The Oracle Cloud Infrastructure (OCI) Object Storage Multipart Upload API is designed for uploading large objects efficiently. The process involves splitting a large object into individual parts. According to OCI service limits, each part can have a maximum size of 50 GiB. An object can be split into a maximum of 10,000 parts. These parts can be uploaded independently and in parallel, and after all parts are uploaded, a final commit operation is required to assemble them into a single object in the storage bucket.

A. A final commit operation is mandatory. Without it, the uploaded parts are not assembled into a final object, and the upload remains incomplete.

B. The core concept of a multipart upload is to split a large object into smaller, more manageable parts for parallel and resilient uploads.

1. Oracle Cloud Infrastructure Documentation, "Using Multipart Uploads": This document outlines the three-step process for multipart uploads: Initiate, Upload Parts, and Commit. It explicitly states, "After you have uploaded all the object parts, you commit the upload." This directly refutes option A. It also describes the fundamental concept: "In a multipart upload, a large object is broken into smaller parts," which refutes option B.

Reference: Oracle Cloud Infrastructure Documentation > Storage > Object Storage > Using Multipart Uploads > Multipart Uploads for the Console, CLI, and SDKs.

2. Oracle Cloud Infrastructure Documentation, "Service Limits": This official documentation page lists the specific service limits for Object Storage.

Reference: Oracle Cloud Infrastructure Documentation > Solution & Platform > Core Services > Service Limits > Object Storage and Archive Storage Service Limits.

Under the "Object Storage and Archive Storage Service Limits" table, the "Maximum size for an object part in a multipart upload" is listed as "50 GiB," confirming option C.

The "Maximum number of parts for a multipart upload" is listed as "10,000," confirming option D.

Object Versioning in Oracle Cloud Infrastructure (OCI) Object Storage is a feature that is configured at the bucket level, not at the namespace level. A namespace is a logical container for all buckets within a tenancy, but granular features like versioning, logging, and lifecycle policies are managed on a per-bucket basis. This allows administrators to apply different data protection strategies to different buckets based on their specific requirements. Enabling versioning at the namespace level would incorrectly apply the setting to all buckets in the tenancy, which is not how the service is designed.

A. Retention rules are the specific OCI feature that provides WORM (Write-Once-Read-Many) compliance by making objects immutable for a defined period, preventing deletion or modification.

B. OCI Identity and Access Management (IAM) policies can be configured to grant users or groups in one tenancy access to Object Storage resources, such as buckets, in another tenancy.

C. Object Lifecycle Management policies are used to define rules that automatically transition objects to different storage tiers (e.g., Archive) or delete them based on their age.

1. Oracle Cloud Infrastructure Documentation, "Using Object Versioning". This document states: "You enable Object Versioning at the bucket level. You can't enable versioning at the namespace level." This directly supports why option D is the correct answer.

2. Oracle Cloud Infrastructure Documentation, "Using Retention Rules". This document states: "Retention rules provide an immutable storage option for data stored in Object Storage... When an object is under a retention rule, the object cannot be modified, overwritten, or deleted." This confirms that statement A is true.

3. Oracle Cloud Infrastructure Documentation, "Using Object Lifecycle Management". This document states: "Use lifecycle policy rules to automatically archive or delete objects after a specified amount of time." This confirms that statement C is true.

4. Oracle Cloud Infrastructure Documentation, "Accessing Object Storage Resources in Other Tenancies". This document explains the process: "You can grant a group in your tenancy (Tenancy A) access to a bucket or an object in another tenancy (Tenancy B)." This confirms that statement B is true.

The primary benefit of using instance principals is to automate the authentication process for applications running on OCI compute instances, eliminating the need for manual credential management. The instance automatically obtains temporary, short-lived security tokens from the IAM service. Auth Tokens are long-lived credentials generated for a specific IAM user, not an instance, and are used for authenticating with services like OCI Registry. Therefore, generating Auth Tokens is not part of the instance principal setup process; the authentication is handled transparently by the OCI SDK.

A. Deploying an application with a supported OCI SDK is essential. The SDK contains the logic to interact with the instance metadata endpoint to request security tokens and sign API calls.

B. Creating a dynamic group is a mandatory first step. It defines which instances are included as principals based on matching rules, allowing policies to be applied to them collectively.

C. A policy is required to grant the dynamic group (and thus the instances within it) specific permissions to access other OCI resources. Without a policy, the instances have no authority.

