1z0-1147 Oracle AI Database@Azure Architect Professional Questions and Answers

Microsoft's Oracle Exadata Database on Dedicated Infrastructure observability guidance explicitly defines a no-duplicate-destination rule for these resources: two diagnostic settings cannot send the same log categories to the same destination. Each diagnostic-setting configuration must therefore remain unique.

An Exadata resource can have multiple diagnostic settings—Microsoft documents a maximum of five per resource—but those settings are intended to provide different category/destination combinations. If an administrator attempts to create another setting with the same log categories targeting the same Log Analytics workspace, the duplicate configuration is rejected rather than automatically consolidated.

Microsoft Sentinel does not serve as a conflict-management mechanism for the diagnostic-settings configuration, and the platform does not resolve the collision by modifying Log Analytics retention. Retention is a separate workspace/data-management concern.

This rule prevents unintended duplicate ingestion and avoids unnecessary telemetry duplication and associated ingestion cost.

Therefore, A accurately describes the outcome.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — Exadata logging, Azure Monitor diagnostic settings, Log Analytics and observability constraints.

===============

Oracle's current service-availability matrix states that Oracle Exadata Database Service on Dedicated Infrastructure is eligible for Private Offer only . It is not available through the Public Offer/Pay As You Go purchasing model.

Therefore, if an organization originally onboarded Oracle AI Database@Azure using the Public Offer and subsequently requires Dedicated Exadata Infrastructure, the commercial relationship must be changed by engaging Oracle Sales and obtaining the appropriate Private Offer .

A delegated-subnet service-limit increase affects networking capacity and does not enable a database service that is excluded by the selected Marketplace offer. BYOL can reduce Oracle Database licensing charges where eligible, but licensing model and Marketplace service eligibility are separate issues. Changing an Autonomous Database workload type is completely unrelated to Exadata hardware procurement.

Oracle's current service table also shows why the confusion can arise: Exadata Database Service on Exascale Infrastructure is available through both Public and Private Offers, whereas Exadata Database Service on Dedicated Infrastructure remains Private Offer only.

Therefore, A is correct.

Study Guide reference: Oracle AI Database@Azure Architecture and Onboarding — offer eligibility and Dedicated Infrastructure purchasing.

===============

Oracle AI Database@Azure does not eliminate the need for an OCI tenancy. Oracle explicitly requires an Oracle Cloud account/OCI tenancy during onboarding. A Public Offer creates a new tenancy, while a Private Offer can link an eligible existing tenancy or create one.

The other choices describe genuine architectural advantages. Oracle deploys its database infrastructure inside isolated areas of selected Microsoft Azure data centers, which places Oracle database resources physically close to Azure applications. This enables low-latency application-to-database communication through Azure networking rather than forcing production data traffic across the public internet to a distant OCI region.

Oracle also configures a managed connection between the Azure Child Site and geographically paired OCI Parent Site. The Parent Site hosts the Oracle control-plane components used to operate and manage the Oracle infrastructure located inside Azure.

The result is an architecture combining Azure-native application proximity and management integration with Oracle's database infrastructure and operational control.

Therefore, the claim that OCI tenancy requirements disappear is false, making A the correct "NOT a benefit" answer.

Study Guide reference: Introduction to Multicloud — Oracle AI Database@Azure architecture and multicloud benefits.

===============

Oracle's Multicloud Architecture Framework emphasizes architectural considerations that arise because workloads, applications, data, identities, and operational responsibilities span multiple cloud providers. Two major areas are network latency/data movement and security, identity, and operations management .

Cross-cloud network latency can directly affect application response time, database performance, replication behavior, and transaction processing. Data movement can also introduce throughput constraints and cost considerations. Oracle therefore recommends workload placement and private connectivity strategies that minimize unnecessary cross-cloud distance and traffic.

Security and operations become similarly important because each cloud provider has its own IAM, monitoring, automation, and administrative models. Oracle recommends consistent identity and access policies, unified visibility, standardized automation, and common operational practices to avoid fragmented governance or management silos.

