1z0-1084-26 Oracle Cloud Infrastructure Developer Professional Questions and Answers

Explanation

The correct value for the " type " field in the API deployment specification is " STOCK_RESPONSE_BACKEND " . By setting the " type " to " STOCK_RESPONSE_BACKEND " , you are indicating that the backend for the specified route should return a pre-defined response. This type of backend is commonly used when you want a specific response to be returned consistently, regardless of the actual backend service implementation. In this case, the API deployment specification is configured to have a single route with the path " /hello " and the method " GET " . The backend section specifies the type as " STOCK_RESPONSE_BACKEND " . Additionally, it defines the response status code as 200, sets the " Content-Type " header to " application/json " , and provides the JSON content in the " body " field. Using this configuration, any request to the " /hello " path with the " GET " method will always receive a consistent JSON response with the content " { " myjson " : " consistent response " } " .

Explanation

The Fn Project is an open source serverless computing platform that serves as the engine for Oracle Functions. It provides a runtime environment for executing functions in a serverless architecture. The Fn Project enables developers to build and deploy functions using different programming languages, including Java, Python, Node.js, and more. The Fn Project is designed to be flexible and extensible, allowing developers to define functions as small units of code and execute them in response to events or triggers. It supports event-driven execution, allowing functions to be triggered by various events such as HTTP requests, messages from messaging systems, or changes in data. Oracle Functions leverages the Fn Project as its underlying engine, providing a managed serverless platform within the Oracle Cloud Infrastructure. It allows developers to easily develop, deploy, and manage functions using the familiar Fn Project framework and tooling. With Oracle Functions, developers can focus on writing their function code while leaving the infrastructure management, scaling, and operational tasks to the platform.

Oracle ' s current OCI Streaming limits specify that each stream partition supports a total data write rate of 1 MB per second. Partition count is therefore a fundamental capacity-planning parameter for producer workloads. If an application is expected to produce more than 1 MB per second, the stream must contain enough partitions to distribute the required ingress throughput appropriately. Oracle ' s partitioning guidance likewise states that expected throughput should be calculated before stream creation because each partition is limited to the 1 MB-per-second write rate. The 2 MB figure is not the documented write limit, while 4 MB and 8 MB exceed the per-partition ingress capacity. Therefore, the maximum write throughput represented by the available choices is 1 MB per second.

Explanation

The best answer is: " Use the OCI Logging service and enable VCN flow logs. " To meet the requirement of analyzing network communication between two services deployed in different Container Engine for Kubernetes (OKE) clusters within the same Virtual Cloud Network (VCN) in a cost-effective way, you can use the OCI Logging service and enable VCN flow logs. The VCN flow logs feature in OCI allows you to capture and log network traffic information for your VCN resources. By enabling VCN flow logs, you can monitor and analyze the network communication between your services without the need for additional third-party logging services or tools. Enabling VCN flow logs provides visibility into the network traffic, including source and destination IP addresses, ports, protocols, and other relevant details. This information can be collected and stored in the OCI Logging service, where you can analyze and gain insights into the network communication patterns between your services. By leveraging the built-in capabilities of the OCI Logging service and enabling VCN flow logs, you can fulfill the security team ' s requirement for network communication analysis in a cost-effective manner. This eliminates the need for deploying additional third-party logging services or tools, reducing complexity and potential costs associated with their setup and maintenance. The other options mentioned are not the most cost-effective or suitable solutions for analyzing network communication in this scenario: Deploying a third-party logging service and aggregating the network flow logs would introduce additional costs and complexity, which may not be necessary considering the built-in capabilities provided by OCI. Rewriting the application to send logs to an outside log aggregator would not directly address the requirement of analyzing network communication between the services. It would focus more on application-level logs rather than network-level analysis. Deploying Wireshark and intercepting packets would require additional infrastructure setup and maintenance, which may not be the most cost-effective approach for network analysis in this scenario.

Explanation

To provision storage buckets as part of your Kubernetes deployment process for an application that depends on Oracle Cloud Infrastructure (OCI) Object Storage, you should leverage the OCI Service Broker for Kubernetes. OCI Service Broker for Kubernetes enables you to provision and manage OCI resources, including Object Storage buckets, directly from Kubernetes. It provides a Kubernetes-native experience for managing OCI services, allowing you to define and manage OCI resources as part of your application deployment process. By using the OCI Service Broker for Kubernetes, you can define the required Object Storage buckets in your Kubernetes manifests, and the service broker will handle the provisioning and management of those buckets in OCI, ensuring that they are available for your application wherever it is running.

The docker inspect command retrieves detailed low-level metadata for Docker objects and returns the information in JSON format by default. Oracle ' s Docker documentation explicitly states that docker inspect can obtain full information about a container in JSON format and can expose specific configuration elements through formatting options. This includes network configuration, mapped ports, mounted storage, environment details, container state, and other runtime properties. docker stats provides live CPU, memory, network, and I/O utilization rather than static configuration metadata. docker history examines the image layer history and Dockerfile-derived changes. docker system provides system-wide administration commands and cleanup operations rather than detailed inspection of an individual container. Therefore, docker inspect is the appropriate troubleshooting command.