1. Oracle Cloud Infrastructure Documentation, "Calling Services from an Instance": This document outlines the setup process. It states, "You must: 1. Create a dynamic group... 2. Create a policy... 3. Your code, running on the instances, makes calls to OCI services... The SDK handles the rest." It explicitly notes that you do not need to configure user credentials on the instance. (Doc ID: OCI IAM Documentation -> Identity and Access Management -> Secure IAM -> Calling Services from an Instance).

2. Oracle Cloud Infrastructure Documentation, "Managing Dynamic Groups": This document details the necessity of creating dynamic groups to group instances that need to make API calls. It states, "You can group Oracle Cloud Infrastructure compute instances as 'principal' actors... You can then create policies to permit instances in the group to make API calls against Oracle Cloud Infrastructure services." (Doc ID: OCI IAM Documentation -> Identity and Access Management -> Dynamic Groups -> Managing Dynamic Groups).

3. Oracle Cloud Infrastructure Documentation, "Managing Auth Tokens": This source clarifies the purpose of Auth Tokens, stating, "Auth tokens are Oracle-generated token strings that you can use to authenticate with third-party APIs that do not support the Oracle Cloud Infrastructure's signature-based authentication... An auth token is specific to a user." This confirms Auth Tokens are user-centric and not part of the instance principal mechanism. (Doc ID: OCI IAM Documentation -> Identity and Access Management -> Users -> Managing Auth Tokens).

Oracle Cloud Infrastructure (OCI) notifies customers of scheduled maintenance that requires an instance reboot. Customers are given a time window to proactively reboot the instance at their convenience. If the customer takes no action by the maintenance due to date, OCI will automatically perform the necessary maintenance. This action involves either a reboot migration, where the instance is stopped, moved to a healthy physical host, and restarted, or a rebuild in place, where the instance is stopped, maintained on the same hardware, and restarted. In both scenarios, the instance is rebooted by Oracle to complete the maintenance.

A. Simply sending another notification does not complete the required physical hardware maintenance; the due date is a firm deadline for the action.

B. Termination is a destructive action that deletes the instance. OCI does not terminate instances for routine, planned infrastructure maintenance.

D. Similar to option A, another notification is not the final action. The maintenance will be performed automatically after the deadline passes.

1. Oracle Cloud Infrastructure Documentation. (2024). Infrastructure Maintenance. Section: "Reboot Migration". "If you don't proactively reboot the instance by the specified maintenance due date, Oracle will reboot migrate the instance for you."

2. Oracle Cloud Infrastructure Documentation. (2024). Infrastructure Maintenance. Section: "Rebuild in Place". "If you don't proactively reboot the instance by the specified maintenance due date, Oracle will rebuild the instance in place for you."

3. Oracle Cloud Infrastructure Documentation. (2024). Overview of Compute Instance Maintenance. "For maintenance events that require a reboot, such as reboot migration, Oracle Cloud Infrastructure schedules the maintenance and notifies you of the upcoming due date. If you do not proactively reboot the instance before the due date, Oracle Cloud Infrastructure reboots the instance for you."

The recommended, credential-free way for an application that will run on an OCI Compute instance to call OCI services is to enable Instance Principals.

1. The instance is placed in a Dynamic Group that represents the application.

2. IAM policies are written for that Dynamic Group granting only the required permissions.

3. At run time the SDK/CLI obtains a temporary security token from the Instance Metadata Service and signs API requests.

Because no long-lived user credentials are stored or shared and access is limited by policy, this method meets the requirement to “securely grant … access to specific OCI resources.”

A. OAuth 2.0 is not an authentication mechanism for OCI service APIs; OCI uses API-signature keys or resource/instance principals.

B. A tenancy-wide “allow full access” policy violates least-privilege, exposing all resources rather than the specific ones required.

D. Sharing administrator credentials is insecure, breaks key-rotation practices, and gives the application unrestricted access far beyond the requested scope.

1. Oracle Cloud Infrastructure Docs – Identity & Access Management, “Calling Services from an Instance” (Instance Principals), Section: Overview; Steps 1–4. URL: https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm

2. Oracle Cloud Infrastructure Docs – Identity & Access Management, “Dynamic Groups,” Section: Concepts.

3. Oracle Cloud Infrastructure Docs – Security Best Practices, “Use least privilege and avoid sharing user credentials,” pp. 3–4 (June 2023).

