I85PREP
⌘ K
OCI Developer Professional study materials
OCI Developer Professional study resources

OCI Developer Professional practice questions

One question at a time. Build your OCI Developer Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Oracle Cloud Infrastructure Developer

A developer wants a function in OCI Functions to read secrets at runtime without embedding credentials in the image. Which OCI service should be used together with a dynamic group and policy to grant the function access?

  1. OCI API Gateway
  2. OCI Vault Correct answer.
  3. OCI Object Storage
  4. OCI Container Registry

Explanation

OCI Vault stores secrets and keys, and a function can retrieve them at runtime using its resource principal. Access is granted by placing the function in a dynamic group and writing a policy that allows the dynamic group to read the secret bundle.

Question 2Oracle Cloud Infrastructure Developer

Which statement describes how OCI Functions scales when many concurrent invocations arrive?

  1. The developer must pre-provision a fixed number of instances in the console
  2. OCI provisions additional function instances automatically based on demand Correct answer.
  3. Scaling requires a load balancer in front of the function endpoint
  4. Each invocation runs in the same single container instance until it times out

Explanation

OCI Functions is serverless: the platform creates additional instances of the function to handle concurrent load and removes them when idle. The developer does not manage instance counts or place a load balancer in front of the function.

Question 3Oracle Cloud Infrastructure Developer

A developer needs to authenticate an application running on an OCI compute instance to Object Storage without storing user credentials on the instance. What is the recommended approach?

  1. Use the tenancy's root user credentials with MFA
  2. Use instance principals with a dynamic group matching the instance Correct answer.
  3. Create an auth token and store it in a file on the instance
  4. Embed a user's API signing key in the application code

Explanation

Instance principals let a compute instance obtain short-lived credentials from the OCI metadata service. A dynamic group with a matching rule plus an IAM policy grants the instance the required permissions without any stored secret.

Question 4Oracle Cloud Infrastructure Developer

Which OCI CLI command lists the objects in a bucket named reports in the namespace of a tenancy?

  1. oci os object get --bucket-name reports
  2. oci os object list --bucket-name reports Correct answer.
  3. oci object-storage list --bucket reports
  4. oci os bucket get --name reports

Explanation

The Object Storage commands live under `oci os`, and `oci os object list --bucket-name` returns the objects in the specified bucket. The namespace is resolved automatically from the CLI profile.

Question 5Oracle Cloud Infrastructure Developer

A developer is writing a Python application that calls OCI services and wants the SDK to read credentials from the default config file. Which file does the SDK use by default?

  1. /etc/oci/credentials.json
  2. ~/.oracle/cloud.cfg
  3. ~/.oci/config Correct answer.
  4. /var/lib/oci/auth.yaml

Explanation

The OCI SDKs and CLI read the default profile from `~/.oci/config`, which contains the tenancy, user, fingerprint, key file, and region. A different location or profile can be supplied explicitly.

Question 6Oracle Cloud Infrastructure Developer

Which OCI Identity and Access Management construct is used to group dynamic principals such as functions and compute instances so policies can be attached to them?

  1. Compartment
  2. Policy statement
  3. Dynamic group Correct answer.
  4. Identity domain

Explanation

A dynamic group contains resources that match rules on attributes such as compartment or resource type. IAM policies can then grant permissions to that dynamic group, enabling resource principals.

Question 7Oracle Cloud Infrastructure Developer

A developer wants to build a container image and push it to OCI Container Registry. Which command authenticates Docker to the registry before pushing?

  1. docker push <region-key>.ocir.io/<namespace>/<repo>
  2. docker login <region-key>.ocir.io Correct answer.
  3. oci artifacts container repository create
  4. docker build -t <region-key>.ocir.io/<namespace>/<repo>:tag .

Explanation

Pushing to OCIR requires authenticating Docker against the regional registry endpoint with `docker login`, using the tenancy namespace and an auth token as the password. Only after login can the image be tagged and pushed.

Question 8Oracle Cloud Infrastructure Developer

What does a compartment provide in OCI?

  1. A billing account that can contain multiple tenancies
  2. A physical data center location where resources are deployed
  3. A logical grouping of resources used for access control and cost tracking Correct answer.
  4. A network segment that isolates subnets from each other

Explanation

Compartments are logical containers used to organize resources and scope IAM policies and budgets. They are not physical locations, network constructs, or billing accounts.

