1Z0-1084-26 practice questions
Oracle · 1Z0-1084-26 · 300 questions
Original practice questions for the Oracle Cloud Infrastructure Developer Professional (1Z0-1084-26) exam, covering cloud-native development on OCI including containerization with Docker and OKE, serverless with Oracle Functions and API Gateway, data streaming with OCI Streaming and Queue, application security with Vault and IAM, and observability with OCI Monitoring, Logging, and APM.
This course contains the use of artificial intelligence.
About the 1Z0-1084-26 exam
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Cloud Native Fundamentals · 33 questions
- A city permitting office relocates its long-lived JVM monolith onto OCI Compute instances with the same nightly patch cycle and shared in-memory session store. Which change would most clearly move the workload toward a cloud-native design?
- A municipal utility team wants every build of its meter-reading API to run the same way on a laptop, in a registry, and later on a managed cluster. Which packaging choice best expresses that cloud-native unit of delivery?
- A county records portal still runs three unrelated apps on one long-lived middleware host that operators patch in place after each CVE. What cloud-native deployment posture should replace that shared farm?
- A parks-and-recreation team wants the platform to keep three healthy replicas of its reservation API without an operator running start and stop checklists. Which cloud-native pillar describes that approach?
- During a late-night outage, a transit-authority developer finds a misconfigured runtime on a production host and is tempted to SSH in and edit files until the service recovers. Which immutable-infrastructure response is the cloud-native alternative?
- A water-department product team ships a billing microservice but still pages a separate operations group whenever the service misbehaves at 2 a.m. Which cloud-native principle are they missing?
- A library consortium containerizes its catalog app but still requires a stop-the-world release whenever any module changes, and operators cannot see why requests fail. What outcomes should the cloud-native pillars primarily unlock?
- A city open-data portal team wants high-impact configuration changes to feel routine instead of heroic overnight projects. Which approach best matches the cloud-native goal of frequent, predictable change?
- While reviewing a design for a municipal notifications service, an architect cites twelve-factor as guidance for portable, disposable processes with externalized configuration. How should that guidance be treated on the exam?
- A zoning-board API image embeds the production database URL and a plaintext password so “it just works” in prod. What twelve-factor-aligned fix should the team apply before promoting the same artifact to test and production?
- A 311 mobile backend keeps open case drafts and uploaded photos only in process memory and local container disk so responses stay fast. What risk does that create on a cloud platform that may stop or multiply the process at any time?
- A tax-assessment service hardcodes localhost Redis and a compile-time JDBC driver path so developers can run “everything on one laptop.” Which cloud-native adjustment treats those collaborators correctly?
- Each replica of a public-works work-order API writes its own dated log file under /var/log on the container filesystem. Operators cannot search one incident across replicas after a node is replaced. Which logging design matches cloud-native practice?
- A court-scheduling service takes several minutes of JVM warm-up before accepting traffic and ignores termination signals, dropping in-flight bookings when instances are replaced. Which disposability improvement should the team prioritize?
- After an emergency, an elections-office engineer edits binaries on the running production host so voters can keep checking polling locations. Why does that violate cloud-native build/release/run staging?
- Two municipal teams plan to integrate a license-renewal service with a payments service. They intend to code both implementations first and “document the URLs later.” Which API-first correction should they make?
- A city emergency-alert API must stay available if a single data-center event occurs, while callers need low latency and data residency in one geography. Which application-level placement approach best fits that goal on OCI?
- A housing-authority team labels “intake,” “inspection,” and “payments” as microservices but packages them as libraries loaded into one OS process so they can share memory. What essential microservice property have they lost?
- A DMV modernization program proposes services named “all database access,” “all UI widgets,” and “all batch jobs.” Which boundary approach better supports independent business change?
- A small parks department is still discovering its domain model for a new reservation system and currently ships weekly with one modular deployable. When is keeping a well-modular monolith the more honest choice?
- After splitting permit-review and fee-calculation into separate processes, developers propose a shared internal JAR of domain types so each side can call the other like a local method. What integration approach should replace that hidden coupling?
- In a city commerce platform, “price” means shelf list price in the catalog team’s model but means amount due after tax and fees in billing. Which decomposition tool should guide where to cut services?
- A reporting service on the inspections team starts issuing SQL against the licensing service’s tables to “avoid an extra API hop.” What persistence rule of microservice design does that break?
- Three municipal teams keep one shared database schema “to keep transactions easy,” so every migration needs a coordinated release window. What is the main design cost of that shared-schema anti-pattern?
- A waste-collection routing API adds a new optional ETA field for newer mobile clients but also renames a required stop-id field that older kiosk clients still send. Which evolution practice keeps independent deployability real?
- A city parking-fine service accepts payment callbacks that platforms may retry when the first response is lost. The handler currently charges the card on every invocation. What design change prevents double billing under at-least-once delivery?
- A municipal permit portal’s checkout must still return a useful response when the optional recommendations service is down. Which design approach best isolates that failure?
- A clerk waits on “is this SKU in stock?” while a separate nightly job fans a fee schedule change out to six interested services. How should those two interactions be designed?
- One city team wants Python for a GIS microservice while another prefers Java for billing, as long as the published HTTP contract stays stable. What makes that polyglot choice viable?
- During open enrollment, the city’s parcel-search service is the hotspot while permit submission stays quiet. What scaling approach fits independent services?
