Practice Free 1z0-1147 Oracle AI Database@Azure Architect Professional Exam Questions Answers With Explanation

Oracle AI Database@Azure applies a regional service limit to delegated subnet usage. The documented default is five delegated subnets per OCI tenancy in a specific region . This is a service quota rather than a limitation that can be bypassed through additional Azure routing constructs.

To exceed the default, the customer must request a service limit increase . Oracle identifies the relevant OCI service as Multicloud, the resource as Delegated Subnet Multicloud Links , and the corresponding service-limit name as azure-delegated-subnet-count. The limit is regional, so introducing another VNet, Route Server, VNet peering relationship, or Microsoft Entra tenant does not increase the permitted count.

Current documentation phrases the operation as requesting a service limit increase through Oracle's service-limit process. Among the supplied choices, option D is the only one that represents that required Oracle-side quota increase.

Architecturally, this distinction matters because routing topology and service capacity are independent control planes: networking objects determine reachability, whereas Oracle-enforced service limits determine how many delegated-subnet links may exist.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet limits and Multicloud service-limit management.

===============

Oracle documents multiple Azure network patterns for application connectivity to Oracle AI Database@Azure, including VNet peering and Hub-and-Spoke VNet peering .

VNet peering enables application workloads in one Azure VNet to communicate privately with Oracle database resources exposed through a delegated subnet in another VNet. This is appropriate when relatively direct, low-latency communication is required.

A Hub-and-Spoke design introduces a central hub containing shared connectivity and security services, such as Azure Firewall, a Network Virtual Appliance, ExpressRoute gateway, or VPN gateway. Application and database VNets connect as spokes or workload/data networks, allowing centralized inspection and hybrid connectivity.

Oracle's documented topology set also includes local VNet, global connectivity, on-premises Hub-and-Spoke, and related enterprise designs. A point-to-site VPN client model is not identified as the standard application topology requested here. More fundamentally, an Oracle AI Database@Azure deployment cannot exist without an Azure VNet and delegated networking.

Therefore, the correct selections are B and C .

Study Guide reference: Configure Oracle AI Database@Azure Networking — VNet Peering and Hub-and-Spoke topologies.

===============

Oracle's cross-region Oracle Database@Azure reference architecture requires an additional Hub VCN because each OCI VCN can be attached to only one Dynamic Routing Gateway (DRG) at a time.

The Oracle-managed database VCN associated with an Exadata VM Cluster already uses a DRG as part of the Oracle Database@Azure network architecture. Cross-region VCN peering also requires DRG-based remote peering. Because a second DRG cannot simply be attached to the existing database VCN, Oracle introduces a separate Hub VCN with its own DRG. The database VCN is locally connected to the Hub VCN, and the Hub DRGs establish the cross-region remote peering connection.

OCI documentation independently confirms that one VCN can attach to only one DRG, whereas a single DRG can support many VCN attachments. A VCN can also have multiple Local Peering Gateways, so option B is technically incorrect.

The limitation is therefore architectural rather than a restriction caused by Azure subnet delegation or tenancy boundaries.

Study Guide reference: HA and DR — OCI transit networking, Hub VCN, DRG, LPG and cross-region Data Guard.

===============

Oracle AI Database@Azure has a default regional service limit of five delegated subnets . Once a deployment requires more than five delegated subnet links in a region, the customer must request a service-limit increase.

This aggregate regional limit must not be confused with the separate VNet design rule. An individual Azure VNet can contain a maximum of one delegated subnet for Oracle AI Database@Azure, but an organization can have several VNets and therefore several delegated subnets across the same region up to the default service limit.

Oracle identifies the relevant service-limit metadata as:

Service: Multicloud

Resource: Delegated Subnet Multicloud Links

Limit name: azure-delegated-subnet-count

The limit operates at regional scope. Therefore, creating additional peerings or Route Servers does not bypass it; the correct approach is to request additional service capacity through Oracle's service-limit process.

Values of 1, 3, and 10 do not represent the default regional limit.

Therefore, A. 5 is correct.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet quotas and service-limit increases.

===============

An Oracle AI Database@Azure delegated subnet remains part of the customer's Azure VNet and can use supported Azure networking controls. Two fundamental controls are Network Security Groups (NSGs) and Azure route tables containing User-Defined Routes .

An NSG performs traffic filtering by applying inbound and outbound security rules based on criteria such as source, destination, protocol, and port. This allows organizations to enforce database-access policies at the Azure network layer. Route tables provide forwarding control, allowing traffic to be directed through Azure Firewall, an NVA, a virtual network gateway, or other supported next-hop architecture.

