Oracle Cloud Infrastructure 2025 Architect Professional Advanced Practice Exam: Hard Questions 2025

A financial services company is designing a multi-region OCI architecture for a tier-1 trading platform. Requirements: (1) sub-minute RPO and low RTO for regional disasters, (2) active-active reads globally, (3) writes must be strongly consistent per account to avoid double-spend, (4) minimal operational overhead. Which architecture best satisfies these constraints on OCI?

You are migrating a microservices platform to OCI. The platform runs in OKE and calls multiple internal services over HTTPS. A new requirement mandates mutual TLS (mTLS) between all services, certificate rotation without downtime, and centralized policy control. The solution must support progressive rollout and minimize application changes. What is the best approach?

A SaaS provider uses a hub-and-spoke VCN model across multiple compartments. Spoke VCNs must privately access several shared services in the hub (logging, scanning, artifact repositories) and also reach Oracle services (Object Storage, OCIR) without using the public internet. Additionally, spoke VCNs must not be able to initiate connections to each other. What is the most appropriate network design?

An analytics team needs to process multi-terabyte datasets stored in Object Storage using Spark. Jobs are bursty, must scale to hundreds of executors for short windows, and must be isolated from other tenants. The team wants minimal cluster management and fast job startup. Which OCI service/architecture is the best fit?

A team runs stateful workloads on OKE with persistent volumes backed by OCI Block Volume. During a zonal outage (availability domain impairment), workloads in the remaining AD must continue with minimal manual intervention. The application can tolerate a short pause but requires the same data after failover. What design best meets this requirement?

A media company distributes large files globally. They use OCI Object Storage as origin and OCI CDN/edge caching. A subset of customers requires access via private connectivity from on-prem without traversing the public internet, but the same content must also be served publicly with signed URLs and WAF protections. Which solution best satisfies both access models with least duplication?

A regulated enterprise must ensure that even OCI tenancy administrators cannot decrypt certain sensitive data stored in Object Storage and Autonomous Database. Keys must be controlled outside OCI, with provable separation of duties, while still allowing OCI services to perform encryption/decryption operations. What is the best approach?

A company uses OCI IAM with multiple identity providers. They need to ensure: (1) production compartments can only be modified through an approved CI/CD pipeline, (2) human administrators have break-glass access with strong controls, (3) all changes are traceable to a person and a pipeline run. Which design best meets these requirements?

A security team must enforce egress controls so that compute instances in a private subnet can reach only specific OCI services and a small allowlist of external domains. They also need TLS inspection for outbound traffic, centralized logging, and the ability to quarantine a compartment quickly. What is the best OCI-aligned solution?

A company is migrating a large on-prem VMware environment to OCI. They initially move workloads using lift-and-shift, then modernize gradually. After migration, they observe intermittent packet loss and increased latency between migrated apps and on-prem systems over FastConnect. The FastConnect circuit shows no errors. What is the most likely OCI-side cause and the best corrective action?