Explanation

The user is responsible for patching, upgrading, and maintaining the worker nodes in Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE). In OKE, the user has control over the worker nodes, which are the compute instances that run the Kubernetes worker components. As the user, you are responsible for managing and maintaining these worker nodes, including tasks such as patching the underlying operating system, upgrading Kubernetes versions, and performing any necessary maintenance activities. While Oracle provides the underlying infrastructure and support services, including managing the control plane and ensuring the availability of the OKE service, the responsibility for managing the worker nodes lies with the user. This allows you to have control and flexibility in managing your Kubernetes environment according to your specific needs and requirements.

In the Linux/Unix environment normally assumed for OCI container development, the Docker client communicates with the locally running Docker daemon through a UNIX domain socket. Docker ' s default endpoint on Linux is unix:///var/run/docker.sock. This allows local inter-process communication without requiring a TCP network connection. TCP can be configured when the client must communicate with a daemon through a network, while SSH can provide secure access to a remote Docker daemon. RPC is not the default Docker client transport. Therefore, for a Docker client and daemon running locally on a Linux-based OCI development host, Local UNIX Sockets is the correct answer. On Windows, Docker uses a named pipe by default, so the answer is specifically applicable to the Linux/Unix OCI context.

Explanation

The correct answer is: Microservices are used for long running operations while serverless functions are used for short running operations. One of the key differences between microservices and serverless functions is the duration of their execution. Microservices are typically designed to handle long-running operations and may continuously run and process requests as part of a larger system. They are often deployed and managed as long-lived services. On the other hand, serverless functions are designed to handle short-lived operations or tasks that execute in response to specific events or triggers. They are event-driven and execute only when invoked, providing a lightweight and ephemeral computing model. Serverless functions are often used for executing small, isolated pieces of code without the need for managing infrastructure or scaling concerns. While both microservices and serverless functions can be stateless or stateful depending on the specific implementation, the key distinction lies in the typical duration and execution pattern of these components within an application architecture.

Explanation

To mandate image verification when deploying container images to Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE) clusters, you should enable image verification policies separately for each OKE cluster. This is enforced at the cluster level. Enabling image verification policies at the cluster level ensures that all container images deployed to the OKE cluster are automatically verified against the specified master encryption key (MEK). This helps maintain the security and integrity of the deployed microservices by ensuring that only signed and trusted container images are used. Enabling image verification policies at the cluster level allows for consistent and centralized enforcement of the verification process across all nodes and node pools within the cluster. It provides a standardized approach to image verification for the entire cluster, simplifying management and ensuring compliance with the organization ' s mandate. Enabling image verification policies separately for each node pool or at the pod level would introduce complexity and potential inconsistencies in the verification process. Therefore, enforcing image verification at the cluster level is the recommended approach.

Explanation

The two true statements for serverless computing and serverless architectures are: Applications running on a FaaS (Functions as a Service) platform: Serverless architectures typically involve running code in the form of functions on a serverless platform. These functions are event-driven and executed in response to specific triggers or events. Serverless function execution is fully managed by a third party: In serverless computing, the cloud provider takes care of the infrastructure management and resource provisioning. The execution of serverless functions is handled automatically by the platform, relieving developers from the responsibility of managing servers or infrastructure. It ' s important to note that long running tasks are not typically suited for serverless architectures due to the event-driven nature of serverless functions. Also, while serverless functions may have state, it is recommended to avoid external storage dependencies and instead leverage stateless functions whenever possible. Additionally, scaling in serverless architectures is typically handled automatically by the platform, rather than being the responsibility of the application DevOps team.

The Transactional Outbox pattern addresses the distributed-system dual-write problem by recording both the business-state change and an outgoing event within one local database transaction. Rather than attempting to atomically update a database and independently publish to a messaging platform, the service writes the event into an outbox table alongside the business update. Because both database modifications occur within the same transaction, they commit or roll back together. A separate publisher subsequently reads the outbox and sends the event to the messaging infrastructure. Oracle ' s current microservices architecture documentation explicitly identifies Transactional Outbox as the pattern for sending a message and performing a data manipulation operation within a single local transaction. Saga and CQRS address different distributed-system concerns.

Explanation

The correct answer is: Enable monitoring for all worker nodes in the cluster. Enabling monitoring for all worker nodes in the cluster is not required to collect and parse application logs using Oracle Cloud Infrastructure (OCI) Logging. Monitoring is a separate feature that allows you to collect metrics and monitor the health and performance of the worker nodes. To collect and parse application logs, you need to perform the following tasks: Set the OCI Logging option to Enabled for the cluster: This enables the OCI Logging service for the cluster. Create a dynamic group with a rule that includes all worker nodes in the cluster: This helps in targeting the logs generated by the worker nodes. Configure a custom log in OCI Logging with the appropriate agent configuration: This involves specifying the log source, log path, and log format to parse and collect the application logs. By completing these tasks, you can collect and parse the application logs generated by the applications running on the worker node compute instances in the OKE cluster.

