Sep-2021 Latest Actual4test 1Z0-997-20 Exam Dumps with PDF and Exam Engine Free Updated Today!
Following are some new 1Z0-997-20 Real Exam Questions!
NEW QUESTION 75
A digital marketing company is planning to host a website on Oracle Cloud Infrastructure (OCI) and leverage OCI Container Engine for Kubernetes (OKE). The web server will make API calls to access OCI Object Storage to store all images uploaded by users.
For security purposes, your manager instructed you to ensure that the credentials used by the web server to allow access not stored locally on the compute instance.
What solution results in an Implementation with the least effort for this scenario?
- A. Configure the credentials to use Transparent Data Encryption (TDE) which will automatically allow the web server to make API calls to OCl Object Storage.
- B. Configure the credentials using OCI Registry (OC1R) which will automatically connect with OKE allowing the web server to make API calls to OCI Object Storage.
- C. Configure the credentials using Instance Principal to allow the web server to make API calls to OCl Object Storage
- D. Configure the credentials using OCI Key Management to allow an instance to make API calls and grant access to OCl Object Storage.
Answer: A
Explanation:
INSTANCE PRINCIPALS
The IAM service feature that enables instances to be authorized actors (or principals) to perform actions on service resources. Each compute instance has its own identity, and it authenticates using the certificates that are added to it. These certificates are automatically created, assigned to instances and rotated, preventing the need for you to distribute credentials to your hosts and rotate them.
Dynamic groups A special type of group that contains resources (such as compute instances) that match rules that you define (thus the membership can change dynamically as matching resources are created or deleted). These instances act as "principal" actors and can make API calls to services according to policies that you write for the dynamic group.
The following steps summarize the process flow for setting up and using instances as principals. The subsequent sections provide more details.
1 Create a dynamic group. In the dynamic group definition, you provide the matching rules to specify which instances you want to allow to make API calls against services.
2 Create a policy granting permissions to the dynamic group to access services in your tenancy (or compartment).
3 A developer in your organization configures the application built using the Oracle Cloud Infrastructure SDK to authenticate using the instance principals provider. The developer deploys the application and the SDK to all the instances that belong to the dynamic group.
4 The deployed SDK makes calls to Oracle Cloud Infrastructure APIs as allowed by the policy (without needing to configure API credentials).
5 For each API call made by an instance, the Audit service logs the event, recording the OCID of the instance as the value of principalId in the event log.
NEW QUESTION 76
An upcoming e-commerce company has deployed their online shopping application on OCI. The application was deployed on compute instances with autoscaling configuration for application servers fronted by a load balancer and OCI Autonomous Transaction Processing (ATP) in the backend.
In order to promote their e-commerce platform 50% discount was announced on all the products for a limited period. During the day 1 of promotional period it was observed that the application is running slow and company's hotline is flooded with complaints.
What could be two possible reasons for this situation?
- A. The health check on some of the backend servers has failed and the load balancer was rebooting these servers.
- B. The autoscaling has already scaled to the maximum number of instances specified in the configuration and there is no room of scaling
- C. The health check on some of the backend servers has failed and the load balancer has taken those servers temporarily out of rotation
- D. As part of autoscaling, the load balancer shape has dynamically changed to a larger shape to handle more incoming traffic and the system was slow for a short time during this change
Answer: B,C
NEW QUESTION 77
You have provisioned a new VM.DenseIO2.24 compute instance with local NVMe drives. The compute instance is running production application. This is a write heavy application, with a significant Impact to the business it the application goes down.
What should you do to help maintain write performance and protect against NVMe devices failure.
- A. NVMe drive have built in capability to recover themself so no other actions are required
- B. Configure RAID 1 for NVMe devices.
- C. Configure RAID 6 for NVMe devices.
- D. Configure RAID 10 for NVMe devices.
Answer: D
Explanation:
VM.DeselO2.24 compute instance include locally attached NVMe devices. These devices provide extremely low latency, high performance block storage that is ideal for big data, OLTP, and any other workload that can benefit from high-performance block storage.
A protected RAID array is the most recommended way to protect against an NVMe device failure. There are three RAID levels that can be used for the majority of workloads:
RAID 1: An exact copy (or mirror) of a set of data on two or more disks; a classic RAID 1 mirrored pair contains two disks RAID 10: Stripes data across multiple mirrored pairs. As long as one disk in each mirrored pair is functional, data can be retrieved RAID 6: Block-level striping with two parity blocks distributed across all member disks If you need the best possible performance and can sacrifice some of your available space, then RAID 10 array is an option.