Hardware manufacturing origin and OCI hypervisor patch schedules do not represent the principal multicloud architectural design considerations described by the framework. Hypervisor maintenance is primarily a provider operational responsibility.

Therefore, B and D align directly with Oracle's documented multicloud design pillars.

Study Guide reference: Introduction to Multicloud — latency, data movement, Cloud Security, Cloud Operations, identity integration and operational standardization.

===============

Oracle Database Autonomous Recovery Service provides the specific capabilities required for multi-year database backup retention combined with immutability .

Oracle's Long-Term Retention capability allows a full database backup to be retained for up to ten years . This addresses regulatory requirements that exceed ordinary operational backup-retention windows. Recovery Service additionally supports Retention Lock , which prevents protected backups from being modified or deleted before the configured retention period expires. This provides a database-aware immutability mechanism suitable for ransomware, malicious-administrator, and compliance-protection scenarios.

Merely increasing a standard Object Storage backup retention value does not provide the same Recovery Service lifecycle, recoverability validation, protection-policy model, or database-specific retention locking. NFS likewise does not introduce a managed ten-year immutable recovery framework. Manual on-demand backups also fail to provide policy-enforced retention and introduce unnecessary operational risk.

The combination of Recovery Service, LTR, and Retention Lock directly addresses both requirements in the question: ten-year retention and immutability .

Therefore, B is correct.

Study Guide reference: Secure Oracle AI Database@Azure — Autonomous Recovery Service, Long-Term Retention and Retention Lock.

===============

Oracle's current Oracle AI Database@Azure service matrix explicitly identifies Oracle Exadata Database Service on Exascale Infrastructure as eligible for both Private Offer and Public Offer purchasing models.

A Public Offer uses a pay-as-you-go Azure Marketplace model and allows customers to begin consuming supported services without first negotiating a custom contract with Oracle Sales. A Private Offer is based on negotiated commercial terms and is appropriate for enterprise commitments and customized pricing.

Exadata Database Service on Dedicated Infrastructure is Private Offer eligible but not Public Offer eligible. The same Private-Offer-only restriction applies to Autonomous AI Database on Dedicated Exadata Infrastructure. Oracle Database Autonomous Recovery Service is a database protection service rather than the alternative primary high-performance Exadata database platform requested by the scenario, and it is also listed as Private Offer only.

Exascale therefore combines Exadata database capabilities with a lower-entry, elastic shared-infrastructure model and marketplace flexibility.

Thus, A is correct.

Study Guide reference: Oracle AI Database@Azure Architecture and Onboarding — Azure Marketplace offers and available database services.

===============

Purchasing and subscribing to the Oracle AI Database@Azure Private Offer establishes the Azure Marketplace commercial relationship, but it does not complete the technical onboarding process. The next mandatory stage is linking the Azure subscription to an Oracle Cloud Infrastructure tenancy . Oracle refers to this process as multicloud linking.

For a Private Offer, the customer can either create a new OCI tenancy or link an existing eligible OCI tenancy. The linked OCI account supplies the Oracle-side control-plane context used for database resources, including management of container databases and pluggable databases and delivery of Oracle infrastructure and software maintenance services. Only after the Purchase and Link stages have been completed and the account relationship is verified can normal Oracle AI Database@Azure resource provisioning proceed.

Azure Key Vault integration is optional and relates to customer-managed TDE keys. Data Guard is configured after database infrastructure exists, and an Autonomous Database is not a prerequisite for Exadata.

Therefore, D is correct. Study Guide reference: Oracle AI Database@Azure Architecture and Onboarding — Purchase, Link, Verify, and OCI tenancy association.

===============

Oracle AI Database@Azure applies a regional service limit to delegated subnet usage. The documented default is five delegated subnets per OCI tenancy in a specific region . This is a service quota rather than a limitation that can be bypassed through additional Azure routing constructs.

To exceed the default, the customer must request a service limit increase . Oracle identifies the relevant OCI service as Multicloud, the resource as Delegated Subnet Multicloud Links , and the corresponding service-limit name as azure-delegated-subnet-count. The limit is regional, so introducing another VNet, Route Server, VNet peering relationship, or Microsoft Entra tenant does not increase the permitted count.

