1z0-1084-26 Oracle Cloud Infrastructure Developer Professional Questions and Answers

Oracle provides a dedicated logging-search OCI CLI command group for querying indexed log content. The documented syntax is oci logging-search search-logs, with --search-query, --time-start, and --time-end as the principal parameters required to define the Logging Query Language expression and search interval. The ordinary oci logging command group is used for administration of logs and log groups rather than searching their contents. logging-query is not a valid top-level OCI CLI service group, and --query-string is not the documented search parameter. Therefore, option B exactly matches Oracle ' s current CLI command reference for submitting a programmatic log search across custom or service logs.

Oracle explicitly defines the default batchAtomicity setting for PostMetricData asNON_ATOMIC. With NON_ATOMIC validation, at least one metric object in the request must pass validation for valid metric objects to be accepted. Individual objects that fail validation are rejected and identified in the returned summary with their associated errors. By comparison, ATOMIC requires every metric object in the batch to pass validation; if one object fails, the whole request fails validation. PARTIAL_COMMIT and TRANSACTIONAL are not supported values for the batchAtomicity parameter. The supported enumeration consists of ATOMIC and NON_ATOMIC, with NON_ATOMIC being the documented default. Therefore, B accurately reflects OCI Monitoring ' s default custom-metric ingestion behavior.

In OCI Monitoring Query Language, grouping() aggregates multiple matching metric streams into a common result rather than retaining separate streams for individual resources. Oracle ' s documentation demonstrates this syntax with expressions such as IopsRead[1m]{...}.grouping().max(). Here, [15m] establishes the metric aggregation interval, .mean() calculates the average transaction latency, and > 500 supplies the alarm threshold. groupBy(resourceId) would preserve separate result streams by resource ID, which directly contradicts the requirement to evaluate all resource metrics as one unified stream. filter(resourceId) is not valid grouping syntax, and absent() is designed to detect missing metric data rather than evaluate latency values. Therefore, TransactionLatency[15m].grouping().mean() > 500 correctly implements the stated aggregation and threshold logic.

 Cloud native is the software approach of building, deploying, and managing modern applications in cloud computing environments3. Cloud native apps are designed and built to exploit the scale, elasticity, resiliency, and flexibility the cloud provides4. Cloud native technologies support fast and frequent changes to applications without impacting service delivery, providing adopters with an innovative, competitive advantage3. Therefore, cloud native refers to the design and deployment of applications that are optimized for cloud infrastructure. Verified References: What is Cloud Native? - Everything you need to know, What is Cloud Native?| Microsoft Learn

OCI Application Performance Monitoring is specifically designed fordistributed tracingof application transactions across multiple components and services. Oracle states that APM collects and processes trace and span data, allowing administrators to analyze transaction performance, latency, volume, and errors across distributed applications. Trace Explorer can visualize traces containing multiple spans and help identify bottlenecks as requests move between services, databases, functions, and asynchronous components. OCI Monitoring concentrates primarily on metric streams, while Logging Analytics focuses on log aggregation and analysis. Service Mesh can provide service-to-service traffic telemetry and may participate in observability, but APM is the service designed to collect, correlate, and analyze distributed transaction traces. Therefore, D directly satisfies the end-to-end tracing requirement.

Oracle ' s Events filtering documentation explicitly defines the behavior of a standalone asterisk wildcard. When an attribute value consists only of *, it matchesall values for that attribute except null. The field must therefore exist and contain a non-null value for the rule condition to match. Oracle permits wildcard characters only in attribute values, and an asterisk can otherwise appear at the beginning, middle, or end of a value pattern. It is not interpreted as a literal asterisk in this context, nor is it restricted to matching empty strings. Option A is incorrect because null values are excluded. Therefore, option B precisely reflects Oracle ' s documented Events rule wildcard semantics.

Explanation

The testing strategy that achieves high velocity of deployments and releases of cloud native applications is " Automated testing. " Automated testing involves the use of automated tools and frameworks to execute tests, validate functionality, and detect issues or bugs in an application. By automating the testing process, developers and DevOps teams can rapidly test and validate code changes, ensuring that new features and updates are functioning correctly before being deployed to production. This approach helps increase the speed and efficiency of the testing process, allowing for faster and more frequent deployments of cloud native applications.