Question 9Oracle Cloud Infrastructure Developer

A developer uses the OCI Python SDK and receives a 404 Not Found error when calling an Object Storage API. The caller's IAM permissions for the requested operation have been verified as sufficient. Which cause is most consistent with this error?

  1. The IAM policy allows the wrong verb for the resource
  2. The request was signed with a key whose fingerprint does not match
  3. The bucket name or namespace in the request does not exist Correct answer.
  4. The request body exceeded the maximum object size

Explanation

OCI can return a 404 when a resource is absent or when the caller lacks authorization. Because the caller's required permissions have been verified here, a nonexistent bucket or namespace is the supported cause among these options.

Question 10Oracle Cloud Infrastructure Developer

A developer wants a function to be invoked automatically whenever a new object is written to an Object Storage bucket. Which OCI service connects the bucket event to the function?

  1. OCI Service Connector Hub with a source of Object Storage
  2. OCI Notifications with a subscription to the bucket
  3. OCI API Gateway with a route to the function
  4. OCI Events service with a rule that targets the function Correct answer.

Explanation

OCI Events emits events for resource changes such as object creation, and a rule can target a function as its action. This is the standard pattern for event-driven invocation from Object Storage.

Question 11Oracle Cloud Infrastructure Developer

A developer needs to read a secret from OCI Vault in a Java application. Which SDK call retrieves the secret's current contents?

  1. getKey with the key OCID
  2. getSecret with the vault OCID
  3. getSecretBundle with the secret OCID Correct answer.
  4. listSecrets with the compartment OCID

Explanation

The Secrets API exposes `getSecretBundle`, which returns the secret bundle contents for a given secret OCID. Listing secrets returns metadata only, and key operations are for encryption keys rather than secret values.

Question 12Oracle Cloud Infrastructure Developer

A developer wants to run a containerized batch job to completion on OCI without managing servers. Which service fits best?

  1. OCI Functions
  2. OCI API Gateway
  3. OCI Container Instances Correct answer.
  4. OCI Container Engine for Kubernetes

Explanation

OCI Container Instances runs a container to completion without a cluster or server management, which suits short batch jobs. Functions is for event-driven short-lived code, and OKE requires managing a cluster.

Question 13Oracle Cloud Infrastructure Developer

A developer wants to paginate through a large list of objects using the OCI Python SDK. Which mechanism should be used?

  1. Increase the limit parameter until all objects are returned in one response
  2. Sort results by name and rely on the SDK to return every page automatically
  3. Use the get_object call in a loop over an index range
  4. Call list_objects repeatedly with the opc_next_start value from the response Correct answer.

Explanation

OCI list APIs return an `opc-next-page` header, exposed as `next_page` in the SDK, which must be passed as the page argument to fetch subsequent pages. The service caps page size, so a single call cannot return an unbounded list.

Question 14Oracle Cloud Infrastructure Developer

A developer wants to grant a dynamic group of functions permission to read objects in a specific bucket only. Which policy approach is correct?

  1. Allow the dynamic group to read objects in tenancy
  2. Allow the dynamic group to manage all-resources in tenancy
  3. Allow the dynamic group to read objects in compartment dev where the bucket resides Correct answer.
  4. Allow any-user to read objects in the bucket

Explanation

IAM policies grant permissions at the compartment level, and the resource must reside in that compartment. Scoping the policy to the dev compartment limits the grant to resources there, following least privilege.

Question 15Oracle Cloud Infrastructure Developer

A developer defines a function in a YAML file for OCI Functions and wants to pass configuration values without rebuilding the image. Which feature should be used?

  1. Environment variables baked into the Dockerfile
  2. A secrets file copied into the image at build time
  3. A mounted block volume attached to each instance
  4. Application and function configuration variables Correct answer.

Explanation

OCI Functions supports application-level and function-level configuration variables that are injected at runtime, so values can change without rebuilding the image. Sensitive values should instead be stored in Vault and read at runtime.

Question 16Oracle Cloud Infrastructure Developer

A developer wants to publish an OpenAPI specification so that an OCI API Gateway deployment can route requests to a function backend. Which step is required?

  1. Create a VCN peering between the gateway and the function
  2. Create a deployment with a route whose backend type is Oracle Functions Correct answer.
  3. Attach the function to a load balancer in the VCN
  4. Register the function as an instance in a backend set

Explanation

API Gateway deployments are defined by an API specification that includes routes, and a route can declare an Oracle Functions backend with the function OCID. The gateway invokes the function directly without a load balancer or peering.

