Oracle 1Z0-997-26 Real Exam Questions [October 2026 Update]

The Architect Professional exam tests a fundamentally different kind of knowledge than the Architect Associate – and the most experienced OCI architects fail it for the same reason less experienced candidates do: they try to answer scenario questions the way they run actual projects, by recalling what they did in comparable situations. The professional exam is not testing recalled configurations. It is testing structured trade-off reasoning – given five technically valid OCI architectural options for a described requirement, identify the one that best satisfies all constraints simultaneously. The constraints in the exam scenarios are always multidimensional: a solution must be highly available across fault domains and availability domains, cost-optimised for the described workload pattern, secure without requiring customer-managed encryption key rotation, operable without a dedicated security team, and deployable using Infrastructure as Code. Each incorrect option in a professional-level question violates exactly one of the stated constraints while satisfying all the others – a deliberate design that penalises candidates who read only until they find the first plausible answer.

Full Stack DR is the most frequently tested HA/DR topic in the 2026 version of this exam, reflecting Oracle’s significant investment in the service. Full Stack DR is not a networking service and not a storage replication service – it is a coordinated multi-region failover orchestration service that executes a defined sequence of OCI resource state changes across a DR plan. A DR plan in Full Stack DR contains DR plan step groups (logical phases of the failover – stop the primary, replicate any remaining data, start the standby) and plan steps within each group (specific actions – stop compute instances, switchover databases, update DNS records, start new compute instances in the standby region). The exam tests Full Stack DR architecture at the plan design level: how to define DR plans, what step group sequencing means for RTO, and when Full Stack DR is the correct choice versus a simpler HA pattern using load balancers and instance pools within a single region.

The 2026 exam’s security domain is the heaviest-weighted section, and within it Zero Trust Packet Routing (ZPR) is the newest and least-studied topic. ZPR is OCI’s security framework that enforces network access policies at the packet level – decoupled from VCN topology and security lists. Instead of relying on subnet-level security rules that change as architecture evolves, ZPR allows security policies to be defined in terms of resource attributes (this workload, these databases, that service) and enforced regardless of which VCNs or subnets those resources happen to live in. The exam tests ZPR as the correct architectural choice when network security must be maintained independently of infrastructure changes – when topology-based security rules (security lists, NSGs) would create governance risk as the architecture scales and changes.

Exam Snapshot

Domain 1: Architect High Availability and Disaster Recovery Solutions

Availability domains and fault domains: OCI’s HA architecture is built on two tiers of isolation. Availability Domains (ADs) are independent data centres within a region – physically separate, with no shared power, cooling, or network. Fault Domains (FDs) are logical groupings within an AD – compute instances and database nodes placed in different FDs are protected from shared hardware failure within the AD. A properly architected solution distributes compute across FDs within an AD for protection against hardware failure, and across ADs (or regions) for protection against AD-level failure.

Load Balancer vs. Network Load Balancer: The OCI Load Balancer operates at Layer 7 (HTTP/HTTPS) – it terminates SSL, performs content-based routing, and provides session persistence. The Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) – it passes packets without terminating connections, providing extremely low latency and preserving client source IP. The exam tests the choice between them as a scenario-matching decision: applications requiring SSL termination and path-based routing use the Load Balancer; applications requiring protocol-transparent forwarding, source IP preservation, or extremely high throughput use the NLB.

Full Stack DR (FSDR): Full Stack DR orchestrates coordinated failover of entire application stacks across OCI regions. A DR protection group defines the set of OCI resources (compute instances, databases, load balancers, DNS records) that form one application tier. A DR plan defines the failover sequence – step groups execute in order, and steps within a group execute in parallel. Full Stack DR handles switchover (planned, graceful role reversal with no data loss) and failover (unplanned failover accepting potential data loss within the RPO) automatically, reducing the manual effort and human error risk of large-scale regional failovers.

RTO and RPO trade-offs: Different OCI DR patterns offer different Recovery Time Objectives and Recovery Point Objectives at different cost points. Backup-and-restore (lowest cost, highest RTO/RPO), Pilot Light (critical resources running at minimal capacity in DR region – faster recovery but limited scope), Warm Standby (a scaled-down replica running continuously – moderate cost, moderate RTO/RPO), and Active-Active (both regions serving live traffic – lowest RTO/RPO, highest cost). The exam tests the correct DR pattern for a described RTO/RPO requirement and budget constraint.

