1z0-1084-23 Oracle Cloud Infrastructure 2023 Developer Professional Question and Answers

Explanation

The statement that accurately describes the Oracle Cloud Infrastructure (OCI) Load Balancer integration with OCI Container Engine for Kubernetes (OKE) is: "OKE service provisions an OCI Load Balancer instance for each Kubernetes service with LoadBalancer type in the YAML configuration." When you define a Kubernetes service in your YAML configuration with the LoadBalancer type, the OKE service automatically provisions an OCI Load Balancer instance specifically for that service. This Load Balancer instance is dedicated to the Kubernetes service and provides traffic balancing functionality. Each Kubernetes service that requires load balancing will have its own OCI Load Balancer instance provisioned by OKE.

Explanation

The correct answer is: "Multiple microservices can run in one process." The statement that is FALSE about microservices is: "Multiple microservices can run in one process." Microservices are designed to be independent and autonomous services that can be deployed, scaled, and managed separately. Each microservice typically runs as its own separate process. This separation allows for loose coupling and independent scalability of individual services. Running multiple microservices in a single process would violate the fundamental principle of microservices architecture, which emphasizes the isolation and independence of services. Combining multiple microservices into a single process would tightly couple them, making it difficult to independently manage, scale, and update each service. The other statements provided are true about microservices: It is fairly common for microservices to communicate with HTTP: Microservices often communicate with each other using lightweight protocols like HTTP/REST. This allows for interoperability, flexibility, and ease of communication between microservices. Microservices are typically designed around business capabilities: Microservices architecture advocates designing services based on specific business capabilities or functionalities. Each microservice focuses on a specific business domain or task, enabling modular and scalable development. They are independently deployable: Microservices are designed to be independently deployable units. This means that each microservice can be developed, tested, deployed, and updated separately without affecting other services. This flexibility allows for faster development cycles and more efficient scalability.

Idle-timeout is the parameter that is used to configure the time period during which an idle function will remain in memory before Oracle Functions removes its container image from memory2. The idle-timeout parameter is specified in seconds and can be set when creating or updating a function2. The default value for idle-timeout is 30 seconds and the maximum value is 900 seconds (15 minutes)2. If a function has the --provisioned-concurrency option enabled, the idle-timeout parameter is ignored and the function instances are always kept in memory3.Verified References: Creating Functions, Provisioned Concurrency

Explanation

Oracle Functions does not currently support PL/SQL as a language for writing function code. PL/SQL is a procedural language used in Oracle Database for developing stored procedures, triggers, and other database-related code. However, Oracle Functions supports several other popular programming languages such as Go, Node.js, Python, and Java, allowing developers to choose the language that best suits their application requirements and their familiarity with the language. While PL/SQL is powerful for working with the Oracle Database, it is not an option for writing function code in the Oracle Functions serverless architecture.

Explanation

The correct answer is: Test using an API mock of service B. To test service A without deploying all of its dependencies, including service B, you can use an API mock of service B. An API mock is a simulated version of the API that mimics the behavior of the actual service. By using an API mock, you can isolate the testing of service A and simulate the responses and behavior of service B's APIs. With an API mock, you can define the expected responses and behavior of service B's APIs, allowing you to test the integration between service A and the mocked version of service B. This approach enables you to verify the functionality of service A without relying on the availability or changes in the actual service B. By decoupling the dependencies and using an API mock, you can perform independent testing of service A, ensuring its functionality in isolation.

OCI API Gateway supports the following authentication methods for accessing an API deployment3:

• HTTP Basic: The client sends a username and password with each request. The credentials are validated against a user database in Oracle Identity Cloud Service (IDCS).
• API Key: The client sends an API key with each request. The API key is validated against a list of keys stored in IDCS or OCI Vault.
• OAuth: The client obtains an access token from an authorization server (such as IDCS) and sends it with each request. The access token is validated against the authorization server and optionally checked for required scopes.
• JWT Token: The client obtains a JSON Web Token (JWT) from an identity provider (such as IDCS or OCI IAM) and sends it with each request. The JWT is validated against the identity provider’s public key and optionally checked for required claims. SAML Token is not a valid authentication method for accessing an OCI API Gateway deployment. SAML is an XML-based standard for exchanging authentication and authorization data between different parties, such as a service provider and an identity provider4. SAML tokens are typically used for web browser single sign-on (SSO) scenarios, not for API access4.

To pull a Docker image from OCI Registry to the client machine, you need to use the docker pull command with the following syntax1: docker pull .ocir.io//: where:

• is the key for the OCI Registry region you’re using. For example, iad. See Availability by Region1.
• ocir.io is the OCI Registry name.
• is the auto-generated Object Storage namespace string of the tenancy that owns the repository from which you want to pull the image (as shown on the Tenancy Information page)1.
• is the name of the repository that contains the image you want to pull.
• is the tag of the image you want to pull.