- A property-tax assessment update must write both the assessed value and the related lien flag in one commit, and both fields always change on the same release cadence. What should the team do about service boundaries?
- The city’s license API must introduce a breaking change to the permit payload. Independently deployed mobile and kiosk clients still call the current contract. What is the sound migration approach?
- After splitting a monolith, a city IT group wants each microservice to stay independently deployable. Which ownership model supports that goal?
Cloud Native Applications and Containerization · 99 questions
- A municipal developer packages the inspection API as a Docker artifact for later runs on laptops and in OCI. Which statement correctly distinguishes image from container?
- On a city developer workstation, which component actually creates the isolated process when someone runs a docker command?
- After building a waste-collection scheduling image on a laptop, other hosts and the cluster must run the same artifact. What role does a container registry play?
- A utilities team stores a Dockerfile next to their meter-reading service. What is that file’s correct role?
- Rebuilds of a city’s permit-intake image are slow because application source changes on every commit. How should Dockerfile instructions be ordered to protect the layer cache?
- When authoring the Dockerfile for a new public-records API, what does the FROM instruction establish?
- A Dockerfile for a zoning-map renderer installs packages with RUN. When do those RUN commands execute?
- The team needs to place known application source from the build context into a citizen-portal image without unpacking archives or fetching remote URLs. Which instruction is the professional default?
- Operators pass extra CLI arguments at docker run for a traffic-signal simulator image, but the container seems to ignore them. Which ENTRYPOINT/CMD relationship should they verify?
- A Dockerfile for a water-quality API sets WORKDIR, ENV, and EXPOSE. Which statement about those instructions is accurate?
- Many base images default to root. What should a professional Dockerfile for a parks reservation API do before the process starts?
- Builders pass a version string with --build-arg while assembling a court-calendar image. How do ARG and ENV differ for configuration?
- A Go service for flood-alert SMS is compiled in CI. Why would the Dockerfile use a second FROM stage?
- docker build for a 911-dispatch helper is unexpectedly large and slow. What should the team understand about the build context?
- Production for a voter-registration API must not silently drift to a different image tomorrow. How should the team think about tags versus digests?
- A developer prepares a local sidewalk-inspection tool image before any registry push. Which statement matches the build–tag–run lifecycle?
- A library-hours API container is running and healthy, but nothing on the host can reach it. EXPOSE 8080 is in the Dockerfile. What is the most likely gap?
- A city permit portal runs a container that writes uploaded PDFs under /tmp/uploads. After a redeploy the files are gone. What should the developer use so those uploads survive container replacement?
- The parks department wants the Docker Engine itself to mark a running recreation-API container unhealthy when its local probe fails. Which image-level feature provides that hook?
- A library catalog microservice currently ships on a full general-purpose OS base image with shells and package managers the runtime never uses. Why should the team switch to a slim or distroless runtime base?
- A transit-ticketing team packs a web API, a sidecar cron job, and a local database into one container so they can “share localhost.” What Docker design problem does that create?
- An on-call engineer patches a CVE inside a long-lived utilities-billing container with docker exec and apt-get. What is the Docker-native fix so the running instance matches what is in the registry?
- A municipal GIS team needs the Oracle-managed place to store, share, and retrieve container images with the ordinary Docker CLI. Which OCI service should they use?
- A developer on the water-meter telemetry service runs docker login against OCIR and keeps getting authentication failures after pasting an API signing key as the password. What should they use instead?
- A developer logs in to OCIR in Phoenix, then tries to push an image whose repository path is in Ashburn. The push fails. What is the most likely registry-auth mistake?
- When logging the Docker CLI into OCIR for a non-federated IAM user, what is the correct username shape?
- A federated user in a city tenancy has a valid auth token but docker login to OCIR still fails. The Profile menu shows an identity-provider path such as oracleidentitycloudservice. What username shape should they use?
- A public-works CI job must push a tagged image to OCIR. Which pieces belong in the fully qualified image path?
- A developer built city-permits-api:local on a laptop and needs that artifact in OCIR. What is the correct Docker sequence?
- A CI runner and later an OKE worker must retrieve the same permits-api artifact that was pushed to OCIR. How is that artifact identified on pull?
- Where should a developer read the tenancy namespace string that appears in OCIR image paths?
- Official OCIR documentation describes more than one valid registry hostname shape for the same regional service. Which statement is accurate?
- A planning-department repository in OCIR must be pullable only by callers with IAM permission or a logged-in Docker session. Which repository setting matches that requirement?
- A developer with rights only in a non-root compartment is ready to push the first tag of sanitation-routing. What should they do before the first docker push?
- OCIR shows repositories named project01/acme-web-app and project01/other-app. What do those names mean?
- Operators retagged :release in OCIR so it now points at yesterday’s build, and a cluster that pulls :release silently changed artifacts. How should a team pin a specific push?
- A fleet team ships both linux/amd64 and linux/arm64 builds of a civic mobile-backend image and also stores Helm charts. Why can OCIR hold all of those artifacts?
- After pushing a verified build of inspections-api to OCIR, the team must cryptographically bind that particular push to a key they manage. What is the documented OCIR signing approach?
- A teammate can pull from a private OCIR repository used by the 311 mobile API but cannot push new tags. What best explains that at developer depth?