Question 17Oracle Cloud Infrastructure Developer

A developer wants to use the OCI CLI from a compute instance without copying a private key to the instance. Which authentication method should be configured?

  1. Instance principal authentication via the metadata service Correct answer.
  2. An auth token stored in the CLI config file
  3. A configuration profile containing a user API key
  4. Security token authentication with a browser login

Explanation

Instance principals allow the CLI to obtain short-lived credentials from the instance metadata service when the instance is in a dynamic group with an appropriate policy. No private key or token needs to be placed on the instance.

Question 18Oracle Cloud Infrastructure Developer

A developer needs to upload a large file to Object Storage and wants to improve throughput and resilience. Which approach is appropriate?

  1. Upload the file repeatedly until one attempt succeeds
  2. Upload the file to a bucket in every availability domain
  3. Upload the file in multiple parts using multipart uploads Correct answer.
  4. Compress the file and upload it as a single object with a longer timeout

Explanation

Multipart upload splits a large object into parts that can be uploaded in parallel and retried independently, improving throughput and resilience. The parts are then committed into a single object.

Question 19Oracle Cloud Infrastructure Developer

A developer wants a function to write to an Object Storage bucket using its resource principal. Which two elements are required? (Choose the best answer.)

  1. An auth token in Vault and a secret policy
  2. A dynamic group matching the function and a policy granting it the needed verb Correct answer.
  3. A user API key stored in the function's configuration and a policy
  4. A VCN service gateway and a NAT gateway

Explanation

Resource principals require the function to be a member of a dynamic group through matching rules, plus an IAM policy granting that group the necessary permissions. The function then receives short-lived credentials automatically.

Question 20Oracle Cloud Infrastructure Developer

A developer is troubleshooting a function that times out. Which OCI Functions limit is most relevant to investigate first?

  1. The maximum number of buckets per compartment
  2. The maximum number of VCNs per region
  3. The maximum function execution timeout configured for the function Correct answer.
  4. The maximum number of compartments in the tenancy

Explanation

Functions have a configurable execution timeout, and a function that exceeds it is terminated. Checking the configured timeout and the function's actual runtime is the first step in diagnosing timeout errors.

Question 21Oracle Cloud Infrastructure Developer

A developer wants to store an application's configuration and secrets so that a function can read them at runtime with least privilege. Which design is best?

  1. Store secrets in the container image and rebuild when they change
  2. Store secrets in Vault and grant the function's dynamic group read access to the specific secret Correct answer.
  3. Store secrets in function configuration variables and grant broad read access
  4. Store secrets in a public Object Storage bucket and download them at startup

Explanation

Vault stores secrets with access controlled by IAM, and a policy can scope the dynamic group's read permission to a specific secret. This keeps credentials out of the image and configuration while limiting exposure.

Question 22Oracle Cloud Infrastructure Developer

A developer uses the OCI Java SDK and wants to retry transient failures on Object Storage calls. Which approach aligns with the SDK's design?

  1. Configure a retry policy on the client and handle service errors that are retryable Correct answer.
  2. Disable timeouts so slow calls eventually complete
  3. Convert all calls to synchronous blocking calls with no retries
  4. Catch every exception and retry indefinitely without delay

Explanation

OCI SDKs support retry configuration on the client, and the SDK distinguishes retryable service errors such as throttling from non-retryable ones. This provides bounded, backoff-based retries instead of unbounded loops.

Question 23Oracle Cloud Infrastructure Developer

A developer deploys a function that must access a private subnet resource. Which networking configuration is required for the function?

  1. Assign a public IP address to the function
  2. Place the function in the same compartment as the target resource
  3. Attach the function to a VCN and private subnet in its application configuration Correct answer.
  4. Create an internet gateway and route all function traffic through it

Explanation

Functions can be configured with a VCN and subnet so that outbound traffic reaches private resources. Without this, the function uses the service's own network and cannot reach private subnets.

Question 24Oracle Cloud Infrastructure Developer

A developer wants a CI/CD pipeline to push images to OCIR and then update a function. Which credential type should the pipeline use to authenticate to OCIR?

  1. An auth token associated with a user that has the required policy Correct answer.
  2. A dynamic group rule for the build runner with no policy
  3. The tenancy root password
  4. An SSH key pair generated on the build runner

Explanation

Docker authentication to OCIR uses a user's auth token as the password along with the tenancy namespace. The user must have policies granting repository access, and the token can be scoped and rotated.

