Pass the Oracle Oracle Cloud Infrastructure 1z0-1147 Questions and answers with CertsForce

An Oracle AI Database@Azure delegated subnet remains part of the customer's Azure VNet and can use supported Azure networking controls. Two fundamental controls are Network Security Groups (NSGs) and Azure route tables containing User-Defined Routes .

An NSG performs traffic filtering by applying inbound and outbound security rules based on criteria such as source, destination, protocol, and port. This allows organizations to enforce database-access policies at the Azure network layer. Route tables provide forwarding control, allowing traffic to be directed through Azure Firewall, an NVA, a virtual network gateway, or other supported next-hop architecture.

Oracle's delegated-subnet design documentation explicitly states that because the delegated subnet belongs to the customer's VNet, it can leverage Azure networking capabilities including NSGs and routing tables . This enables private application-to-database communication while retaining enterprise routing and security controls.

Azure Load Balancer backend pools and Application Gateway ingress controllers are application/load-balancing constructs and are not the two subnet-associated controls identified for this Oracle database networking requirement.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet design, NSGs, Azure route tables, UDRs and traffic controls.

===============

Oracle documents multiple Azure network patterns for application connectivity to Oracle AI Database@Azure, including VNet peering and Hub-and-Spoke VNet peering .

VNet peering enables application workloads in one Azure VNet to communicate privately with Oracle database resources exposed through a delegated subnet in another VNet. This is appropriate when relatively direct, low-latency communication is required.

A Hub-and-Spoke design introduces a central hub containing shared connectivity and security services, such as Azure Firewall, a Network Virtual Appliance, ExpressRoute gateway, or VPN gateway. Application and database VNets connect as spokes or workload/data networks, allowing centralized inspection and hybrid connectivity.

Oracle's documented topology set also includes local VNet, global connectivity, on-premises Hub-and-Spoke, and related enterprise designs. A point-to-site VPN client model is not identified as the standard application topology requested here. More fundamentally, an Oracle AI Database@Azure deployment cannot exist without an Azure VNet and delegated networking.

Therefore, the correct selections are B and C .

Study Guide reference: Configure Oracle AI Database@Azure Networking — VNet Peering and Hub-and-Spoke topologies.

===============

Azure Front Door single-endpoint routing is not a documented Oracle AI Database@Azure database connectivity topology.

Azure Front Door is primarily a global Layer-7 HTTP/HTTPS application-delivery, acceleration, and load-balancing service. It is designed for web applications and public-facing application endpoints rather than private SQL*Net/database connectivity into an Oracle AI Database@Azure delegated subnet.

Oracle's documented networking patterns instead center on Azure VNets and private routing. These include local/same-region VNet connectivity, VNet peering, Hub-and-Spoke VNet peering, cross-region connectivity, and hybrid on-premises Hub-and-Spoke architectures. Oracle also documents enterprise connectivity patterns involving Azure Virtual WAN.

Hub-and-Spoke is particularly important where centralized firewalls or NVAs must inspect database-bound traffic, while local VNet/VNet peering is useful for direct application-to-database private communication where minimizing network latency is the priority.

Because Azure Front Door does not provide the required private database networking architecture and is absent from Oracle's supported topology set, C is the correct answer.

Study Guide reference: Configure Oracle AI Database@Azure Networking — supported VNet, peering, Hub-and-Spoke and enterprise connectivity topologies.

Backup Retention Lock is a protection mechanism intended to prevent administrators or compromised credentials from prematurely reducing the recoverability window of Autonomous AI Database backups. Once the lock is established, normal administrative interfaces cannot simply disable it or reduce the protected backup-retention period.

Oracle's Autonomous AI Database documentation explicitly states that after the backup retention lock has been set, the option cannot be disabled or the retention period changed through ordinary database administration. To disable the lock or modify the locked retention setting, the administrator must file a Service Request with Oracle Cloud Support .

This design provides an administrative separation between ordinary database management and an action that could materially weaken backup protection. Changing an Azure Key Vault key has no relationship to the retention-policy lock. An SQL ALTER DATABASE command cannot override a service-level backup governance control, and the Azure Portal does not expose a supported bypass to reduce the locked period.

Accordingly, A is the only supported escalation path in the choices.

Study Guide reference: Secure Oracle AI Database@Azure — Autonomous AI Database backup protection, retention policy, retention lock and operational security controls.

===============

Oracle's current service-availability matrix states that Oracle Exadata Database Service on Dedicated Infrastructure is eligible for Private Offer only . It is not available through the Public Offer/Pay As You Go purchasing model.

Therefore, if an organization originally onboarded Oracle AI Database@Azure using the Public Offer and subsequently requires Dedicated Exadata Infrastructure, the commercial relationship must be changed by engaging Oracle Sales and obtaining the appropriate Private Offer .

A delegated-subnet service-limit increase affects networking capacity and does not enable a database service that is excluded by the selected Marketplace offer. BYOL can reduce Oracle Database licensing charges where eligible, but licensing model and Marketplace service eligibility are separate issues. Changing an Autonomous Database workload type is completely unrelated to Exadata hardware procurement.

Oracle's current service table also shows why the confusion can arise: Exadata Database Service on Exascale Infrastructure is available through both Public and Private Offers, whereas Exadata Database Service on Dedicated Infrastructure remains Private Offer only.