Statement D is NOT valid because OCIAudit logs are retained for 365 days, not 180 days. Oracle states that Audit retention is a tenancy-level setting affecting all regions and compartments and that its value cannot be changed. By contrast, OCI Logging service and custom logs support configurable retention in 30-day increments up to 180 days. Oracle also confirms that reducing a log ' s retention period makes existing data outside the new retention window unavailable and unsearchable. Therefore, the question intentionally distinguishes configurable Logging retention from the fixed OCI Audit retention model. The incorrect portion of D is specifically the stated 180-day duration; OCI Audit uses a 365-day retention period.

Oracle Monitoring formally defines ametric streamas an individual set of aggregated data for a metric with zero or more dimension values. Different dimension combinations create distinct streams. For example, CPU utilization emitted for two separate Compute instance OCIDs can constitute two separate metric streams because the resourceId dimension differs. A metric namespace identifies the service or application emitting the metrics, such as oci_computeagent. A datapoint is an individual timestamped value within a metric stream. Oracle also uses the term metric group for limit calculations, defining it as the combination of a metric, namespace, and tenancy; that is different from the dimension-specific time-series data described in the question. Therefore, option A exactly matches Oracle ' s documented Monitoring terminology.

Explanation

In the given scenario, the developer should use the approach of creating an authorizer function using token-based authorization. Token-based authorization is a commonly used approach for authenticating API requests. It involves generating and issuing tokens to API callers, which they can then include in the requests they make to the API. The tokens serve as proof of authentication and are validated by the server to ensure the caller ' s identity and access rights. By creating an authorizer function using token-based authorization, the developer can implement a custom scheme that accepts string-based parameters from the API caller. This allows the developer to define their own authentication logic and validate the provided tokens according to their requirements. The authorizer function can be configured in the OCI API Gateway to be invoked before forwarding the request to the web application. It will perform the necessary token validation and authentication checks, allowing only authorized requests to access the protected resources of the web application.

Explanation

The two statements that are NOT valid regarding the Oracle Cloud Infrastructure (OCI) Streaming service are: A stream can be configured with either a public or a private endpoint with support for customer managed encryption keys. This statement is not valid because the OCI Streaming service currently supports only private endpoints. Customer managed encryption keys are not currently supported for OCI Streaming. OCI Streaming can support up to 2,000 requests per second to each partition. This statement is not valid because the throughput of a stream is not defined by the partition in terms of requests per second. The throughput of a stream is defined in terms of data input and output rates. Each partition provides 1 MB/sec data input and 2 MB/sec data output, but it does not correspond to a specific number of requests per second. The other statements are valid: OCI Streaming stores all data for 24 hours by default, but that can be extended up to 7 days. Although OCI Streaming automatically encrypts all data while in transit, it is the developer ' s responsibility to encrypt data at rest, if needed.

maxClockSkewInSeconds specifies the maximum expected difference between the system clock of the token issuer and the OCI API Gateway. Oracle documents this value as part of token/JWT authentication policy configuration. The gateway accounts for the configured skew when evaluating time-dependent JWT claims such as nbf (not before) and exp (expiration), preventing otherwise valid tokens from being rejected because of minor clock differences between systems. Oracle currently documents a valid range from 0 through 120 seconds for the JWT policy. maxCacheDurationInHours controls caching behavior rather than clock synchronization, while SSL verification relates to certificate validation. allowedClockVariance is not the documented OCI API Gateway property. Therefore, B is the correct configuration parameter.

Explanation

The three technologies best suited for implementing a microservices-based application are: Service Mesh: A service mesh is a dedicated infrastructure layer that provides features like service discovery, load balancing, encryption, authentication, and observability for microservices. It helps in managing the communication and interactions between microservices in a scalable and secure manner. Kubernetes: Kubernetes is an open-source container orchestration platform that enables the deployment, scaling, and management of containerized applications. It provides features like automated scaling, service discovery, load balancing, and self-healing capabilities, which are essential for managing microservices in a distributed environment. Docker: Docker is a popular containerization platform that allows packaging applications and their dependencies into lightweight containers. It provides a consistent and portable environment for running microservices, enabling easy deployment and scalability. Docker also facilitates isolation and resource efficiency, making it an ideal choice for deploying microservices. While Big Data, Anomaly Detection, and Terraform are valuable technologies, they are not specifically focused on enabling the implementation of microservices-based applications.

OCI API Gateway supports the following authentication methods for accessing an API deployment3:

HTTP Basic: The client sends a username and password with each request. The credentials are validated against a user database in Oracle Identity Cloud Service (IDCS).

API Key: The client sends an API key with each request. The API key is validated against a list of keys stored in IDCS or OCI Vault.