Current documentation phrases the operation as requesting a service limit increase through Oracle's service-limit process. Among the supplied choices, option D is the only one that represents that required Oracle-side quota increase.

Architecturally, this distinction matters because routing topology and service capacity are independent control planes: networking objects determine reachability, whereas Oracle-enforced service limits determine how many delegated-subnet links may exist.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet limits and Multicloud service-limit management.

===============

The required workflow is ZDM Logical Online Migration . The defining requirements are cross-platform migration, database-version change, Data Pump initial loading, ongoing transaction replication, and minimal cutover downtime.

ZDM Logical Online uses Oracle Data Pump to establish the initial target data set and Oracle GoldenGate to capture and replicate transactions occurring on the source while the bulk migration is underway. Once the target is synchronized, ZDM coordinates the final cutover, reducing application interruption to the controlled switchover period.

This logical model is appropriate for migrations such as IBM AIX to Linux-based Exadata because logical migration is not dependent on source and target having identical physical database-file formats or endian architectures. It also accommodates supported cross-version migrations.

Logical Offline also uses Data Pump but does not maintain continuous GoldenGate synchronization and therefore requires substantially greater application downtime. Physical migration uses RMAN/Data Guard and is constrained by physical compatibility requirements, making it unsuitable for the described cross-platform transformation.

Thus, B is correct.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDM Logical Online, Data Pump and GoldenGate.

===============

Oracle's documented federation procedure between Microsoft Entra ID and an OCI IAM Identity Domain uses Security Assertion Markup Language (SAML) , specifically SAML 2.0.

During configuration, an Oracle Cloud Infrastructure Console enterprise application is configured in Microsoft Entra ID. The administrator selects SAML as the single sign-on method, exchanges SAML metadata between Microsoft Entra ID and the OCI Identity Domain, configures identity attributes and claims, and establishes Microsoft Entra ID as the identity provider for OCI.

SAML allows an administrator to authenticate through the enterprise Microsoft identity environment and obtain federated access to OCI without maintaining a separate password specifically for the OCI Console.

Kerberos is primarily a ticket-based authentication protocol traditionally associated with Active Directory and internal network authentication. RADIUS is commonly used for network access authentication and accounting. OAuth 2.0 Client Credentials is designed for service-to-service authorization rather than interactive federated user SSO.

Therefore, D. SAML is the correct protocol.

Study Guide reference: Secure Oracle AI Database@Azure — Microsoft Entra ID and OCI Identity Domain federation.

===============

The scenario directly matches Oracle's documented multicloud use case of running applications in one cloud and databases in another , also described here as an application and database split-stack architecture .

This design allows an organization to place its application tier in the cloud offering the preferred application-development ecosystem while retaining the database on the cloud platform offering the required database capabilities. In this case, Azure provides containerization and application modernization services, while OCI continues hosting Oracle Exadata Database Service for high transaction throughput, database availability, and Oracle-native operational control.

Private, high-bandwidth intercloud connectivity is critical because application-to-database latency directly affects transaction response time. Keeping data movement predictable and minimizing unnecessary public-internet routing also improves security and can reduce data-transfer overhead.

Horizontal workload distribution instead spreads workloads across clouds rather than separating application and database tiers. Production/development separation addresses lifecycle environments, while SaaS/ERP integration addresses data interoperability rather than a transactional split-stack application.

Therefore, C is the correct architectural pattern.

Study Guide reference: Introduction to Multicloud — Running Applications in One Cloud and Databases in Another.

===============

Oracle's preferred ZDM Physical Online workflow for Oracle Database@Azure supports direct data transfer , specifically to avoid staging large RMAN backups in intermediate object or file storage. In this workflow, ZDM creates the target database using the Restore From Service method.

RMAN streams the required database blocks directly from the source database service to the target environment over the configured network connection. After the target database has been instantiated, Oracle Data Guard maintains synchronization between source and target by transporting and applying redo. ZDM then orchestrates the cutover when the migration reaches the appropriate stage.