- OKE worker nodes for a records-management workload run in a private subnet and must pull images from OCIR in the same region without public IPs. Which VCN attachment pattern do official OCIR docs call out for that pull path?
- A single Docker Engine on one host can docker run the city’s FAQ API. Why is that still not container orchestration?
- Operators declare three healthy replicas of a licensing API image. What posture distinguishes an orchestrator from a human start/stop runbook?
- A city permitting office runs permit-review workers as containers across a pool of hosts. When a reviewer container must start, which orchestration responsibility decides which worker has enough CPU and memory and binds the container there?
- A municipal parking citation API declares three replicas on OKE. One replica’s process exits unexpectedly. What does orchestration self-healing do so the declared count stays true?
- Weekend campground reservation spikes overload the city’s checkout microservice on OKE. How should the team scale capacity using orchestration’s primary scale knob?
- A library catalog frontend must call the search backend on OKE, but search Pod IPs change whenever replicas restart. What orchestration concern gives callers a stable name that tracks currently healthy replicas?
- Public-works inspectors need a new image of the field-notes API with no Saturday outage. Which orchestration role updates replicas so clients keep working under the same service name?
- A parks department team deploys containers on OKE. Which split correctly describes how orchestration separates decision-making from execution?
- A county IT board asks which industry orchestrator this OCI developer path standardizes on, and which OCI service delivers that API without the city running control-plane VMs. What is the correct pairing?
- A water-utility team wants OKE to keep twenty meter-reading API replicas running. Which approach actually uses the orchestration contract?
- A building-permit API Pod has started its process but is still loading reference data and cannot answer HTTP yet. How should orchestration’s service layer treat that replica?
- One OKE cluster hosts both the clerk portal and the inspector mobile API for a city. What orchestration constructs slice the cluster so a Service or controller affects only the intended replica set?
- A transit app team needs scheduling, desired replica state, horizontal scale, and stable service discovery on OKE. Which product family correctly covers those needs for this exam item?
- A clerk is debugging a single container locally, and a separate short-lived event handler will run as an Oracle Function. When does a multi-node orchestrated cluster earn its keep?
- A municipal development team wants a CNCF-conformant Kubernetes API on OCI without operating control-plane VMs. Which OCI service provides that?
- Inspectors’ dispatch workloads run on an OKE cluster. How should developers manage those workloads day to day?
- A sanitation routing image sits in OCIR and must run on OKE. What is the atomic scheduled unit that actually runs that image (alone or with tightly coupled sidecars)?
- A 24×7 municipal payments microservice must keep a declared replica count and roll out image changes safely on OKE. Which Kubernetes object should the team kubectl apply as the everyday service controller?
- During a rollout of the city’s code-enforcement API, which statement best describes the ReplicaSet relative to the Deployment authors use day to day?
- After applying a Service for the tax-assessor API, kubectl reports no endpoints even though Pods are running. What binding mechanism should the team verify first?
- Inside an OKE cluster, the clerk portal must call the checkout service. Which Service type provides a stable in-cluster virtual IP that forwards to ready Pods and is not itself a public internet front door?
- A partner system outside the OKE cluster must reach a Service via a port on worker nodes. Which Service type publishes that node port, and how should teams treat it as a public front door on OKE?
- Residents must reach a public recreation-registration API on OKE through an OCI load balancer. Which developer-facing Kubernetes object asks OKE to provision and wire that balancer to the selected Pods?
- A city exposes permits.example.gov and inspections.example.gov with different URL paths and does not want a separate LoadBalancer Service for each hostname. Which Kubernetes object declares host and path HTTP routing typically in front of ClusterIP Services?
- On OKE, which documented ingress controller reads Ingress resources and programs an OCI flexible load balancer, adding Pods as backends on VCN-native clusters or nodes (with NodePort Services) on flannel clusters?
- A parks reservation API needs different feature flags and log levels in test versus production on OKE. Where should those non-secret settings live so retargeting an environment does not require rebuilding the OCIR image?
- The utility billing API on OKE needs a database password and an OCIR pull credential at runtime. Where should those credentials live relative to ConfigMaps and the container image?
- A city permit portal on OKE needs database credentials that operators may rotate overnight without rewriting the Pod template. How should those Secrets be injected?
- County library catalog Pods on OKE stay ImagePullBackOff after the Deployment points at a private OCIR repository. What is the most likely missing piece?
- Transit fare API owners change the OCIR image tag on an OKE Deployment and want riders to keep hitting ready Pods during the cutover. Which strategy should they keep?
- A small water-meter telemetry node pool is nearly full. During a Deployment roll, many new Pods sit Pending while capacity is exhausted. Which RollingUpdate knob most directly oversubscribed the pool?
- After a bad OCIR tag hit the parks reservation Deployment, operators need the previous working Pods back quickly. Why does kubectl rollout undo succeed here?
- Clinic appointment Pods report Running but callers still see intermittent 502s during boot while dependencies warm up. Which probe should gate Service membership?
- A zoning-map microservice listens on its port but deadlocks and stops handling requests. Extra replicas alone do not clear the stuck processes. Which probe should restart the unhealthy containers?
- A property-tax batch importer on OKE needs several minutes to load reference data on first boot, and liveness keeps killing it mid-load. What should the team add?
- 311 ticket workers on OKE must land on nodes with enough free capacity, yet noisy neighbors must not consume unbounded CPU. How should the Pod spec express that?