OAuth: The client obtains an access token from an authorization server (such as IDCS) and sends it with each request. The access token is validated against the authorization server and optionally checked for required scopes.

JWT Token: The client obtains a JSON Web Token (JWT) from an identity provider (such as IDCS or OCI IAM) and sends it with each request. The JWT is validated against the identity provider’s public key and optionally checked for required claims. SAML Token is not a valid authentication method for accessing an OCI API Gateway deployment. SAML is an XML-based standard for exchanging authentication and authorization data between different parties, such as a service provider and an identity provider4. SAML tokens are typically used for web browser single sign-on (SSO) scenarios, not for API access4.

DevOps principles directly address automation across the software delivery lifecycle. Oracle describes DevOps as collaboration between development and operations teams aimed at continuous delivery, with automation applied throughout planning, coding, building, testing, releasing, deploying, operating, and monitoring. OCI specifically identifies CI/CD tooling for automating build, test, release, and deployment activities. Containerization provides consistent application packaging, microservices define an architectural decomposition model, and serverless computing removes much of the underlying infrastructure-management responsibility. None of those technologies by itself defines the automated delivery lifecycle requested in the question. Continuous Integration and Continuous Delivery are core DevOps practices that make software changes repeatable, testable, and deployable at high frequency while reducing manual intervention and release risk. Therefore, the correct cloud-native pillar is DevOps Principles.

Explanation

The correct answer is: Invoke from the Docker CLI.Explanation: Executing a function deployed in Oracle Functions is typically done using the following options: Invoke from the Fn Project CLI: The Fn Project CLI provides a command-line interface specifically designed for interacting with Oracle Functions. You can use commands like fn invoke to invoke a function. Trigger by an event in the Oracle Cloud Infrastructure (OCI) Events service: You can configure events in OCI to trigger your function based on various criteria, such as object storage events, resource state changes, or scheduled events. Invoke from the OCI CLI: The OCI CLI (Command Line Interface) allows you to interact with various services in Oracle Cloud Infrastructure, including Oracle Functions. You can use the fn invoke command to invoke a function. Send signed HTTP requests to the function ' s invoke endpoint: Oracle Functions provides an HTTP endpoint that can be used to invoke functions. You can send signed HTTP requests to this endpoint using tools or programming languages that support making HTTP requests. On the other hand, invoking a function deployed in Oracle Functions using the Docker CLI is not a valid option. The Docker CLI is primarily used for managing Docker containers and images, and it does not provide a direct mechanism for invoking functions in Oracle Functions.

Explanation

Which TWO statements are correct regarding Docker images and containers? (Choose two.) Writing and building a new Dockerfile is the only way you can create new Docker images. A container can exist without an image but an image cannot exist without a container. Only one container can be spawned from a given image at a time. If multiple containers are spawned from the same image, then they all use the same copy of that image in memory. (Correct) An image is a collection of immutable layers whereas a container is a running instance of an image. (Correct) ChatGPT The correct statements regarding Docker images and containers are: If multiple containers are spawned from the same image, then they all use the same copy of that image in memory. This statement is correct. When multiple containers are created from the same Docker image, they share the underlying layers of the image in memory. Each container has its own isolated filesystem and runtime environment, but they all use the same base image, which helps in efficient resource utilization. An image is a collection of immutable layers whereas a container is a running instance of an image. This statement is also correct. Docker images are composed of multiple layers, with each layer representing a specific change or addition to the previous layer. These layers are read-only and can be shared among multiple containers. On the other hand, a container is a lightweight and isolated runtime instance created from a specific image. It is a running process that has its own filesystem, network, and runtime configuration. The statements " Writing and building a new Dockerfile is the only way you can create new Docker images " and " A container can exist without an image but an image cannot exist without a container " are incorrect. Docker images can be created in various ways, including using Dockerfiles, importing from existing images, or pulling from registries. Additionally, a container requires an image to run, so an image must exist before a container can be created from it.

Themaximum retention perioddefines the total amount of time OCI Queue retains a message before automatically deleting it if a consumer has not removed it. Oracle currently allows this value to be configured from 10 seconds through seven days, with a default of one day. Visibility timeout serves a different purpose: after a consumer retrieves a message, it temporarily hides that message from other consumers. Maximum delivery attempts controls how many unsuccessful delivery cycles can occur before a message is moved to the dead letter queue. Polling timeout determines how long a consumer request waits for messages to become available. Therefore, only the maximum retention period controls the overall lifetime of an unremoved message in OCI Queue.

Explanation

The testing strategy that achieves high velocity of deployments and releases of cloud native applications is " Automated testing. " Automated testing involves the use of automated tools and frameworks to execute tests, validate functionality, and detect issues or bugs in an application. By automating the testing process, developers and DevOps teams can rapidly test and validate code changes, ensuring that new features and updates are functioning correctly before being deployed to production. This approach helps increase the speed and efficiency of the testing process, allowing for faster and more frequent deployments of cloud native applications.