NEW QUESTION 78
A hospital in Austin has hosted its web based medical records portal entirely In Oracle cloud Infrastructure (OCI) using Compute Instances for its web-tier and DB system database for its data tier. To validate compliance with Health Insurance Portability and Accountability (HIPAA), the security professional to check their systems it was found that there are a lot of unauthorized coming requests coming from a set of IP addresses originating from a country in Southeast Asia.
Which option can mitigate this type of attack?
- A. Block the attacking IP address by implementing a OCI Web Application Firewall policy using Access Control Rules
- B. Block the attacking IP address by creating a Security List rule to deny access to the subnet where the web server Is running
- C. Block the attacking IP address by creating by Network Security Group rule to deny access to the compute Instance where the web server Is running
- D. Mitigate the attack by changing the Route fable to redirect the unauthorized traffic to a dummy Compute instance
Answer: A
Explanation:
WAF can protect any internet facing endpoint, providing consistent rule enforcement across a customer's applications.
WAF provides you with the ability to create and manage rules for internet threats including Cross-Site Scripting (XSS), SQL Injection and other OWASP-defined vulnerabilities. Unwanted bots can be mitigated while tactically allowed desirable bots to enter. Access rules can limit based on geography or the signature of the request.
As a WAF administrator you can define explicit actions for requests that meet various conditions. Conditions use various operations and regular expressions. A rule action can be set to log and allow, detect, or block requests
NEW QUESTION 79
You are trying to troubleshoot the configuration of your Oracle Cloud Infrastructure (OCI) Load Balancing service. You have a backend HTTP service for which you have created a backend set in the load balancer. You have configured health checks for the backend set. Although the health checks appear good, customers sometimes experience transaction failures.
Which of the following options will definitely lead to this problem?
- A. You are running a TCP-level health check against your HTTP service. The TCP handshake can succeed and indicate that the service is up even when the HTTP service has issues.
- B. You are using iSCI for block volume attachment to the compute instances in your backed HTTP service.
TCP/IP configuration of your block volume attachment is not configured correctly, leading to issues in your backend service. - C. You are using OCI Domain Name System. You have misconfigured the 'A' record with the wrong IP address leading to requests not getting routed correctly.
- D. You are NOT using regional subnets in your Virtual Cloud Network. With Availability Domain (AD) specific subnet. the compute instances of the backend service running in the subnet have issues when the AD is down.
Answer: A
NEW QUESTION 80
An Oracle Cloud Infrastructure (OCI) Public Load Balancer's SSL certificate is expiring soon. You noticed the Load Balancer is configured with SSL Termination only. When the certificate expires, data traffic can be interrupted and security compromised.
What steps do you need to take to prevent this situation?
- A. Add the new SSL certificate to the Load Balancer and implement end to end SSL so it can encrypt the traffic from clients all the way to the backend servers.
- B. Add the new SSL certificate to the Load Balancer and update listeners to use the new certificate bundle.
- C. Add the new SSL certificate to the Load Balancer and update backend servers to use the new certificate bundle.
- D. Add the new SSL certificate to the Load Balancer, update backend servers to work with a new certificate and edit listeners so they can use the new certificate bundle.
- E. Add the new SSL certificate to the Load Balancer, update listeners and backend sets so they can use the new certificate bundle.
Answer: D
Explanation:
https://docs.cloud.oracle.com/en-us/iaas/Content/Balance/Tasks/managingcertificates.htm
NEW QUESTION 81
Which of the below options for private access to services within Oracle Cloud Infrastructure (OCI) is NOT valid?
- A. You can enable private access to certain services within OCI from your Virtual Cloud Network by using either a private endpoint or a service gateway.
- B. Traffic from an OCI compute instance going through a Service Gateway to Object Storage is routed without being sent over the internet.
- C. You cannot use the private endpoint for hosts in the on-premises network.
- D. The private endpoint gives hosts within your Virtual Cloud Network access to a given service within Oracle Cloud Infrastructure.
Answer: C
NEW QUESTION 82
You are part of a project team working in the development environment created in Oracle Cloud Infrastructure (OCI). You realize that the CIDR block specified for one of the subnets in a Virtual Cloud Network (VCN) is not correct and want to delete the subnet. While deleting you get an error indicating that there are still resources that you must delete first. The error includes the OCID of the VNIC that is in the subnet.
