Oracle 1Z0-997 Online Practice Questions and Exam Preparation

Oracle 1Z0-997 Online Questions & Answers

• Question 11:

  A hospital in Austin has hosted its web based medical records portal entirely In Oracle cloud Infrastructure (OCI) using Compute Instances for its web-tier and DB system database for its data tier. To validate compliance with Health Insurance

  Portability and Accountability (HIPAA), the security professional to check their systems it was found that there are a lot of unauthorized coming requests coming from a set of IP addresses originating from a country in Southeast Asia.

  Which option can mitigate this type of attack?

  A. Block the attacking IP address by creating by Network Security Group rule to deny access to the compute Instance where the web server Is running
  B. Block the attacking IP address by implementing a OCI Web Application Firewall policy using Access Control Rules
  C. Mitigate the attack by changing the Route fable to redirect the unauthorized traffic to a dummy Compute instance
  D. Block the attacking IP address by creating a Security List rule to deny access to the subnet where the web server Is running
  B. Block the attacking IP address by implementing a OCI Web Application Firewall policy using Access Control Rules

  ---

  WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications.

  WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable

  bots to enter. Access rules can limit based on geography or the signature of the request.

  As a WAF administrator you can define explicit actions for requests that meet various conditions. Conditions use various operations and regular expressions. A rule action can be set to log and allow, detect, or block requests

• Question 12:

  Your company will soon start moving critical systems Into Oracle Cloud Infrastructure (OCI) platform. These systems will reside in the us-phoenix-1and us-ashburn 1 regions. As part of the migration planning, you are reviewing the company's

  existing security policies and written guidelines for the OCI platform usage within the company. you have to work with the company managed key.

  Which two options ensure compliance with this policy?

  A. When you create a new compute instance through OCI console, you use the default options for "configure boot volume" to speed up the process to create this compute instance.
  B. When you create a new block volume through OCI console, select Encrypt using Key Management checkbox and use encryption keys generated and stored in OCI Key Management Service.
  C. When you create a new compute instance through OCI console, you use the default shape to speed up the process to create this compute instance.
  D. When you create a new OCI Object Storage bucket through OCI console, you need to choose "ENCRYPT USING CUSTOMER-MANAGED KEYS" option.
  E. You do not need to perform any additional actions because the OCI Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption.
  B. When you create a new block volume through OCI console, select Encrypt using Key Management checkbox and use encryption keys generated and stored in OCI Key Management Service.
  D. When you create a new OCI Object Storage bucket through OCI console, you need to choose "ENCRYPT USING CUSTOMER-MANAGED KEYS" option.

  ---

  Block Volume Encryption By default all volumes and their backups are encrypted using the Oracle-provided encryption keys. Each time a volume is cloned or restored from a backup the volume is assigned a new unique encryption key. You have the option to encrypt all of your volumes and their backups using the keys that you own and manage using the Vault service.If you do not configure a volume to use the Vault service or you later unassign a key from the volume, the Block Volume service uses the Oracle-provided encryption key instead.

  

  This applies to both encryption at-rest and in-transit encryption. Object Storage Encryption Object Storage employs 256-bit Advanced Encryption Standard (AES-256) to encrypt object data on the server. Each object is encrypted with its own data encryption key. Data encryption keys are always encrypted with a master encryption key that is assigned to the bucket. Encryption is enabled by default and cannot be turned off. By default, Oracle manages the master encryption key. However, you can optionally configure a bucket so that it's assigned an Oracle Cloud Infrastructure Vault master encryption key that you control and rotate on your own schedule. Encryption: Buckets are encrypted with keys managed by Oracle by default, but you can optionally encrypt the data in this bucket using your own Vault encryption key. To use Vault for your encryption needs, select Encrypt Using Customer-Managed Keys. Then, select the Vault Compartment and Vault that contain the master encryption key you want to use. Also select the Master Encryption Key Compartment and Master Encryption Key.

  

• Question 13:

  You are building a highly available and fault tolerant web application deployment for your company. Similar application delayed by competitors experienced web site attack including DDoS which resulted in web server failing. You have decided to use Oracle Web Application Firewall (WAF) to implement an architecture which will provide protection against such attacks and ensure additional configuration will you need to implement to make sure WAF is protecting my web application 24?. Which additional configuration will you need to Implement to make sure WAF Is protecting my web application 24??