API Gateway and Oracle Functions are OCI-managed services with native integration into OCI Logging, so their diagnostic output is collected throughservice logs, not host-based custom-log agent configurations. Oracle ' s Service Log Reference explicitly includes both API Gateway and Functions. For Functions, Oracle ' s current CLI example creates a SERVICE log whose source resource is the Function application and whose category is invoke. API Gateway likewise exposes service logging for gateway/deployment activity. Both log resources can be placed in the same organizational log group while remaining separate log objects, satisfying the compliance requirement. Logging agents and custom logs are intended primarily for files produced on managed hosts or applications, not for these managed OCI service sources. Therefore, C and D are correct.

Oracle provides a dedicated logging-search OCI CLI command group for querying indexed log content. The documented syntax is oci logging-search search-logs, with --search-query, --time-start, and --time-end as the principal parameters required to define the Logging Query Language expression and search interval. The ordinary oci logging command group is used for administration of logs and log groups rather than searching their contents. logging-query is not a valid top-level OCI CLI service group, and --query-string is not the documented search parameter. Therefore, option B exactly matches Oracle ' s current CLI command reference for submitting a programmatic log search across custom or service logs.

Explanation

To push a new image to the Oracle Cloud Infrastructure (OCI) Registry, you would need to perform the following two actions: Assign a tag via Docker CLI to the image: Before pushing the image, you need to assign a tag to it using the Docker CLI. The tag helps identify the image and associate it with a specific version or label. Generate an auth token to complete the authentication via Docker CLI: To authenticate and authorize the push operation, you need to generate an auth token. This token is used to authenticate your Docker CLI with the OCI Registry, allowing you to push the image securely. Note: Generating an API signing key, assigning an OCI defined tag via OCI CLI, and generating an OCI tag namespace are not required steps for pushing a new image to the OCI Registry.

Explanation

A valid concern that needs to be further investigated in this scenario is whether the OKE cluster has a secret with the credentials of the Oracle Cloud Infrastructure Registry (OCIR) repository and if that secret is being used in the Kubernetes deployment manifest. Here ' s why this concern is relevant: Access to the OCIR repository: In order for the OKE cluster to pull images from the OCIR repository, it needs proper authentication credentials. These credentials are typically provided in the form of a secret, which contains the necessary information to authenticate with the registry. Secret in the deployment manifest: The Kubernetes deployment manifest defines how the application containers should be deployed. It includes specifications such as the container image, resource requirements, and environment variables. To pull images from a private repository like OCIR, the deployment manifest needs to reference the appropriate secret that contains the registry credentials. If the images are not being pulled from the designated OCIR repository, it suggests that either the secret with the OCIR credentials is missing or it is not properly referenced in the deployment manifest. Further investigation should focus on verifying the presence and correctness of the secret, as well as confirming that it is correctly referenced in the deployment manifest for the application containers. By ensuring the presence of the secret and proper configuration in the deployment manifest, the OKE cluster will have the necessary credentials to access the OCIR repository and successfully deploy the application containers.

OCI Vault provides both Secret Expiry Rules and Secret Reuse Rules. secret_version_expiry_interval uses an ISO 8601 duration, so P30D establishes a 30-day validity period. Setting is_secret_content_retrieval_blocked_on_expiry to true ensures secret contents cannot be retrieved after expiry, satisfying the first requirement. For the second requirement, a SECRET_REUSE_RULE prevents previously used secret contents from being reused across versions. Oracle ' s SDK documentation confirms that is_enforced_on_deleted_secret_versions=true extends that restriction even when the previous secret version has been deleted. Setting either Boolean to false would weaken the stated controls. HSM_PURGE_RULE is not one of the documented OCI Vault secret-rule types. Therefore, C and D jointly satisfy both requirements.

Explanation

The statement that accurately describes the Oracle Cloud Infrastructure (OCI) Load Balancer integration with OCI Container Engine for Kubernetes (OKE) is: " OKE service provisions an OCI Load Balancer instance for each Kubernetes service with LoadBalancer type in the YAML configuration. " When you define a Kubernetes service in your YAML configuration with the LoadBalancer type, the OKE service automatically provisions an OCI Load Balancer instance specifically for that service. This Load Balancer instance is dedicated to the Kubernetes service and provides traffic balancing functionality. Each Kubernetes service that requires load balancing will have its own OCI Load Balancer instance provisioned by OKE.

Explanation

The correct answer is: fn deploy --app travel-app --allExplanation: To build and deploy multiple Oracle Functions as part of a single application named " travel-app, " you can use the fn deploy command with the appropriate options. The command fn deploy --app travel-app --all is the correct syntax. Here ' s what each part of the command does: fn deploy: This command is used to deploy functions and applications in Oracle Functions. --app travel-app: This option specifies the application name as " travel-app, " indicating that you want to deploy functions to this application. --all: This option indicates that you want to deploy all the functions within the application. By using fn deploy --app travel-app --all, you can build and deploy all the functions in your travel application across different programming languages (Java, Python, and Node.js) to the " travel-app " application in Oracle Functions.

