You are deploying a serverless data integration pipeline where an OCI Function needs to consume real-time events from an OCI Stream in the prod-compartment compartment. Your corporate security policy mandates strict least-privilege access, meaning the function must only be permitted to consume (pull) messages, with absolutely no capability to publish (push) messages to the stream. Which TWO configurations are required to establish this granular authorization using a Dynamic Group named analytics-function-dg?

• A. Create a dynamic group rule to match the function: ALL {resource.type = ' compute ' , resource.
  compartment.id = ' ocid1.compartment.oc1..example ' }
• B. Create an IAM policy statement: Allow dynamic-group analytics-function-dg to use stream-push in compartment prod-compartment
• C. Create a dynamic group rule to match the function: ALL {resource.type = ' fnfunc ' , resource.
  compartment.id = ' ocid1.compartment.oc1..example ' }
• D. Create an IAM policy statement: Allow dynamic-group analytics-function-dg to use streams in compartment prod-compartment
• E. Create an IAM policy statement: Allow dynamic-group analytics-function-dg to use stream-pull in compartment prod-compartment

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Which statement is NOT valid regarding autoscaling configurations in Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE)?

• A. The Kubernetes Horizontal Pod Autoscaler is supported for adjusting the replica count of deployments running on both virtual node pools and managed node pools.
• B. The Kubernetes Metrics Server can be deployed as a standalone program to collect resource metrics on both virtual node pools and managed node pools.
• C. The Kubernetes Vertical Pod Autoscaler is restricted to managed node pools and is not supported for adjusting resources on virtual node pools.
• D. The Kubernetes Cluster Autoscaler can be deployed to automatically resize both managed node pools and virtual node pools when pod resource demands change.

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Your development team wants to configure API Gateway request validation to shield an upstream backend microservice from ill-formed API calls. You want to test the validation rules in your staging environment first without blocking any non-compliant client requests, and you want to ensure the gateway checks that a mandatory HTTP header is present. Which TWO configurations should you apply to your API Gateway deployment specification to meet this requirement?

• A. Set the request validation policy mode to Enforcing to forward failed requests to the execution log instead of blocking them.
• B. Configure the request validation policy with header validations to mandate the presence of the required HTTP header.
• C. Create a dynamic group and IAM policy to grant the API Gateway permission to inspect incoming request bodies in real-time.
• D. Use the request.auth[ < key > ] context variable inside a Stock Response backend to log non-compliant headers.
• E. Set the request validation policy mode to Permissive to log validation failures without rejecting requests.

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

You developed a microservices-based application that runs in an Oracle Cloud Infrastructure (OCI) Container Engine for Kubernetes (OKE) cluster. Your security team wants to use SSL termination for this application.
What should you do to create a secure SSL termination for this application using the fewest steps possible?

• A. Generate a self-signed certificate using Let ' s Encrypt. Use that certificate on OCI Load Balancer.Create the Kubernetes service using this load balancer.
• B. Add these annotations to the kubernetes service: annotations: service.beta.kubernetes.io/oci-load- balancer-ssl-ports: " 443 " service.beta.kubernetes.io/oci-load-balancer-ssl-secret-key: ssl secret-key
• C. Create a self-signed certificate and its corresponding key. Create a Kubernetes secret using the certificate and the key. Then add these annotations to the Kubernetes service: annotations: service.beta.
  kubernetes.io/oci-load-balancer-ssl-ports: " 443 " service.beta.kubernetes.io/oci-load-balancer-security- list management-mode: " Frontend "
• D. Create a self-signed certificate and its corresponding key. Create a Kubernetes secret using the certificate and the key. Then add these annotations to the Kubernetes service: annotations: service.beta.
  kubernetes.io/oci-load-balancer-ssl-ports: " 443 " service.beta.kubernetes.io/oci-load-balancer-tls- secret: ssl certificate-secret

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Your organization is deploying a high-performance distributed deep learning training workload that requires GPU-enabled bare metal Compute instances connected through an ultra-low-latency Oracle Cloud Infrastructure (OCI) RDMA cluster network. To maximize processing efficiency and comply with strict corporate OS requirements, your team must use a custom, pre-hardened Oracle Linux operating system image that is not supported by default node pools. The containerized training jobs must be orchestrated and scheduled using your existing Container Engine for Kubernetes (OKE) control plane.
Which worker node deployment model must you implement?

• A. Instance-Pool Nodes
• B. Self-Managed Nodes
• C. Managed Node Pools
• D. Virtual Node Pools

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).