Oracle's delegated-subnet design documentation explicitly states that because the delegated subnet belongs to the customer's VNet, it can leverage Azure networking capabilities including NSGs and routing tables . This enables private application-to-database communication while retaining enterprise routing and security controls.

Azure Load Balancer backend pools and Application Gateway ingress controllers are application/load-balancing constructs and are not the two subnet-associated controls identified for this Oracle database networking requirement.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet design, NSGs, Azure route tables, UDRs and traffic controls.

===============

The appropriate built-in Azure RBAC role is Monitoring Contributor . Microsoft defines this role for administrators who need to read monitoring information and create or modify monitoring configuration .

Monitoring Contributor includes the monitoring-read capabilities required to inspect metrics and diagnostic data and adds permissions needed to create or edit diagnostic settings, alert-related configurations, and monitoring resources. Microsoft also identifies creation of private monitoring dashboards as a supported use case for this role.

Monitoring Reader is insufficient because it is primarily a read-only monitoring role. It allows users to inspect monitoring data and settings but does not grant the required configuration-modification permissions. The general Reader role similarly lacks write capabilities. Owner would technically provide sufficient access but violates least privilege because it grants comprehensive resource-management permissions, including access-control authority far beyond monitoring.

Because the administrator's duties are specifically monitoring-oriented but require configuration changes, Monitoring Contributor supplies the correct functional scope without granting unrestricted ownership.

Study Guide reference: Secure Oracle AI Database@Azure — Azure RBAC, monitoring permissions, least privilege and operational administration

Oracle's documented ZDM logical migration architecture for Oracle Database@Azure uses Azure Files to provide the NFS share used for Oracle Data Pump dump-file staging.

During a logical offline migration, Data Pump exports the source data to dump files placed on the NFS share, and the target database reads those files during import. For a logical online migration, the initial load similarly uses Data Pump, while Oracle GoldenGate captures and applies ongoing changes so that source and target remain synchronized until cutover.

The NFS share must be accessible from the participating database environments. Oracle's migration walkthrough uses an Azure Files NFSv4.1 mount and creates a database directory such as DATA_PUMP_DIR_NFS that points to the mounted path.

Azure Disk Storage is block storage rather than a cross-host NFS file share, while Azure Blob Storage exposes an object-storage interface rather than the mounted filesystem expected by standard Data Pump staging. Other NFS technologies can be used in broader ZDM architectures, but the documented Oracle Database@Azure workflow identified in this question uses Azure Files .

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDM logical migration, Data Pump, NFS staging and Azure Files.

===============

Oracle Database Autonomous Recovery Service supports Long-Term Retention (LTR) backups for organizations that need to preserve full database backups for compliance, regulatory, legal, or business requirements. The correct destination is the OCI Object Storage Infrequent Access tier .

The question source specifies that the LTR backup initially remains in the standard storage tier and transitions after the first 24 hours to Infrequent Access storage for the remainder of its retention period. Oracle's Recovery Service documentation independently confirms that long-term retention backups are stored in the Object Storage Infrequent Access tier and can be retained for periods extending up to ten years.

The Infrequent Access tier is appropriate because LTR backups are retained for extended periods but are generally restored less frequently than operational backups. Archive Storage is not the managed destination used by Recovery Service for this workflow. Azure Archive Blob Storage is likewise not the Oracle-managed OCI storage tier identified for these backups, and there is no "OCI Legacy Backup" storage tier.

Therefore, D is correct.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — Autonomous Recovery Service, LTR backups, retention and storage lifecycle.

===============

Oracle's Oracle AI Database@Azure prerequisites explicitly identify the personas required for optional identity federation. On the Azure side, the required persona is an Entra ID Administrator with appropriate Microsoft Entra administrative permissions. On the OCI side, the corresponding persona is an Identity Domain Administrator .

This combination is necessary because federation spans both identity systems. Microsoft Entra ID must be configured with the OCI enterprise application, SAML authentication details, groups/users, and provisioning configuration. OCI IAM Identity Domains must then trust the Entra identity provider, establish the corresponding IdP configuration and policies, and support any required user provisioning.

Oracle's prerequisite matrix specifically lists Azure permissions including External Identity Provider Administrator, Groups Administrator, and User Administrator capabilities, with OCI Identity Domain Administrator permission on the Oracle side.

