Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
You are part of a team that manages a set of workload instances running in an on-premises environment. The Architect team is tasked with designing and configuring Oracle Cloud Infrastructure (OCI) Logging service to collect logs from these instances. There is a requirement to archive Info-level logging data of these instances into OCI Object Storage. Which two features of OCI can help you achieve this? (Choose two.)
To collect logs from on-premises instances and archive Info-level logs in OCI Object Storage, you need tools for log ingestion and data movement:
Service Connectors (A): This feature enables data transfer from OCI Logging (source) to Object Storage (target). You can configure a service connector with a filter (e.g., log level = Info) to archive only Info-level logs.
ObjectCollection Rule (D): Part of Logging Analytics, this rule collects logs from Object Storage buckets into Logging Analytics for analysis. If logs are first written to Object Storage by an agent, this rule ensures continuous ingestion.
Why not B or C?
Agent Configuration (B): Used to set up Management Agents but doesn't handle archiving to Object Storage.
Cloud Agent Plugin Grouping Function (C): This is not a valid OCI feature.
The workflow involves agents sending logs to Logging, Service Connectors filtering and moving them to Object Storage, and ObjectCollection Rules enabling further analysis.
In Application Performance Monitoring (APM), where is the span context information located during transfer?
In OCI APM, span context (e.g., Trace ID, Span ID) is propagated across services to track requests.
In HTTP header (B): Span context is embedded in HTTP headers (e.g., X-B3-TraceId) during transfer between services. This allows APM to correlate spans across distributed systems for a single user request.
Why not A, C, or D?
Service boundaries (A): This is a conceptual term, not a location for data.
HTTP call (C): Too vague---''HTTP call'' isn't a specific storage location.
Browser and microservices (D): Context originates here but is transferred via headers, not stored locally during transit.
This follows the OpenTracing standard used by OCI APM.
You are part of an organization with thousands of users accessing Oracle Cloud Infrastructure (OCI). An unknown user action was executed, resulting in configuration errors. You are tasked to quickly identify the details of all users who were active in the last six hours along with any REST API calls that were executed. Which OCI service would you use?
To investigate user activity and REST API calls over the last six hours, the OCI Audit service is the appropriate tool.
Audit (E): This service automatically records all API operations (including REST API calls) performed on OCI resources. It provides detailed logs with user details, timestamps, and actions, ideal for security and compliance investigations. You can filter audit logs by time range (e.g., last six hours) and user attributes.
Why not A, B, C, or D?
Notifications (A): Sends alerts but doesn't store or analyze API call details.
Service Connectors (B): Moves data between services, not for auditing.
Management Agent (C): Collects metrics/logs from resources, not API audit data.
Logging (D): Handles application and system logs, not API activity tracking.
Audit logs are retained for 90 days by default, making this a perfect fit.
Which of the following TWO are stored in a Log Source of Logging Analytics? (Choose two.)
A Log Source in Logging Analytics defines how logs are collected and processed:
Which Parsers to use (A): Specifies the parsers (e.g., Syslog, JSON) that extract fields from logs, enabling structured analysis.
Where to find Logs (C): Defines the log location (e.g., file path /var/log/messages, database connection string), directing the collection process.
Why not B or D?
Where to store Log data (B): Storage is managed by Logging Analytics, not defined in the Source.
Which Management Agents to use (D): Agents are associated with Entities, not specified in the Source.
These elements configure log ingestion effectively.
Which pillars of Observability are available as a single view from the Dashboard?
OCI Dashboards consolidate the three pillars of observability:
Logs, Metrics, and Traces (A):
Logs: Event records from Logging Service.
Metrics: Numeric data from Monitoring Service.
Traces: Request flows from APM.
These can be visualized together in OCI Dashboards for unified observability.
Why not B, C, or D?
B: Resource categories, not pillars.
C: Tools or components, not pillars.
D: OCI services, not the core concepts.
This integration enhances system visibility.
How does Application Performance Monitoring track all related spans for a single user request?
APM tracks request flows using:
Using Trace ID (A): A unique identifier assigned to a trace (collection of spans) for a single user request. Propagated via HTTP headers, it links all spans across services.
Why not B or C?
User ID (B): Identifies users, not request flows.
Application Name (C): Too broad; doesn't correlate specific requests.
Trace ID ensures end-to-end visibility in distributed systems.
Which Management Agent group allows the agent to upload data to the discovery service?
Management Agents require group membership and policies to interact with OCI services:
AgentUsersGrp (A): A predefined dynamic group for all Management Agents in a tenancy. With an attached policy granting upload permissions (e.g., allow dynamic-group AgentUsersGrp to use discovery-service-family in tenancy), agents can send data to the discovery service for resource detection.
Why not B, C, or D?
B and C: Specific to Stack Monitoring roles, not general agent uploads.
D: A generic name, not a predefined OCI group.
AgentUsersGrp is the standard for this purpose.
Exam domains verified against: Official Oracle 1Z0-1111-26 exam guide, last checked October 2026.
Summarize the OCI Observability and Management Services platform and understand how observability differs from basic monitoring. Learn the foundational concepts that underpin effective cloud observability strategy and SRE practices.
Explain the key concepts of the Monitoring Service and enable metrics for OCI resources. Configure alarm definitions using best practices to create effective alerting strategies for your cloud infrastructure.
Sample question from this domain above: Q2
Analyze the key concepts of Events Service and determine event structure, types and rules. Respond to events by integrating with OCI services to automate remediation and maintain system stability.
Distinguish log categories and enable log collection from various sources across your infrastructure. Manage and search logs from your entire log estate and create connectors for log transitions between systems.
Distinguish the key concepts of Logging Analytics and explore log ingestion methods. Analyze logs through search, filter and visualization tools, and apply advanced analytics features to troubleshoot problems faster.
Sample question from this domain above: Q7
Explore the key concepts of Application Performance Monitoring and instrument applications for data collection. Examine how to visualize and analyze performance data to understand user experience and application health.
Identify the key concepts of Stack Monitoring and analyze how to discover resources and monitor them with metrics. Gain visibility into complex multi-tier application architectures running on OCI.
Common questions about the exam itself
