Oracle Cloud Infrastructure 2025 Multicloud Architect Professional Practice Exam 2025: Latest Questions

An enterprise runs workloads in OCI and Microsoft Azure. Users sign in to Microsoft Entra ID and must access OCI Console and OCI APIs without separate OCI passwords. Which approach best meets this requirement?

You must provide private, low-latency connectivity between OCI and Azure for application tiers that communicate frequently. The company wants to avoid sending traffic over the public internet. Which solution is the most appropriate?

An application is deployed across OCI and another cloud. The security team requires that OCI Object Storage data is encrypted with customer-controlled keys and that key usage is auditable. Which OCI capability best satisfies this requirement?

A multicloud deployment includes OCI and a third-party cloud. The operations team wants a single place to view OCI metrics and alarms and to send notifications to an existing enterprise incident system. Which OCI service combination is most appropriate?

A company uses Terraform to deploy identical network and compute stacks into multiple OCI compartments and wants to standardize deployments across OCI and another cloud. Which practice best improves repeatability and reduces configuration drift in OCI?

After configuring identity federation, a user can sign in to the OCI Console but receives "NotAuthorizedOrNotFound" when attempting to list buckets using the OCI CLI with a federation-based token. What is the most likely cause?

A workload spans OCI and Azure. Some OCI subnets use overlapping CIDR ranges with Azure VNets, preventing route exchange and causing intermittent connectivity failures. Which design change is the most appropriate long-term fix?

An application must fail over from OCI to another cloud provider. The database is hosted in OCI, and the recovery strategy requires minimizing data loss while enabling controlled failover. Which approach is most appropriate?

A regulated enterprise requires that OCI resources can be created only in approved compartments, must inherit mandatory tags, and must block public exposure for certain services. The solution should prevent noncompliant resources at creation time, not just detect them later. Which OCI capability best meets these requirements?

You have private connectivity between OCI and a partner cloud using BGP. During maintenance, the provider changes BGP attributes and traffic unexpectedly shifts to a backup path with insufficient bandwidth, causing packet loss. What is the best architectural practice to reduce the risk of unintended traffic shifts while maintaining resiliency?

Your organization wants to let developers authenticate to OCI using their existing Microsoft Entra ID (Azure AD) identities, with no local OCI passwords. Which approach best meets this requirement?

A multicloud application runs active/active across OCI and another cloud. You want to securely store database credentials and rotate them regularly without changing application code. Which OCI service best fits?

You are troubleshooting intermittent connectivity from an on-premises network to an OCI VCN over Site-to-Site VPN. The tunnels show as UP, but some applications time out. Which is the most likely networking issue to check first?

A company needs private connectivity from OCI to Azure for a latency-sensitive workload. They want traffic to stay off the public internet and prefer a provider-managed cross-cloud connection. What is the best solution?

Your security team requires that OCI resources in multiple compartments can use customer-managed keys (CMK) for encryption at rest, and that key usage is auditable and restricted. Which design best aligns with OCI best practices?

A multicloud team uses Terraform to deploy OCI networking. During deployment, route rules are created but instances still cannot reach the internet. Subnets are private by design. What is the most likely missing component?

You need to provide separate, least-privilege access for a CI/CD system that deploys resources across several OCI compartments. The system must not have console access and should be able to rotate credentials without human interaction. What is the recommended approach?

An application spans OCI and another cloud. Users report that DNS sometimes resolves to the wrong (stale) endpoint after failover. The architecture uses a DNS record that is updated during DR events. What change most directly reduces stale resolution issues without requiring application changes?

A financial services company must ensure that OCI administrators cannot decrypt application data without explicit approval, even though the data is encrypted with customer-managed keys in OCI Vault. Which control best supports this separation-of-duties requirement?

You are designing cross-cloud connectivity where OCI and another cloud exchange routes dynamically. After a change, traffic to a specific OCI subnet is asymmetrically routed, causing stateful firewall drops. Which architectural adjustment most effectively prevents asymmetric routing in this scenario?

Your organization uses Microsoft Entra ID as the primary identity provider. OCI must enforce MFA for all console access, but you want OCI IAM to remain the system of record for authorization (policies, compartments, and dynamic groups). Which approach best meets this requirement?

A workload runs on OCI in a private subnet. It must access an object storage service in another cloud provider over the public internet, but security requires that the workload has no inbound internet exposure and the egress path must be controlled. Which design is the most appropriate?

You are designing a multicloud, active-passive disaster recovery solution. The primary application runs in AWS, while the standby stack runs in OCI. The recovery requirement is to re-create infrastructure consistently during failover with minimal manual steps. Which approach best supports repeatable DR provisioning across clouds?

A team federated users into OCI and mapped an external IdP group to an OCI IAM group. Users can sign in successfully, but they receive "NotAuthorizedOrNotFound" when attempting to list buckets in a specific compartment. You confirmed the policy grants the OCI IAM group read access to Object Storage in that compartment. What is the most likely cause?

A company uses a FastConnect private virtual circuit from OCI to an on-premises data center. Users report intermittent loss of connectivity to an OCI private IP range. BGP sessions remain established, but routes to the OCI VCN CIDR sometimes disappear on the on-premises router. What is the best architectural mitigation to improve resiliency and reduce route flaps impacting connectivity?