Which of the following action you will take to troubleshoot this issue?
- A. Use OCI CLI to delete the VNIC first and then delete the subnet.
- B. Use OCI CLI to call "network vnic" and "compute vnic-attachment" operations to find out the parent resource of the VNIC.
- C. Use OCI CLI to delete the subnet using -force option.
- D. Copy and paste OCID of the VNIC in the search box of the OCI Console to find out the parent resource of the VNIC.
Answer: B
NEW QUESTION 83
Your organization is planning on using Oracle Cloud Infrastructure (OCI) File Storage Service (FSS). You will be deploying multiple compute instance in Oracle Cloud Infrastructure (OCI) and mounting the file system to these compute instances. The file system will hold payment data processed by a Database instance and utilized by compute instances to create a overall inventory report. You need to restrict access to this data for specific compute instances and must be allowed/blocked per compute instance's CIDR block.
Which option can you use to secure access?
- A. Use 'Export option' feature of FSS to restrict access to the mounted file systems.
- B. Create a new VCN security list, choose SOURCE TYPE as Service and SOURCE SERVICE as FSS.
Add stateless ingress and egress rules for specific P address and CIDR blocks. - C. Create and configure OCI Web Application Firewall service with built in DNS based intelligent routing.
- D. Use stateless Security List rule to restrict access from known IP addresses only.
Answer: A
Explanation:
Explanation
NFS export options enable you to create more granular access control than is possible using just security list rules to limit VCN access. You can use NFS export options to specify access levels for IP addresses or CIDR blocks connecting to file systems through exports in a mount target. Access can be restricted so that each client's file system is inaccessible and invisible to the other, providing better security controls in multi-tenant environments.
Using NFS export option access controls, you can limit clients' ability to connect to the file system and view or write data. For example, if you want to allow clients to consume but not update resources in your file system, you can set access to Read Only. You can also reduce client root access to your file systems and map specified User IDs (UIDs) and Group IDs (GIDs) to an anonymous UID/GID of your choice. For more information about how NFS export options work with other security layers
NEW QUESTION 84
You are a solutions architect for a global health care company which has numerous data centers around the globe. Due to the ever growing data that your company is storing, you were Instructed to set up a durable, cost effective solution to archive you data from your existing on-premises tape based backup Infrastructure to Oracle Cloud Infrastructure (OCI).
What is the most-effective mechanism to Implement this requirement?
- A. Use the File Storage Service in OCI and copy the data from your existing tape based backup to the shared file system
- B. Setup fastConnect to connect your on premises network to your OCI VCN and use rsync tool to copy your data to OCI Object Storage Archive tier.
- C. Setup an on premises OCI Storage Gateway which will back up your data to OCI Object Storage Archive tier.(Correct)
- D. Setup an on-promises OCI Storage Gateway which will back up your data to OCI Object Storage Standard
- E. Setup an on premises OCI Storage Gateway which will back up your data to OCI object Storage Standard tier. Use Object Storage life cycle policy management to move any data older than 30 days from Standard to Archive tier.
Answer: C
Explanation:
Explanation
Oracle Cloud Infrastructure offers two distinct storage tiers for you to store your unstructured data. Use the Object Storage Standard tier for data to which you need fast, immediate, and frequent access. Use the Archive Storage service's Archive tier for data that you access infrequently, but which must be preserved for long periods of time. Both storage tiers use the same manageable resources (for example, objects and buckets). The difference is that when you upload a file to Archive Storage, the object is immediately archived. Before you can access an archived object, you must first restore the object to the Standard tier.
you can use Storage Gateway to move files to Oracle Cloud Infrastructure Archive Storage as a cost effective backup solution. You can move individual files and compressed or uncompressed ZIP or TAR archives. Storing secondary copies of data is an ideal use case for Storage Gateway.
NEW QUESTION 85
A developer is using Oracle Functions to deploy her code as part of an event-driven solution in Oracle Cloud Infrastructure (OCI). When she invokes her function, Oracle Functions returns a FunctionlnvokelmageNotAvailable message and a 502 error:
Which of the following options is NOT a plausible reason for this error?
- A. The VCN being used does not have an internet gateway or a service gateway configured for Oracle Functions to be able to access OCI Registry.
- B. OCI Events service rule is not configured with the correct location of the function in OCI Registry.