When a resource, such as a database instance, is moved from one compartment to another in Oracle Cloud Infrastructure (OCI), it becomes subject to the Identity and Access Management (IAM) policies of the new compartment. The policies that governed the resource in its original compartment no longer apply. Consequently, any user access that was granted through policies attached to the original compartment is effectively revoked. Access must be re-established through policies attached to the new compartment or a parent compartment in its hierarchy.

A. IAM policies are not tied to compartments.

This is incorrect. IAM policies are fundamentally tied to compartments; they define permissions for resources within a specific compartment or the entire tenancy (root compartment).

C. Compartments prevent resource movement.

This is incorrect. OCI is designed to allow the movement of most resources between compartments, providing organizational flexibility.

D. Compartments are not covered by IAM policies.

This is incorrect. Compartments are the primary mechanism for organizing resources and are the scope to which most IAM policies are applied.

1. Oracle Cloud Infrastructure Documentation, Managing Compartments, "Moving a Resource from One Compartment to Another":

"When you move a resource to a new compartment, the policies that govern the new compartment apply immediately and affect access to the resource. Be aware of the following consequences: ... Access is controlled by the policies written for the new compartment. If you move a resource to a compartment where the current users don't have access, then those users will no longer be able to access the resource."

Source: Oracle Cloud Infrastructure Documentation, Doc ID: E97345-19, Section: "Managing Compartments".

2. Oracle Cloud Infrastructure Documentation, Overview of Identity and Access Management, "How Policies Work":

"Policies are comprised of one or more statements that specify which groups can access what resources and at what level of access. The policies are attached to a compartment or the tenancy. The attachment point determines who can modify or delete the policy."

Source: Oracle Cloud Infrastructure Documentation, Doc ID: E97345-19, Section: "Overview of Identity and Access Management".

To achieve high availability, fault tolerance, and data durability for a critical financial application, the architect must plan for regional failures. OCI Object Storage replication provides an automated, asynchronous mechanism to copy objects to a bucket in another region. This ensures that a secondary, up-to-date copy of the data exists in a geographically separate location. In the event of a regional outage, the application can failover to the secondary region, minimizing service disruption and preventing data loss. This strategy directly addresses the core requirements of the online trading platform.

A. A "recycle policy" is not a standard OCI feature for data replication. Furthermore, moving data, rather than replicating it, would remove it from the primary region, decreasing availability.

C. A lifecycle policy is used for cost optimization by transitioning data to cheaper, slower storage tiers like Archive Storage. This would negatively impact the performance and availability of an active online platform.

D. Copying an Object Storage bucket to a block volume is not a standard or logical operation. They are fundamentally different storage types designed for different use cases (unstructured vs. structured data).

1. Oracle Cloud Infrastructure Documentation, Object Storage, Replication: "Replication provides you with a data-driven, asynchronous mechanism for copying objects to another bucket in the same region or in another region... Replication helps you meet your data redundancy and compliance requirements, and provides you with disaster recovery protection from a regional outage."

Source: Oracle Cloud Infrastructure Documentation, "Object Storage Replication," Section: Overview of Replication.

2. Oracle Cloud Infrastructure Documentation, Object Storage, Object Lifecycle Management: "Use object lifecycle management to create a set of rules for a bucket that automatically archives or deletes objects after a specified number of days... This feature helps you manage your storage costs."

Source: Oracle Cloud Infrastructure Documentation, "Object Lifecycle Management," Section: Overview of Object Lifecycle Management.

3. Oracle Cloud Infrastructure Documentation, Best practices for your cloud topology, Disaster Recovery: "A disaster is a sudden event that causes great damage or loss. A disaster can be natural or man-made. A regional disaster can be a major flood, an earthquake, a hurricane, a large-scale power outage, or a network outage... To protect your business from the effects of a regional disaster, you can deploy your applications in multiple regions."

Source: Oracle Cloud Infrastructure Documentation, "Disaster Recovery," Section: Regional Disaster.

A custom image is a snapshot of a configured instance's boot disk. The standard OCI practice for deploying multiple, identical systems is to first launch a base instance, install all necessary applications, apply configurations, and then create a custom image from it. This "golden image" can then be used to launch any number of new instances that are exact clones of the original. This method encapsulates all setup work into a reusable template, ensuring consistency and representing the most minimal effort for subsequent deployments.

A. Bring your own image: This is primarily for migrating existing on-premises or third-party cloud virtual machines to OCI, not for creating new, identical instances within OCI itself.

B. Select an image from the OCI Marketplace: Marketplace images are vendor-provided templates. While useful, they would likely still require your own specific customizations before they could be considered "identical" for your needs.