To prevent images from being deleted from a repository, you can set the global policy of image retention to “Retain All Images”. This policy applies to all repositories in the tenancy and overrides any individual repository settings. You can also lock the policy to prevent any changes to it.Verified References: Using Retention Rules to Preserve Data

Explanation

The correct answer is: Microservices are used for long running operations while serverless functions are used for short running operations. One of the key differences between microservices and serverless functions is the duration of their execution. Microservices are typically designed to handle long-running operations and may continuously run and process requests as part of a larger system. They are often deployed and managed as long-lived services. On the other hand, serverless functions are designed to handle short-lived operations or tasks that execute in response to specific events or triggers. They are event-driven and execute only when invoked, providing a lightweight and ephemeral computing model. Serverless functions are often used for executing small, isolated pieces of code without the need for managing infrastructure or scaling concerns. While both microservices and serverless functions can be stateless or stateful depending on the specific implementation, the key distinction lies in the typical duration and execution pattern of these components within an application architecture.

Explanation

The valid OKE cluster network configuration that meets the requirement of having the least attack surface while still allowing direct access to the deployed applications from the Internet is: Private subnets for nodes and the Kubernetes API endpoint; public subnets for load balancers. By placing the nodes and the Kubernetes API endpoint in private subnets, they are not directly accessible from the Internet, reducing the attack surface. The load balancers, on the other hand, are placed in public subnets, allowing them to be accessed from the Internet and serve as the entry point for accessing the deployed applications. This configuration ensures that the critical components of the cluster, such as the nodes and the API endpoint, are protected within the private network, while still providing accessibility to the applications through the load balancers. It helps to enhance security by limiting direct access to the internal components of the cluster while maintaining the availability of the deployed applications.

Explanation

The term that describes developing microservices in different languages of choice is "Polyglot." In a polyglot architecture, each microservice is developed using the most appropriate programming language or technology stack for its specific requirements. This approach allows developers to leverage the strengths of different languages and frameworks, enabling them to use the most suitable tool for each microservice while still maintaining interoperability between services.

Explanation

The correct answer is: "read only." The layers of a Docker image are read-only. Once a layer is created, it cannot be modified. Each layer represents a Dockerfile instruction, and it is stacked on top of the previous layer, forming a stack of immutable layers. These layers are designed to be read-only to ensure consistency and integrity of the image. When a Docker image is built, each instruction in the Dockerfile creates a new layer. Each layer represents the changes made by that instruction relative to the previous layer. The layers are stacked on top of each other to form the complete image. This layer-based approach allows for efficient storage and distribution of Docker images. Because the layers are read-only, any changes or modifications to the image result in the creation of new layers rather than modifying the existing ones. This immutability ensures that each layer remains intact and preserves the integrity of the image. It also enables Docker's caching mechanism, where previously built layers can be reused if the corresponding instructions haven't changed, speeding up the image build process. The other options mentioned, such as "write only," "write once," "movable," and "read mostly," do not accurately describe the permission associated with Docker image layers. Docker image layers are specifically designed to be read-only.

Explanation

The feature that is typically NOT associated with Cloud Native is "Application Servers." Cloud Native architecture emphasizes lightweight, scalable, and containerized deployments, which often replace traditional monolithic application servers. Instead of relying on application servers, Cloud Native applications are typically deployed as containerized microservices that can be orchestrated and managed using container orchestration platforms like Kubernetes. This approach enables greater flexibility, scalability, and agility in deploying and managing applications. While application servers have been widely used in traditional application architectures, they are not a characteristic feature of Cloud Native architectures. Cloud Native architectures focus on containerization, declarative APIs, immutable infrastructure, and service meshes to enable efficient and scalable deployment and management of applications.

Explanation

The correct options are: A configured OCI API signing key pair: The API signing key pair is used for authentication and authorization to access OCI resources, including the OKE cluster. The private key should be configured on your local machine to authenticate API requests. An SSH key pair with the public key added to the cluster worker nodes: This is required for secure SSH access to the worker nodes in the OKE cluster. You need to generate an SSH key pair and add the public key to the cluster's worker node pool during cluster creation or update. Therefore, the correct options are having a configured OCI API signing key pair and an SSH key pair with the public key added to the cluster worker nodes.

