One possible IAM policy statement that allows API Gateway to access Oracle Functions in your compartment is:

ALLOW any-user to use functions-family in compartment <your-compartment-name> where ALL {request.principal.type = 'ApiGateway', request.resource.compartment.id = '<your-compartment-OCID>'}

This statement grants the any-user group the permission to use the functions-family resource type in the specified compartment, but only if the request is coming from an API Gateway and the function belongs to the same compartment as the API Gateway. For more information, see Create a Policy to Give API Gateways Access to Functions.

To complete the task of creating a public API Gateway and invoking a private function in OCI, you can follow these steps:

To create a new public API Gateway in your compartment named exam-gateway, follow these steps:

In the OCI Console, go toDeveloper Servicesand clickAPI Gateway.

Select your assigned compartment from the list on the left.

ClickCreate Gateway.

Enterexam-gatewayas theNameand selectPublicas theType. You can also add a description for the gateway if you want.

Select your previously created VCN from theVCNdropdown menu and select any subnet from theSubnetdropdown menu. You can also enable logging for the gateway if you want.

ClickCreate. This will create a new public API Gateway in your compartment that can expose your functions to the internet.

To create a new API Deployment named exam-deployment using /v1 as the path prefix in exam-gateway, follow these steps:

In the OCI Console, go toDeveloper Servicesand clickAPI Gateway.

Select your assigned compartment from the list on the left and click on your previously created gateway (exam-gateway).

ClickDeploymentson the left panel and then clickCreate Deployment.

Enterexam-deploymentas theNameand selectFrom Scratchas theSpecification Type. You can also add a description for the deployment if you want.

Enter /v1 as thePath Prefixand leave the other fields as default. ClickNext.

To create a new route by using /hello as the path and GET as the method, follow these steps:

In the Create Deployment dialog box, clickAdd Route.

Enter /hello as thePath, select GET as theMethod, and select Oracle Functions as theType.

Select your previously created function (hello-python) from theFunction Namedropdown menu and leave the other fields as default. ClickSave Changes. This will create a new route that will invoke your function when you send a GET request to /v1/hello.

To create a new stateful CIDR Ingress Rule that allows for TCP HTTPS traffic (port 443) from all IP addresses and ports in the default Security List for exam-vcn, follow these steps:

In the OCI Console, go toNetworkingand clickVirtual Cloud Networks.

Select your assigned compartment from the list on the left and click on your previously created VCN (exam-vcn).

ClickSecurity Listson the left panel and then click on the default security list for your VCN.

ClickEdit All Rulesand then clickAdd Ingress Ruleunder the Ingress Rules section.

Enter 0.0.0.0/0 as theSource CIDR, select TCP as theIP Protocol, and enter 443 as both theSource Port Rangeand theDestination Port Range. You can also add a description for the rule if you want.

ClickSave Security List Rules. This will create a new stateful CIDR Ingress Rule that will allow HTTPS traffic from any source to reach your API Gateway.

To use curl to call the function via your API Gateway deployment, follow these steps:

In the OCI Console, go toDeveloper Servicesand clickAPI Gateway.

Select your assigned compartment from the list on the left and click on your previously created gateway (exam-gateway).

ClickDeploymentson the left panel and then click on your previously created deployment (exam-deployment).

Copy the value of the Endpoint URL field. This is the base URL for your API Deployment.

In a terminal window, enter the following command:

curl -k -X GET {deployment-endpoint}/v1/hello

where {deployment-endpoint} is the base URL that you copied.

For example, if your deployment endpoint is https://abc123xyz456.apigateway.us-ashburn-1.oci.customer-oci.com, your command would be:

curl -k -X GET https://abc123xyz456.apigateway.us-ashburn-1.oci.customer-oci.com/v1/hello

This will send a GET request to your API Deployment and invoke your function. You should see a response similar to this:

{'message': 'Hello World!'}

Topic 2, Multiple Choice Questions

To create a new private repository in the Container Registry named 99248134-lab.user01/hello-python within your assigned compartment, you can follow these steps:

In the OCI Console, go toDeveloper Servicesand clickContainer Registry.

Select your assigned compartment from the list on the left.

ClickCreate Repository.

In theCreate Repositorydialog box, enter99248134-lab.user01/hello-pythonas theRepository Nameand selectPrivateas theAccessoption. You can also add a description for the repository if you want.

ClickSubmit. This will create a new private repository in the Container Registry that you can use to store your serverless function images.

Option A is incorrect because using OCI Traffic management service with failover steering policy will not distribute the traffic between OCI and on premises infrastructure.Failover steering policy will only route traffic to a secondary endpoint if the primary endpoint is unresponsive2. This is not suitable for a gradual migration scenario.

Option B is correct because using OCI Traffic management service with Load Balancing steering policy will distribute the traffic between OCI and on premises infrastructure based on a ratio or round robin algorithm2. This will allow you to control the percentage of traffic that goes to the new infrastructure in OCI and monitor the results.

Option C is incorrect because using an OCI load Balancer will not distribute the traffic between OCI and on premises infrastructure.A load balancer will only distribute the traffic among multiple compute instances within a single region in OCI2. This will not help you migrate from your on premises infrastructure.

Option D is incorrect because using VPN connectivity between on premises Infrastructure and OCI and creating routing tables to distribute the traffic between them will require more effort than using OCI Traffic management service.You will need to set up a VPN connection, configure routing rules, and monitor the network performance2. This will not be as simple and reliable as using a DNS-based solution.

Option A is correct because using multiple OCI Data Transfer Appliances to transfer data to OCI is the most effective service to use to migrate the data to OCI given the time constraints. This option can securely move terabytes or petabytes of data between on-premises data centers and the cloud in days instead of weeks or months.It also avoids using the public internet, which can be slow, unreliable, and expensive45.

Option B is incorrect because setting up an OCI Storage Gateway to connect your data center and your VCN and uploading all data to OCI is not effective given the time constraints. This option requires using the public internet, which can be intermittent due to the damages caused by the hurricane.It also requires installing and configuring a software appliance on your premises, which can add complexity and overhead6.

Option C is incorrect because setting up a hybrid network by launching a 1Gbps FastConnect virtual circuit between your data center and OCI and using OCI Object Storage multipart upload tool to automate the migration of your data to OCI is not feasible given the time constraints. This option requires provisioning a FastConnect circuit, which can take several days or weeks depending on your network provider. It also requires using a public internet backup path, which can be unreliable due to the hurricane .

Option D is incorrect because setting up an OCI Storage Gateway to connect your data center and your VCN and uploading all data to OCI using OCI Storage Gateway Cloud Sync tool is not effective given the time constraints. This option requires using the public internet, which can be intermittent due to the damages caused by the hurricane.It also requires installing and configuring a software appliance on your premises, which can add complexity and overhead6.

Option E is incorrect because uploading the data to OCI using OCI Object Storage multipart upload tool is not effective given the time constraints. This option requires using the public internet, which can be slow, unreliable, and expensive due to the hurricane and the large amount of data involved