1Z0-997 practice questions 11–20

1. Question 11 · 52 in bank

   You are designing the network infrastructure for two application servers: appserver-1 and appserver-2 running in two different subnets inside the same Virtual Cloud Network (VCN) in Oracle Cloud Infrastructure (OCI). You have a requirement where your end users will access appserver-1 from the internet and appserver-2 from the on-premises network. The on-premises network is connected to your VCN over a FastConnect virtual circuit. How should you design your routing configuration to meet these requirements?

   • AConfigure a single routing table (Route Table-1) that has two sets of rules: one that has route to internet via the Internet Gateway and another that propagates specific routes for the on-premise network via Dynamic Routing Gateway (DRG). Associate the routing table with the VCN.
   • BConfigure two routing tables: Route Table-1 that has a route to internet via the Internet gateway. Associate this route table to the subnet containing appserver-1. Route Table-2 that propagate specific routes for the on-premises network via the Dynamic Routing Gateway (DRG). Associate this route table to subnet containing appserver-2.
   • CConfigure a single routing table (Route Table-1) that has two sets of rules. One that has route to internet via the Internet Gateway and another that propagates specific routes for the on-premise network via the Dynamic Routing Gateway. Associate the routing table with all the VCN subnets.
   • DConfigure two routing tables (Route Table-1 & Route Table-2) that have rule to route all traffic via the Dynamic Routing Gateway (DRG). Associate the two routing tables with all the VCN subnets.

   Show answer

   Answer: B

   Next question

2. Question 12 · 52 in bank

   You are a Lead Architect at one of the leading consulting firms. Your firm has workloads deployed in both Oracle Cloud Infrastructure (OCI) and Microsoft Azure. You are asked to design a solution where workloads on both clouds can communicate directly and efficiently. You would like to set up a private interconnection between OCI and Microsoft Azure. What are the steps you need to perform on the OCI side to set up the interconnection?

   • ACreate a VCN with subnets and attach a DRG to the VCN. Create a FastConnect connection of the connection type "FastConnect Partner" and select "Microsoft Azure: ExpressRoute” as the Partner. Create a public virtual circuit, provide details of the DRG and add the “partner connection key” provided by Microsoft Azure. Configure OCI VCN Security Lists and Route Tables.
   • BCreate a Virtual Cloud Network (VCN) with subnets and attach a Virtual Network Gateway to the VCN. Create a FastConnect connection of the connection type "FastConnect Partner" and select "Microsoft Azure: ExpressRoute" as the Partner. Create a private virtual circuit, provide details of the Dynamic Routing Gateway (DRG) and add the "partner interconnect key" provided by Microsoft Azure. Provide the BGP IP addresses. Configure OCI VCN Security Lists and Route Tables.
   • CCreate a VCN with subnets and attach a DRG to the VCN. Create a FastConnect connection of the connection type "FastConnect Direct". Create a Cross-Connect Group, provide details of the DRG and add the "partner secret key" provided by Microsoft Azure. Provide the BGP IP addresses, Configure OCI VCN Security Lists and Route Tables.
   • DCreate a VCN with subnets and attach a DRG to the VCN. Create a FastConnect connection of the connection type "FastConnect Partner" and select "Microsoft Azure: ExpressRoute" as the Partner. Create a private virtual circuit, provide details of the DRG and add the "partner service key" provided by Microsoft Azure. Provide the BGP IP addresses, Configure OCI VCN Security Lists and Route Tables.

   Show answer

   Answer: D

   Next question

3. Question 13 · 52 in bank

   To serve web traffic for a popular product, your cloud engineer has provisioned four BM.Standard2.52 instances, evenly spread across two availability domains in the us-ashburn-1 region; LoadBalancer is used to deliver the traffic across instances. After several months, the product grows even more popular and you need additional compute capacity. As a result, an engineer provisioned two additional VM.Standard2.8 instances. You register the two VM.Standard2.8 instances with your Load Balancer Backend set and quickly find that the VM.Standard2.8 instances are now running at 100% of CPU utilization but the BM.Standard2.52 instances have significant CPU capacity that's unused. Which option is the most cost effective and uses instances capacity most effectively?