Domain 2: Architect Cloud-Native Solutions

Oracle Container Engine for Kubernetes (OKE): OKE is Oracle’s managed Kubernetes service. OKE manages the Kubernetes control plane, leaving customers responsible only for the worker node pool configuration. Key OKE architectural decisions the exam tests: node pool sizing and shape selection (including Flex shapes for right-sized CPU/memory), cluster networking mode (VCN-native pods with their own IP addresses versus the older flannel overlay mode), and node lifecycle configuration (pre-emptible instances for cost-optimised, fault-tolerant batch workloads versus standard on-demand instances for production services).

Oracle Functions: Functions is OCI’s serverless compute service – code that executes on-demand in response to events without requiring the customer to manage underlying compute infrastructure. Functions are deployed as Docker container images, invoked via HTTP or OCI Events, and billed per invocation. The exam tests Functions as the correct choice for event-driven, bursty, or infrequent workloads where the overhead of running persistent compute would be cost-inefficient.

API Gateway: OCI API Gateway exposes backend services (Functions, OKE services, OCI compute instances) as managed RESTful APIs – providing authentication, rate limiting, CORS handling, request transformation, and usage monitoring. The exam tests API Gateway as the correct architectural layer between external API consumers and backend services – particularly when OAuth/JWT authentication and rate throttling are requirements.

OCI DevOps and Resource Manager: OCI DevOps provides CI/CD pipeline capabilities – code repositories, build pipelines, and deployment pipelines that deliver application artifacts to compute, OKE, and Functions. Resource Manager is OCI’s Terraform-as-a-service – it stores Terraform configurations, manages state files, and executes Terraform plans and applies without requiring the customer to run Terraform locally.

Domain 3: Infrastructure as Code

Terraform on OCI: Terraform is the primary Infrastructure as Code tool for OCI. The OCI Terraform provider translates Terraform HCL resource declarations into OCI API calls – creating VCNs, compute instances, databases, load balancers, and all other OCI resources as code. The exam tests Terraform at the architectural level: state file management (remote state in Object Storage for team collaboration), module structure for reusable architecture patterns, and workspace configuration for managing multiple environments from one codebase.

OCI Resource Manager: Resource Manager wraps Terraform with a managed service interface – it stores configuration stacks, executes Terraform jobs in a managed compute environment, maintains state remotely, and provides an audit trail of all infrastructure changes. The exam tests Resource Manager as the operationally preferred Terraform execution environment for organisations that cannot or do not want to manage Terraform state and execution infrastructure themselves.

Drift detection: Resource Manager’s drift detection identifies differences between the Terraform state (what Terraform believes is deployed) and the actual OCI resource state (what is actually running). Drift is detected when someone makes a manual change to OCI infrastructure outside of Terraform, creating a configuration inconsistency. The exam tests drift detection as a governance tool – the correct way to identify and remediate infrastructure changes made outside the IaC pipeline.

Domain 4: Database Architecture in OCI

Oracle Base Database Service: The Base Database Service provides Oracle Database (from 11g through 23ai) on OCI compute – with patching, backup, and data guard managed through the OCI console. Architects choose between VM DB Systems (shared hardware, more cost-effective) and BM DB Systems (dedicated bare metal for maximum performance and isolation). The exam tests shape selection and Data Guard configuration as the key architectural decisions for Base Database.

Autonomous Database: Autonomous Database self-tunes, self-patches, and self-secures – appropriate for organisations that want Oracle Database without DBA overhead. Autonomous Transaction Processing (ATP) is optimised for OLTP workloads; Autonomous Data Warehouse (ADW) is optimised for analytics. The exam tests Autonomous Database as the correct choice when the requirement includes minimal management overhead combined with enterprise Oracle Database capabilities.

Globally Distributed Autonomous Database: For globally distributed applications requiring sub-millisecond read latency in multiple regions, the Globally Distributed Autonomous Database shards data across multiple autonomous database instances in different regions or availability domains. The exam tests this as the choice for globally distributed OLTP with geographic data locality requirements.

OCI Cache: OCI Cache is Oracle’s managed Redis-compatible in-memory caching service. The exam tests OCI Cache as the correct choice for application architectures requiring high-speed caching of frequently accessed data – reducing database read load and improving response times for read-heavy workloads.

Autonomous Recovery Service: The Autonomous Recovery Service provides continuous, automated backup for Oracle databases in OCI – with point-in-time recovery and guaranteed recovery point objectives. The exam tests this as a managed alternative to customer-managed RMAN backup configurations.