The best way to store and use secret information, such as database passwords, in Oracle Functions is to use the OCI Vault service. The OCI Vault service provides encryption and decryption capabilities for sensitive data. You can use the OCI Vault service to encrypt the password and store it as an application-level configuration variable. Then, you can use the generated key to decrypt the password in your function code when you need to access the database. Verified References: Oracle Functions: Using Key Management To Encrypt And Decrypt Configuration Variables

Explanation

The valid OKE cluster network configuration that meets the requirement of having the least attack surface while still allowing direct access to the deployed applications from the Internet is: Private subnets for nodes and the Kubernetes API endpoint; public subnets for load balancers. By placing the nodes and the Kubernetes API endpoint in private subnets, they are not directly accessible from the Internet, reducing the attack surface. The load balancers, on the other hand, are placed in public subnets, allowing them to be accessed from the Internet and serve as the entry point for accessing the deployed applications. This configuration ensures that the critical components of the cluster, such as the nodes and the API endpoint, are protected within the private network, while still providing accessibility to the applications through the load balancers. It helps to enhance security by limiting direct access to the internal components of the cluster while maintaining the availability of the deployed applications.

The docker inspect command retrieves detailed low-level metadata for Docker objects and returns the information in JSON format by default. Oracle ' s Docker documentation explicitly states that docker inspect can obtain full information about a container in JSON format and can expose specific configuration elements through formatting options. This includes network configuration, mapped ports, mounted storage, environment details, container state, and other runtime properties. docker stats provides live CPU, memory, network, and I/O utilization rather than static configuration metadata. docker history examines the image layer history and Dockerfile-derived changes. docker system provides system-wide administration commands and cleanup operations rather than detailed inspection of an individual container. Therefore, docker inspect is the appropriate troubleshooting command.

Explanation

The valid statements regarding the OCI Container Engine for Kubernetes (OKE) service are: OKE automatically creates and configures new network resources for the new cluster. When creating a new OKE cluster, the service automatically provisions and configures the necessary network resources, such as VCNs, subnets, route tables, security lists, and load balancers, to support the cluster. Your tenancy must have sufficient quota on different types of resources. Before creating an OKE cluster, you need to ensure that your Oracle Cloud Infrastructure (OCI) tenancy has sufficient quota for the required resources, such as compute instances, block storage, networking resources, and load balancers. You must have access to an Oracle Cloud Infrastructure tenancy. To use the OKE service, you need to have access to an OCI tenancy. This means you must have a valid OCI account and the necessary permissions to create and manage resources within the tenancy. The following statements are not valid: OKE cannot use existing network resources for the creation of a new cluster. OKE creates new network resources specifically for the cluster, and it does not support using existing network resources. There is a limit of three clusters within each region, but there is no limit on the number of nodes and pods you can create within each cluster. This statement is incorrect. There is no specific limit on the number of clusters you can create within a region in OKE. However, there may be certain limits or quotas on resources that can impact the number of clusters you can create.

OKE Virtual Nodes provide Oracle ' s serverless Kubernetes execution model. Oracle manages the underlying node infrastructure, eliminating the need for customers to provision, patch, upgrade, scale, or troubleshoot conventional worker-node infrastructure. Resource allocation and elasticity occur at the pod level, allowing workloads to scale without planning the capacity of a conventional node pool. Oracle also describes Virtual Nodes as providing pay-per-use pricing based on the compute resources consumed by each Kubernetes pod rather than charging for entire worker servers that might contain unused capacity. Managed, bare metal, and self-managed nodes remain infrastructure-oriented worker-node models and therefore do not provide the same serverless pod-level operating model. Consequently, Virtual Nodes are the configuration designed for granular elasticity and pod-oriented consumption.

Explanation

To troubleshoot issues in OCI, the option that is not valid is: Trace performance issues in the Application Performance Monitoring service by enabling Function traces. While the Application Performance Monitoring service in OCI allows you to monitor and trace the performance of your applications, it is specifically designed for monitoring OCI Functions (serverless functions) and does not directly apply to all types of applications. The other options mentioned, such as configuring logs in the OCI Logging service, leveraging OCI Cloud Guard for debug logs, viewing service metrics in the OCI Monitoring service, and using OCI Service Connector Hub for log forwarding, are valid options for troubleshooting and monitoring applications in OCI.

