Testing and Securing Cloud Native Applications

1Z0-1084-26 · 39 questions

• A library-holds microservice ships to production without a coordinated release of catalog or fines neighbors. How should its automated tests be organized?
• A parking-fine fee calculator changed overnight. Which test layer best gives fast feedback on that logic alone?
• Permit-status and inspection services meet only over a published HTTP contract. Which test type best locks that seam without re-running every collaborator’s business rules?
• A transit-fare consumer depends on specific fields from a fare-rules producer. How can consumer-driven contracts catch producer drift before production?
• A code-enforcement worker must prove it can publish, consume, and delete on OCI Queue the way production will—including visibility timeout behavior. Which test approach fits?
• A recreation booking path crosses API Gateway → Function → Queue → OKE worker. How should end-to-end journeys be sized in the suite?
• A water-billing service ships as a container image to OKE. Laptop unit tests pass, but production pods fail on missing CA material and a non-root USER. What should CI exercise?
• After a parks-reservation service rolls out a new revision on OKE, which post-deploy checks best prove the new revision actually serves?
• A license-renewal producer plans to remove a field that independently deployed consumers still need. What test order protects those consumers?
• A zoning microservice times out a hung GIS dependency, retries carefully, and requires POSTs to be idempotent. What should the automated suite include?
• CI for a utility-billing image currently COPY’s a database password into a layer “just for tests.” What is the sound testing posture?
• A city team adds a new OCI Queue subscription to an existing case-intake service. Which test investment is the cheapest that would catch publish/consume/delete bugs?
• Several municipal microservices share one staging OKE cluster. What does that shared environment imply for each team’s test ownership?
• A citizen-portal Function needs a database password at run time. Where should that secret live?
• A records office encrypts citizen PDFs with envelope encryption in OCI Vault. Which statement correctly matches key roles?
• An integrated OCI service stores a citizen document using Vault envelope encryption. What is stored next to the ciphertext, and why must the app call Vault to read it?
• A water-meter gateway must encrypt readings with a symmetric key and separately sign firmware manifests. Which Vault algorithm pairing matches those jobs?
• A city security team creates a new Vault master key for permit archives and must choose protection mode. Which statement is accurate?
• After rotating a Vault symmetric key used for permit PDFs, last month’s ciphertext must still decrypt. What does rotation do?
• A city’s permitting platform must store encryption keys for citizen document uploads. Compliance requires an isolated HSM partition, a large included key-version allotment, and vault backup. Which OCI Vault type should the developer choose?
• A municipal benefits Function always retrieves a database password by the same Vault secret OCID. After operators rotate the password in Vault, which statement correctly describes what the Function receives on the next retrieval?
• The city’s parking-citation database password was written into Vault as a new version, but the database has not been cut over yet. Apps that always fetch the current secret must keep using the old password until cutover. Which rotation-state pairing is correct?
• A permits Oracle Function needs only the current database password at runtime. Which Vault operation should the Function call?
• A water-utility Oracle Function must read a Vault secret at runtime without embedding an IAM user key. Which approach follows the documented Functions path?
• An OKE workload for the city’s 311 app needs a production API token. Developers propose checking a Kubernetes Secret YAML with the live token into the Helm chart repo. What is the correct production approach?
• The city wants Object Storage buckets for permit PDFs encrypted with a customer-managed Vault master key. How do integrated OCI services use that key?
• A civic Oracle Function only needs to fetch a Vault secret bundle at invoke time. Which IAM verb and target best match least privilege?
• A developer must authorize several Oracle Functions in one compartment to call OCI APIs. What should the dynamic-group matching rule select?
• While packaging a tax-filing Oracle Function, a teammate wants to copy a tenancy config file and an IAM user’s PEM into the image so SDK calls succeed. What is the documented secure pattern instead?
• The city’s grants Function is in dynamic group civic-fn-dg and must read objects only from bucket permit-uploads. Which policy shape best reflects least privilege?
• After fixing an IAM policy for a civic Oracle Function, an immediate re-invoke still returns NotAuthorizedOrNotFound. The matching rule and policy text are now correct. What is the most likely explanation?
• A developer must authorize an OKE Pod in the city’s enhanced cluster to call OCI APIs with workload identity. Which identifying triple is written into IAM for that workload?
• An OKE Pod must read a Vault secret using workload identity without putting an instance principal on every node. Which policy form matches the documented shape?
• A teammate tries to add an OKE workload identity to the same dynamic group used by Oracle Functions. Why will that fail?
• A recreation-department Function should read only the Vault secret that holds the parks database password, not every secret in the compartment. How should the policy be tightened?
• City IAM design must separate humans who rotate Vault secrets from Functions that only fetch current contents. Which split is appropriate?
• During review of a licensing Oracle Function, a database password is found in Function application config and duplicated as an ENV in the image. What should replace both?
• The city’s enhanced OKE cluster must admit only trusted images from OCIR. Which image-integrity approach is in scope for this developer exam?
• Private-subnet Oracle Functions and OKE Pods for the city intranet must reach Vault without exposing the apps to the internet or dropping user keys on nodes. What is the appropriate pattern?