Billing Account Owner, Subscription Owner, Support Owner, and Security Zone Administrator roles serve different administrative purposes and do not jointly provide the identity-domain configuration authority required for federation.

Therefore, B exactly matches Oracle's documented administrative personas.

Study Guide reference: Secure Oracle AI Database@Azure — identity federation, Microsoft Entra ID, OCI IAM Identity Domains, SSO and RBAC.

===============

Oracle owns and operates the underlying Exadata infrastructure layer used by Oracle AI Database@Azure, even though that infrastructure is physically located in Microsoft Azure data centers. Consequently, Oracle performs infrastructure-level maintenance, patching, security updates, monitoring, and lifecycle operations.

Oracle-managed Exadata infrastructure components include the physical database-server hosts, storage servers, network fabric, hypervisor or virtualization infrastructure, firmware, management components, and control-plane systems. Microsoft supplies the Azure data-center environment and associated Azure platform capabilities, but Microsoft support engineers do not maintain Oracle's Exadata hardware/software stack.

The customer retains responsibility for customer-controlled portions of co-managed database environments, including database configuration and, depending on service and maintenance model, guest VM, Grid Infrastructure, database homes, and database software lifecycle activities. Oracle has also introduced optional Oracle-managed database software update capabilities for applicable newer Exadata services, but that does not change responsibility for the underlying infrastructure.

Therefore, C correctly identifies Oracle's Cloud Infrastructure operations organization.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — shared operational responsibility and Exadata infrastructure maintenance.

===============

Oracle's reference architecture for multi-region Oracle Database@Azure disaster recovery explicitly states that no subnet is required in the Hub VCN to enable transit routing .

The Hub VCN serves primarily as a routing construct connecting gateways and route-table attachments. DRGs, Local Peering Gateways, Remote Peering Connections, and VCN route tables provide the required network forwarding between the Oracle Database@Azure Child Site VCNs and remote regions. Because the hub does not need to host compute instances or network virtual appliances for this gateway-based transit model, it does not require a workload subnet.

This has an additional design benefit: the hub VCN can use a comparatively small CIDR range because there is no requirement to reserve substantial address space for servers or VNICs.

A public subnet and Internet Gateway are unnecessary because Data Guard traffic should traverse private cloud networking. Likewise, dedicated /24 transit-appliance subnets or per-availability-domain private subnets are not mandatory for the gateway-based topology.

Therefore, D is correct.

Study Guide reference: HA and DR with Oracle AI Database@Azure — cross-region Data Guard, OCI Hub VCN and transit routing.

===============

Oracle's documented federation procedure between Microsoft Entra ID and an OCI IAM Identity Domain uses Security Assertion Markup Language (SAML) , specifically SAML 2.0.

During configuration, an Oracle Cloud Infrastructure Console enterprise application is configured in Microsoft Entra ID. The administrator selects SAML as the single sign-on method, exchanges SAML metadata between Microsoft Entra ID and the OCI Identity Domain, configures identity attributes and claims, and establishes Microsoft Entra ID as the identity provider for OCI.

SAML allows an administrator to authenticate through the enterprise Microsoft identity environment and obtain federated access to OCI without maintaining a separate password specifically for the OCI Console.

Kerberos is primarily a ticket-based authentication protocol traditionally associated with Active Directory and internal network authentication. RADIUS is commonly used for network access authentication and accounting. OAuth 2.0 Client Credentials is designed for service-to-service authorization rather than interactive federated user SSO.

Therefore, D. SAML is the correct protocol.

Study Guide reference: Secure Oracle AI Database@Azure — Microsoft Entra ID and OCI Identity Domain federation.

===============

Oracle Exadata Database Service on Exascale Infrastructure uses the Elastic Compute Processing Unit (ECPU) resource model. During initial VM Cluster provisioning, Oracle requires a minimum of 8 ECPUs enabled per VM .

The distinction between the initial minimum and subsequent scaling increments is important. After the VM Cluster exists, enabled compute capacity is adjusted in increments of 4 ECPUs . Therefore, 4 ECPUs represents the scaling granularity, not the minimum provisionable starting configuration. Oracle also allows enabled ECPUs to be reduced to zero after provisioning when administrators need to temporarily shut down the VMs and suspend enabled-ECPU usage billing, but zero cannot be used as the initial active configuration.

Current Oracle documentation defines the supported total ECPU allocation per VM within the applicable Exascale service limits and explicitly states that the provisioned value must be a multiple of four.