- C. Missing or invalid IAM policy to give Oracle Functions read access to images stored for functions in repositories in OCI Registry.
- D. The function does not exist in the specified location in OCI Registry.
Answer: B
NEW QUESTION 86
All three Data Guard Configuration are fully supported on Oracle Cloud infrastructure (OCI). You want to deploy a maximum availability architecture (MAA) for database workload.
Which option should you consider while designing your Data Guard configuration to ensure best RTO and PRO without causing any data loss?
- A. Configure ''Maximum Availability" mode in SYNC mode between two availability domains (same region), and use the Maximum Availability mode in SYNC mode between two regions.
- B. Configure ''Maximum Scalability" mode which provides the highest level of scalability without compromising the availability of the primary database.
- C. Configure "Maximum Protection" mode which provides zero data loss If the primary database fails.
- D. Configure "Maximum Performance" mode In SYNC mode between two availability domains (same region) which provides, the highest level of data protection that is possible without affecting the performance of the primary database.
Answer: A
Explanation:
Explanation
https://docs.cloud.oracle.com/en-us/iaas/Content/Resources/Assets/whitepapers/best-practices-for-dr-on-oci.pdf All three Data Guard configurations are fully supported on Oracle Cloud Infrastructure. However, because of a high risk of production outage, we don't recommend using the maximum protection mode for your Data Guard configuration.
We recommend using the maximum availability mode in SYNC mode between two availability domains (same region), and using the maximum availability mode in ASYNC mode between two regions. This architecture provides you the best RTO and RPO without causing any data loss. We recommend building this architecture in daisy-chain mode: the primary database ships redo logs to the first standby database in another availability domain in SYNC mode, and then the first standby database ships the redo logs to another region in ASYNC mode. This method ensures that your primary database is not doing the double work of shipping redo logs, which can cause performance impact on a production workload.
This configuration offers the following benefits:
* No data loss within a region.
* No overhead on the production database to maintain standbys in another region.
* Option to configure lagging on the DR site if needed for business reasons.
* Option to configure multiple standbys in different regions without any additional overhead on the
* production database. A typical use case is a CDN application
* Bottom of Form
NEW QUESTION 87
Your customer has gone through a recent departmental re structure. As part of this change, they are organizing their Oracle Cloud Infrastructure (OCI) compartment structure to align with the company's new organizational structure.
They have made the following change:
Compartment x Is moved, and its parent compartment is now compartment c.
Policy defined in compartment A: Allow group networkadmins to manage subnets in compartment X Policy defined in root compartment: Allow group admins to read subnets in compartment Finance:A:X After the compartment move, which action will provide users of group networkadmins and admins with similar privileges as before the move?
- A. No change in any policy statement is required as compartments move automatically moves alt the policy statements associated with compartments as well.
- B. Define a policy in Compartment C as follows: Allow group network admins to manage subnets in compartment X.
- C. Define a policy in compartment C as follows Allow group admins to read subnets in compartment HR:C:X
- D. Define a policy in compartment C as follows: Allow group admins to read subnets in compartment HR:C:X
- E. Define a policy in compartment HR as follows: Allow group network admins to manage subnets in compartment X.
Answer: B
Explanation:
You can move a compartment to a different parent compartment within the same tenancy. When you move a compartment, all its contents (subcom partments and resources) are moved with it.
After you move a compartment to a new parent compartment, the access policies of the new parent take effect and the policies of the previous parent no longer apply. Before you move a compartment, ensure that:
- You are aware of the policies that govern access to the compartment in its current position.
- You are aware of the polices in the new parent compartment that will take effect when you move the compartment.
1- Policy that defined in root compartment: Allow group admins to read subnets in compartment Finance:A:X you move compartment X from Finance:A to HR:C. The policy that governs compartment X is attached to the shared parent, root compartment. When the compartment X is moved, the policy statement is automatically updated by the IAM service to specify the new compartment location.
The policy
Allow group admins to read subnets in compartment Finance:A:X
is updated to Allow group admins to read subnets in compartment HR:C:X
so the admins group will have the same access after the compartment X is moved
2- Policy that defined in compartment A: Allow group networkadmins to manage subnets in compartment X you move compartment X from Finance:A to HR:C. However, the policy that governs compartment X here is attached directly to the A compartment. When the compartment is moved, the policy is not automatically updated. The policy that specifies compartment X is no longer valid and must be manually removed. Group networkadmins no longer has access to compartment X in its new location under HR:C. Unless another existing policy grants access to group networkadmins , you must create a new policy to allow networkadmins to continue to manage buckets in compartment X.