This approach is particularly significant for a large database such as the 10 TB system in the scenario because intermediate backup staging would require substantial temporary storage, additional I/O, and backup-transfer operations. Oracle explicitly states that the physical online direct-data-transfer workflow creates the target through Restore From Service and avoids backing up the source to an intermediate storage location.

Backup and Restore therefore describes the physical offline/staged model. Transportable Tablespaces is not the standard ZDM physical-online instantiation mechanism.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDM Physical Online, direct data transfer, RMAN Restore From Service and Data Guard.

===============

The requirement is specifically to place backup recovery points outside the cloud that hosts the production database . Oracle identifies this as the Cross-Cloud Backups multicloud use case.

In a cross-cloud backup architecture, production data hosted in one cloud is backed up to a different cloud provider. Oracle describes this pattern as providing protection against failures, operational mistakes, attacks, or other incidents affecting the primary cloud. Because the secondary copy is located outside the original cloud environment, it also provides an additional isolation boundary that can satisfy organizational or regulatory requirements for off-site backups.

An application/database split-stack design solves a different problem: it places application and database tiers in different clouds to exploit provider-specific capabilities. Horizontal workload distribution spreads active workloads across providers, while production/development separation assigns lifecycle environments to different clouds. Neither inherently guarantees an independently located backup recovery point.

The scenario is therefore a direct match for Oracle's Cross-Cloud Backups pattern.

Study Guide reference: Introduction to Multicloud — Cross-Cloud Backups, resilience, data protection and provider diversification.

===============

Oracle Exadata Database Service on Exascale Infrastructure uses the Elastic Compute Processing Unit (ECPU) resource model. During initial VM Cluster provisioning, Oracle requires a minimum of 8 ECPUs enabled per VM .

The distinction between the initial minimum and subsequent scaling increments is important. After the VM Cluster exists, enabled compute capacity is adjusted in increments of 4 ECPUs . Therefore, 4 ECPUs represents the scaling granularity, not the minimum provisionable starting configuration. Oracle also allows enabled ECPUs to be reduced to zero after provisioning when administrators need to temporarily shut down the VMs and suspend enabled-ECPU usage billing, but zero cannot be used as the initial active configuration.

Current Oracle documentation defines the supported total ECPU allocation per VM within the applicable Exascale service limits and explicitly states that the provisioned value must be a multiple of four.

Consequently, neither 1 nor 4 meets the initial provisioning baseline, while 16 is valid but exceeds the minimum. The correct answer is A. 8 ECPUs .

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — Exascale VM Cluster sizing and ECPU configuration.

===============

The -eval option invokes the evaluation workflow of Oracle Zero Downtime Migration rather than executing the production migration. Oracle specifically directs administrators to use ZDMCLI migrate database ... -eval to evaluate the migration process, including prerequisite checks, source/target connectivity verification, configuration validation, and applicable pre-migration assessment phases.

The resulting job is an evaluation job rather than a migration job that performs database movement. This distinction is reflected throughout ZDM command handling: ZDM can query evaluation jobs separately from actual migration jobs, and the evaluation workflow is intended to identify prerequisite or configuration failures before production data movement begins.

The option does not create a mock standby or execute a simulated Data Guard switchover. It also does not begin an offline migration and stop before the copy phase. CPAT may participate in migration-readiness assessment depending on ZDM version and command options, but -eval is not an installation command for CPAT.

Consequently, A correctly represents the effect: an EVAL-type workflow performs migration prechecks and validation without executing the actual migration.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDM CLI, evaluation mode, migration validation and prechecks.

===============

Oracle Autonomous AI Database Serverless documents a local Autonomous Data Guard standby RTO SLO of two minutes for failure events that require failover to the standby.

For the Recovery Point Objective, current Oracle documentation is slightly more precise than the wording in option A: the local standby's maximum possible data-loss objective is less than 10 seconds . Therefore, the exam option stating "RPO of 10 seconds" represents the intended and closest supported value.