  A. Configure auto scaling policy and it to WAF instance.
  B. Configure Control Rules to send traffic to multiple web servers
  C. Configure multiple origin servers
  D. Configure new rules based on now vulnerabilities and mitigations
  C. Configure multiple origin servers

  ---

  Origin Management An origin is an endpoint (typically an IP address) of the application protected by the WAF. An origin can be an Oracle Cloud Infrastructure load balancer public IP address. A load balancer IP address can be used for high availability to an origin. Multiple origins can be defined, but only a single origin can be active for a WAF. You can set HTTP headers for outbound traffic from the WAF to the origin server. These name value pairs are then available to the application. Oracle Cloud Infrastructure Web Application Firewall (WAF) is a cloud-based, Payment Card Industry (PCI) compliant, global security service that protects applications from malicious and unwanted internet traffic. WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications. WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable bots to enter. Access rules can limit based on geography or the signature of the request. Distributed Denial of Service (DDoS) A DDoS attack is an often intentional attack that consumes an entity's resources, usually using a large number of distributed sources. DDoS can be categorized into either Layer 7 or Layer 3/4 (L3/4) A layer 7 DDoS attack is a DDoS attack that sends HTTP/S traffic to consume resources and hamper a website's ability to delivery content or to harm the owner of the site. The Web Application Firewall (WAF) service can protect layer 7 HTTP-based resources from layer 7 DDoS and other web application attack vectors.

• Question 14:

  An insurance company is storing critical financial data in the OCI block volume. This volume is currently encrypted using oracle managed keys. Due to regulatory compliance, the customer wants to encrypt the data using the keys that they

  can control and not the keys which are controlled by Oracle.

  What of the following series of tasks are required to encrypt the block volume using customer managed keys?

  A. Create a vault, import your master encryption key into the vault, generate data encryption key, assign data encryption key to the block volume
  B. Create a master encryption key, create a data encryption key, decrypt the block volume using existing oracle managed keys, encrypt the block volume using the data encryption key
  C. Create a vault, create a master encryption key in the vault, assign this master encryption key to the block volume
  D. Create a master encryption key, create a new version of the encryption key, decrypt the block volume using existing oracle managed keys and encrypt using new version of the encryption key
  C. Create a vault, create a master encryption key in the vault, assign this master encryption key to the block volume

  ---

  Oracle Cloud Infrastructure Vault lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to securely access resources. You can use the Vault service to create and manage the following resources: Vaults Keys Secrets Vaults securely store master encryption keys and secrets that you might otherwise store in configuration files or in code. The Vault service lets you create vaults in your tenancy as containers for encryption keys and secrets. If needed, a virtual private vault provides you with a dedicated partition in a hardware security module (HSM), offering a level of storage isolation for encryption keys that's effectively equivalent to a virtual independent HSM.

• Question 15:

  A global media organization is working on a project which lets users upload their videos on their site. After upload is complete, the video should be automatically processed by an Al algorithm. The algorithm will try to recognize actions in the videos so that it can be used to show related advertisements in future. The development team wants to focus on writing Al code and don't want to worry about underlying infrastructure for high-availability, scalability, security and monitoring. Which OCI services should you recommend for this project?

  A. Use OCI Events service for triggering automatic processing of video, Oracle Container Engine for Kubernetes (OKE) and OCI Digital Assistant
  B. Use Oracle Container Engine for Kubernetes (OKE) for deployment of Al Code, OCI Notifications and Object Storage
  C. Use OCI Resource Manager to manage the underlying infrastructure, OCI Functions and OCI Events service.
  D. Use Object Storage for storing videos, OCI Events service and OCI Functions
  D. Use Object Storage for storing videos, OCI Events service and OCI Functions

  ---

  Oracle Functions is a fully managed, multi-tenant, highly scalable, on-demand, Functions-as-a- Service platform. It is built on enterprise-grade Oracle Cloud Infrastructure and powered by the Fn Project open source engine. Use Oracle Functions (sometimes abbreviated to just Functions) when you want to focus on writing code to meet business needs. The serverless and elastic architecture of Oracle Functions means there's no infrastructure administration or software administration for you to perform. You don't provision or maintain compute instances, and operating system software patches and upgrades are applied automatically. Oracle Functions simply ensures your app is highly-available, scalable, secure, and monitored. With Oracle Functions, you can write code in Java, Python, Node, Go, and Ruby (and for advanced use

• Question 16:

  After performing maintenance on an Oracle Linux compute instance the system is returned to a running state You attempt to connect using SSH but are unable to do so. You decide to create an instance console connection to troubleshoot the issue. Which three tasks would enable you to connect to the console connection and begin troubleshooting?