NEW QUESTION 88
You are a solutions architect for a global health care company which has numerous data centers around the globe. Due to the ever growing data that your company is storing, you were Instructed to set up a durable, cost effective solution to archive you data from your existing on-premises tape based backup Infrastructure to Oracle Cloud Infrastructure (OCI).
What is the most-effective mechanism to Implement this requirement?
- A. Use the File Storage Service in OCI and copy the data from your existing tape based backup to the shared file system
- B. Setup fastConnect to connect your on premises network to your OCI VCN and use rsync tool to copy your data to OCI Object Storage Archive tier.
- C. Setup an on premises OCI Storage Gateway which will back up your data to OCI Object Storage Archive tier.(Correct)
- D. Setup an on-promises OCI Storage Gateway which will back up your data to OCI Object Storage Standard
- E. Setup an on premises OCI Storage Gateway which will back up your data to OCI object Storage Standard tier. Use Object Storage life cycle policy management to move any data older than 30 days from Standard to Archive tier.
Answer: C
Explanation:
Oracle Cloud Infrastructure offers two distinct storage tiers for you to store your unstructured data. Use the Object Storage Standard tier for data to which you need fast, immediate, and frequent access. Use the Archive Storage service's Archive tier for data that you access infrequently, but which must be preserved for long periods of time. Both storage tiers use the same manageable resources (for example, objects and buckets). The difference is that when you upload a file to Archive Storage, the object is immediately archived. Before you can access an archived object, you must first restore the object to the Standard tier.
you can use Storage Gateway to move files to Oracle Cloud Infrastructure Archive Storage as a cost effective backup solution. You can move individual files and compressed or uncompressed ZIP or TAR archives. Storing secondary copies of data is an ideal use case for Storage Gateway.
NEW QUESTION 89
As a part of migration exercise for an existing on premises application to Oracle Cloud Infrastructure (OCT), yon ore required to transfer a 7 TB file to OCI Object Storage. You have decided to upload functionality of Object Storage.
Which two statements are true?
- A. After initiating a multipart upload by making a CreateMultlPartUpload RESI API Call, the upload remains active until you explicitly commit it or abort.
- B. It is possible to spill this fileInto multiple parts using the APIs provided by Object Storage.
- C. It is possible to split this file into multiple parts using rclone tool provided by Object Storage.
- D. Active multipart upload can be checked by listing all parts that have been uploaded, however It Is not possible to list information for individual object part in an active multipart upload
- E. Contiguous numbers need to be assigned for each part so that Object Storage constructs the object by ordering, part numbers in ascending order
Answer: A,D
Explanation:
You can check on an active multipart upload by listing all parts that have been uploaded. (You cannot list information for an individual object part in an active multipart upload.) After you finish creating object parts, initiate a multipart upload by making a CreateMultipartUpload REST API call. Provide the object name and any object metadata. Object Storage responds with a unique upload ID that you must include in any requests related to this multipart upload. Object Storage also marks the upload as active. The upload remains active until you explicitly commit it or abort it.
NEW QUESTION 90
Multiple departments In your company use a shared Oracle Cloud Infrastructure (OCI) tenancy to Implement their projects. You are in charge of managing the cost of OCI resources in the tenancy and need to obtain better Insights Into department's usage.
Which three options can you implement together to accomplish this?
- A. Set up a tag default that automatically applies tags to all specified resources created In a compartment then use these tags for cost analysis.
- B. Use the billing cost tracking report to analyze costs
- C. Set up a consolidated budget tracking lags to analyze costs in ,1 granular manner
- D. Set up different compartments for each department then track and analyze cost per compartment
- E. Create a budget that matches your commitment amount and an alert at 100 percent of the forecast
Answer: A,D,E
Explanation:
budgets
You can use budgets to track costs in your tenancy. After creating a budget for a compartment, you can set up alerts that will notify you if a budget is forecast to be exceeded or if spending surpasses a certain amount.
OCI Cost Analysis
* Visualization tools Help understand spending patterns at a glance
* Filter costs by Date, Tags and Compartments
* Trend lines show how spending patterns are changing
* To use Cost Analysis you must be a member of the Administrators group
NEW QUESTION 91
A manufacturing company is planning to migrate their on-premises database to OCI and has hired you for the migration. Customer has provided following information regarding their existing onpremises database:
Database version, host operating system and version, database character set, storage for data staging, acceptable length of system outage.