These SLOs apply to events such as full database failure, complete storage failure, corruption scenarios requiring standby transition, and availability-domain failures when Autonomous Data Guard is enabled. Local standby protection provides materially faster recovery and a substantially smaller possible data-loss window than cross-region standby protection because replication remains geographically close.

An hour-long RTO is inconsistent with active standby protection, while five-minute RPO and thirty-second RPO values do not match Oracle's stated local Autonomous Data Guard objectives.

Therefore, A is correct, interpreted technically as 2-minute RTO and < 10-second RPO .

Study Guide reference: HA and DR — Autonomous Data Guard local standby SLOs.

===============

The Network Anchor abstraction establishes the mapping between Azure networking resources and corresponding OCI networking constructs. It is particularly important for services that use the newer multicloud anchor model, allowing an Azure VNet and delegated subnet to be associated consistently with Oracle-managed resources.

Oracle's DNS documentation explicitly restricts the Network Anchor DNS-resolution capability in question to Oracle Base Database Service . Network Anchors can provide DNS integration between Azure and OCI, including inbound and outbound resolution paths. Depending on the configuration, DNS listening and forwarding functionality can be enabled so resources on either side of the multicloud boundary can resolve the required private names.

The question's "Replicate DNS Private zones during DB creation" behavior belongs to this Base Database Service Network Anchor DNS workflow. Exadata Database Service on Dedicated Infrastructure and Exadata Database Service on Exascale Infrastructure use their documented Exadata networking and DNS provisioning mechanisms. Autonomous AI Database likewise has its own networking lifecycle and is not the service to which this Network Anchor-specific private-zone replication setting applies.

Therefore, the database service required to expose the specified option is Oracle Base Database Service .

Study Guide reference: Configure Oracle AI Database@Azure Networking — Network Anchors, private DNS, inbound/outbound DNS resolution, Base Database Service networking.

===============

ZDM manages migrations as persistent scheduled jobs and assigns each job a unique job ID. Administrators must manipulate these jobs through the supported ZDMCLI lifecycle commands rather than modifying ZDM repository or log files manually.

Oracle documents the command zdmcli abort job -jobid < job_id > for terminating a specified ZDM job. When an existing job context is preventing a new migration workflow from being established for the same source, the supported administrative approach among the available options is to identify the existing job and abort it through ZDMCLI.

Restarting the ZDM service does not remove the persistent job record; the job metadata is maintained by ZDM rather than existing only in the running daemon's memory. Manually deleting files from ZDM directories is unsupported and risks corrupting or desynchronizing job state. Likewise, the proposed -ignore ALL option is not a supported mechanism for bypassing ZDM's migration-job lifecycle controls.

Consequently, B is the correct operational command because it acts on the existing migration through the supported ZDM control interface.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDMCLI job management, query/abort operations and migration workflow lifecycle.

===============

Cross-availability-zone Oracle AI Database@Azure disaster recovery requires separate networking constructs for the primary and standby deployments. Oracle's Data Guard prerequisite documentation specifies two Azure VNets , with each VNet containing one Oracle AI Database@Azure delegated subnet , when configuring Data Guard between different availability zones in the same Azure region.

A separate delegated subnet ensures that each Exadata deployment receives the correct network attachment, address space, routing, and zone-aligned connectivity. Oracle also requires the associated VNet address spaces to be non-overlapping.

Reusing the AZ1 delegated subnet for infrastructure located in AZ2 would therefore conflict with the supported topology. Self-peering a subnet is not an Azure networking construct and would provide no meaningful isolation. Removing delegation would be counterproductive because delegation to Oracle's database resource provider is fundamental to provisioning Oracle AI Database@Azure networking.

Thus, A is the correct deployment pattern.

Study Guide reference: Configure Oracle AI Database@Azure Networking — cross-zone Data Guard networking, delegated subnets and VNet separation.

===============

Oracle Application Continuity (AC) is the application-availability technology designed to mask recoverable database outages and replay database requests transparently after a connection is re-established.