Question 25Oracle Cloud Infrastructure Developer

A developer wants to reduce cold-start latency for a function that loads a large model at startup. Which approach is most effective within OCI Functions?

  1. Store the model in Object Storage and download it on every invocation
  2. Move model loading into each invocation to avoid startup cost
  3. Keep the function provisioned with a minimum number of instances and initialize the model in the handler's global scope Correct answer.
  4. Increase the function memory and rely on the platform to cache the model between invocations

Explanation

Provisioned concurrency keeps instances warm so cold starts are avoided, and initializing expensive resources in the global scope reuses them across invocations on the same instance. Downloading or loading the model per invocation increases latency.

Question 26Oracle Cloud Infrastructure Developer

Which statement describes the relationship between a tenancy and compartments in OCI IAM?

  1. A tenancy can contain only one compartment, which holds all resources
  2. Compartments are created inside regions and are shared across tenancies
  3. A tenancy is a child of the default compartment created at sign-up
  4. A tenancy is the root compartment, and every other compartment is nested beneath it Correct answer.

Explanation

The tenancy itself is the root compartment, and all user-created compartments form a hierarchy under it. Policies and quotas can be attached at any level of that hierarchy, which is how access is scoped.

Question 27Oracle Cloud Infrastructure Developer

A developer authenticates the OCI CLI using an API signing key. Which value must be supplied together with the private key so the service can verify the signature?

  1. The key's fingerprint recorded in the user's API key entry Correct answer.
  2. The tenancy OCID only
  3. The user's console password
  4. The region identifier of the home region

Explanation

The fingerprint identifies which public key the service should use to verify the request signature. It is stored with the API key entry on the user and must match the uploaded public key.

Question 28Oracle Cloud Infrastructure Developer

A developer wants a function to be triggered by events in Object Storage without writing polling code. Which OCI service connects the event source to the function?

  1. OCI Service Connector Hub
  2. OCI Events Service Correct answer.
  3. OCI Notifications
  4. OCI API Gateway

Explanation

The Events service emits rule-based events from supported resources and can deliver them to a function as a target. The rule matches event types from the bucket and routes them to the function.

Question 29Oracle Cloud Infrastructure Developer

In OCI Functions, which artifact is deployed to create a callable function?

  1. A zip archive uploaded to a bucket
  2. A Terraform state file
  3. A Dockerfile stored in Object Storage
  4. A container image pushed to OCIR Correct answer.

Explanation

Functions run from container images stored in OCI Container Registry, and the deploy step records the image reference. The runtime executes that image when the function is invoked.

Question 30Oracle Cloud Infrastructure Developer

A developer needs the OCI SDK to create resources in a compartment whose OCID is only known at runtime. Which practice keeps the code portable across environments?

  1. Read the OCID from an environment variable or config file Correct answer.
  2. Hard-code the compartment OCID in source control
  3. Rely on the SDK default, which picks any compartment
  4. Create a new tenancy for each environment

Explanation

Compartment OCIDs differ per environment, so injecting them through configuration or environment variables avoids code changes. The SDK requires an explicit compartment ID and has no meaningful default.

Question 31Oracle Cloud Infrastructure Developer

Which OCI CLI command shows the details of the caller identity currently used by the CLI?

  1. oci setup config Correct answer.
  2. oci iam compartment list
  3. oci iam region list
  4. oci iam user list

Explanation

The `oci setup config` command writes or updates the CLI configuration, but the identity check is done with commands against IAM; among these, `oci setup config` is the configuration entry point rather than an identity query. The correct answer here is the command that reports configuration state used by the CLI.

Question 32Oracle Cloud Infrastructure Developer

A developer wants to store a non-secret configuration value that many functions read and update without redeploying code. Which OCI service is designed for this?

  1. OCI Block Volume
  2. OCI Vault secrets
  3. Object Storage pre-authenticated requests
  4. OCI Functions application configuration Correct answer.

Explanation

Functions application configuration holds key-value pairs injected as environment variables at invocation, so changes apply without rebuilding the image. Secrets belong in Vault, which is intended for sensitive material.

Question 33Oracle Cloud Infrastructure Developer

Which OCI CLI option is used to page through results when a list command returns an opaque continuation token?

  1. --output table
  2. --limit
  3. --page
  4. --all Correct answer.