- Recycling-schedule API traffic spikes at evening set-out times. Operators want more Pods automatically when CPU rises. Which object changes the Deployment replica count?
- HPA raised court-docket replicas, but new Pods stay Pending because managed-node CPU is saturated. What capacity action addresses the shortage?
- Checkout-stage and checkout-prod for the city storefront share one OKE cluster. What Kubernetes unit keeps their Services, ConfigMaps, and Secrets from clobbering each other?
- Public-works crews want one versioned bundle for the work-order Deployment, Service, Ingress, and ConfigMap on OKE. Which packaging approach fits that need?
- Stage and production for the city grants portal should share one Helm chart but differ in image tag, replica count, and Service type. Where should those differences live?
- Emergency-alert microservices already push images to OCIR. Where should the matching Helm chart artifact live, and how is it applied to OKE?
- Building-inspection APIs need worker VMs the team can shape and patch themselves on OKE. Which node type matches that responsibility model?
- A seasonal parks ticket burst should scale Pods with HPA without patching worker instances or babysitting pool capacity. Which OKE node type fits?
- A municipal GIS renderer needs GPU shapes that managed and virtual pools do not offer. Which enhanced-cluster node option joins custom Compute instances to OKE?
- The city platform team wants virtual nodes, workload identity, and node cycling on their OKE cluster. Which cluster type unlocks those developer features?
- Permit-API Pods must be reachable as native addresses from a peered VCN that already routes the application subnet. Which OKE network type gives pods routable VCN IPs?
- A records-search team wants the simpler overlay model where pod IPs stay inside the cluster rather than as native VCN addresses. Which network type should they pick?
- Operators want serverless virtual node pools for a summer camp registration API and also selected flannel as the cluster network type. What does official OKE behavior imply?
- The city runs a general managed pool for web APIs and a separate GPU self-managed pool for model inference on one OKE cluster. What unit holds shape, image, subnet, and Kubernetes version for each capacity group?
- Virtual-node Pods for the health-clinic API must read secrets from OCI Vault without relying on a worker-instance principal. Which enhanced-cluster approach maps a Kubernetes service account to IAM for those calls?
- The cluster must refuse to run unsigned or wrongly signed images from OCIR for the tax-assessor workloads. Where is that enforcement configured?
- A city permitting microservice on OKE must keep uploaded PDF attachments across Pod restarts. Which Kubernetes object should the developer declare so the Pod receives durable storage provisioned by the cluster?
- Before the main container of a municipal records API starts on OKE, the team must run a one-shot schema migration against the database. Which Pod construct should they use?
- Developers on a county OKE cluster want kubectl logs and later platform collectors to see application messages from a containerized service. Where should the process write those messages?
- A transit-authority microservice on OKE must call the Kubernetes API (and later OCI APIs via workload identity) under a least-privilege identity. Which Pod-level object supplies that identity?
- A city finance team needs a report that runs once each night, finishes, and then stops. Which OKE workload object fits that pattern?
- An OKE cluster for a municipal GIS team was created with a private Kubernetes API endpoint only. What does that imply for how developers run kubectl?
- Before OKE terminates or recycles a managed worker so Pods can move safely, what sequence does the platform use?
Leveraging Serverless Technologies for Cloud Native Development · 99 questions
- A parks department wants small event-driven handlers that run only when invoked, without managing worker shapes or patching guest OS. Which OCI approach matches that model?
- OCI Functions documentation names the open-source, container-native serverless engine that powers the service and shares the fn CLI and func.yaml model. Which engine is that?
- A civic tech team wants to iterate on a function on a workstation and later deploy the same unit to OCI Functions with one toolchain. What workflow does OCI document?
- When creating OCI Functions for a utility billing notifier, where must network attachment and shared configuration be defined so every function in the group inherits them?
- In OCI Functions, which statement correctly distinguishes the function from its application?
- A library IT team will implement an OCI Function using the documented Fn Development Kit. Which statement matches official runtime guidance?
- A county analytics function needs GraalVM packaging that the standard FDK runtime images do not cover. What advanced OCI Functions packaging path is documented?
- After changing memory and timeout in a function’s func.yaml for a city alerts handler, what must the developer do before the running OCI Function uses those values?
- A developer runs fn init --runtime python water-quality-check for a new OCI Function. What does that command produce?
- What does the professional default command fn deploy --app <app-name> accomplish for an OCI Function?
- A developer’s fn deploy cannot find the municipal Functions application even though the app exists in OCI. Which Fn CLI configuration most directly explains targeting the wrong place?
- When creating an OCI Functions application for a permits webhook, which documented subnet pairing applies?
- For high availability of OCI Functions executions across availability domains, what subnet choice does official guidance prefer when available?
- After fn deploy, where does OCI Functions obtain the container image it runs for a function?
- Which set lists documented ways to invoke an OCI Function?
- A citizen portal must wait for a function’s response body before rendering the next page. Which OCI Functions invoke type should the portal use?
- What are the documented default and maximum durations for a synchronous OCI Functions invocation?
- For a detached OCI Functions invocation that should not block the caller, what is the documented upper bound for detachedModeTimeoutInSeconds?
- A county permit office deploys an Oracle Function that validates uploaded site plans. The handler sometimes spikes above its configured memory and the invoke fails mid-run. Which statement correctly describes how Oracle Functions treats memory?