Oracle documents two predefined OKE Block Volume storage classes: oci-bv, which uses the CSI volume plugin, and oci, which uses the older FlexVolume plugin. For clusterscreated using Kubernetes version 1.24 or later, Oracle initially configures oci-bv as the default StorageClass. Because Kubernetes 1.28 is later than 1.24, a newly created 1.28 cluster uses oci-bv when a PVC omits storageClassName. Oracle recommends the CSI plugin and continues adding new functionality to it. An important exception applies to clusters originally created with Kubernetes 1.23 or earlier and subsequently upgraded—their original oci default can remain unchanged. Under the scenario stated, however, the initial default is oci-bv.

Explanation

The correct answer is: " Create a self-signed certificate and its corresponding key. Create a Kubernetes secret using the certificate and the key. Then add these annotations to the Kubernetes service: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret. " To create a secure SSL termination for your microservices-based application running in an OCI Container Engine for Kubernetes (OKE) cluster, you can follow these steps: Create a self-signed certificate and its corresponding key: Generate a self-signed SSL certificate and its private key using a tool like OpenSSL. Create a Kubernetes secret: Create a Kubernetes secret using the certificate and key obtained in the previous step. This secret will securely store the certificate and key within the Kubernetes cluster. Add annotations to the Kubernetes service: Modify the Kubernetes service that exposes your application and add the following annotations to enable SSL termination: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' (specify the SSL port as 443) annotations: service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret (specify the name of the Kubernetes secret containing the certificate and key) By following these steps, you can create a secure SSL termination for your application using a self-signed certificate and Kubernetes secret. The annotations added to the Kubernetes service ensure that the SSL port is configured correctly and the TLS secret is utilized for SSL termination when traffic reaches the load balancer. The other options provided are not the most suitable approaches for achieving secure SSL termination in an OCI Container Engine for Kubernetes (OKE) cluster: Adding annotations related to the OCI load balancer SSL secret key is not the correct approach for SSL termination in this scenario. Using Let ' s Encrypt to generate a self-signed certificate and configuring it on the OCI Load Balancer is not necessary when you can create and manage the SSL certificate within the Kubernetes cluster using a Kubernetes secret.

Option D is invalid because OCI Streaming imposes a maximum request/message payload size of approximately1 MiB, not 10 MB. Oracle ' s current Streaming documentation also verifies the remaining statements. Stream retention can be configured between 24 hours and seven days. Cursors are temporary consumption pointers and expire five minutes after being returned by the service. Private endpoints can be configured at the stream-pool level using a private subnet in a VCN, keeping producer and consumer traffic from traversing the public internet. These limits affect application architecture directly: payloads larger than the Streaming request limit normally need to be chunked or stored externally with only a reference carried in the message. Therefore, D is the only invalid statement.

OCI Streaming consumer groups assign each stream partition exclusively to one consumer-group instance at a time. Oracle states that every partition is owned by one instance following a successful rebalance and that instances exceeding the number of available partitions remain idle. With eight partitions, no more than eight of the twelve consumer instances can actively consume simultaneously, leaving four without assignments. This is not a fixed eight-consumer limitation: increasing the stream to twelve or more partitions could allow all twelve instances to become active. Consumer groups automatically coordinate partition assignment, offsets, commits, heartbeats, and rebalancing, so Service Connector Hub is unnecessary. Stream pools likewise do not determine the consumer-to-partition scaling relationship. Therefore, B explains the observed behavior precisely.

Oracle ' s documented OKE Workload Identity policy pattern is Allow any-user to < verb > < resource > in < location > where all {...} with conditions identifying request.principal.type= ' workload ' , the Kubernetes namespace, service account, and cluster OCID. Crucially, Oracle defines < location > as either the entire tenancyor a specific compartment. Oracle even provides examples granting a workload access only to resources in a named compartment. Consequently, C is false because workload-identity policies do not have to be tenancy-wide. Options A, B, and D accurately describe the standard policy structure: any-user is narrowed through workload-specific conditions, and those conditions identify the exact OKE workload by cluster, namespace, and service account. This enables fine-grained least-privilege access without storing OCI credentials inside pods.

Explanation

The correct options are: A configured OCI API signing key pair: The API signing key pair is used for authentication and authorization to access OCI resources, including the OKE cluster. The private key should be configured on your local machine to authenticate API requests. An SSH key pair with the public key added to the cluster worker nodes: This is required for secure SSH access to the worker nodes in the OKE cluster. You need to generate an SSH key pair and add the public key to the cluster ' s worker node pool during cluster creation or update. Therefore, the correct options are having a configured OCI API signing key pair and an SSH key pair with the public key added to the cluster worker nodes.