  A. Use SSH to connect to the public: IP address of the compute Instance and provide the console connection OCID as the username.
  B. edit the Linux boot menu to enable access to console.
  C. Use SSH to connect to the service endpoint of the console connection service
  D. Reboot the compute instance using the Oracle Cloud Infrastructure (OCI) Management Console
  E. Upload an API signing key for console connection authentication.
  F. Stop the compute Instance using the Oracle cloud Infrastructure (OCI) Command Line interface (CLI).
  B. edit the Linux boot menu to enable access to console.
  C. Use SSH to connect to the service endpoint of the console connection service
  D. Reboot the compute instance using the Oracle Cloud Infrastructure (OCI) Management Console

  ---

  The Oracle Cloud Infrastructure Compute service provides console connections that enable you to remotely troubleshoot malfunctioning instances, such as:

  An imported or customized image that does not complete a successful boot.

  A previously working instance that stops responding.

  the steps to connect to console and troubleshoot the OS Issue 1- Before you can connect to the serial console you need to create the instance console connection. Open the navigation menu. Under Core Infrastructure, go to Compute and

  click Instances.

  Click the instance that you're interested in.

  Under Resources, click Console Connections.

  Click Create Console Connection.

  Upload the public key (.pub) portion for the SSH key. You can browse to a public key file on your computer or paste your public key into the text box.

  Click Create Console Connection.

  When the console connection has been created and is available, the status changes to ACTIVE.

  2- Connecting to the Serial Console

  you can connect to the serial console by using a Secure Shell (SSH) connection to the service endpoint

  of the console connection service

  Open the navigation menu. Under Core Infrastructure, go to Compute and click Instances.

  Click the instance that you're interested in.

  Under Resources, click Console Connections.

  Click the Actions icon (three dots), and then click Copy Serial Console Connection for Linux/Mac. Paste the connection string copied from the previous step to a terminal window on a Mac OS X or Linux system, and then press Enter to

  connect to the console. If you are not using the default SSH key or ssh-agent, you can modify the serial console connection

  Press Enter again to activate the console.

  3- Troubleshooting Instances from Instance Console Connections To boot into maintenance mode

  Reboot the instance from the Console.

  When the reboot process starts, switch back to the terminal window, and you see Console messages start to appear in the window. As soon as you see the GRUB boot menu appear, use the up/down arrow key to stop the automatic boot

  process, enabling you to use the boot menu. In the boot menu, highlight the top item in the menu, and type e to edit the boot entry. In edit mode, use the down arrow key to scroll down through the entries until you reach the line that starts with

  either linuxefi for instances running Oracle Autonomous Linux 7.x or Oracle Linux 7.x, or kernel for instances running Oracle Linux 6.x.

  At the end of that line, add the following:

  init=/bin/bash

  Reboot the instance from the terminal window by entering the keyboard shortcut CTRL+X.

• Question 17:

  Your customer recently ordered for a 1-Gbps Fast Connect connection In ap-tokyo-1 region of Oracle Cloud Infrastructure (OCI). They will us this to one Virtual cloud Network (VCN) in their production (OC1) tenancy and VCN In their development OC1 tenancy As a Solution Architect, how should yon configure and architect the connectivity between on premises and VCNs In OCI?