Domain 5: Architect Security Solutions

IAM with identity domains: OCI IAM manages authentication and authorisation across the tenancy. Identity domains are the 2026 IAM model – each domain is an independent identity store with its own users, groups, policies, and application registrations. An enterprise tenancy typically has a Default domain (for OCI service access) and one or more application domains (for SaaS, PaaS, and custom application identities). The exam tests identity domain architecture – when to use multiple domains versus one, and how cross-domain federation works.

OCI Vault and Key Management Service: OCI Vault stores and manages encryption keys and secrets. Master encryption keys (MEKs) are stored in Vault’s hardware security module (HSM) – they never leave the HSM in plaintext. Data encryption keys (DEKs) are generated by Vault and encrypted by the MEK before being distributed to services. Bring Your Own Key (BYOK) allows customers to import their own key material into Vault rather than having OCI generate keys. The exam tests Vault key hierarchy (MEK → DEK) and BYOK as the architectural choices for regulatory key custody requirements.

Zero Trust Packet Routing (ZPR): ZPR enforces OCI network security at the packet level using security attributes attached to resources rather than subnet-based rules. A ZPR policy allows or denies network traffic between resources based on their security attribute values – for example, “allow traffic from resources tagged app-tier to resources tagged db-tier on port 1521.” Because the policy references attributes rather than subnet addresses, it remains effective even when resources move between subnets or VCNs. The exam tests ZPR as the correct choice when security must be maintained independently of infrastructure topology changes.

OCI Network Firewall and WAF: Network Firewall is a stateful Layer 3/4/7 firewall – it inspects all traffic entering or leaving a VCN, enforcing rules based on protocol, port, URL, and application. Web Application Firewall (WAF) operates at Layer 7 for web traffic specifically – inspecting HTTP/HTTPS requests for SQL injection, cross-site scripting, and other OWASP threats. The exam tests Network Firewall for general VCN traffic inspection and WAF for application-layer HTTP threat protection.

OCI Bastion: Bastion provides secure, audited SSH access to compute instances and managed services that are not exposed to the public internet – no public IP is required on the target resource. The exam tests Bastion as the secure access pattern for production workloads that must not have public endpoints.

Domain 6: Hybrid and Multicloud Architecture

FastConnect: FastConnect provides dedicated private connectivity between a customer’s on-premises network and OCI – bypassing the public internet for lower latency, more predictable bandwidth, and higher security than VPN. FastConnect connections are available through Oracle’s global network of colocation and carrier partners. The exam tests FastConnect as the correct connectivity choice when VPN bandwidth or reliability is insufficient.

Oracle Interconnect for Azure (OCI-Azure Interconnect): The OCI-Azure Interconnect is a direct, private, low-latency network connection between OCI and Microsoft Azure data centres in the same metro area. It allows applications to span both clouds – for example, running Oracle Database on OCI while running application logic or Azure services on Azure – with sub-2ms latency between the clouds. The exam tests the OCI-Azure Interconnect as the correct architecture for Oracle-Azure distributed workloads, distinct from using the public internet or Azure ExpressRoute independently.

Oracle Database@Azure: Oracle Database@Azure runs Oracle Exadata Database Service natively within Azure data centres – on Oracle-managed Exadata hardware but accessible from Azure Virtual Networks. The exam tests this as the choice when Oracle Database must be deployed inside Azure for network proximity to Azure-native workloads.

Oracle Cloud VMware Solution (OCVS): OCVS allows customers to run VMware workloads natively on OCI bare metal – using VMware vSphere, vSAN, and NSX exactly as on-premises, but on OCI infrastructure. The exam tests OCVS as the lift-and-shift option for VMware workloads that cannot be refactored to cloud-native services.

Domain 7: Workload and Database Migration

OCI Database Migration Service: Managed service for migrating Oracle Database from on-premises or other clouds to OCI – handling schema conversion for heterogeneous migrations and continuous data replication to minimise migration downtime. The exam tests Database Migration Service as the managed migration path versus manual approaches for large-scale database migrations.

Oracle Zero Downtime Migration (ZDM): ZDM is a command-line automation toolkit that orchestrates online migration of Oracle Database to OCI with minimal downtime – using Data Guard for continuous synchronisation during migration and a brief cutover window at the end. The exam tests ZDM as the correct tool for near-zero-downtime database migrations where the database must remain available throughout the process.

