/0) to the Hub VCN attachment.

Accepted Answer

In the Hub VCN DRG attachment, associate a VCN Ingress Route Table that directs traffic destined for Spoke CIDRs to the private IP of the Network Firewall.

Accepted Answer

In the subnet containing the Network Firewall, configure a Route Table with rules sending traffic destined for Spoke CIDRs back to the DRG.

Answer

In the Spoke VCN, configure the Local Peering Gateway (LPG) to point to the Hub VCN.

Answer

In the Hub VCN, configure a NAT Gateway to route East-West traffic between spokes.

Question 4

You are creating a disaster recovery plan for a critical application running on OCI Compute instances with attached Block Volumes. The business requirement states that in the event of a region-wide outage, data must be recoverable in the destination region with a Recovery Point Objective (RPO) of less than 1 hour. You decide to use Cross-Region Replication for Block Volumes.

What is a mandatory prerequisite for enabling this feature?

Accepted Answer

You must define a specific IAM policy allowing the Block Volume service to manage volume backups across regions.

Answer

The source and destination regions must be peered via a Remote Peering Connection (RPC).

Answer

The Block Volume must be detached from the instance before enabling replication.

Answer

You must enable Object Storage replication in the same compartment first.

Question 5

A developer is building a serverless application using OCI Functions. The function requires access to a legacy database that runs on a Compute instance in a private subnet. The function code needs the database credentials, but security policy strictly prohibits hardcoding secrets in the code or environment variables.

Which sequence of steps implements the most secure and compliant solution?

Accepted Answer

Create a Dynamic Group for the function. Create an IAM policy allowing the Dynamic Group to read secrets in the OCI Vault. Store credentials in OCI Vault. In the function code, use the OCI SDK with Resource Principal authentication to retrieve the secret.

Answer

Create a dedicated IAM User with read-only access to the Vault. Generate an API Key for this user. Store the API Key in the function's configuration variables and use it to authenticate the OCI SDK.

Answer

Enable the 'Private Endpoint' option for the OCI Function. Configure the function to read the credentials directly from a file mounted from OCI File Storage Service.

Answer

Use OCI KMS to encrypt the credentials and paste the ciphertext into the function code. Use the master key to decrypt them at runtime.

Question 6

Case Study: **Company Background:** TechFin Global is migrating its core banking platform to OCI. The platform consists of a Web Tier (OCI Container Engine for Kubernetes), an App Tier (OCI Functions), and a Database Tier (Autonomous Transaction Processing). **Requirement:** The security team mandates that all application secrets (API keys, DB passwords) must be automatically rotated every 60 days. The rotation process must be fully automated without human intervention. The database password rotation must update the Autonomous Database user password and the secret stored in OCI Vault simultaneously to avoid downtime. **Current Status:** You have configured OCI Vault to store the DB password. You have a function code ready to perform the rotation logic. **Question:** Which architectural component should you configure to trigger and execute this secret rotation securely according to OCI best practices?

Accepted Answer

Define a Secret Rotation Rule in OCI Vault that targets a specific OCI Function. Configure the Function to use Resource Principal to update the password in the Autonomous Database and then update the Secret version in the Vault.

Answer

Create an OCI Events rule that triggers on 'Vault Secret Retrieval'. Set the action to invoke a Function that checks the age of the secret and rotates it if necessary.

Answer

Use a CronJob in the OKE cluster to run a pod every 60 days that executes a script to update the database and the vault.

Answer

Configure the Autonomous Database 'Password Management' profile to auto-expire passwords every 60 days and send a notification to OCI Vault to generate a new one.

Question 7

Your organization is deploying a multi-cloud solution using Oracle Database@Azure. The application tier runs in an Azure VNet in the East US region, and the database service is an Oracle Exadata Database Service hosted in the OCI East US region, physically co-located in the Azure data center. You need to ensure the lowest possible latency between the Azure application and the Oracle database.

Which networking component is automatically provisioned and utilized to facilitate this direct connectivity?

Accepted Answer

Azure Delegated Subnet

Answer

OCI FastConnect Direct Public Peering

Answer

OCI Remote Peering Connection (RPC)

Answer

Azure ExpressRoute Local

Question 8

True or False: When configuring OCI Cache with Redis, you can distribute the primary and replica nodes across different OCI regions to achieve active-active cross-region read/write consistency.

Accepted Answer

False

Answer

True

Oracle Cloud Infrastructure 2025 Architect Professional Free Sample Questions

Lifetime One

Two

Pro Four

Premium Twelve

1Z0-997-25 Sample Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Trusted by professionals at