Consequently, neither 1 nor 4 meets the initial provisioning baseline, while 16 is valid but exceeds the minimum. The correct answer is A. 8 ECPUs .

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — Exascale VM Cluster sizing and ECPU configuration.

===============

Oracle Database Autonomous Recovery Service provides the specific capabilities required for multi-year database backup retention combined with immutability .

Oracle's Long-Term Retention capability allows a full database backup to be retained for up to ten years . This addresses regulatory requirements that exceed ordinary operational backup-retention windows. Recovery Service additionally supports Retention Lock , which prevents protected backups from being modified or deleted before the configured retention period expires. This provides a database-aware immutability mechanism suitable for ransomware, malicious-administrator, and compliance-protection scenarios.

Merely increasing a standard Object Storage backup retention value does not provide the same Recovery Service lifecycle, recoverability validation, protection-policy model, or database-specific retention locking. NFS likewise does not introduce a managed ten-year immutable recovery framework. Manual on-demand backups also fail to provide policy-enforced retention and introduce unnecessary operational risk.

The combination of Recovery Service, LTR, and Retention Lock directly addresses both requirements in the question: ten-year retention and immutability .

Therefore, B is correct.

Study Guide reference: Secure Oracle AI Database@Azure — Autonomous Recovery Service, Long-Term Retention and Retention Lock.

===============

The two managed backup destinations represented in the question are OCI Object Storage and Oracle Database Autonomous Recovery Service .

OCI Object Storage is the established managed backup destination for Oracle Database services and stores Oracle-managed database backup objects in OCI. Autonomous Recovery Service is Oracle's recommended advanced database-protection platform. It provides database-aware incremental-forever backup processing, centralized protection policies, recoverability validation, retention locking, and optional real-time transaction protection.

For Oracle Database@Azure, Recovery Service can store protected-database backups either in the paired OCI region or, where supported and selected by policy, within the same Azure cloud provider location. Oracle architecture documentation therefore increasingly positions Autonomous Recovery Service as the preferred automatic-backup destination.

The physical Zero Data Loss Recovery Appliance is an on-premises engineered system rather than the managed cloud backup destination in this service. Direct Azure Blob Storage API access is likewise not presented as the standard built-in automatic Exadata backup destination; Azure-hosted Recovery Service storage is accessed through the managed Recovery Service architecture rather than direct customer Blob APIs.

Therefore, C and D are correct.

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — Exadata backup destinations and Autonomous Recovery Service.

===============

Oracle Zero Downtime Migration organizes its Oracle database migration methods into two fundamental workflow families: Physical Migration and Logical Migration . Each family can then have online and offline variants depending on compatibility requirements and acceptable downtime.

Physical migrations operate on the physical database representation and rely on technologies such as RMAN and Oracle Data Guard. Physical Online migration can instantiate a target using Restore From Service and maintain synchronization using Data Guard, while Physical Offline uses RMAN backup and restore.

Logical migrations operate through logical database objects and data. Oracle Data Pump provides the initial export/import mechanism, while Logical Online migration integrates Oracle GoldenGate to capture and replicate ongoing transactions before cutover. Logical workflows are also suitable for many cross-version or cross-platform scenarios that physical workflows cannot support.

"Container-based migration" and "snapshot-based migration" are not ZDM's top-level migration workflow categories.

Oracle's current ZDM documentation explicitly states that ZDM supports both Physical and Logical Migration workflows.

Therefore, B and D are correct.

Study Guide reference: Migrate Oracle Databases to Oracle AI Database@Azure — ZDM workflow categories.

===============

Oracle Autonomous AI Database Serverless documents a local Autonomous Data Guard standby RTO SLO of two minutes for failure events that require failover to the standby.

For the Recovery Point Objective, current Oracle documentation is slightly more precise than the wording in option A: the local standby's maximum possible data-loss objective is less than 10 seconds . Therefore, the exam option stating "RPO of 10 seconds" represents the intended and closest supported value.

These SLOs apply to events such as full database failure, complete storage failure, corruption scenarios requiring standby transition, and availability-domain failures when Autonomous Data Guard is enabled. Local standby protection provides materially faster recovery and a substantially smaller possible data-loss window than cross-region standby protection because replication remains geographically close.

An hour-long RTO is inconsistent with active standby protection, while five-minute RPO and thirty-second RPO values do not match Oracle's stated local Autonomous Data Guard objectives.

Therefore, A is correct, interpreted technically as 2-minute RTO and < 10-second RPO .