- A city clerk wants an Oracle Function to accept a full multi-megabyte zoning PDF in the invoke body and return a similarly large annotated copy. What is the correct design constraint?
- After overnight idle time, the first call to a parks-department Oracle Function takes several seconds, while immediate follow-up calls return much faster. What explains the slow first invoke?
- A 311-call triage function must keep sub-second starts during morning peaks; cold starts are unacceptable. Which Oracle Functions capability should the team configure?
- A water-utility team needs every Oracle Function in one application to read the same Object Storage bucket name without rebuilding images when the name changes. Where should that value live?
- A municipal Functions application sets REGION=us-ashburn-1 for all handlers, but the GIS export function must use a different region key. How should that override be applied?
- A library catalog function must list objects in an Object Storage bucket at runtime without embedding long-lived user API keys in configuration. What is the correct authentication approach for the running function?
- Public works receives occasional Object Storage uploads of inspection photos and needs a short, stateless transform with scale-to-zero between jobs. Which runtime choice best fits?
- A transit agency needs a long-running HTTP fare API with custom sidecars and readiness probes, plus a worker that keeps a Streaming cursor open. Where should those processes run?
- A planning department wants official OCI services to invoke a zoning-check Oracle Function. Which set correctly reflects documented invokers for this exam’s common choices?
- A developer copies a local Fn Project func.yaml that includes a triggers HTTP section into an OCI Functions deploy for a city payments helper. The deploy fails. What is the fix?
- A records-office function usually finishes in under 20 seconds, but the team set timeout to 300 seconds “just in case.” What is the recommended timeout practice?
- After adding a heavier library, a Java Oracle Function for tax-roll transforms begins returning FunctionInvokeTimeout / 504 even though wall-clock work used to finish. What should the team check first among Functions settings?
- A county automation lead asks whether Oracle Functions only consume events or also produce them. What is accurate?
- A municipality wants one HTTPS hostname for clients that reaches load-balanced microservices and several Oracle Functions without handing out raw function invoke URLs. Which component should sit in front?
- An internal HR API for city employees must not be reachable from the public internet, while a second citizen portal API must be. How do API Gateway front-end types differ?
- A network-aware developer is placing an API Gateway for a permits API. Which placement rule is correct?
- After creating an empty API Gateway appliance for a licensing portal, clients still receive nothing useful. Which object must exist before the API accepts requests?
- On a parks recreation API, GET /permits should invoke one Oracle Function and POST /permits should invoke another. What is the correct unit in the deployment specification?
- A citizen-services team wants HTTPS clients to call an Oracle Function through a normal API path without exposing the signed invoke endpoint or adding a func.yaml triggers block. Which API Gateway back-end type fits?
- A long-running permitting microservice already listens behind a load balancer on OKE. The team wants API Gateway to forward /v1/applications there. Which back-end choice is appropriate?
- Before wiring live back ends, a developer wants /health on a new municipal API deployment to always return a fixed 200 body from the gateway itself. Which back-end type should they use?
- Three city departments want separate API path prefixes and policies but one shared public hostname. When is a second API Gateway unnecessary?
- Securing a unified permitting API, the team must decide where authentication is declared on API Gateway. Which statement is correct?
- On the same API deployment, /health should allow anonymous clients while /admin must require a specific access scope after authentication. How is that modeled?
- A city’s building-permit portal must reject callers unless a custom combination of API key header, department code, and an internal lookup succeeds. Standard JWT validation alone is not enough. Which API Gateway authentication approach should the developer choose?
- A municipal 311 API needs new custom authentication that inspects several request headers and a query parameter. The team is wiring an OCI Functions authorizer to API Gateway. Which authorizer shape should they choose for a new implementation?
- A county library API uses an OCI Functions authorizer in front of HTTP back ends. After authentication succeeds, routes must enforce which operations the patron may perform, and one back-end URL needs a library-branch id injected from the authorizer. What should the authorizer return?
- A city’s open-data single-page app in the browser must call an OCI API Gateway deployment. Developers need the gateway to answer CORS preflight and attach the configured CORS headers on actual responses. How should CORS be implemented?
- A parking-citation API behind one OCI API Gateway deployment is overwhelmed by a noisy public client. Operators want a simple ceiling that protects every back end on that deployment. Per-partner paid tiers will come later. Which control matches that need?
- A water-utility billing API exposes a public JSON field named accountId, but the stable HTTP back end still expects customerNumber. The team wants the public contract to evolve without forking the Function. Which gateway capability should they use?
- A building-department API receives incomplete permit payloads that waste Function invocations. The team wants malformed requests rejected at the front door before any back end runs. Which API Gateway feature fits?
- A regional transit agency sells partner access to a real-time arrival API on OCI API Gateway. Product wants per-second rates, monthly quotas, and a list of which deployments each subscriber may call, using a client token only for metering. What does a usage plan provide in this model?
- A parks-and-recreation team has an OpenAPI 3.0 description for a new reservations API and wants OCI API Gateway routes pre-populated from that file. Creating an API resource is optional. What happens when they upload the OpenAPI description?
- A city’s sanitation department is shipping a mobile app for bulky-item pickup. Developers considered giving every phone a direct Oracle Functions invoke URL and an API-signing key. Why should external clients call OCI API Gateway over HTTPS instead?