C. Use Oracle-provided images: These are base operating system images. Using them would require you to manually configure each new instance from scratch, which is the opposite of minimal effort.

1. Oracle Cloud Infrastructure Documentation, "Managing Custom Images": "After you've installed software, applied updates and patches, and configured an instance to meet your needs, you can create a custom image of the instance's boot disk. You can then use the custom image to launch other instances that have the same customizations, configuration, and software." This directly describes the process of using custom images to create identical instances.

2. Oracle Cloud Infrastructure Documentation, "Overview of Images": This document defines the different image types. It clarifies that Oracle-provided images are basic templates, Marketplace images are from partners, and Custom Images are "images that you create from your running instances." This distinction highlights why custom images are the correct choice for this specific use case.

3. Oracle Cloud Infrastructure Documentation, "Creating an Image": "You can create a custom image of an instance's boot disk and use it to launch other instances. Instances that you launch from your image include the customizations, configuration, and software installed when you created the image." This reinforces that custom images are the mechanism for replicating a configured state with minimal effort.

In Oracle Cloud Infrastructure (OCI) network monitoring, there are two primary services for capturing traffic data, each employing a distinct type of filtering. The VTAP (Virtual Test Access Point) service uses a resource called a Capture Filter, which contains specific rules to mirror designated network packets. Separately, VCN Flow Logs capture IP traffic metadata and can be configured with a filter to log either all traffic, only accepted traffic, or only rejected traffic for a subnet. These two mechanisms, "VTAP capture filters" and the filtering capability within "Flow log" configurations, represent the two types of capture filters.

A. "Flow control" is a network mechanism to manage data rates, not a type of capture filter in OCI. "Traffic capture filters" is too generic.

B. While VTAP performs packet capture, "packet capture filters" is a generic term. "VTAP capture filters" is the specific OCI service name, making option D more accurate.

C. "Network capture filters" is a generic category that includes VTAP filters, making this option imprecise and the pairing redundant.

1. Oracle Cloud Infrastructure Documentation, "VTAP, Capture Filters": "A capture filter contains a set of rules that you define. These rules specify the traffic you're interested in... You can associate a capture filter with a VTAP to mirror traffic from a source to a network load balancer." This source confirms the existence and purpose of "VTAP capture filters".

2. Oracle Cloud Infrastructure Documentation, "VCN Flow Logs": "You can configure flow logs to capture information about traffic that is accepted or rejected for a specific subnet... When you enable a flow log on a subnet, you can specify a filter to capture all traffic, only traffic that is rejected, or only traffic that is accepted." This source confirms the filtering capability for VCN Flow Logs.

The IAM Identity Domain Premium type is Oracle's comprehensive, full-featured Identity-as-a-Service (IDaaS) solution. It encompasses all features available in the Free and Oracle Apps Premium tiers and adds advanced capabilities. These include Identity Governance for access reviews and requests, advanced multi-factor authentication (MFA) options like FIDO2, adaptive security, and extensive third-party application integration. This tier is designed for enterprise-wide identity and access management, providing the most complete set of features for complex security and compliance requirements.

A. External User: This is a license model for managing B2B and B2C users within a domain, not a distinct domain type itself.

C. Free: This is the default, basic tier included with an OCI tenancy. It provides core identity functions but lacks the advanced security and governance features of a full IDaaS solution.

D. Oracle Apps Premium: This domain type is specifically tailored for Oracle Applications (like Fusion Cloud Apps) and, while feature-rich, is superseded by the Premium type, which is the most comprehensive offering.

1. Oracle Cloud Infrastructure Documentation, "IAM with Identity Domains," Section: "Understanding Identity Domain Types."

Reference Detail: The documentation explicitly states, "The Premium domain type is a full-featured Identity-as-a-Service (IDaaS) solution. The Premium domain type includes all the features of the Oracle Apps Premium domain type, plus additional features such as Identity Governance..." This directly confirms that Premium is the correct answer. It also describes the "Free" and "Oracle Apps Premium" types as having fewer features.

2. Oracle Cloud Infrastructure Documentation, "IAM with Identity Domains," Section: "Compare Identity Domain Types."

Reference Detail: The feature comparison table in this section clearly shows that the "Premium" column has checkmarks for all available features, including "Identity Governance," "Adaptive Security," and "Identity Synchronization with On-Premises Directories," which are absent in the "Free" tier. This visually demonstrates its status as the "full-featured" option.