The OCI VCN-Native Pod Networking CNI plugin assigns pod IP addresses directly from the OCI VCN address space instead of allocating addresses from a separate overlay network. Oracle specifically states that these pod IP addresses are directly routable from other VCNs connected through VCN peering and from on-premises networks. This architecture makes pods first-class participants in OCI networking and enables native VCN functionality such as network security groups, security lists, and VCN flow logs to be applied to pod traffic. Flannel uses an overlay model and therefore does not provide the required directly routable VCN pod addresses. Calico is commonly associated with Kubernetes NetworkPolicy enforcement rather than being the required OCI native routing CNI. Therefore, D is correct.

Explanation

The correct answer is: Enable monitoring for all worker nodes in the cluster. Enabling monitoring for all worker nodes in the cluster is not required to collect and parse application logs using Oracle Cloud Infrastructure (OCI) Logging. Monitoring is a separate feature that allows you to collect metrics and monitor the health and performance of the worker nodes. To collect and parse application logs, you need to perform the following tasks: Set the OCI Logging option to Enabled for the cluster: This enables the OCI Logging service for the cluster. Create a dynamic group with a rule that includes all worker nodes in the cluster: This helps in targeting the logs generated by the worker nodes. Configure a custom log in OCI Logging with the appropriate agent configuration: This involves specifying the log source, log path, and log format to parse and collect the application logs. By completing these tasks, you can collect and parse the application logs generated by the applications running on the worker node compute instances in the OKE cluster.

Explanation

The step that is NOT required for setting up the Container Engine for Kubernetes (OKE) cluster access using a local installation of kubectl is to generate an Auth token from the OCI console. The authentication for accessing the OKE cluster using kubectl can be performed using the OCI CLI configuration, specifically the API signing key pair and the kubeconfig file. Here are the correct steps for setting up the OKE cluster access using a local installation of kubectl: Set up the kubeconfig file: The kubeconfig file contains the necessary information to authenticate and access the OKE cluster using kubectl. It includes details such as the cluster endpoint, authentication method, and credentials. Generate an API signing key pair (if you do not already have one) and upload the public key of the API signing key pair: The API signing key pair is used for authentication with the OCI services. The public key of the key pair needs to be uploaded to the OCI Console to associate it with your user account. Install and configure the Oracle Cloud Infrastructure (OCI) CLI: The OCI CLI provides a command-line interface to interact with the OCI services. It needs to be installed and configured with your OCI credentials, including the user ' s OCID, tenancy OCID, region, and the path to the API signing key pair. By completing these steps, you can configure kubectl to access and manage your OKE clusters from your local machine using the OCI CLI authentication configuration.

Explanation

The maximum execution time of Oracle Functions is 300 seconds, which is equivalent to 5 minutes. This means that a function running within Oracle Functions cannot exceed a runtime of 5 minutes. If a function requires longer execution times, alternative approaches such as invoking external services asynchronously or using long-running processes should be considered. It is important to design functions with this execution time limitation in mind to ensure optimal performance and efficiency within the Oracle Functions platform.

Oracle APM documentation specifies the provision-agent operation for installing and configuring the APM Java Agent. Its mandatory arguments include -service-name, identifying the monitored service; -destination, specifying where the agent is provisioned; -private-data-key, using the installation key generated for the APM domain; and -data-upload-endpoint, identifying the domain ' s upload endpoint. Oracle provides essentially the same command structure as option D in its provisioning documentation. register-agent, install-agent, and configure-agent are not the documented provisioning subcommands, while the alternative parameter names such as -app-name, -upload-key, and -path do not match Oracle ' s mandatory syntax. Consequently, option D is the fully documented command.

Explanation

The option that will get you more information on the error when invoking Oracle Functions from your Cloud Shell session is: " DEBUG=1 fn invoke myapp myfunction " . Setting the environment variable DEBUG=1 before invoking the function using the fn command allows you to enable debug mode, which provides more detailed information about the execution of the function. This can be useful for troubleshooting and understanding the root cause of the error. By using the command " DEBUG=1 fn invoke myapp myfunction " , the function invocation will be executed with debug mode enabled, and additional debug information will be displayed in the console output. This information can include stack traces, detailed error messages, and other relevant details that can help identify and resolve the issue. Using the verbose option (--verbose) or debug option (--debug) with the fn command may also provide additional information, but the specific behavior may depend on the version and configuration of the fn CLI tool. While contacting Oracle support with the error message is always an option, enabling debug mode using the DEBUG=1 environment variable provides immediate access to more detailed information and can help in diagnosing and resolving the error more efficiently.