Explanation

The appropriate logging approach for services running in Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE) is: "All services log to standard output only." When running services in a containerized environment like OKE, it is recommended to follow the Twelve-Factor App methodology, which suggests treating logs as event streams. According to this methodology, services should write their log events to standard output (stdout) instead of writing to log files. By logging to standard output, the container runtime (such as Kubernetes) can collect and aggregate the logs generated by the services. These logs can then be accessed and managed through the container runtime's logging infrastructure. Logging to standard output offers several advantages in a containerized environment: Simplicity and consistency: Standardizing on logging to stdout ensures a consistent approach across different services, making it easier to manage and analyze logs. Log aggregation: The container runtime can collect the logs from all the running containers and provide centralized log management, allowing you to access and search logs from different services in one place. Scalability: Since logs are written to stdout, they can be easily handled by the container runtime's log management system, which can scale to handle large volumes of log data. Separation of concerns: By logging to stdout, the responsibility of managing log files and their rotation is shifted to the container runtime, allowing the services to focus on their core functionality. While it is possible to log to log files or external logging systems, the recommended approach in a containerized environment like OKE is to log to standard output and leverage the logging infrastructure provided by the container runtime.

Explanation

To address the requirement of extracting and transforming data from the Oracle Cloud Infrastructure (OCI) Streaming service and sending it to a third-party REST endpoint using the OCI Service Connector Hub, the best configuration option is: Configure a new service connector as follows: • Source: Streaming • Task: None • Target: Notifications By selecting the Streaming service as the source, you can capture the transactional data from the stream. Since there is a need to transform and send the data to a third-party REST endpoint, you don't need to specify any specific task in the connector. The target is set to Notifications, which allows you to send the transformed data to an endpoint outside of the OCI environment. Notifications can be configured to deliver the data to various supported destinations, including HTTP endpoints, email addresses, and more. This configuration enables you to automate the process of extracting data from the streaming service and sending it to the desired third-party REST endpoint, fulfilling the requirement of extracting, transforming, and forwarding the data.

Explanation

The three technologies best suited for implementing a microservices-based application are: Service Mesh: A service mesh is a dedicated infrastructure layer that provides features like service discovery, load balancing, encryption, authentication, and observability for microservices. It helps in managing the communication and interactions between microservices in a scalable and secure manner. Kubernetes: Kubernetes is an open-source container orchestration platform that enables the deployment, scaling, and management of containerized applications. It provides features like automated scaling, service discovery, load balancing, and self-healing capabilities, which are essential for managing microservices in a distributed environment. Docker: Docker is a popular containerization platform that allows packaging applications and their dependencies into lightweight containers. It provides a consistent and portable environment for running microservices, enabling easy deployment and scalability. Docker also facilitates isolation and resource efficiency, making it an ideal choice for deploying microservices. While Big Data, Anomaly Detection, and Terraform are valuable technologies, they are not specifically focused on enabling the implementation of microservices-based applications.

Explanation

To dynamically make Kubernetes resources discoverable to public DNS servers, you can use ExternalDNS. ExternalDNS is a Kubernetes add-on that automates the management of DNS records for your Kubernetes services and ingresses. It can be configured to monitor the changes in your Kubernetes resources and automatically update DNS records in a supported DNS provider. By integrating ExternalDNS with your Kubernetes cluster, you can ensure that the DNS records for your services and ingresses are automatically created, updated, or deleted based on changes in your Kubernetes resources. This allows your Kubernetes resources to be discoverable by external systems through public DNS servers.

Explanation

The correct answer is: "Tightly coupled." Tightly coupling is not a criterion that is usually met by a microservice. In fact, microservices are designed to be loosely coupled. Loosely coupling refers to reducing dependencies and minimizing the direct interactions between different components or services. Microservices promote independence and autonomy, allowing each service to operate independently without being tightly bound to other services. The other options listed are criteria that are typically met by microservices: Organized around business capabilities: Microservices architecture suggests designing services around specific business capabilities or functionalities. This allows for focused and specialized services that align with the organization's business needs. Independently deployable: Microservices are designed to be independently deployable units. Each microservice can be developed, tested, and deployed separately, without impacting other services. This enables agility and scalability in the deployment process. Highly maintainable: Microservices are often designed to be highly maintainable. They are smaller in scope and focused on specific tasks, making it easier to manage and maintain individual services. Additionally, microservices can be updated, patched, or replaced without affecting the entire system, facilitating easier maintenance and evolution of the application. Therefore, the criterion that is NOT typically met by a microservice is being tightly coupled.

Explanation

The correct answer is: "Robust Deployment." When using test cases that simultaneously validate a deployment and perform a selected set of functional tasks, the testing measure that should be considered is "Robust Deployment." Robust Deployment refers to the ability of an application or system to be deployed reliably and consistently, without errors or failures. It involves ensuring thatthe deployment process is well-defined, automated, and able to handle different scenarios and configurations. When conducting testing that combines the validation of deployment and functional tasks, it is crucial to ensure that the deployment itself is robust. This means verifying that the application or system can be successfully deployed and configured without encountering deployment-related issues such as incorrect configurations, missing dependencies, or compatibility problems. By considering "Robust Deployment" as a testing measure, you can evaluate the reliability and effectiveness of the deployment process, ensuring that the application or system is deployed correctly and ready to perform the selected set of functional tasks.