- An economic-development office created an OCI API Gateway and defined routes on paper, but callers still receive nothing useful. What must exist before the gateway can serve the API?
- A transit authority continuously publishes ridership pings, vehicle telemetry, and lifecycle events that several analytics services must read at their own pace in order. Which OCI service model fits this pattern?
- A metro government wants several related OCI Streaming streams—permits, inspections, and payments—to share Kafka compatibility settings, encryption, and an optional private endpoint. Which construct owns those shared settings?
- A 911 computer-aided dispatch feed on OCI Streaming must let several consumers process messages in parallel. What is the unit that determines that parallelism?
- A permit-tracking service publishes status updates on OCI Streaming. All updates for the same permit number must be processed in order, while different permits may run in parallel. How should messages be keyed?
- After a restart, a city’s smart-meter consumer must resume reading an OCI Streaming partition without replaying the entire retention window. Which concept marks the consumer’s place in that partition?
- A public-works telemetry reader needs to start at a specific time in an OCI Streaming partition without deleting messages when they are read. Which construct points at that location?
- Several inspector-app instances must jointly consume a multi-partition work-order stream on OCI Streaming so each partition is handled by only one instance at a time. Which feature coordinates that assignment?
- Streetlight controllers publish events to OCI Streaming. A flaky consumer may see the same message again after a failed commit, and another team may replay within the retention window after a bug fix. What delivery and retention behavior should handlers assume?
- A parking-enforcement feed uses multiple OCI Streaming partitions for throughput. Stakeholders ask whether the entire stream preserves a single global order of every citation. What is the correct order guarantee?
- A city-council meeting chat pipeline creates a new OCI Streaming stream for live reactions. Operators need the valid retention window, the default, and whether retention can be changed later. Which statement is correct?
- Parking-sensor producers already speak Kafka APIs. The city wants those clients to publish into OCI Streaming without running a self-managed Apache Kafka cluster. What capability should they rely on?
- A records office wants first-party and third-party systems to exchange data with OCI Streaming without writing a custom pump for every product. Which documented integration path fits?
- A health department publishes sensitive lab-result events to OCI Streaming and must keep producers and consumers off the public internet while still using IAM to control who may produce or consume. Which stream-pool option supports that attachment model?
- A court-records analytics stream on OCI Streaming must use a customer-managed encryption key instead of relying only on Oracle-managed keys. Where is that customer-managed key sourced?
- A city permits bureau streams inspection updates into OCI Streaming and must transform each partition’s messages with an Oracle Function before writing results to Object Storage, preserving order. Which documented path wires the stream through the function?
- A municipal transit dashboard has many producers continually appending vehicle telemetry, and several independent analytics consumers must read—and sometimes replay—the same data with per-partition order and Kafka-shaped clients. Which OCI service should carry that bus?
- A parks department developer is designing subscriptions for bucket and database lifecycle changes. What envelope do OCI services use when they emit those resource-state messages through the Events service?
- A city open-data team wants OCI to react when certain resource changes occur. In the Events service model, what developer object combines the match criteria with the destinations that receive a match?
- A wastewater SCADA modernization project needs an Events rule to deliver matching OCI resource changes somewhere useful. Which set lists the documented Events action destinations?
- A library IT developer creates an Events rule so Object Storage object creates can start processing. What should be the primary filter condition in the official create-rule flow?
- A city’s Events rule already matches Object Storage create-object events, but every bucket in the tenancy would fire it. How should the developer narrow matches to one bucket’s family of resources?
- Operations tags databases that need automated follow-up. Which Events capability aims a rule at only those labeled resources without listing every OCID?
- A planning department keeps emitting Object Storage and database resources in a nested compartment tree. Where should the Events rule live so it sees those emissions, and must the Function action live in the same compartment?
- A records office writes a perfect Events rule for com.oraclecloud.objectstorage.createobject, yet uploads never trigger the Function. What Object Storage requirement is most likely missing?
- A building-permits office wants each new scan that lands in a bucket to be converted by serverless code. Which Events pattern implements that event-driven conversion?
- When a municipal database backup completes, on-call staff should get an email or pager alert. If instead the match must resize or convert a resource, which Events actions fit those two intents?
- Several downstream municipal services—and a short replay window—must all see the same OCI resource-state change that an Events rule matches. Which action destination fits that fan-out?
- A civic apps team debates where to put continuous click-stream telemetry versus reactions to OCI bucket and database state changes. Which distinction correctly separates Events from Streaming?
- Microservice A in a city payments mesh must ask microservice B to process a refund job. Separately, a bucket change should start automation. Which producer distinction guides Events versus Queue?
- Before enabling an Events rule that should invoke a Function and also notify a topic, what must already be true about those destinations?
- After an Events rule matches, what is the service’s responsibility versus the destination’s, and how should multi-step follow-up be designed?
- A licensing microservice must hand independently processed transactional jobs to worker services without treating the traffic as an analytics log or as OCI resource automation. Which OCI service fits that consume-and-complete inbox?
- Workers for a city citation processor use OCI Queue. Which sequence reflects the official message lifecycle principles after a producer publishes work?
- Two worker pods poll the same municipal Queue. What does the visibility timeout provide after one consumer receives a message?
- A GIS export worker pulled a Queue message but processing will exceed the remaining visibility window. What should the consumer do so the message does not return mid-work?