OCI Queue is a fully managed serverless service that helps decouple systems and enable asynchronous operations2. Queue handles high-volume transactional data that requires independently processed messages without loss or duplication2. A valid use case for OCI Queue is building decoupled and scalable systems, such as event-driven architectures or microservices-based applications2. For example, you can use Queue to decouple your application and build an event-driven architecture. Decoupling ensures that individual application components can scale independently and that you can future-proof your design so that as new application components are built, they can publish or subscribe to the queue2.

Statement C is NOT valid because OCI Queue currently limits an individual message to256 KB, not a configurable 1 MB. Oracle ' s current functional limits specify a maximum message size of 256 KB, while a PutMessage batch request can contain up to 20 messages with a combined request size of 512 KB. Message retention can be configured from 10 seconds through seven days and cannot be changed after queue creation. Queue-level visibility timeout ranges from one second to twelve hours, and visibility can be adjusted while processing. Oracle also documents maximum delivery attempts as configurable from 1 through 20 before failed messages are moved to the dead letter queue. Therefore, C alone contradicts the current Queue functional limits.

Oracle Monitoring documents groupBy(x) specifically for aggregating metric streams according to a shared dimension. Oracle ' s own fault-domain example uses the exact expression CpuUtilization[1m].groupBy(faultDomain).mean(). The resulting chart contains one aggregated metric stream for each fault domain, which means a compartment containing three fault domains produces three lines rather than one line per Compute instance. grouping() combines all selected metric streams into a single aggregate instead of retaining separate fault-domain groups. filter(faultDomain) is not the appropriate MQL grouping operation, and split() is not the documented operator for this requirement. Because the scenario requires mean CPU utilization separately aggregated for each value of the faultDomain dimension, option B exactly matches Oracle ' s documented MQL pattern.

Explanation

To address the requirement of extracting and transforming data from the Oracle Cloud Infrastructure (OCI) Streaming service and sending it to a third-party REST endpoint using the OCI Service Connector Hub, the best configuration option is: Configure a new service connector as follows: • Source: Streaming • Task: None • Target: Notifications By selecting the Streaming service as the source, you can capture the transactional data from the stream. Since there is a need to transform and send the data to a third-party REST endpoint, you don ' t need to specify any specific task in the connector. The target is set to Notifications, which allows you to send the transformed data to an endpoint outside of the OCI environment. Notifications can be configured to deliver the data to various supported destinations, including HTTP endpoints, email addresses, and more. This configuration enables you to automate the process of extracting data from the streaming service and sending it to the desired third-party REST endpoint, fulfilling the requirement of extracting, transforming, and forwarding the data.

Statement D is NOT valid because OCIAudit logs are retained for 365 days, not 180 days. Oracle states that Audit retention is a tenancy-level setting affecting all regions and compartments and that its value cannot be changed. By contrast, OCI Logging service and custom logs support configurable retention in 30-day increments up to 180 days. Oracle also confirms that reducing a log ' s retention period makes existing data outside the new retention window unavailable and unsearchable. Therefore, the question intentionally distinguishes configurable Logging retention from the fixed OCI Audit retention model. The incorrect portion of D is specifically the stated 180-day duration; OCI Audit uses a 365-day retention period.

Explanation

The two statements that are NOT valid regarding the Oracle Cloud Infrastructure (OCI) Streaming service are: A stream can be configured with either a public or a private endpoint with support for customer managed encryption keys. This statement is not valid because the OCI Streaming service currently supports only private endpoints. Customer managed encryption keys are not currently supported for OCI Streaming. OCI Streaming can support up to 2,000 requests per second to each partition. This statement is not valid because the throughput of a stream is not defined by the partition in terms of requests per second. The throughput of a stream is defined in terms of data input and output rates. Each partition provides 1 MB/sec data input and 2 MB/sec data output, but it does not correspond to a specific number of requests per second. The other statements are valid: OCI Streaming stores all data for 24 hours by default, but that can be extended up to 7 days. Although OCI Streaming automatically encrypts all data while in transit, it is the developer ' s responsibility to encrypt data at rest, if needed.