  A. Create two private virtual circuits on the FastConnect link. Create two Dynamic Routing Gateways, one for each VCNs. Attach the virtual circuits to the dynamic routing gateways.
  B. You cannot achieve connectivity using single FastConnect link as the production and the development VCNs-are in separate tenancies. Request one more FastConnect connection.
  C. Create a single private virtual circuit over FastConnect and attach fastConnect to either of the
  D. Create a hub-VCN that uses Dynamic Routing Gateway (DRG) to communicate with on-premises network over FastConnect. Connect the hub-VCN to the production VCN spoke and with development VCN spoke, each peered via their respective local Peering Gateway (LPG)
  D. Create a hub-VCN that uses Dynamic Routing Gateway (DRG) to communicate with on-premises network over FastConnect. Connect the hub-VCN to the production VCN spoke and with development VCN spoke, each peered via their respective local Peering Gateway (LPG)

  ---

  There's an advanced routing scenario called transit routing that enables communication between an onpremises network and multiple VCNs over a single Oracle Cloud Infrastructure FastConnect or IPSec VPN. The VCNs must be in the same region and locally peered in a hub-and-spoke layout. As part of the scenario, the VCN that is acting as the hub has a route table associated with each LPG (typically route tables are associated with a VCN's subnets).

  

• Question 18:

  An OCI Architect is working on a solution consisting of analysis of data from clinical trials of a pharmaceutical company. The data is being stored in OCI Autonomous Data Warehouse (ADW) having 8 CPU Cores and 70 TB of storage. The architect is planning to setup autoscaling to respond to dynamic changes in the workload. Which of the following needs to be considered while configuring auto scaling? Choose two

  A. Enabling auto scaling does not change the concurrency and parallelism settings
  B. Auto scaling also scales IO throughput linearly along with CPU
  C. The database memory SGA and PGA will not get affected by the changes in the number of CPUs during auto scaling
  D. The maximum CPU cores that will be automatically allocated for this database is 16 CPUs
  A. Enabling auto scaling does not change the concurrency and parallelism settings
  B. Auto scaling also scales IO throughput linearly along with CPU

  ---

  Auto scaling is enabled by default when you create an Autonomous Database instance or you can use Scale Up/Down on the Oracle Cloud Infrastructure console to enable or disable auto scaling. With auto scaling enabled the database can use up to three times more CPU and IO resources than specified by the number of OCPUs currently shown in the Scale Up/Down dialog. When auto scaling is enabled, if your workload requires additional CPU and IO resources the database automatically uses the resources without any manual intervention required. Enabling auto scaling does not change the concurrency and parallelism settings for the predefined services IO throughput depends on the number of CPUs you provision and scales linearly with the number of CPUs.

• Question 19:

  Your company has recently deployed a new web application that uses Oracle functions Your manager Instructed you to Implement major manage your systems more effectively. You know that Oracle functions automatically monitors functions on your behalf reports metrics through Service Metrics. Which two metrics are collected and made available by this feature?

  A. length of time a function runs
  B. number of times a function is removed
  C. number of times a function is invoked
  D. amount of CPU used by a function
  E. number of concurrent connections
  A. length of time a function runs
  C. number of times a function is invoked

  ---

  https://docs.cloud.oracle.com/en-us/iaas/Content/Functions/Reference/functionsmetrics.htm you can monitor the health, capacity, and performance of functions you've deployed to Oracle Functions by using metrics Oracle Functions monitors

  function execution, and collects and reports metrics such as:

  The number of times a function is invoked.

  The length of time a function runs for.

  The number of times a function failed.

  The number of requests to invoke a function that returned a '429 Too Many Requests' error in the response (known as 'throttled function invocations').

• Question 20:

  You are working with a customer who needs to attach an Oracle Cloud Infrastructure (OCI) block volume to a VM instance with read/write access type. The customer wants to know if the number of IOPS and throughput performance differs

  between the following two choices:

  ?Option A: attach a single 1 TB block volume to the VM instance ?Option B: attach two separate 500 GB block volumes In a RAID 0 array configuration to the VM instance You can assume that the customer is using iSCSI attachment type to

  attach the volumes to the instance. In addition, you can assume 1 MB block size for throughput and 4 KB block size for IOPS consideration.

  How should you respond to the customer?

  A. Option B provides higher level of throughput, but lower level of IOPS performance.
  B. Both options provide the same number of IOPS and throughput performance.
  C. Option A provides better IOPS, but lower throughput performance.
  D. Option B provides better IOPS and throughput performance.
  B. Both options provide the same number of IOPS and throughput performance.