Oracle RAC provides database-service continuity when one database instance or node becomes unavailable, but an application may still have active sessions or in-flight work on the failed instance. Application Continuity works with Oracle's high-availability connection infrastructure, database services, FAN, Transaction Guard, and supported clients to reconnect to an available instance and replay eligible database requests. This significantly reduces the application errors that would otherwise be exposed during node failure or planned maintenance.

Fast-Start Failover and Data Guard Broker operate at the Data Guard database-role and disaster-recovery level. They manage primary/standby transitions rather than transparently replaying an individual application session after a RAC node failure. Transparent Data Encryption protects database data at rest and has no role in request replay or failure masking.

Therefore, C. Oracle Application Continuity is correct.

Study Guide reference: HA and DR with Oracle AI Database@Azure — RAC application availability, FAN, Transaction Guard and Application Continuity.

===============

With the Default DNS option, Oracle automatically creates and manages the private DNS configuration associated with the Exadata VM Cluster. The generated database networking domain uses the oraclevcn.com suffix.

The Single Client Access Name (SCAN) listener and database-node FQDNs are registered within this Oracle-managed private DNS domain. OCI hosts the corresponding private DNS zone and, as part of the Oracle AI Database@Azure integration, the service replicates the required DNS records into a matching Azure Private DNS zone. Azure then links that private zone to the VNet hosting the Oracle database deployment, allowing Azure applications to resolve the Oracle database endpoints privately.

oraclecloud.com is broadly used for Oracle public cloud endpoints but is not the default private VCN suffix for the Exadata SCAN name. azure-database.net and oci-exadata.com are likewise not the default suffixes used by this Oracle-managed DNS architecture.

Therefore, D. oraclevcn.com is correct.

Study Guide reference: Configure Oracle AI Database@Azure Networking — Exadata default DNS, SCAN and Azure Private DNS replication.

===============

Oracle's Hub-and-Spoke design guidance defines an important UDR rule for Oracle AI Database@Azure delegated subnets: the route prefix must be at least as specific as the delegated subnet CIDR . A /24 delegated subnet therefore cannot be reliably represented by a broader /16 route when the architecture requires the delegated subnet-specific path.

The less-specific route can fail to take precedence over more-specific system or service routes. This creates the possibility that traffic takes one route toward the database but returns through a different route. Such asymmetric routing is especially problematic with Azure Firewall or an NVA because stateful firewalls expect both directions of a connection to traverse the same inspection point. If the return packet follows a different path, the firewall can drop the session.

A UDR has no mechanism for duplicating VNICs, changing SQL*Net encryption, or resizing the underlying subnet. It simply influences Layer-3 forwarding.

Therefore, A accurately describes the documented routing consequence.

Study Guide reference: Configure Oracle AI Database@Azure Networking — UDR prefix specificity, delegated subnet routing, Hub-and-Spoke and asymmetric routing prevention.

===============

Oracle's cross-region Oracle Database@Azure reference architecture requires an additional Hub VCN because each OCI VCN can be attached to only one Dynamic Routing Gateway (DRG) at a time.

The Oracle-managed database VCN associated with an Exadata VM Cluster already uses a DRG as part of the Oracle Database@Azure network architecture. Cross-region VCN peering also requires DRG-based remote peering. Because a second DRG cannot simply be attached to the existing database VCN, Oracle introduces a separate Hub VCN with its own DRG. The database VCN is locally connected to the Hub VCN, and the Hub DRGs establish the cross-region remote peering connection.

OCI documentation independently confirms that one VCN can attach to only one DRG, whereas a single DRG can support many VCN attachments. A VCN can also have multiple Local Peering Gateways, so option B is technically incorrect.

The limitation is therefore architectural rather than a restriction caused by Azure subnet delegation or tenancy boundaries.

Study Guide reference: HA and DR — OCI transit networking, Hub VCN, DRG, LPG and cross-region Data Guard.

===============

Oracle documents multiple Azure network patterns for application connectivity to Oracle AI Database@Azure, including VNet peering and Hub-and-Spoke VNet peering .

VNet peering enables application workloads in one Azure VNet to communicate privately with Oracle database resources exposed through a delegated subnet in another VNet. This is appropriate when relatively direct, low-latency communication is required.