Explanation

A valid concern that needs to be further investigated in this scenario is whether the OKE cluster has a secret with the credentials of the Oracle Cloud Infrastructure Registry (OCIR) repository and if that secret is being used in the Kubernetes deployment manifest. Here ' s why this concern is relevant: Access to the OCIR repository: In order for the OKE cluster to pull images from the OCIR repository, it needs proper authentication credentials. These credentials are typically provided in the form of a secret, which contains the necessary information to authenticate with the registry. Secret in the deployment manifest: The Kubernetes deployment manifest defines how the application containers should be deployed. It includes specifications such as the container image, resource requirements, and environment variables. To pull images from a private repository like OCIR, the deployment manifest needs to reference the appropriate secret that contains the registry credentials. If the images are not being pulled from the designated OCIR repository, it suggests that either the secret with the OCIR credentials is missing or it is not properly referenced in the deployment manifest. Further investigation should focus on verifying the presence and correctness of the secret, as well as confirming that it is correctly referenced in the deployment manifest for the application containers. By ensuring the presence of the secret and proper configuration in the deployment manifest, the OKE cluster will have the necessary credentials to access the OCIR repository and successfully deploy the application containers.

Oracle Secret Management documentation explicitly specifies that themaximum allowable size for a secret bundle is 25 KB. This limit applies when creating a secret or creating a new version of an existing secret. When using the OCI Console, administrators can enter plain-text secret contents and the Console performs the required Base64 encoding. When communicating directly with the service through supported APIs or CLI operations, secret contents must be supplied in the required encoded form. Secrets are intended for security-sensitive values such as passwords, API tokens, certificates, and configuration credentials rather than arbitrary large files. Payloads exceeding the supported secret-bundle size should therefore be redesigned, divided appropriately, or stored using a service suited to larger objects. Consequently, B is the verified Oracle limit.

End-to-end testing is a technique that involves checking the entire user flow as well as the moving parts of a cloud native app, ensuring that there are no high-level discrepancies3. End-to-end testing simulates real user scenarios and validates the functionality, performance, reliability, and security of the app from start to finish3. End-to-end testing has several benefits, such as3:

Comprehensive testing: You can test your app as a whole and verify that all the components work together as expected.

User-centric testing: You can test your app from the user’s perspective and ensure that it meets the user’s needs and expectations.

Quality assurance: You can test your app in a realistic environment and identify any issues or defects before releasing it to the users.

The Transactional Outbox pattern addresses the distributed-system dual-write problem by recording both the business-state change and an outgoing event within one local database transaction. Rather than attempting to atomically update a database and independently publish to a messaging platform, the service writes the event into an outbox table alongside the business update. Because both database modifications occur within the same transaction, they commit or roll back together. A separate publisher subsequently reads the outbox and sends the event to the messaging infrastructure. Oracle ' s current microservices architecture documentation explicitly identifies Transactional Outbox as the pattern for sending a message and performing a data manipulation operation within a single local transaction. Saga and CQRS address different distributed-system concerns.

Explanation

The term that describes developing microservices in different languages of choice is " Polyglot. " In a polyglot architecture, each microservice is developed using the most appropriate programming language or technology stack for its specific requirements. This approach allows developers to leverage the strengths of different languages and frameworks, enabling them to use the most suitable tool for each microservice while still maintaining interoperability between services.

Themaximum retention perioddefines the total amount of time OCI Queue retains a message before automatically deleting it if a consumer has not removed it. Oracle currently allows this value to be configured from 10 seconds through seven days, with a default of one day. Visibility timeout serves a different purpose: after a consumer retrieves a message, it temporarily hides that message from other consumers. Maximum delivery attempts controls how many unsuccessful delivery cycles can occur before a message is moved to the dead letter queue. Polling timeout determines how long a consumer request waits for messages to become available. Therefore, only the maximum retention period controls the overall lifetime of an unremoved message in OCI Queue.

Explanation

The correct value for the " type " field in the API deployment specification is " STOCK_RESPONSE_BACKEND " . By setting the " type " to " STOCK_RESPONSE_BACKEND " , you are indicating that the backend for the specified route should return a pre-defined response. This type of backend is commonly used when you want a specific response to be returned consistently, regardless of the actual backend service implementation. In this case, the API deployment specification is configured to have a single route with the path " /hello " and the method " GET " . The backend section specifies the type as " STOCK_RESPONSE_BACKEND " . Additionally, it defines the response status code as 200, sets the " Content-Type " header to " application/json " , and provides the JSON content in the " body " field. Using this configuration, any request to the " /hello " path with the " GET " method will always receive a consistent JSON response with the content " { " myjson " : " consistent response " } " .