What additional information do you need from customer in order to recommend a suitable migration method?
Choose two
- A. On-premises host operating system and version
- B. Top 5 longest running queries
- C. Number of active connections
- D. Data types used in the on-premises database
- E. Elapsed time since database was last patched
Answer: A,D
Explanation:
Explanation
Not all migration methods apply to all migration scenarios. Many of the migration methods apply only if specific characteristics of the source and destination databases match or are compatible. Moreover, additional factors can affect which method you choose for your migration from among the methods that are technically applicable to your migration scenario.
Some of the characteristics and factors to consider when choosing a migration method are:
On-premises database version
Database service database version
On-premises host operating system and version
On-premises database character set
Quantity of data, including indexes
Data types used in the on-premises database
Storage for data staging
Acceptable length of system outage
Network bandwidth
NEW QUESTION 92
You have deployed a multi-tier application with multiple compute instances in Oracle Cloud Infrastructure.
You want to back up these volumes and have decided to use 'Volume Groups' feature. The Block volume and Compute instances exist in different compartments within your tenancy.
Periodically, a few child compartments are moved under different parent compartments, and you notice that sometimes volume group backup fails.
What could be the cause?
- A. The Identity and Access Management policy allowing backup failed to move when the compartment was moved.
- B. You are exceeding your volume group backup quota configured.
- C. A compute instance with multiple block volumes attached cannot move when a compartment is moved.
- D. You have the same block volume attached to multiple compute instances; if these compute instances are in different compartments then all concerned compartments must be moved at the same time.
Answer: A
NEW QUESTION 93
You are working with a social media company as a solution architect. The media company wants to collect and analyze large amounts of data being generated from their websites and social media feeds to gain insights and continuously improve the user experience. In order to meet this requirement, you have developed a microservices application hosted on Oracle Container Engine for Kubernetes. The application will process the data and store the result to an Autonomous Data Warehouse (ADW) instance.
Which Oracle Cloud Infrastructure (OCI) service can you use to collect and process a large volume of unstructured data in real time?
- A. OCI Events
- B. OCI Notifications
- C. OCI Resource Manager
- D. OCI Streaming
Answer: D
NEW QUESTION 94
You are currently working for a public health care company based in the United Stats. Their existing patient records runs in an on-premises data center and the customer is sending tape backups offsite as part of their recovery planning.
You have developed an alternative archival solution using Oracle Cloud Infrastructure (OCI) that will save the company a significant amount of mom on a yearly basis. The solution involves storing data in an OCI Object Storage bucket After reviewing your solution with the customer global Compliance (GRC) team they have highlighted the following security requirements:
* All data less than 1 year old must be accessible within 2 hour.
* All data must be retained for at least 10 years and be accessible within 48 hours
* AH data must be encrypted at rest
* No data may be transmitted across the public Internet
Which two options meet the requirements outlined by the customer GRC team?
- A. Provision a FastConnect link to the closest OCI region and configure a public peering virtual circuit
- B. Provision a FastConnect link to the closest OCI region and configure a private peering virtual circuit.
- C. Create a VPN connection between your on premises data center and OCI. Create a Virtual Cloud Network (VCN) along with an OCI Service Gateway for OCI Object Storage.
- D. Create an OCI Object Storage Standard tier bucket. Configure a lifecycle policy to delete any object that is older than 7 years
- E. Create an OCI Object Storage Standard tier bucket Configure a lifecycle policy to archive any object that Is older than 365 days
Answer: A,E
Explanation:
Explanation
The Oracle Services Network is a conceptual network in Oracle Cloud Infrastructure that is reserved for Oracle services. These services have public IP addresses that you typically reach over the internet. However, you can access the Oracle Services Network without the traffic going over the internet. There are different ways, depending on which of your hosts need the access:
Hosts in your on-premises network:
- Private access through a VCN with FastConnect private peering or VPN Connect: The on-premises hosts use private IP addresses and reach the Oracle Services Network by way of the VCN and the VCN's service gateway.