- A utility billing worker crashes after consuming a Queue message but before deleting it. What happens when visibility ends, and what design duty follows?
- Poison messages keep failing a city inspections worker. After repeated unsuccessful gets without a successful update or delete, where do those messages go on OCI Queue?
- Capacity planners ask how long undeleted OCI Queue messages can remain compared with Streaming retention. Which statement matches official Queue retention?
- A 311 request-reply API and fair work distribution across producers share one OCI Queue. Which Queue feature provides ephemeral destinations for fairness and caller-specific replies?
- A city inspection desk polls OCI Queue with GetMessages for new site-visit jobs. Empty replies keep the worker chatty. Which setting lets a single GetMessages wait up to thirty seconds for a message instead of returning empty right away?
- A parking-citation microservice must pull work from OCI Queue. Which client approaches does Oracle document for Queue access?
- A public-works app must hand each repair ticket to exactly one worker, hide it while in flight, and remove it after success—with no need for a second team to replay yesterday’s tickets. Which OCI messaging choice fits?
- The permitting service must ask a separate provisioning service to create a field tablet record, while Object Storage createobject events should invoke a Function. Which pairing is correct?
- Tax-notice producers spike overnight while consumers process steadily by day. Where should the backlog live, and what still must run the business logic?
- Building-permit review and fee-collection microservices must scale independently, keep each task until success or dead-letter, and avoid losing work if one side slows. Which Domain 3 service best fits that decoupling?
Testing and Securing Cloud Native Applications · 39 questions
- A library-holds microservice ships to production without a coordinated release of catalog or fines neighbors. How should its automated tests be organized?
- A parking-fine fee calculator changed overnight. Which test layer best gives fast feedback on that logic alone?
- Permit-status and inspection services meet only over a published HTTP contract. Which test type best locks that seam without re-running every collaborator’s business rules?
- A transit-fare consumer depends on specific fields from a fare-rules producer. How can consumer-driven contracts catch producer drift before production?
- A code-enforcement worker must prove it can publish, consume, and delete on OCI Queue the way production will—including visibility timeout behavior. Which test approach fits?
- A recreation booking path crosses API Gateway → Function → Queue → OKE worker. How should end-to-end journeys be sized in the suite?
- A water-billing service ships as a container image to OKE. Laptop unit tests pass, but production pods fail on missing CA material and a non-root USER. What should CI exercise?
- After a parks-reservation service rolls out a new revision on OKE, which post-deploy checks best prove the new revision actually serves?
- A license-renewal producer plans to remove a field that independently deployed consumers still need. What test order protects those consumers?
- A zoning microservice times out a hung GIS dependency, retries carefully, and requires POSTs to be idempotent. What should the automated suite include?
- CI for a utility-billing image currently COPY’s a database password into a layer “just for tests.” What is the sound testing posture?
- A city team adds a new OCI Queue subscription to an existing case-intake service. Which test investment is the cheapest that would catch publish/consume/delete bugs?
- Several municipal microservices share one staging OKE cluster. What does that shared environment imply for each team’s test ownership?
- A citizen-portal Function needs a database password at run time. Where should that secret live?
- A records office encrypts citizen PDFs with envelope encryption in OCI Vault. Which statement correctly matches key roles?
- An integrated OCI service stores a citizen document using Vault envelope encryption. What is stored next to the ciphertext, and why must the app call Vault to read it?
- A water-meter gateway must encrypt readings with a symmetric key and separately sign firmware manifests. Which Vault algorithm pairing matches those jobs?
- A city security team creates a new Vault master key for permit archives and must choose protection mode. Which statement is accurate?
- After rotating a Vault symmetric key used for permit PDFs, last month’s ciphertext must still decrypt. What does rotation do?
- A city’s permitting platform must store encryption keys for citizen document uploads. Compliance requires an isolated HSM partition, a large included key-version allotment, and vault backup. Which OCI Vault type should the developer choose?
- A municipal benefits Function always retrieves a database password by the same Vault secret OCID. After operators rotate the password in Vault, which statement correctly describes what the Function receives on the next retrieval?
- The city’s parking-citation database password was written into Vault as a new version, but the database has not been cut over yet. Apps that always fetch the current secret must keep using the old password until cutover. Which rotation-state pairing is correct?
- A permits Oracle Function needs only the current database password at runtime. Which Vault operation should the Function call?
- A water-utility Oracle Function must read a Vault secret at runtime without embedding an IAM user key. Which approach follows the documented Functions path?
- An OKE workload for the city’s 311 app needs a production API token. Developers propose checking a Kubernetes Secret YAML with the live token into the Helm chart repo. What is the correct production approach?
- The city wants Object Storage buckets for permit PDFs encrypted with a customer-managed Vault master key. How do integrated OCI services use that key?
- A civic Oracle Function only needs to fetch a Vault secret bundle at invoke time. Which IAM verb and target best match least privilege?
- A developer must authorize several Oracle Functions in one compartment to call OCI APIs. What should the dynamic-group matching rule select?
- While packaging a tax-filing Oracle Function, a teammate wants to copy a tenancy config file and an IAM user’s PEM into the image so SDK calls succeed. What is the documented secure pattern instead?
- The city’s grants Function is in dynamic group civic-fn-dg and must read objects only from bucket permit-uploads. Which policy shape best reflects least privilege?