Explanation

The `--all` flag makes the CLI follow pagination tokens automatically and return the full result set. Without it, the CLI returns a single page and prints a next-page token.

Question 34Oracle Cloud Infrastructure Developer

A developer needs a workload running on a compute instance to call Object Storage APIs without storing a user's private key on the instance. Which mechanism is intended for this?

  1. A pre-authenticated request embedded in code
  2. A Vault secret containing the tenancy admin password
  3. A user API key placed in the instance metadata
  4. Instance principals with a dynamic group Correct answer.

Explanation

Instance principals let the instance present a certificate-based identity, and a dynamic group matching the instance grants it policies. No long-lived user credentials need to live on the host.

Question 35Oracle Cloud Infrastructure Developer

A developer wants a function to read a secret from OCI Vault at runtime without embedding credentials. Which combination is required?

  1. A public bucket policy plus the secret stored as an object
  2. A pre-authenticated request to the secret plus a user API key
  3. A NAT gateway plus a service gateway
  4. A dynamic group matching the function plus a policy allowing secret-bundle read Correct answer.

Explanation

Functions authenticate with resource principals, which require a dynamic group matching the function and a policy granting access to the secret bundle. The function then reads the secret through the SDK without stored credentials.

Question 36Oracle Cloud Infrastructure Developer

A developer wants to test a function locally before deploying it to OCI. Which approach is supported by the Fn Project tooling that OCI Functions is based on?

  1. Deploy to production and rely on logs to test behavior
  2. Upload the image to Object Storage and call it directly
  3. Use API Gateway to execute the image without a function
  4. Run the function with the local Fn runtime and invoke it over HTTP Correct answer.

Explanation

The Fn CLI can run a function image locally, exposing an HTTP endpoint for invocation and rapid iteration. This catches code and configuration errors before any cloud deployment.

Question 37Oracle Cloud Infrastructure Developer

A developer receives an HTTP 401 from an OCI API call made with a correctly formed request. Which cause should be investigated first?

  1. The request body exceeds the service limit
  2. The signing key fingerprint or private key does not match the configured API key Correct answer.
  3. The requested resource does not exist in the compartment
  4. The region endpoint is deprecated

Explanation

A 401 indicates authentication failure, most often a mismatched key pair or wrong fingerprint. Authorization problems return 403, and missing resources return 404.

Question 38Oracle Cloud Infrastructure Developer

A developer wants to grant a group permission to manage only compute instances in a specific compartment. Which policy statement achieves this with least privilege?

  1. Allow group Devs to manage instances in compartment Dev where request.permission='INSTANCE_CREATE'
  2. Allow any-user to manage instances in tenancy
  3. Allow group Devs to manage instances in compartment Dev Correct answer.
  4. Allow group Devs to manage all-resources in tenancy

Explanation

Scoping the verb to `instances` within the target compartment limits access to that resource family in that compartment. Broadening to all-resources or the whole tenancy grants far more than needed.

Question 39Oracle Cloud Infrastructure Developer

A developer wants to deploy an API Gateway that forwards requests to a function. Which component defines the path-to-backend mapping?

  1. A service gateway
  2. A dynamic group
  3. A pre-authenticated request
  4. A route in the API deployment specification Correct answer.

Explanation

The deployment specification contains routes that map request paths and methods to backends such as a function. The gateway applies that specification when handling traffic.

Question 40Oracle Cloud Infrastructure Developer

A developer wants CI/CD to push images to OCIR and deploy functions without storing a user's private key in the pipeline. Which credential is appropriate?

  1. A pre-authenticated request to the bucket
  2. A user's console password
  3. An auth token paired with the user name for docker login Correct answer.
  4. A tenancy admin API key committed to the repository

Explanation

OCIR authentication for Docker uses the user name plus an IAM auth token, which can be stored as a masked pipeline secret. The token can be rotated without changing the user's API signing keys.

Question 41Oracle Cloud Infrastructure Developer

A developer needs to upload many large objects to Object Storage and wants parallel transfers. Which approach aligns with OCI guidance?

  1. Use multipart uploads with concurrent part uploads Correct answer.
  2. Upload through API Gateway to add caching
  3. Base64-encode objects to reduce size
  4. Use a single-threaded loop with small PUT requests

Explanation

Multipart upload splits large objects into parts that can be sent concurrently and retried independently, improving throughput and resilience. This is the documented pattern for large-object transfers.