OCI Streaming is a fully managed, scalable, and durable messaging solution for ingesting continuous, high-volume streams of data that you can consume and process in real-time1. Streaming is suitable for any use case in which data is produced and processed continually and sequentially in a publish-subscribe messaging model1. Streaming can handle millions of messages per second with low latency2. Therefore, OCI Streaming is the most appropriate choice for handling real-time data feeds from a fleet of vehicles.Verified References: Overview of Streaming, Container Engine for Kubernetes

 Cloud native is the software approach of building, deploying, and managing modern applications in cloud computing environments3. Cloud native apps are designed and built to exploit the scale, elasticity, resiliency, and flexibility the cloud provides4. Cloud native technologies support fast and frequent changes to applications without impacting service delivery, providing adopters with an innovative, competitive advantage3. Therefore, cloud native refers to the design and deployment of applications that are optimized for cloud infrastructure. Verified References: What is Cloud Native? - Everything you need to know, What is Cloud Native?| Microsoft Learn

Oracle ' s Events documentation explicitly states that wildcard matching with * is supported only inattribute values, not in attribute keys. The asterisk can appear at the beginning, middle, or end of a value, but field names themselves must remain literal. Oracle also confirms all three other behaviors. An empty {} condition matches every applicable event; Events rules apply to their compartment and child compartments; and an event must contain every field named in the condition using the same nesting structure. Therefore, option C improperly extends wildcard functionality to attribute keys. The valid model is to preserve the exact JSON field structure while applying wildcard patterns only to values associated with those fields.

Explanation

The term that describes a group formed by a master machine and a worker machine in a Kubernetes architecture is " Cluster " . A cluster in Kubernetes consists of one or more master machines and multiple worker machines (also known as nodes). The master machine manages the overall control plane and orchestrates the deployment and management of containers on the worker nodes. The worker nodes are responsible for running the containers and executing the workloads. The cluster is the fundamental unit of organization and management in Kubernetes, providing the infrastructure and resources to run and manage containerized applications. It ensures high availability, scalability, and fault tolerance for the applications deployed within it.

The supplied Word answer key requires correction here. Current Oracle Queue documentation explicitly states that adead letter queue is automatically created when a queue is created. Therefore, option C is correct and option B is not. Oracle also provides the Maximum delivery attempts setting, which controls how many unsuccessful deliveries can occur before a problematic message is transferred to the DLQ. Setting that value to 5 implements the requested retry threshold. No separately provisioned target queue is required, consumer groups are optional and unrelated to enabling DLQ functionality, and administrators do not create an IAM policy authorizing a source queue resource to write to its automatically associated DLQ. Consequently, the verified current answer isA, C, not the Word file ' s A, B.

Explanation

The correct answer is: " Edit the tenancy global retention policy. " To ensure that container images never get deleted from the Oracle Cloud Infrastructure Registry (OCIR), you should edit the tenancy global retention policy. The tenancy global retention policy is a setting that determines the retention behavior for all the images in the OCIR across the entire tenancy. By editing this policy, you can define the retention behavior that suits your requirements. To edit the tenancy global retention policy, you would typically perform the following steps: Access the Oracle Cloud Infrastructure Console and navigate to the OCIR service. Go to the " Policies " section or " Settings " section in the OCIR service. Locate the tenancy global retention policy settings. Modify the retention policy to specify the desired retention behavior. In this case, you would set the policy to retain all images, ensuring they are never deleted from the repository. By setting the global policy of image retention to " Retain All Images, " you can ensure that the container images in your OCIR repository are permanently retained and not subject to deletion based on any default or automatic retention rules. The other options mentioned are not directly related to ensuring that container images are never deleted from the repository: Creating a group and assigning a policy to perform lifecycle operations on images or writing a policy to limit access to the specific repository in your compartment are access control measures and do not address the retention of images. Setting the global policy of image retention to " Retain All Images " is the correct action to achieve the desired outcome of preventing image deletion from the repository.

Explanation

The correct answer is: Test using an API mock of service B. To test service A without deploying all of its dependencies, including service B, you can use an API mock of service B. An API mock is a simulated version of the API that mimics the behavior of the actual service. By using an API mock, you can isolate the testing of service A and simulate the responses and behavior of service B ' s APIs. With an API mock, you can define the expected responses and behavior of service B ' s APIs, allowing you to test the integration between service A and the mocked version of service B. This approach enables you to verify the functionality of service A without relying on the availability or changes in the actual service B. By decoupling the dependencies and using an API mock, you can perform independent testing of service A, ensuring its functionality in isolation.