OCI API Gateway request validation supportsEnforcing, Permissive, and Disabledvalidation modes. In Permissive mode, requests are validated and failures are recorded, but even non-compliant requests continue to the backend, making it appropriate for testing the impact of validation before enforcing it. Oracle also supports explicit header validation rules in which a header can be marked required: true. Enforcing mode instead blocks requests that fail validation and returns a 4xx response. No dynamic group is required for API Gateway to validate standard HTTP headers, and request.auth relates to authentication context rather than header-presence validation. Therefore, A and C directly satisfy both stated requirements.

OKE transitioned from Docker toCRI-Obeginning with Kubernetes 1.20.8. Oracle documents CRI-O as its Kubernetes Container Runtime Interface implementation for modern OKE worker nodes. CRI-O is purpose-built for Kubernetes and runs Open Container Initiative-compliant images, so existing Docker-format images remain usable even though Docker Engine itself is no longer the underlying Kubernetes runtime. Oracle ' s current OKE documentation continues to reference CRI-O on modern node pools, including current releases where runtime configuration changes can affect container behavior. containerd is common in other Kubernetes distributions but is not the runtime identified by Oracle for these OKE nodes. rkt is obsolete, and Docker Engine was used only by older OKE versions. Therefore, D is correct.

OCI Queue exposes separate IAM resource types specifically to enforce producer/consumer separation. Oracle documents queue-push for producers and queue-pull for consumers. The policy Allow dynamic-group payment-producer-dg to use queue-push in compartment prod-payment-compartment grants only QUEUE_PRODUCE, which covers the PutMessages API operation. It does not grant GetMessages, DeleteMessage, queue configuration reads, or queue administration. By comparison, use queues is broader because the general queues resource type includes read, update, produce, and consume capabilities. queue-pull provides consumer permissions rather than producer permissions, and manage queue-push is not the correct permission model for this specialized resource type. Therefore, A precisely implements least-privilege publishing for the producer microservice.

Explanation

The two correct differences between continuous delivery and continuous deployment in the DevOps lifecycle are: Continuous delivery is a process that initiates deployment manually, while continuous deployment is based on automating the deployment process. In continuous delivery, the software is ready for deployment, but the decision to deploy is made manually by a human. On the other hand, continuous deployment automates the deployment process, and once the software passes all the necessary tests and quality checks, it is automatically deployed without human intervention. Continuous delivery involves automatic deployment to a development environment, while continuous deployment involves automatic deployment to a production environment. In continuous delivery, the software is automatically deployed to a development or staging environment for further testing and validation. However, the actual deployment to the production environment is performed manually. In continuous deployment, the software is automatically deployed to the production environment, eliminating the need for manual intervention in the deployment process. These differences highlight the level of automation and human involvement in the deployment process between continuous delivery and continuous deployment approaches in the DevOps lifecycle.

Explanation

The correct answer is: " Edit the tenancy global retention policy. " To ensure that container images never get deleted from the Oracle Cloud Infrastructure Registry (OCIR), you should edit the tenancy global retention policy. The tenancy global retention policy is a setting that determines the retention behavior for all the images in the OCIR across the entire tenancy. By editing this policy, you can define the retention behavior that suits your requirements. To edit the tenancy global retention policy, you would typically perform the following steps: Access the Oracle Cloud Infrastructure Console and navigate to the OCIR service. Go to the " Policies " section or " Settings " section in the OCIR service. Locate the tenancy global retention policy settings. Modify the retention policy to specify the desired retention behavior. In this case, you would set the policy to retain all images, ensuring they are never deleted from the repository. By setting the global policy of image retention to " Retain All Images, " you can ensure that the container images in your OCIR repository are permanently retained and not subject to deletion based on any default or automatic retention rules. The other options mentioned are not directly related to ensuring that container images are never deleted from the repository: Creating a group and assigning a policy to perform lifecycle operations on images or writing a policy to limit access to the specific repository in your compartment are access control measures and do not address the retention of images. Setting the global policy of image retention to " Retain All Images " is the correct action to achieve the desired outcome of preventing image deletion from the repository.