OCI Compute migration: Workload migration uses OCI OS Management Hub, Rclone for storage migration, and full disk images for rehosting on-premises VMs to OCI compute. The exam tests the correct migration approach for described application tiers based on OS, application type, and acceptable migration downtime.

Domain 8: Observability and Management

OCI Monitoring: Monitors OCI resource metrics – CPU utilisation, memory usage, network throughput, storage IOPS – through a time-series metrics engine. Alarm rules trigger notifications (OCI Notifications) or automated responses (OCI Functions) when metric thresholds are breached. The exam tests Monitoring as the first-line operational visibility tool for OCI compute, networking, database, and service health.

OCI Logging: Centralises logs from OCI services (audit logs, VCN flow logs, service logs) and from customer applications (custom logs from compute instances via unified monitoring agent). The exam tests Logging as the audit and compliance tool – specifically, how audit logs provide evidence of API calls made in the tenancy.

OCI Application Performance Monitoring (APM): APM provides distributed tracing and real-user monitoring for applications running on OCI – tracking individual request flows across microservices, measuring end-user page load times, and identifying which service in a distributed system is introducing latency. The exam tests APM as the deep application-level observability tool, distinct from the infrastructure-level metrics in OCI Monitoring.

5 Study Tips for Oracle 1Z0-997-26

• Study Full Stack DR plan architecture in detail – DR plan step groups, sequential versus parallel execution, switchover versus failover – and know when Full Stack DR is the correct choice versus simpler within-region HA using load balancers and instance pools.
• Study Zero Trust Packet Routing (ZPR) as the architecture for topology-independent security – know how ZPR policies differ from security lists and NSGs and when ZPR is the correct choice over topology-based rules.
• Study OCI multicloud architecture – OCI-Azure Interconnect, Oracle Database@Azure, and OCVS as three distinct solutions for three distinct multicloud scenarios, and know which applies to each described requirement.
• Practise multi-constraint trade-off reasoning: for each scenario question, identify all stated constraints (availability, cost, operability, security, compliance) and eliminate options that violate any single constraint.
• Practice with Cert Empire’s 1Z0-997-26 exam questions covering all eight domain areas at Full Stack DR plan design, ZPR security architecture, and multicloud solution selection depth.

Best Study Resources

• Cert Empire 1Z0-997-26 exam questions PDF and practice simulator (October 2026 edition).
• Oracle official 1Z0-997-26 exam page (education.oracle.com – search “1Z0-997-26”).
• OCI Architecture documentation (docs.oracle.com/en/solutions/).
• Oracle Cloud Infrastructure documentation (docs.oracle.com/en-us/iaas/Content/home.htm).
• OCI Full Stack DR documentation (docs.oracle.com/en/cloud/paas/disaster-recovery/).

Why Candidates Choose Cert Empire for Oracle 1Z0-997-26 Preparation

Free Practice Tests

Sample our 1Z0-997-26 questions before purchasing. Test your Full Stack DR plan design reasoning, ZPR vs. NSG architectural decision-making, and multicloud architecture knowledge before committing.

Regular Updates

Oracle updates OCI services quarterly and the 1Z0-997-26 exam objectives evolve with major service releases. Our question bank is continuously reviewed against current OCI documentation and updated exam objectives.

Free Exam Guides

Every purchase includes our free 1Z0-997-26 exam guide covering all eight domain areas, the DR pattern comparison table (backup-restore vs. warm standby vs. active-active), the security service selection guide, and a structured study plan.

PDF Exam Questions – Study Anywhere, Anytime

Download your 1Z0-997-26 questions instantly after purchase. Study on any device or print the PDF. No login required after download, no expiry on the file.

24/7 Chat Support

Available at any hour for questions about your materials, your order, or specific OCI architecture concepts – including Full Stack DR plan step group sequencing, ZPR policy design, and OCI-Azure Interconnect topology.

3 Months of Unlimited Access

Three full months of unlimited access to the 1Z0-997-26 question bank and simulator. Revisit HA/DR pattern scenarios, database architecture trade-off questions, and multicloud topology topics as many times as needed.

Official Vendor Resources – Learn from the Source

Every solution in our 1Z0-997-26 question bank links directly to the relevant official Oracle documentation – the OCI architecture guide, Full Stack DR documentation, or specific service documentation behind the answer.