Study Guide reference: HA and DR — Autonomous Data Guard local standby SLOs.

===============

The purchase process creates an Azure-managed resource group in the background to host the OracleSubscription resource used for Oracle AI Database@Azure billing and subscription integration. Microsoft specifically documents a known issue in which Azure Policy can block this operation.

The system-created managed resource group must initially be located in EastUS , must conform to the provider-defined naming requirement, and is initially created without tags . Consequently, an enterprise policy that allows only West Europe or denies untagged resource groups prevents the OracleSubscription resource from being created. The correct remediation is to exempt the applicable managed resource group from those blocking policies during the purchase process. Microsoft recommends identifying the blocking assignment in the Azure activity log and creating an appropriate, preferably time-bound, Azure Policy exemption.

Administrators cannot solve the problem by manually creating their own resource group in West Europe because this is a provider-managed resource. Billing-address changes likewise do not change the resource provider's required deployment location, and OCI commercial-model changes do not remove the Azure OracleSubscription requirement.

Study Guide reference: Oracle AI Database@Azure Architecture and Onboarding — private offer purchase, OracleSubscription resource, Azure prerequisites and policy considerations.

===============

Azure Front Door single-endpoint routing is not a documented Oracle AI Database@Azure database connectivity topology.

Azure Front Door is primarily a global Layer-7 HTTP/HTTPS application-delivery, acceleration, and load-balancing service. It is designed for web applications and public-facing application endpoints rather than private SQL*Net/database connectivity into an Oracle AI Database@Azure delegated subnet.

Oracle's documented networking patterns instead center on Azure VNets and private routing. These include local/same-region VNet connectivity, VNet peering, Hub-and-Spoke VNet peering, cross-region connectivity, and hybrid on-premises Hub-and-Spoke architectures. Oracle also documents enterprise connectivity patterns involving Azure Virtual WAN.

Hub-and-Spoke is particularly important where centralized firewalls or NVAs must inspect database-bound traffic, while local VNet/VNet peering is useful for direct application-to-database private communication where minimizing network latency is the priority.

Because Azure Front Door does not provide the required private database networking architecture and is absent from Oracle's supported topology set, C is the correct answer.

Study Guide reference: Configure Oracle AI Database@Azure Networking — supported VNet, peering, Hub-and-Spoke and enterprise connectivity topologies.

Oracle AI Database@Azure Network Anchors support DNS integration between Azure-side applications and OCI-side database networking. The two endpoint constructs used by Oracle DNS are the DNS forwarding endpoint and DNS listening endpoint .

For inbound DNS resolution from OCI toward Azure, Oracle's Network Control Plane can create a forwarding DNS endpoint and configure forwarding rules so OCI-hosted resources can forward queries toward the Azure DNS environment. Conversely, outbound resolution from Azure toward Oracle resources relies on an OCI listening DNS endpoint. The listening endpoint receives DNS requests and enables Azure or connected on-premises systems to resolve Oracle AI Database@Azure names.

The terminology is important. Oracle explicitly uses listening and forwarding endpoint constructs. "DNS replication endpoint" is not the endpoint name used for private-zone synchronization, and "DNS peering endpoint" is not an Oracle Network Anchor endpoint type. DNS-record synchronization is a separate behavior from the endpoint resource itself.

Consequently, the correct selections are A and D .

Study Guide reference: Configure Oracle AI Database@Azure Networking — Network Anchors, inbound DNS, outbound DNS, forwarding endpoints and listening endpoints.

===============

Oracle recommends OCI Full Stack Disaster Recovery (Full Stack DR) for orchestrating disaster-recovery operations around Oracle Database@Azure deployments.

Oracle's reference architecture for local and regional Oracle Database@Azure standbys explicitly recommends Full Stack DR to orchestrate database switchover and failover operations . The service can coordinate ordered disaster-recovery plans instead of requiring administrators to manually perform every database and infrastructure transition during an incident or DR drill.

Oracle Data Guard remains the underlying database replication and role-management technology, while Full Stack DR provides the higher-level orchestration framework for executing coordinated transitions.

Azure Site Recovery is primarily designed for Azure VM and workload replication/recovery and is not Oracle's recommended database-role orchestration service. GoldenGate provides logical replication and data integration rather than end-to-end DR orchestration. Azure Traffic Manager performs DNS-based traffic distribution and can participate in application routing, but it does not execute Oracle database switchovers or failovers.