Therefore, A is correct.

Study Guide reference: Oracle AI Database@Azure Architecture and Onboarding — offer eligibility and Dedicated Infrastructure purchasing.

===============

This configuration is explicitly identified as unsupported in Microsoft's Oracle AI Database@Azure network-planning guidance. If two Oracle AI Database@Azure VNets are deployed in the same Oracle Availability Zone and one uses Advanced Networking while the other uses the default networking implementation, VNet peering between them can introduce asymmetric routing .

Asymmetric routing occurs when outbound and return traffic traverse different network paths. This is particularly problematic with stateful network elements and the differing routing models associated with the two Oracle AI Database@Azure network implementations. The result can be data-plane traffic loss toward the VNet using Advanced Networking.

VNet peering itself does not upgrade a previously provisioned VNet to Advanced Networking, nor does it downgrade the Advanced Networking environment. Advanced Networking capability is determined by the feature configuration and the state of the delegated subnet before Oracle resources/VNICs are provisioned.

Therefore, the two environments should not be directly peered in this mismatched state. The correct answer is A .

Study Guide reference: Configure Oracle AI Database@Azure Networking — Advanced Networking compatibility and VNet peering.

===============

Oracle owns and operates the underlying Exadata infrastructure layer used by Oracle AI Database@Azure, even though that infrastructure is physically located in Microsoft Azure data centers. Consequently, Oracle performs infrastructure-level maintenance, patching, security updates, monitoring, and lifecycle operations.

Oracle-managed Exadata infrastructure components include the physical database-server hosts, storage servers, network fabric, hypervisor or virtualization infrastructure, firmware, management components, and control-plane systems. Microsoft supplies the Azure data-center environment and associated Azure platform capabilities, but Microsoft support engineers do not maintain Oracle's Exadata hardware/software stack.

The customer retains responsibility for customer-controlled portions of co-managed database environments, including database configuration and, depending on service and maintenance model, guest VM, Grid Infrastructure, database homes, and database software lifecycle activities. Oracle has also introduced optional Oracle-managed database software update capabilities for applicable newer Exadata services, but that does not change responsibility for the underlying infrastructure.

Therefore, C correctly identifies Oracle's Cloud Infrastructure operations organization.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — shared operational responsibility and Exadata infrastructure maintenance.

===============

Oracle's Multicloud Architecture Framework emphasizes architectural considerations that arise because workloads, applications, data, identities, and operational responsibilities span multiple cloud providers. Two major areas are network latency/data movement and security, identity, and operations management .

Cross-cloud network latency can directly affect application response time, database performance, replication behavior, and transaction processing. Data movement can also introduce throughput constraints and cost considerations. Oracle therefore recommends workload placement and private connectivity strategies that minimize unnecessary cross-cloud distance and traffic.

Security and operations become similarly important because each cloud provider has its own IAM, monitoring, automation, and administrative models. Oracle recommends consistent identity and access policies, unified visibility, standardized automation, and common operational practices to avoid fragmented governance or management silos.

Hardware manufacturing origin and OCI hypervisor patch schedules do not represent the principal multicloud architectural design considerations described by the framework. Hypervisor maintenance is primarily a provider operational responsibility.

Therefore, B and D align directly with Oracle's documented multicloud design pillars.

Study Guide reference: Introduction to Multicloud — latency, data movement, Cloud Security, Cloud Operations, identity integration and operational standardization.

===============

Oracle AI Database@Azure has a default regional service limit of five delegated subnets . Once a deployment requires more than five delegated subnet links in a region, the customer must request a service-limit increase.

This aggregate regional limit must not be confused with the separate VNet design rule. An individual Azure VNet can contain a maximum of one delegated subnet for Oracle AI Database@Azure, but an organization can have several VNets and therefore several delegated subnets across the same region up to the default service limit.

Oracle identifies the relevant service-limit metadata as:

Service: Multicloud

Resource: Delegated Subnet Multicloud Links

Limit name: azure-delegated-subnet-count

The limit operates at regional scope. Therefore, creating additional peerings or Route Servers does not bypass it; the correct approach is to request additional service capacity through Oracle's service-limit process.

Values of 1, 3, and 10 do not represent the default regional limit.

Therefore, A. 5 is correct.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet quotas and service-limit increases.

===============

The administrator must use the OCI Console for database-management operations that remain exposed through Oracle Cloud Infrastructure. Oracle AI Database@Azure deliberately integrates many infrastructure lifecycle operations into Azure, but the service still maintains an associated OCI tenancy and OCI control plane. Consequently, certain Oracle-native operations—particularly detailed Container Database (CDB) and Pluggable Database (PDB) administration—require access to OCI.

The configured Microsoft Entra ID federation eliminates the need for a separate set of OCI credentials. Oracle documents federation as an optional capability that enables users to authenticate to the OCI tenancy by using their existing Microsoft Entra ID credentials. Oracle specifically notes that although most daily operations can be performed within Azure, some database-management tasks require OCI Console access.

Azure Cloud Shell operates Azure CLI/PowerShell workflows and is not the required CDB/PDB management interface. The Marketplace page controls purchasing and subscriptions, while a standalone Enterprise Manager installation is not the primary management portal for this service.

Therefore, D is correct.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — OCI Console access and database lifecycle management.

===============