   • AConfigure LoadBalancer with two VM.Standard2.8 instances and use Autoscaling instance pool to add up to two additional VM.Standard2.8 instances. Shut off BM.Standard2.52 instances.
   • BConfigure your Load Balancer with weighted round robin policy to distribute traffic to the compute instances, with more weight assigned to bare metal instances.
   • CConfigure Autoscaling instance pool with LoadBalancer to add up to 3 more BM. Standard2.52 Instances when triggered, Shut off VM.Standard2.8 Instances.
   • DRoute traffic to BM.Standard2.52 and VM.Standard2.8 Instances directly using DNS and Health Checks. Shut off the Load Balancer.

   Show answer

   Answer: B

   Next question

4. Question 14 · 52 in bank

   You are a solutions architect for a global health care company, which has numerous data centers around the globe. Due to the increasing volume of data that your company stores, you are tasked with setting up a durable, cost-effective solution to archive data from existing on-premises tape-based backup infrastructure to Oracle Cloud Infrastructure (OCI). Which is the most effective mechanism to implement this requirement?

   • AUse the File Storage Service in OCI and copy the data from your existing tape-based backup to the shared file system.
   • BSet up an on-premises OCI Storage Gateway, which will back up your data to the OCI Object Storage Standard tier. Use Object Storage life cycle policy management to move any data older than 30 days from the Standard to the Archive tier.
   • CSet up FastConnect to connect your on-premises network to OCI VCN and use the rsync tool to copy your data to the OCI Object Storage Archive tier.
   • DSet up an on-premises OCI Storage Gateway, which will back up your data to the OCI Object Storage Archive tier.
   • ESet up an on-premises OCI Storage Gateway, which will back up your data to the OCI Object Storage Standard tier.

   Show answer

   Answer: D

   Next question

5. Question 15 · 52 in bank

   A company runs a public-facing application that uses a Java-based web service via a RESTful API in their on-premises data center. Use of the API is expected to double with a new product launch. The business wants to migrate their application to Oracle Cloud Infrastructure (OCI) to meet the scale and reliability requirements. In order to achieve this, they will divert only 40% of the traffic to the new Apache Tomcat web servers running on OCI and serve the remaining 60% traffic through their on-premises infrastructure. Once the migration is complete and application works fine, they will divert all traffic to OCI. How can these requirements be met with the LEAST amount of effort?

   • ASet up a VPN connectivity between on-premises infrastructure and OCI and create routing tables to distribute traffic between them.
   • BUse OCI Traffic management service with Failover steering policy and distribute traffic between OCI and on-premises infrastructure.
   • CUse OCI Load Balancing service to distribute traffic between OCI and on-premises infrastructure.
   • DUse OCI Traffic management service with Load Balancing steering policy and distribute traffic between OCI and on-premises infrastructure.

   Show answer

   Answer: D

   Next question

6. Question 16 · 52 in bank

   You are developing a Serverless function for your company's IoT project. This function should access Oracle Cloud Infrastructure (OCI) Object Storage to store some files. You choose Oracle Functions to deploy this function on OCI. However, your security team doesn't allow you to carry any API Token or RSA Key to authenticate the function against the OCI API to access the Object Storage. What should you do to get this function to access OCI Object Storage without carrying any static authentication files?

   • AThere is no way that you can access the OCI resources from a running function.
   • BSet up a Dynamic Group using the format below: All {resource, type = ‘fnfunc’, resource.compartment.id - ‘ocidl.compartment.ocl..aaaaaaaa23________smwa’) Create a policy using the format below to give access to OCI Object Storage: allow dynamic-group acme-func-dyn-grp to manage objects in compartment acme- storage-compartment where all (target.bucket.name-‘acme-functions-bucket’) Include a call to a 'resource principal provider' in your function code as below: signer - oci.auth.signers.get_resource_principals_signer{}
   • CAdd these two policy statements for your compartment to give your function automatic access to all other OCI resources: Allow group to manage fn-app in compartmert Allow group to manage fn-function in compartment
   • DAdd these two policy statements for your compartment and then include a call to a 'resource principal provider' in your function code: Allow group acme functions-developers to inspect repos in tenancy Allow group acme-functions-developers to manage repos in tenancy where all {target.repo.name-/acme-web-app*/ }

   Show answer

   Answer: B

   Next question

7. Question 17 · 52 in bank

   Your company developed a function that needs to access the Oracle Database to inject some data to it at runtime. You are tasked to move this function to the Oracle Cloud Infrastructure (OCI) and use Oracle Functions and access Oracle Autonomous Database. You created a Dockerfile below to run this function, however, you are getting this error "cx_Oracle.DatabaseError: ORA-12560: TNS:protocol adapter error".