A Hub-and-Spoke design introduces a central hub containing shared connectivity and security services, such as Azure Firewall, a Network Virtual Appliance, ExpressRoute gateway, or VPN gateway. Application and database VNets connect as spokes or workload/data networks, allowing centralized inspection and hybrid connectivity.

Oracle's documented topology set also includes local VNet, global connectivity, on-premises Hub-and-Spoke, and related enterprise designs. A point-to-site VPN client model is not identified as the standard application topology requested here. More fundamentally, an Oracle AI Database@Azure deployment cannot exist without an Azure VNet and delegated networking.

Therefore, the correct selections are B and C .

Study Guide reference: Configure Oracle AI Database@Azure Networking — VNet Peering and Hub-and-Spoke topologies.

===============

Azure User-Defined Routes provide explicit Layer-3 forwarding control for traffic entering or leaving an Oracle AI Database@Azure delegated subnet. Oracle's documented network topologies use UDRs to direct application, on-premises, and database traffic through prescribed next hops such as an Azure Firewall or Network Virtual Appliance. This enables architects to construct custom network routing paths between on-premises systems and Exadata databases and exercise granular routing control across hybrid infrastructure .

In a Hub-and-Spoke deployment, for example, UDRs on application spokes can force database-bound traffic through the hub firewall, while corresponding routes on the Oracle AI Database@Azure spoke provide a symmetric return path. This is an architectural routing control, not a dynamic-routing protocol. ExpressRoute path selection is governed by BGP and ExpressRoute configuration rather than by a UDR automatically choosing between circuits.

Likewise, UDRs do not override Oracle-managed control-plane connectivity or scheduled lifecycle-management routes. Those functions remain under the service architecture.

Therefore, A and C are the supported routing capabilities. Study Guide reference: Configure Oracle AI Database@Azure Networking — UDRs, delegated subnets, hybrid connectivity, Hub-and-Spoke routing.

===============

Backup Retention Lock is a protection mechanism intended to prevent administrators or compromised credentials from prematurely reducing the recoverability window of Autonomous AI Database backups. Once the lock is established, normal administrative interfaces cannot simply disable it or reduce the protected backup-retention period.

Oracle's Autonomous AI Database documentation explicitly states that after the backup retention lock has been set, the option cannot be disabled or the retention period changed through ordinary database administration. To disable the lock or modify the locked retention setting, the administrator must file a Service Request with Oracle Cloud Support .

This design provides an administrative separation between ordinary database management and an action that could materially weaken backup protection. Changing an Azure Key Vault key has no relationship to the retention-policy lock. An SQL ALTER DATABASE command cannot override a service-level backup governance control, and the Azure Portal does not expose a supported bypass to reduce the locked period.

Accordingly, A is the only supported escalation path in the choices.

Study Guide reference: Secure Oracle AI Database@Azure — Autonomous AI Database backup protection, retention policy, retention lock and operational security controls.

===============

For ZDM physical online migrations using direct data transfer , Oracle's Maximum Availability Architecture pattern uses RMAN's Restore From Service capability. Rather than first creating backup pieces in a staging location, transporting them, and then restoring them on the target, RMAN restores the target database directly across the network from the source service.

This design reduces intermediate storage requirements and simplifies the migration pipeline. Once the target database has been instantiated, ZDM automatically configures Oracle Data Guard and uses redo transport to maintain synchronization until the planned switchover. The combination of Restore From Service and Data Guard is the central technical pattern Oracle documents for physical online migration to Exadata Database Service on Oracle AI Database@Azure.

Although DUPLICATE ... FROM ACTIVE DATABASE is a legitimate RMAN cloning capability in other contexts, it is not the named method documented for this ZDM direct-data-transfer workflow. Compressed backup-set streaming and incremental image-copy pushing also imply different backup/staging mechanisms.

Therefore, Restore From Service is the MAA-aligned RMAN method represented by the scenario.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — MAA, ZDM Physical Online migration, RMAN direct data transfer and Restore From Service.

===============