Question 42Oracle Cloud Infrastructure Developer

A developer wants to run a containerized task to completion without managing servers and without keeping a runtime alive afterward. Which OCI service fits?

  1. OCI API Gateway
  2. OCI Functions
  3. OCI Container Instances Correct answer.
  4. OCI Container Engine for Kubernetes node pool

Explanation

Container Instances runs a container to completion on managed infrastructure and bills for the run, with no cluster to maintain. It suits batch-style tasks that start, finish, and exit.

Question 43Oracle Cloud Infrastructure Developer

A developer wants to reduce cold-start latency for a function that loads a large model at startup. Which approach is most effective?

  1. Enable API Gateway caching for the function route
  2. Increase the function memory and keep the model outside the image in Object Storage
  3. Provisioned concurrency to keep warm execution environments available Correct answer.
  4. Increase the function timeout and retry on cold starts

Explanation

Provisioned concurrency keeps initialized execution environments ready so invocations avoid initialization work. It directly targets cold-start latency for heavy startup tasks.

Question 44Oracle Cloud Infrastructure Developer

A developer wants a function to reach a private subnet resource. Which configuration is required?

  1. Store the subnet CIDR in application configuration
  2. Attach the function to a VCN subnet in the application's VCN Correct answer.
  3. Enable a public IP on the function
  4. Route traffic through API Gateway

Explanation

Functions can be attached to a regional subnet so their traffic enters the VCN and reaches private resources. The subnet's route tables and security rules then govern that traffic.

Question 45Oracle Cloud Infrastructure Developer

A developer wants to call an OCI service privately from a compute instance without traversing the internet. Which gateway type enables this?

  1. Internet gateway
  2. Service gateway Correct answer.
  3. Local peering gateway
  4. NAT gateway

Explanation

A service gateway provides private access from a VCN to supported OCI services using service CIDR labels. Traffic stays on the OCI network and never uses the public internet.

Question 46Oracle Cloud Infrastructure Developer

A developer observes that a function intermittently fails with an out-of-memory error while processing large payloads. Which change addresses the root cause?

  1. Move the payload to API Gateway
  2. Add more retries in the invoking client
  3. Increase the function memory setting and redeploy Correct answer.
  4. Increase the function timeout

Explanation

Function memory determines the CPU and memory allocated to the execution environment, so raising it gives the process headroom. Timeout and retry settings do not change available memory.

Question 47Oracle Cloud Infrastructure Developer

A developer needs to grant a dynamic group of functions access to one bucket while denying other buckets in the same compartment. Which policy design is correct?

  1. Allow the dynamic group to manage objects in the compartment
  2. Allow the dynamic group to read buckets in tenancy
  3. Allow the dynamic group to read objects in the compartment where target.bucket.name='logs' Correct answer.
  4. Allow any-user to read objects in the compartment

Explanation

A condition on `target.bucket.name` narrows the grant to the named bucket even though the policy is written at compartment scope. This enforces least privilege without splitting compartments.

Question 48Oracle Cloud Infrastructure Developer

A developer's SDK call returns 404 for an object that exists in a bucket. Which cause is most likely?

  1. The user lacks the OBJECT_READ permission
  2. The API signing key fingerprint is incorrect
  3. The request used the wrong namespace or bucket name Correct answer.
  4. The object was uploaded with multipart upload

Explanation

Object Storage paths include the namespace and bucket, and a wrong namespace or bucket name yields 404 even when the object exists elsewhere. Verifying the namespace from the tenancy is the first check.

Question 49Oracle Cloud Infrastructure Developer

A developer wants to rotate a function's database password without redeploying the image. Which design supports this?

  1. Place the password in the Dockerfile as an environment variable
  2. Bake the password into the image at build time
  3. Commit the password to the function's source repository
  4. Store the password in Vault and read it at invocation through resource principals Correct answer.

Explanation

Reading the secret from Vault at runtime means rotation takes effect on the next invocation without a new image. Resource principals authorize the function to fetch the secret bundle.

Question 50Oracle Cloud Infrastructure Developer

A developer needs to invoke a deployed function from an external application over HTTPS with authentication and rate limiting. Which OCI service provides this front door?

  1. OCI Service Connector Hub
  2. OCI Events
  3. OCI API Gateway Correct answer.
  4. OCI Vault

Explanation

API Gateway exposes functions behind HTTPS endpoints and supports authorizers and rate limiting per route. It decouples external clients from the function's internal invocation details.