- Public access with FastConnect public peering: The on-premises hosts use public IP addresses.
regarding which Fastconnect Public peering: To access public services in Oracle Cloud Infrastructure without using the internet. For example, Object Storage, the Oracle Cloud Infrastructure Console and APIs, or public load balancers in your VCN. Communication across the connection is with IPv4 public IP addresses. Without FastConnect, the traffic destined for public IP addresses would be routed over the internet. With FastConnect, that traffic goes over your private physical connection.
so Answer 4 will be the best answer that meets the customer requirement A service gateway lets your virtual cloud network (VCN) privately access specific Oracle services without exposing the data to the public internet. No internet gateway or NAT is required to reach those specific services. The resources in the VCN can be in a private subnet and use only private IP addresses. The traffic from the VCN to the Oracle service travels over the Oracle network fabric and never traverses the internet.
Object Lifecycle Management lets you automatically manage the archiving and deletion of objects. By using Object Lifecycle Management to manage your Object Storage and Archive Storage data, you can reduce your storage costs and the amount of time you spend managing data.
NEW QUESTION 95
An organization has its IT infrastructure in a hybrid setup with an on-premises environment and an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) in the us-phonix-1 region. The on-premise applications communications with compute instances inside the VPN over a hardware VPN connection. They are looking to implement an Intrusion detected and Prevention (IDS/IPS) system for their OCI environment. This platform should have the ability to scale to thousands of compute of instances running inside the VCN.
How should they architect their solution on OCI to achieve this goal?
- A. Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform to inspection
- B. Set up an OCI Private Load Balance! and configure IDS/IPS related health checks at TCP and/or HTTP level to inspect traffic
- C. Configure autoscaling on a compute Instance pool and set vNIC to promiscuous mode to called traffic across the vcn and send it IDS/IPS platform for inspection.
- D. There Is no need to implement an IPS/IDS system as traffic coming over IPSec VPN tunnels Is already encrypt
Answer: A
Explanation:
in Transit routing through a private IP in the VCN you set up an instance in the VCN to act as a firewall or intrusion detection system to filter or inspect the traffic between the on-premises network and Oracle Services Network.
The Networking service lets you implement network security functions such as intrusion detection, application-level firewalls In fact, the IDS model can be host-based IDS (HIDS) or network-based IDS (NIDS). HIDS is installed at a host to periodically monitor specific system logs for patterns of intrusions. In contrast, an NIDS sniffs the traffic to analyze suspicious behaviors. A signature-based NIDS (SNIDS) examines the traffic for patterns of known intrusions. SNIDS can quickly and reliably diagnose the attacking techniques and security holes without generating an over-whelming number of false alarms because SNIDS relies on known signatures.
However, anomaly-based NIDS (ANIDS) detects unusual behaviors based on statistical methods. ANIDS could detect symptoms of attacks without specific knowledge of details. However, if the training data of the normal traffic are inadequate, ANIDS may generate a large number of false alarms.
NEW QUESTION 96
An online Stock trading application is deployed to multiple Availability Domains in the us phoenix-1 region.
Considering the high volume of transactions that the trading application handles, the company has hired you to ensure that the data stored by the application available, and disaster resilient. In the event of failure, the Recovery lime Objective (UK)) must be less than 2 hours to meet regulator requirements.
Which Disaster Recovery strategy should be used to achieve the RTO requirement In the event of system failure?
- A. Store hourly block volumes backup to NVMe device under a compute instance and generate a custom Image every 5 minutes.
- B. Configure hourly block volumes backups using the Oracle Cloud Infrastructure (OCI) Command Line Interface (CLI)
- C. Configure hourly block volumes backups through the Storage Gateway service.
- D. Configure your application to use synchronous master slave data replication between Availability Domains.
Answer: B
Explanation:
Explanation
You can use the CLI, REST APIs, or the SDKs to automate, script, and manage volume backups and their lifecycle.
Planning Your Backup
The primary use of backups is to support business continuity, disaster recovery, and long-term archiving requirements. When determining a backup schedule, your backup plan and goals should consider the following:
Frequency: How often you want to back up your data.
Recovery time: How long you can wait for a backup to be restored and accessible to the applications that use it. The time for a backup to complete varies on several factors, but it will generally take a few minutes or longer, depending on the size of the data being backed up and the amount of data that has changed since your last backup.