Therefore, B is correct.

Study Guide reference: HA and DR with Oracle AI Database@Azure — Full Stack DR orchestration and Data Guard role transitions.

===============

Oracle AI Database@Azure integrates its operational telemetry with Azure Monitor diagnostic settings so organizations can apply existing Azure observability, compliance, and SIEM architectures to Oracle database infrastructure.

Three standard destinations are relevant here. An Azure Log Analytics workspace receives telemetry for centralized querying, dashboarding, alerting, and Kusto Query Language analysis. An Azure Storage account can archive logs or metrics for retention, compliance, or later processing. Azure Event Hubs provides a streaming destination for forwarding telemetry to SIEM products, custom consumers, event-processing pipelines, or other downstream platforms.

Oracle's Oracle AI Database@Azure monitoring documentation specifically lists Log Analytics Workspace, Storage Account, and Event Hub among the available Azure Monitor diagnostic-routing destinations. Oracle Enterprise Manager can monitor Oracle environments but is not an Azure Monitor diagnostic-settings destination. OCI Object Storage is likewise not selected directly as a destination from the Azure diagnostic-settings workflow. Azure SQL Database is a database service rather than a supported diagnostic sink.

Therefore, the three correct selections are A, C, and D .

Study Guide reference: Provision and operate Oracle AI Database@Azure Resources — monitoring, Azure diagnostic settings, Log Analytics, Storage accounts and Event Hubs.

===============

The Data Guard Observer is an independent process used by Fast-Start Failover to monitor the primary and standby databases and determine whether an automatic failover should occur. Because its independence directly affects the reliability of the failover decision, it should not share the same failure domain as either database.

For an Oracle AI Database@Azure architecture spanning availability zones, placing the Observer on a separate Azure VM in another availability zone provides appropriate fault isolation. If the primary AZ fails, the Observer remains available to verify the failure and initiate the transition to the standby. Hosting the Observer directly on the primary database node would cause it to disappear with a primary-site outage. Hosting it on the standby similarly creates an undesirable dependency on the standby environment.

The Observer is an external Data Guard Broker process; it does not belong inside Oracle's multicloud control-plane Parent Site. For stronger resilience, Oracle Data Guard can also support multiple observers in appropriate configurations.

Therefore, D represents the recommended architecture.

Study Guide reference: HA and DR with Oracle AI Database@Azure — Data Guard Broker, FSFO and Observer placement.

===============

The correct solution combines Oracle Database Autonomous Recovery Service Long-Term Retention (LTR) with Retention Lock .

Recovery Service permits an LTR backup to be retained for up to 3,650 days—10 years . LTR backups are independent of the normal operational backup window and are designed specifically for compliance, regulatory, legal, and archival requirements.

Retention Lock adds the required immutability control. Oracle describes Retention Lock as an enforcement mechanism that protects retained backups against inadvertent changes and malicious actions such as ransomware. Once governed by the locked protection policy, backup retention cannot simply be shortened or deleted through normal backup-administration privileges before the protected period expires.

A 60-day Object Storage policy fails the ten-year requirement. Manual NFS backups lack the managed LTR and retention-lock framework, while Data Guard standby databases solve availability and disaster-recovery problems rather than replacing governed backup retention.

Therefore, C uniquely satisfies both long-term retention and immutability.

Study Guide reference: Secure Oracle AI Database@Azure — Autonomous Recovery Service, LTR and Retention Lock.

===============

The appropriate architecture is Microsoft Entra ID-to-OCI SAML federation combined with group synchronization/mapping .

SAML provides the authentication component. Administrators authenticate using corporate Microsoft Entra ID identities and obtain federated access to the associated OCI Identity Domain. Oracle's onboarding procedure creates the SAML trust by exchanging metadata between Microsoft Entra ID and OCI.

The provisioning side then maps assigned users and groups from the Microsoft Entra enterprise application into OCI through the configured identity integration. This allows corporate group membership to drive the user's Oracle-side authorization model instead of requiring administrators to create and maintain separate OCI identities individually.

Azure RBAC governs Azure resources but does not by itself create the required OCI IAM group relationships for OCI Console administration. Azure Key Vault controls cryptographic keys and secrets rather than identity federation, while manually creating OCI users directly contradicts the automated identity-lifecycle requirement.

Therefore, A provides both SSO and centralized enterprise identity/group management.

Study Guide reference: Secure Oracle AI Database@Azure — SAML federation, user/group synchronization and OCI IAM.

===============