   

   What should you do to make sure that Oracle Functions can run this Dockerfile properly?

   • AUse --privileged flag while running the Docker container to add runtime privilege.
   • BUse –cap-add-ALL flag while running the Docker container to add runtime capability.
   • CYou need to run this Container as root, so add this line: USER root
   • DAdd these two lines to your Dockerfile: groupadd --gid 1000 fn && \ adduser --uid 1000 --gid fn fn

   Show answer

   Answer: D

   References

   • Oracle documentation

   Next question

8. Question 18 · 52 in bank

   Select 2

   Your company will soon start moving critical systems into the Oracle Cloud Infrastructure (OCI) platform. These systems will reside in the us-phoenix-1 and us-ashburn-1 regions. As part of the migration plan, you review the company's existing security policies and written guidelines for the OCI platform usage within the company. Your security processes for critical systems require that all data be encrypted at rest using Customer-Managed Keys. Which TWO options ensure compliance with this policy? (Choose two.)

   • AWhen you create a new compute instance through the OCI console, use the default options for "configure boot volume" to speed up the process of creating this compute instance.
   • BWhen you create a new compute instance through the OCI console, use the default shape to speed up the process of creating this compute instance.
   • CWhen you create a new OCI Object Storage bucket through the OCI console, you need to choose the "ENCRYPT USING CUSTOMER-MANAGED KEYS" option.
   • DWhen you create a new block volume through the OCI console, select the "Encrypt using Customer-Managed Keys" checkbox and use the encryption keys generated and stored in OCI Vault.
   • EYou do not need to perform any additional actions because the OCI Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption.

   Show answer

   Answer: CD

   Next question

9. Question 19 · 52 in bank

   You are the security architect for a medium sized e-commerce company that runs all of their applications in Oracle Cloud Infrastructure (OCI). Currently, there are 14 unique applications, each deployed and secured in their own compartment. The Operations team has procured a new monitoring tool that will be deployed throughout the OCI ecosystem. Their requirement is to deploy one management node into each compartment. Currently, the Operations team Identity and Access Management (IAM) group has the following policy: allow group OpsTeam to READ all-resources in tenancy Once the new monitoring nodes are deployed, the Operations team may need to stop, start, or reboot them occasionally. What is the most efficient solution to allow the Operations team to fully manage the monitoring nodes, without allowing them to alter other resources across the tenancy?

   • AIn each of the 14 compartments, create a new policy with the following statement: allow group OpsTeam to manage instance-family in compartment XXX where XXX is the name of the compartment where you are creating the policy.
   • BCreate a new policy in the root compartment with the following policy statement: allow group OpsTeam to manage instance-family in tenancy where ANY (request.operation – ‘UpdateInstance’, request.operation – ‘InstanceAction’)
   • CTag all the monitoring nodes with the defined tag AllPolicy:AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllPolicy.AllowAccess – ‘OpsTeam’
   • DTag all the monitoring nodes with the free-form tag AllowAccess:OpsTeam and write the following IAM policy: allow group OpsTeam to manage instance-family in tenancy where target.resource.tag.AllowAccess = ‘OpsTeam’

   Show answer

   Answer: C

   Next question

10. Question 20 · 52 in bank

    You have 10 Oracle Linux Compute instances within the ociarchpro compartment running in Oracle Cloud Infrastructure (OCI). The instances are placed in a private subnet inside a Virtual Cloud Network (VCN). You plan to leverage the Oracle Vulnerability Scanning service to gain visibility into potential vulnerabilities. Your goal is to improve the overall security posture. You create a Scan recipe with the following settings: Type: Compute - Name: ociproscanrecipe - CIS benchmark scanning: Enabled - CIS benchmark profile: Medium (More than 40% of the benchmarks failing is a high risk) Schedule: Daily - You create a target with the following settings: Type: Compute - Compartment: ociarchpro - Scan recipe: ociproscanrecipe - Targets: All compute instances in the selected target compartment and its sub-compartments However, you are not able to see the result of host scans for the compute target. For the given scenario, which is NOT a valid troubleshooting task?

    • ACheck whether the target was created less than 24 hours ago.
    • BEnable the scanning plugin on the Oracle Cloud Agent if you manually disabled it on the target compute instances.
    • CCreate a service gateway for the Virtual Cloud Network (VCN) and configure a route rule.
    • DDisable agent-based scanning in the recipe.

    Show answer

    Answer: D

    References

    • Oracle documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

1Z0-997 practice, question 11. 52 questions available.