When configuring an OCI API Gateway deployment, you need to specify the backend type for each route in your API deployment specification3. The backend type determines how the API gateway handles requests to that route and forwards them to the appropriate backend service3. The following backend types are valid options for an OCI API Gateway deployment3:

HTTP_BACKEND: The API gateway forwards requests to an HTTP or HTTPS URL as the backend service.

ORACLE_FUNCTIONS_BACKEND: The API gateway invokes an Oracle Functions function as the backend service.

STOCK_RESPONSE_BACKEND: The API gateway returns a stock response without invoking any backend service. ORACLE STREAMS_BACKEND is not a valid backend type for an OCI API Gateway deployment. Oracle Streams is a fully managed, scalable, and durable messaging service that you can use to ingest and consume large amounts of data in real-time4. However, Oracle Streams is not supported as a backend service for an OCI API Gateway deployment.

Oracle ' s Logging Query Language specification defines logContent as aspecial column representing the text of the whole original message. This field is particularly valuable when the required information is not available through a known indexed JSON field or when administrators need full-text matching across the original log payload. For example, Oracle documents queries such as where logContent = ' *ERROR* ' to return log lines containing the specified text. messageBody, rawPayload, and eventSource are not documented LQL special columns representing the complete original message. Individual services can contain fields such as data.message, but those fields are part of the service-specific structured payload rather than the universal raw-message special column. Therefore, A is correct.

The supplied Word answer key requires correction here. Current Oracle Queue documentation explicitly states that adead letter queue is automatically created when a queue is created. Therefore, option C is correct and option B is not. Oracle also provides the Maximum delivery attempts setting, which controls how many unsuccessful deliveries can occur before a problematic message is transferred to the DLQ. Setting that value to 5 implements the requested retry threshold. No separately provisioned target queue is required, consumer groups are optional and unrelated to enabling DLQ functionality, and administrators do not create an IAM policy authorizing a source queue resource to write to its automatically associated DLQ. Consequently, the verified current answer isA, C, not the Word file ' s A, B.

Explanation

The correct answers are: Amount of RAM used by a function: Oracle Functions collects and reports the amount of memory (RAM) used by a function during its execution. This metric helps in monitoring and optimizing the resource consumption of functions. Length of time a function runs: Oracle Functions captures and provides the duration of function executions. This metric allows you to track the performance and responsiveness of your functions and identify any potential bottlenecks or delays. These metrics provide valuable insights into the resource utilization and performance of your functions, enabling you to monitor and optimize their behavior in the Oracle Cloud Infrastructure (OCI) environment.

API mocking is a technique that simulates the behavior of real APIs without requiring the actual implementation or deployment of the dependent services1. API mocking allows you to test changes to service A without deploying all of its dependencies, such as service B, by creating mock responses for the APIs that service A relies on1. API mocking has several benefits, such as1:

Faster testing: You can test your service A without waiting for service B to be ready or available, which reduces the testing time and feedback loop.

Isolated testing: You can test your service A in isolation from service B, which eliminates the possibility of external factors affecting the test results or causing errors.

Controlled testing: You can test your service A with different scenarios and edge cases by creating mock responses that mimic various situations, such as success, failure, timeout, etc.

OKE Workload Identity is anenhanced-cluster capability. Oracle ' s current Kubernetes Engine documentation explicitly lists workload identity as supported by Enhanced clusters and not supported by Basic clusters. Workload Identity enables IAM policies to authorize individual Kubernetes workloads according to attributes such as cluster, namespace, and service account, avoiding broader permissions inherited from worker-node instance principals. Basic clusters support standard Kubernetes and OKE functionality but exclude enhanced capabilities including Workload Identity, virtual nodes, self-managed nodes, and advanced cluster add-on management. “Dedicated cluster” and “Autonomous cluster” are not the OKE cluster types used for this feature classification. Therefore, an application architecture requiring OKE Workload Identity must use an Enhanced cluster, making option A correct.

Explanation

The correct answer is " Service Mesh. " A service mesh is a configurable, low-latency infrastructure layer that controls the interaction between a network of microservices. It provides functionalities such as service discovery, load balancing, traffic management, security, and observability for microservices-based applications. It is designed to improve communication and manage the complex interactions between services within a distributed system. Service mesh frameworks like Istio and Linkerd are commonly used to implement service mesh architecture.