Deep Knowledge – Every Answer, Every Option, Fully Explained

Every 1Z0-997-26 question includes a complete explanation covering not just why the correct DR pattern, security service, or multicloud architecture is right, but precisely why each incorrect option fails – whether it uses topology-based NSGs where ZPR is needed for topology-independent security, selects pilot light DR where active-active is the only acceptable RTO, or applies FastConnect where the OCI-Azure Interconnect is the correct connection for Azure-colocated workloads. Each explanation references the specific OCI architecture documentation behind the answer.

Interactive Practice Simulator – Think Like the Exam

Our simulator presents OCI architecture scenarios exactly as the real 1Z0-997-26 exam does – describing a multi-constraint system requirement and testing which combination of OCI services, architecture patterns, and configuration decisions satisfies all constraints simultaneously. Per-question feedback explains the full multi-constraint architectural reasoning behind every correct and incorrect option.

Backed by a Full Money-Back Guarantee

If our 1Z0-997-26 exam questions do not help you pass, you receive a full refund – no questions asked, no conditions.

FAQ’s

What is the Oracle 1Z0-997-26 certification?

1Z0-997-26 is the Oracle Cloud Infrastructure 2026 Architect Professional certification exam. It validates advanced OCI architecture skills – covering HA/DR with Full Stack DR, cloud-native solutions on OKE and Functions, Infrastructure as Code with Terraform and Resource Manager, database architecture, security (IAM, Vault, ZPR, Network Firewall), hybrid and multicloud architectures, workload migration, and observability.

How does Full Stack DR differ from a simple HA architecture using load balancers?

A load-balancer-based HA architecture provides redundancy within a single region – traffic is distributed across multiple instances, and a failed instance is replaced automatically within the same region. Full Stack DR orchestrates coordinated failover of an entire application stack across regions – managing the sequence of stopping, replicating, and restarting entire tiers of infrastructure in a DR region when the primary region is unavailable.

What is Zero Trust Packet Routing (ZPR) and when should it be used?

ZPR enforces OCI network access policies at the packet level using security attributes attached to resources – decoupled from VCN topology. A ZPR policy allows or denies traffic between resources based on their attribute values, not their subnet addresses. ZPR is the correct choice when network security must remain effective independently of infrastructure topology changes, preventing governance drift as the architecture scales.

What is the difference between OCI Network Firewall and Web Application Firewall?

Network Firewall is a stateful Layer 3/4/7 firewall that inspects all traffic entering or leaving a VCN – enforcing rules on any protocol. WAF operates at Layer 7 for HTTP/HTTPS traffic specifically – inspecting web requests for application-layer attacks like SQL injection and XSS. A typical architecture uses both: Network Firewall for general VCN perimeter control and WAF for web-tier application protection.

What is the OCI-Azure Interconnect and when is it the correct architecture?

The OCI-Azure Interconnect is a direct private network connection between OCI and Microsoft Azure in the same metropolitan area. It provides sub-2ms latency between the two clouds, enabling distributed applications that span both OCI (for Oracle Database) and Azure (for application services or Azure-native services). It is the correct choice when an Oracle Database must communicate with Azure workloads with private connectivity and very low latency.

What is the difference between OCI Monitoring and Application Performance Monitoring?

OCI Monitoring tracks infrastructure-level metrics – CPU, memory, network, storage utilisation – for OCI resources, with alarm-based automated response. APM provides application-level observability – distributed tracing across microservices, end-user experience monitoring, and identification of which service in a distributed application is introducing latency. They are complementary: Monitoring for infrastructure health and APM for application-layer performance.

How many questions and what is the passing score for 1Z0-997-26?

The exam has 50 questions, the passing score is 68%, and the duration is 90 minutes. It is delivered through Pearson VUE either online-proctored or at a test centre. The cost is USD $245. The certification is valid for 24 months.

Related Certifications Worth Exploring

OCI Architect Professional candidates building a complete OCI credential portfolio will find the Oracle 1Z0-1067-26 (OCI Cloud Operations Professional 2026) exam questions page covers advanced OCI operations – infrastructure deployment, monitoring, automation, security, availability, troubleshooting, and business continuity skills that closely complement professional-level cloud architecture expertise. For those deepening their expertise in cloud-native application architecture, the Oracle 1Z0-1084-26 (OCI Developer Professional 2026) exam questions page covers OCI application development, Oracle Functions, containers, OKE, APIs, security, and observability at professional depth.