Fn Project is the open source engine that is used by OCI to power Oracle Functions1. Fn Project is an open source, container native, serverless platform that can be run anywhere - any cloud or on-premises1. Fn Project is easy to use, extensible, and performant. You can download and install the open source distribution of Fn Project, develop and test a function locally, and then use the same tooling to deploy that function to Oracle Functions1.Verified References: Overview of Functions

Explanation

The three OCI services that can be leveraged to securely store and version your application's source code, and automate the building, testing, and deployment of applications to the OCI platform are: DevOps: OCI provides a comprehensive set of DevOps services, including Oracle Developer Cloud Service, which allows you to manage source code repositories, automate builds and testing, and streamline the deployment process. Container Engine for Kubernetes: OCI's Container Engine for Kubernetes (OKE) enables you to deploy and manage containerized applications using Kubernetes. It provides a scalable and reliable platform for automating the deployment of your applications. Oracle Cloud Infrastructure Registry: OCI Registry is a fully managed, private container registry that allows you to securely store and manage Docker images. It integrates with other OCI services, such as Container Engine for Kubernetes, to facilitate seamless deployment and orchestration of containerized applications. These services combined provide the necessary tools and infrastructure to support continuous integration and continuous deployment (CI/CD) workflows, enabling efficient and automated application development and deployment processes in the Oracle Cloud Infrastructure environment.

Explanation

The smallest unit of Kubernetes architecture is a Pod. A Pod is a logical grouping of one or more containers that are deployed together on the same host and share the same network namespace, storage, and other resources. It represents the smallest deployable unit in Kubernetes and is used to encapsulate and manage one or more closely related containers. Containers within a Pod are scheduled and deployed together, allowing them to communicate and share resources efficiently.

Explanation

The valid statements regarding the OCI Container Engine for Kubernetes (OKE) service are: OKE automatically creates and configures new network resources for the new cluster. When creating a new OKE cluster, the service automatically provisions and configures the necessary network resources, such as VCNs, subnets, route tables, security lists, and load balancers, to support the cluster. Your tenancy must have sufficient quota on different types of resources. Before creating an OKE cluster, you need to ensure that your Oracle Cloud Infrastructure (OCI) tenancy has sufficient quota for the required resources, such as compute instances, block storage, networking resources, and load balancers. You must have access to an Oracle Cloud Infrastructure tenancy. To use the OKE service, you need to have access to an OCI tenancy. This means you must have a valid OCI account and the necessary permissions to create and manage resources within the tenancy. Thefollowing statements are not valid: OKE cannot use existing network resources for the creation of a new cluster. OKE creates new network resources specifically for the cluster, and it does not support using existing network resources. There is a limit of three clusters within each region, but there is no limit on the number of nodes and pods you can create within each cluster. This statement is incorrect. There is no specific limit on the number of clusters you can create within a region in OKE. However, there may be certain limits or quotas on resources that can impact the number of clusters you can create.

Explanation

The option that allows changes to a Docker image to be stored in a version control system is: docker commit The docker commit command is used to create a new image from a container's changes. It takes a running container as input, captures the changes made to it, and creates a new image with those changes. This new image can then be tagged and pushed to a registry, or saved locally. By using docker commit, you can effectively capture the changes made to a container as a new image and store it in a version control system along with the Dockerfile and other project files. This allows for reproducibility and traceability of changes to the Docker image over time.

Explanation

The correct answer is: "Adding a custom certificate authority (CA) or custom CA bundle to your gateway's trust store for mTLS is optional unless you need to reject certificates that do not contain particular values (such as a domain name)." The statement that is NOT valid regarding the mTLS options in OCI API Gateway is: "Adding a custom certificate authority (CA) or custom CA bundle to your gateway's trust store for mTLS is optional unless you need to reject certificates that do not contain particular values (such as a domain name)." In OCI API Gateway, adding a custom certificate authority (CA) or custom CA bundle to the gateway's trust store is not optional. It is a necessary step when configuring mTLS authentication. The trust store in the gateway is used to validate the client certificates presented during mTLS authentication. The other options listed are valid regarding the mTLS options in OCI API Gateway: Once the mTLS request policy is enabled, all requests with valid certificates are routed to the backend unless specific values (such as a domain name) are defined. This means that only requests with valid client certificates will be allowed to access the backend microservices. The mTLS request policy can only be enabled at the API deployment specification level, and it applies globally to all routes in that deployment. This ensures consistent mTLS authentication across all routes and endpoints in the API deployment. Custom CA or custom CA bundles can be added to the gateway's trust store, but only if they already exist in the OCI Certificates service. This allows you to include trusted CAs or CA bundles to validate client certificates during mTLS authentication.