Explanation

To obtain a log file from one of the nodes in an Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE) cluster, you should SSH into the nodes using the private key. Here ' s the step-by-step process: Obtain the private key: The private key is required to authenticate and access the nodes in the OKE cluster. You should obtain the private key from your administrator or the appropriate key pair used to create the cluster. SSH into the node: Use a secure shell (SSH) client, such as OpenSSH, to connect to the desired node in the cluster. The SSH command typically includes the private key file path and the public IP address or hostname of the node. Example command: ssh -i < private_key_file > opc@ < node_public_ip > Replace < private_key_file > with the path to the private key file and < node_public_ip > with the public IP address of the node you want to access. Navigate to the log file location: Once you have successfully connected to the node, navigate to the directory where the log file is located. The exact location and name of the log file may vary depending on the Kubernetes distribution and configuration. Copy or view the log file: You can either copy the log file from the node to your local machine using the scp command or view the contents directly on the node using tools like cat or less. By following these steps, you will be able to access the log file from the desired node in the OKE cluster for troubleshooting purposes.

OKE Workload Identity is anenhanced-cluster capability. Oracle ' s current Kubernetes Engine documentation explicitly lists workload identity as supported by Enhanced clusters and not supported by Basic clusters. Workload Identity enables IAM policies to authorize individual Kubernetes workloads according to attributes such as cluster, namespace, and service account, avoiding broader permissions inherited from worker-node instance principals. Basic clusters support standard Kubernetes and OKE functionality but exclude enhanced capabilities including Workload Identity, virtual nodes, self-managed nodes, and advanced cluster add-on management. “Dedicated cluster” and “Autonomous cluster” are not the OKE cluster types used for this feature classification. Therefore, an application architecture requiring OKE Workload Identity must use an Enhanced cluster, making option A correct.

OCI Streaming consumer groups assign each stream partition exclusively to one consumer-group instance at a time. Oracle states that every partition is owned by one instance following a successful rebalance and that instances exceeding the number of available partitions remain idle. With eight partitions, no more than eight of the twelve consumer instances can actively consume simultaneously, leaving four without assignments. This is not a fixed eight-consumer limitation: increasing the stream to twelve or more partitions could allow all twelve instances to become active. Consumer groups automatically coordinate partition assignment, offsets, commits, heartbeats, and rebalancing, so Service Connector Hub is unnecessary. Stream pools likewise do not determine the consumer-to-partition scaling relationship. Therefore, B explains the observed behavior precisely.

Explanation

The correct answer is: " Create a self-signed certificate and its corresponding key. Create a Kubernetes secret using the certificate and the key. Then add these annotations to the Kubernetes service: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret. " To create a secure SSL termination for your microservices-based application running in an OCI Container Engine for Kubernetes (OKE) cluster, you can follow these steps: Create a self-signed certificate and its corresponding key: Generate a self-signed SSL certificate and its private key using a tool like OpenSSL. Create a Kubernetes secret: Create a Kubernetes secret using the certificate and key obtained in the previous step. This secret will securely store the certificate and key within the Kubernetes cluster. Add annotations to the Kubernetes service: Modify the Kubernetes service that exposes your application and add the following annotations to enable SSL termination: annotations: service.beta.kubernetes.io/oci-load-balancer-ssl-ports: ' 443 ' (specify the SSL port as 443) annotations: service.beta.kubernetes.io/oci-load-balancer-tls-secret: ssl certificate-secret (specify the name of the Kubernetes secret containing the certificate and key) By following these steps, you can create a secure SSL termination for your application using a self-signed certificate and Kubernetes secret. The annotations added to the Kubernetes service ensure that the SSL port is configured correctly and the TLS secret is utilized for SSL termination when traffic reaches the load balancer. The other options provided are not the most suitable approaches for achieving secure SSL termination in an OCI Container Engine for Kubernetes (OKE) cluster: Adding annotations related to the OCI load balancer SSL secret key is not the correct approach for SSL termination in this scenario. Using Let ' s Encrypt to generate a self-signed certificate and configuring it on the OCI Load Balancer is not necessary when you can create and manage the SSL certificate within the Kubernetes cluster using a Kubernetes secret.

Oracle API Gateway documents the context-variable selectors available for dynamic backend routing. Supported selectors include request.auth[ < key > ], request.headers[ < key > ], request.host, request.path[ < key > ], request.query[ < key > ], request.subdomain[ < key > ], and usage-plan information. Therefore, headers, authentication claims, and query parameters can all participate directly in backend-selection rules. Although API Gateway can expose the request body to amulti-argument authorizer function, Oracle does not list request.body[ < key > ] as a supported selector for dynamic backend routing. Its presence in that separate authorizer context does not make it a dynamic-routing selector capable of parsing arbitrary JSON fields. Consequently, A, B, and C describe supported routing context variables, while D incorrectly extends the routing model to request-body key selection.