- After fixing an IAM policy for a civic Oracle Function, an immediate re-invoke still returns NotAuthorizedOrNotFound. The matching rule and policy text are now correct. What is the most likely explanation?
- A developer must authorize an OKE Pod in the city’s enhanced cluster to call OCI APIs with workload identity. Which identifying triple is written into IAM for that workload?
- An OKE Pod must read a Vault secret using workload identity without putting an instance principal on every node. Which policy form matches the documented shape?
- A teammate tries to add an OKE workload identity to the same dynamic group used by Oracle Functions. Why will that fail?
- A recreation-department Function should read only the Vault secret that holds the parks database password, not every secret in the compartment. How should the policy be tightened?
- City IAM design must separate humans who rotate Vault secrets from Functions that only fetch current contents. Which split is appropriate?
- During review of a licensing Oracle Function, a database password is found in Function application config and duplicated as an ENV in the image. What should replace both?
- The city’s enhanced OKE cluster must admit only trusted images from OCIR. Which image-integrity approach is in scope for this developer exam?
- Private-subnet Oracle Functions and OKE Pods for the city intranet must reach Vault without exposing the apps to the internet or dropping user keys on nodes. What is the appropriate pattern?
Monitoring & Troubleshooting Cloud Native Applications · 30 questions
- A civic operations board needs numeric invoke rates and threshold alerts for Oracle Functions, plus separate stores for log lines and distributed traces. Which OCI service holds metrics and alarms?
- After deploying a new Oracle Function for online payments, the team wants invocation and duration charts. What must they enable first?
- Citizens report that a permitting Function sometimes fails, sometimes feels slow, and sometimes seems overwhelmed. Which metric mapping is correct?
- The Throttles chart for a city’s notifications Function lights up during a mailing spike. What does a throttled invocation mean, and what should developers do first?
- Service Metrics for ocifaas shows noise from every Function in the compartment. How should an operator isolate one permitting Function’s charts?
- A city parking-permit portal team wants a Monitoring chart that shows peak API Gateway request volume during permit renewals. Besides the metric name in the ociapigateway namespace, which two other pieces must the metric query include?
- The municipal snow-route dispatcher wants an alarm that pages on-call when permit-API latency stays high, but a single one-minute spike should not wake anyone. Which alarm design matches OCI Monitoring practice?
- When a parks recreation booking alarm fires, where should the firing message go so on-call staff get email or PagerDuty, without treating Logging as the alarm destination?
- A water-utility OKE cluster shows citizen-portal pods stuck Pending while nodes report not Ready. Which Monitoring approach matches what OCI emits automatically for the cluster and nodes?
- Citizens report slow permit lookups through API Gateway in front of an Oracle Function. Which metric pair best separates gateway overhead from time spent in the Function backend?
- A building-permit team needs application print lines from an Oracle Function, not the tenancy’s public-API trail. Which Logging kind should they enable for that Functions output?
- The library card-renewal API Gateway has no events in Logging yet. What must the developer do so the service starts writing those events?
- A city IT lead wants one IAM boundary and one search scope for all recreation-booking logs across environments. Which Logging construct is the unit that provides that management shape?
- Where does a developer enable Function Invocation Logs so default invocation records appear for functions in a municipal payments Fn application?
- After enabling invocation logs, a tax-assessment Function still shows no diagnostic lines about which parcel ID failed. What else must be true for those custom lines to appear in Logging?
- A permit-status Function prints valid JSON objects, but Logging Search cannot filter on nested fields. Which application setting change unlocks structured fields for advanced filters?
- A transit-pass microservice on OKE writes helpful errors to stdout, but Logging still shows nothing from the app. Which path correctly gets those lines into OCI Logging?
- Pods for a marina slip-reservation app will not schedule, and the team needs control-plane scheduler and API server detail—not the app’s stdout. Which log kind answers that question?
- During a festival ticket outage, operators need one Logging query that spans the API Gateway service log and the Functions invocation log group. What does OCI Logging search support?
- A citizen’s failed dog-license renewal hit API Gateway then an Oracle Function. Which field is the documented way to join gateway and function log lines for that same client call?
- The health-department Fn team wants a span tree for each immunization-appointment Function invocation. Where should those traces be sent?
- While reviewing APM for a grants portal Function, a developer confuses terminology. What is the difference between a trace and a span?
- A clerk portal Functions app has an APM domain ready, but function-level tracing toggles never appear. What enablement order does OCI require?
- After tracing is enabled for a utility-billing Function, Trace Explorer shows an outer invocation span but nothing for the Vault secret fetch inside. What does that indicate?
- Developers want a named custom span around a downstream Function call from a code-enforcement Fn. Which approach matches the official custom-span path?
- Metrics show a long duration for a zoning-variance Function, but not where time was spent. Where should the developer inspect the request’s span tree?
- A business-license Function invokes a fee-calculator Function, but Trace Explorer shows two unrelated traces. What is missing for a single tree covering both?
- On-call for a city payments stack asks three different questions. Which matching is correct?
- A refuse-collection Function starts failing for some ZIP codes. What ordered use of the three official tools matches Functions troubleshooting practice?
- During a planned deploy of the business-license API, the team still wants metrics and logs but must not page the Notifications topic. Which Monitoring action fits?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.