Free 1Z0-1109-25 sample questions

Correct answer: Configure a private build runner on a compute instance within a private subnet of the VCN that has routing rules to the on-premises network via the Dynamic Routing Gateway (DRG).

For secure access to on-premises resources, the correct approach is to use a private build runner. This runner, hosted on an OCI compute instance within your VCN, can leverage the existing FastConnect circuit. By placing it in a private subnet with appropriate route table entries pointing to the DRG, it can communicate directly and securely with the on-premises Maven repository without any public internet exposure. Oracle-managed runners operate outside your VCN and cannot access private on-premises endpoints.

Correct answer: Store the credentials in OCI Vault as secrets, grant the build pipeline's dynamic group IAM permissions to read the secrets, and reference them in the `build_spec.yaml` using the `${vaultVariables. }` syntax.

The most secure and standard OCI practice is to use OCI Vault for secrets management. Credentials should be stored as secrets in a Vault. The build pipeline should be granted access via an IAM policy attached to its dynamic group. The `build_spec.yaml` can then reference these secrets securely using the `${vaultVariables. }` variable substitution syntax, ensuring that credentials are never exposed in plain text within the source code or build specifications.

Correct answer: False

This statement is false. While OCI Resource Manager's drift detection feature can identify discrepancies, you do not have to apply the changes manually. After a drift is detected, you can run a Terraform 'Apply' job directly from the Resource Manager console to bring the infrastructure back into alignment with the configuration file, thus automating the resolution process.

Correct answer: COPY --from=builder /app /app

In a multi-stage Dockerfile, the `COPY` command with the `--from` flag is used to copy files or directories from a previous stage (referenced by its name or index) into the current stage. This is the fundamental mechanism for creating a lean production image by selectively transferring only the necessary compiled code, dependencies, or other artifacts, leaving behind the build tools and intermediate files.

Correct answer: A NetworkPolicy resource applied to the backend pods that specifies an ingress rule.

A NetworkPolicy is a Kubernetes-native firewalling resource used to control traffic flow at the IP address or port level (OSI layer 3 or 4). To enforce traffic rules between pods, you would create a NetworkPolicy that selects the backend pods and defines an ingress rule allowing traffic only from the web server pods on the specified port (8080). This provides granular, declarative network segmentation within the cluster.

Correct answer: OCI Events to detect the 'Deployment Failed' event, with a rule that triggers an OCI Notification topic, which in turn invokes an OCI Function subscribed to that topic to post to Slack.

This is the standard, event-driven approach in OCI. OCI DevOps services emit events for pipeline state changes. An OCI Events rule can be configured to filter for the specific 'Deployment Succeeded' or 'Deployment Failed' event type. The action for this rule would be to send the event to an OCI Notifications topic. An OCI Function, which contains the logic to format and send a message to the Slack webhook URL, can subscribe to this topic, triggering the notification.

Correct answer: Horizontal Pod Autoscaler (HPA)

The Horizontal Pod Autoscaler (HPA) is the Kubernetes component responsible for automatically scaling the number of pods in a ReplicaSet, Deployment, or StatefulSet. It periodically checks metrics such as CPU utilization or custom metrics against a target value defined in the HPA configuration and increases or decreases the number of replicas accordingly. The Cluster Autoscaler scales the number of nodes, and the VPA adjusts the resource requests/limits of individual pods.

Correct answer: Terraform's implicit dependency resolution based on referencing the subnet's OCID in the compute instance's configuration.

Terraform automatically builds a dependency graph by analyzing the references between resources. When the `subnet_id` argument in the `oci_core_instance` resource references an attribute of the `oci_core_subnet` resource (e.g., `oci_core_subnet.mysubnet.id`), Terraform understands that the subnet must be created before the instance. This is known as an implicit dependency and is the preferred method. The `depends_on` meta-argument is for creating explicit dependencies when there is no direct reference between resources.

Correct answer: Use shell script logic (e.g., `if/else` statements) within the `steps` section of a single `build_spec.yaml` file, checking the value of the `${OCI_TRIGGER_SOURCE_BRANCH_NAME}` predefined variable.

The OCI DevOps build service provides predefined environment variables, including `${OCI_TRIGGER_SOURCE_BRANCH_NAME}`, which contains the name of the Git branch that triggered the build. The most efficient way to implement conditional logic is to use this variable within a shell script inside the `build_spec.yaml`. This allows a single pipeline and build specification to handle different workflows based on the source branch, reducing management overhead.

Correct answer: Store the API key as a secret in OCI Vault and reference the secret's OCID as the value for an environment variable in the container instance configuration.

OCI Container Instances integrate directly with OCI Vault for secure secret management. Instead of passing sensitive data in plain text, you store it as a secret in Vault. When configuring the container instance, you can define an environment variable and provide the OCID of the Vault secret as its value. The Container Instances service will securely fetch the secret's content and inject it into the container's environment at runtime, avoiding any exposure of the sensitive data.