Oracle Monitoring documents groupBy(x) specifically for aggregating metric streams according to a shared dimension. Oracle ' s own fault-domain example uses the exact expression CpuUtilization[1m].groupBy(faultDomain).mean(). The resulting chart contains one aggregated metric stream for each fault domain, which means a compartment containing three fault domains produces three lines rather than one line per Compute instance. grouping() combines all selected metric streams into a single aggregate instead of retaining separate fault-domain groups. filter(faultDomain) is not the appropriate MQL grouping operation, and split() is not the documented operator for this requirement. Because the scenario requires mean CPU utilization separately aggregated for each value of the faultDomain dimension, option B exactly matches Oracle ' s documented MQL pattern.

Explanation

Oracle Functions does not currently support PL/SQL as a language for writing function code. PL/SQL is a procedural language used in Oracle Database for developing stored procedures, triggers, and other database-related code. However, Oracle Functions supports several other popular programming languages such as Go, Node.js, Python, and Java, allowing developers to choose the language that best suits their application requirements and their familiarity with the language. While PL/SQL is powerful for working with the Oracle Database, it is not an option for writing function code in the Oracle Functions serverless architecture.

Explanation

The option that allows changes to a Docker image to be stored in a version control system is: docker commit The docker commit command is used to create a new image from a container ' s changes. It takes a running container as input, captures the changes made to it, and creates a new image with those changes. This new image can then be tagged and pushed to a registry, or saved locally. By using docker commit, you can effectively capture the changes made to a container as a new image and store it in a version control system along with the Dockerfile and other project files. This allows for reproducibility and traceability of changes to the Docker image over time.

Explanation

The correct answer is: " Resiliency is about recovering from failures without downtime or data loss. " Service resiliency, in the context of cloud-native applications, is the ability of a service or system to recover from failures and continue functioning without downtime or data loss. It involves designing and implementing mechanisms to handle failures, such as network outages, hardware failures, or software errors, in a way that minimizes the impact on the overall system. The goal of resiliency is to ensure that the application or service can continue to operate and provide a certain level of functionality, even in the face of failures. This typically involves techniques such as redundancy, fault tolerance, and graceful degradation. By implementing resiliency measures, a cloud-native application can recover and adapt to failures, maintain availability, and preserve data integrity. The other statements are not accurate regarding service resiliency: Resiliency is not about not bringing a service to a functioning state after a failure. Instead, it is about recovering from failures and ensuring continued functionality. Resiliency is not about avoiding failures entirely. While it is desirable to prevent failures, resiliency focuses on the ability to handle and recover from failures when they do occur. Resiliency testing is not limited to a test environment. It is important to test and validate the resiliency measures in both test environments and production environments to ensure the application can effectively handle failures in real-world scenarios.

Explanation

The correct answer is: " Adding a custom certificate authority (CA) or custom CA bundle to your gateway ' s trust store for mTLS is optional unless you need to reject certificates that do not contain particular values (such as a domain name). " The statement that is NOT valid regarding the mTLS options in OCI API Gateway is: " Adding a custom certificate authority (CA) or custom CA bundle to your gateway ' s trust store for mTLS is optional unless you need to reject certificates that do not contain particular values (such as a domain name). " In OCI API Gateway, adding a custom certificate authority (CA) or custom CA bundle to the gateway ' s trust store is not optional. It is a necessary step when configuring mTLS authentication. The trust store in the gateway is used to validate the client certificates presented during mTLS authentication. The other options listed are valid regarding the mTLS options in OCI API Gateway: Once the mTLS request policy is enabled, all requests with valid certificates are routed to the backend unless specific values (such as a domain name) are defined. This means that only requests with valid client certificates will be allowed to access the backend microservices. The mTLS request policy can only be enabled at the API deployment specification level, and it applies globally to all routes in that deployment. This ensures consistent mTLS authentication across all routes and endpoints in the API deployment. Custom CA or custom CA bundles can be added to the gateway ' s trust store, but only if they already exist in the OCI Certificates service. This allows you to include trusted CAs or CA bundles to validate client certificates during mTLS authentication.

To pull a Docker image from OCI Registry to the client machine, you need to use the docker pull command with the following syntax1: docker pull < region-key > .ocir.io/ < tenancy-namespace > / < repo-name > : < tag > where:

< region-key > is the key for the OCI Registry region you’re using. For example, iad. See Availability by Region1.

ocir.io is the OCI Registry name.

< tenancy-namespace > is the auto-generated Object Storage namespace string of the tenancy that owns the repository from which you want to pull the image (as shown on the Tenancy Information page)1.

< repo-name > is the name of the repository that contains the image you want to pull.

< tag > is the tag of the image you want to pull.

Oracle ' s Events filtering documentation explicitly defines the behavior of a standalone asterisk wildcard. When an attribute value consists only of *, it matchesall values for that attribute except null. The field must therefore exist and contain a non-null value for the rule condition to match. Oracle permits wildcard characters only in attribute values, and an asterisk can otherwise appear at the beginning, middle, or end of a value pattern. It is not interpreted as a literal asterisk in this context, nor is it restricted to matching empty strings. Option A is incorrect because null values are excluded. Therefore, option B precisely reflects Oracle ' s documented Events rule wildcard semantics.