Number of stored backups: How many backups you need to keep available and the deletion schedule for those you no longer need. You can only create one backup at a time, so if a backup is underway, it will need to complete before you can create another one. For details about the number of backups you can store
NEW QUESTION 97
Your company will soon start moving critical systems Into Oracle Cloud Infrastructure (OCI) platform. These systems will reside in the us-phoenix-1and us-ashburn 1 regions. As part of the migration planning, you are reviewing the company's existing security policies and written guidelines for the OCI platform usage within the company. you have to work with the company managed key.
Which two options ensure compliance with this policy?
- A. When you create a new OCI Object Storage bucket through OCI console, you need to choose
"ENCRYPT USING CUSTOMER-MANAGED KEYS" option. - B. When you create a new compute instance through OCI console, you use the default options for
"configure boot volume" to speed up the process to create this compute instance. - C. When you create a new block volume through OCI console, select Encrypt using Key Management checkbox and use encryption keys generated and stored in OCI Key Management Service.
- D. When you create a new compute instance through OCI console, you use the default shape to speed up the process to create this compute instance.
- E. You do not need to perform any additional actions because the OCI Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption.
Answer: A,C
Explanation:
Explanation
Block Volume Encryption
By default all volumes and their backups are encrypted using the Oracle-provided encryption keys. Each time a volume is cloned or restored from a backup the volume is assigned a new unique encryption key.
You have the option to encrypt all of your volumes and their backups using the keys that you own and manage using the Vault service.If you do not configure a volume to use the Vault service or you later unassign a key from the volume, the Block Volume service uses the Oracle-provided encryption key instead.
This applies to both encryption at-rest and in-transit encryption.
Object Storage Encryption
Object Storage employs 256-bit Advanced Encryption Standard (AES-256) to encrypt object data on the server. Each object is encrypted with its own data encryption key. Data encryption keys are always encrypted with a master encryption key that is assigned to the bucket. Encryption is enabled by default and cannot be turned off. By default, Oracle manages the master encryption key. However, you can optionally configure a bucket so that it's assigned an Oracle Cloud Infrastructure Vault master encryption key that you control and rotate on your own schedule.
Encryption: Buckets are encrypted with keys managed by Oracle by default, but you can optionally encrypt the data in this bucket using your own Vault encryption key. To use Vault for your encryption needs, select Encrypt Using Customer-Managed Keys. Then, select the Vault Compartment and Vault that contain the master encryption key you want to use. Also select the Master Encryption Key Compartment and Master Encryption Key.
NEW QUESTION 98
Which of the below options is true regarding Oracle Cloud Infrastructure's load balancing service?
- A. When you create a private load balancer, the service requires 2 or more subnets to host both the primary and standby load balancers.
- B. You can dynamically change the load balancer shape to handle more incoming traffic.
- C. A public load balancer is Availability Domain specific in scope.
- D. The public load balancer applies a floating public IP address to the primary load balancer.
Answer: D
NEW QUESTION 99
You are working as a cloud engineer for an IoT startup company which is developing a health monitoring pet collar for dogs and cats. The company collects biometric Information of the pet every second and then sends it to Oracle Cloud Infrastructure (OCI) Your task is to come up with an architecture which will accept and process the monitoring data as well as provide complete trends and health reports to the pet owners. The portal should be highly available, durable, and scalable with an additional feature for showing real time biometric data analytics.
which architecture will help you meet this requirement?
- A. Create an OCI Object Storage bucket to collect the incoming biometric data from the smart pet collar Fetch the data horn OC\ Object storage to OCI Autonomous Data Warehouse (ADW) every day and run analytics Jobs with it
- B. Use OCI Streaming Service to collect the incoming biometric data. Use Oracle Functions to process the date and show the results on a real-time dashboard and store the results lo OCI Object Storage Store the data In OCI Autonomous Data warehouse (ADW) to handle analytics.
- C. Use OCI Streaming Service to collect the incoming biometric data. Use an open source Hadoop cluster to analyze the data horn streaming service. Store the results to OCI Autonomous Data warehouse (ADW) to handle complex analytics.
- D. Launch an open source Hadoop cluster to collect the Incoming biometrics data Use an Open source Fluentd cluster to analyze the- data me results to OCI Autonomous Transaction Processing (ADW)to handle complex analytics
Answer: B
NEW QUESTION 100
......
Resources From:
- 2021 Latest Actual4test 1Z0-997-20 Exam Dumps (PDF & Exam Engine) Free Share: https://www.actual4test.com/1Z0-997-20_examcollection.html
Free Resources from Actual4test, We Devoted to Helping You 100% Pass All Exams!