1z0-1157-26 Questions and Answers

Oracle Autonomous AI Database includes a managed MCP Server that is natively integrated with the database rather than requiring customers to deploy and operate a separate MCP infrastructure tier. Oracle states that the service eliminates the need to manage customer-side MCP server infrastructure, directly reducing deployment and operational overhead. It also integrates with database identity, authorization, governance, auditing, network controls, database roles, Virtual Private Database policies, ACLs, and private endpoints.

Architecturally, this is significant because MCP-exposed Select AI Agent tools remain close to the database security boundary. The managed multi-tenant MCP layer can expose approved tools while relying on established database governance controls. Oracle's architecture describes a Unified Security Layer, managed MCP Server, and Select AI Agent Framework working together as an integrated stack.

The capability does not remove SQL, move database execution outside the database, or require a universal MCP host. Instead, its primary advantage is minimizing additional infrastructure while preserving strong database-native control over access and operations. Thus C is technically correct and matches the uploaded source.

Study Guide reference/topic: Agentic AI for Oracle AI Database — Autonomous AI Database MCP Server, native security integration, governance, and managed MCP infrastructure.

The Runner is responsible for executing the OpenAI Agents SDK agent loop. The uploaded course source identifies this directly as the Runner's role.

When Runner.run() , Runner.run_sync() , or Runner.run_streamed() is invoked, the Runner starts with an agent and user input, calls the configured model, evaluates the model output, and decides what happens next. If the output is final, execution terminates. If the model requests a tool call, the Runner executes the tool, appends the result, and calls the model again. If the model produces a handoff, the Runner updates the active agent and continues the loop. OpenAI's official documentation describes precisely this lifecycle.

The Runner is therefore an orchestration/runtime component rather than an agent-hosting deployment service. Authentication configuration exists separately, and function-tool JSON schemas are generated by the tool-definition mechanisms rather than being the Runner's primary responsibility.

This distinction is central to the SDK architecture: the Agent defines behavior and capabilities , while the Runner executes the iterative workflow .

Therefore, C is correct.

Study Guide reference/topic: OpenAI Responses API and Agents SDK — Runner, agent loop, tool execution, handoffs, final output, and runtime orchestration.

===============

The OpenAI Agents SDK uses an iterative agent loop for multi-step tool execution. In this scenario, the model first determines that it needs the multiply tool and generates a call with the arguments 15 and 8 . The application executes that tool and returns 120 as a tool result. The model receives the updated conversation state, recognizes that another operation remains, and subsequently requests divide(120, 3) . The resulting value is then available for the final response. The uploaded course source explicitly specifies this sequence.

OpenAI's Agents SDK documentation confirms that the Runner repeatedly calls the LLM, executes requested tools, appends their results, and runs the model again until final output is produced.

The Runner does not independently decide to calculate the arithmetic itself. Nor does the SDK automatically merge unrelated function calls into one synthetic operation. Likewise, an agent does not invoke every registered tool indiscriminately; the model selects the tools required by the current task.

Therefore, D accurately describes the sequential model/tool interaction.

Study Guide reference/topic: OpenAI Responses API and Agents SDK — agent loop, sequential tool calls, tool results, Runner orchestration, and multi-step execution.

===============

When a LangChain agent is invoked through agent.invoke() , the agent runtime abstracts the core mechanics required for model-mediated tool execution. LangChain tools expose structured inputs and outputs, and tool definitions provide the model with schemas derived from Python type information or explicitly supplied schemas. The framework then coordinates model responses containing tool calls, dispatches the corresponding tools, passes observations back to the model, and repeats the process until the agent reaches a termination condition.

This is a major distinction between directly binding tools to a standalone chat model and using a LangChain agent. LangChain documentation states that, with a model alone, the developer must execute returned tool calls and feed results back manually; when an agent is used, the agent loop handles that tool-execution loop .

Thus, the course's intended abstraction is captured by B: building/exposing tool schemas, processing model tool calls, and orchestrating iterative execution. GPU memory distribution and model training are infrastructure/model-development responsibilities, not functions of agent.invoke() .

The supplied question source explicitly marks B as the expected answer.

Study Guide reference/topic: LangChain for AI Agents — agent.invoke(), tool schemas, tool-call parsing, ToolNode execution, and iterative agent loops.

===============

Memory poisoning is an agent-security attack in which malicious, misleading, or attacker-controlled information is introduced into memory that the agent may reuse in future reasoning or actions. The uploaded course source defines it as malicious content inserted into persistent memory stores and identifies C as correct.

Oracle's current AI Agent Memory security guidance explains why persistent memory must be treated as a security-sensitive surface. Model-derived memories, summaries, context cards, metadata, and retrieved records can become persistent state and later be inserted into prompts. Oracle therefore advises treating memory-derived content as untrusted and emphasizes that write-capable memory paths can influence future prompts and retrieval results.

The broader agent-security definition is also explicit in OWASP's Agentic AI guidance: memory poisoning involves malicious data being persisted in agent memory so that it can influence future sessions or behaviors.

This differs from temporary context-window pressure, SQL injection, or physical RAM corruption. The essential security property is persistence : compromised memory can affect later reasoning long after the original malicious interaction.

Therefore, C is correct.

Study Guide reference/topic: Introduction to AI Agents — agent memory, persistent state, memory poisoning, prompt injection persistence, and agent security.

Oracle Select AI Agent is architected around four foundational behaviors: Planning, Tool Use, Reflection, and Memory Management . Oracle documentation describes these as the framework's principal layers. Planning interprets the user's objective, decomposes it into ordered actions, and identifies appropriate capabilities. Tool Use invokes mechanisms such as NL2SQL, RAG, PL/SQL procedures, or external REST services. Reflection evaluates observations returned by those tools and determines whether the current plan should continue, be revised, or use another capability. Memory preserves context and useful information, supporting coherent multi-turn interactions and longer-term continuity.

Oracle explicitly states that Select AI Agent combines planning, tool use, reflection, and memory and implements a ReAct-style agentic pattern in which the agent reasons, acts through tools, evaluates observations, and continues toward the goal.

The alternative answer sets describe generic information-retrieval or operational lifecycle stages but do not correspond to Oracle's defined Select AI Agent architecture. Consequently, B reproduces the four documented agent behaviors and is the correct answer in the supplied question set.

Study Guide reference/topic: Agentic AI for Oracle AI Database — Select AI Agent architecture, Planning, Tool Use, Reflection, Memory, and ReAct.

===============

The MCP Host is the top-level AI application in the Model Context Protocol architecture. Its responsibility is to coordinate the broader application experience and manage the MCP clients used to connect with one or more MCP servers. The official MCP architecture specifies that an MCP host creates a separate MCP client for each server connection and describes the host as the AI application that coordinates and manages one or multiple MCP clients.

The distinction between host, client, and server is essential. An MCP client maintains the protocol connection to a corresponding MCP server. An MCP server exposes capabilities such as tools, resources, and prompts. The host integrates these connections with the AI application's model and user interaction flow. Therefore, it is incorrect to define the host as the protocol specification itself, an external REST service, or the component that necessarily implements each individual tool.

Option D most accurately represents this orchestration role: the host coordinates the LLM-facing application and MCP client connections to the servers providing capabilities. The source question identifies D accordingly.

Study Guide reference/topic: Model Context Protocol (MCP) Fundamentals — MCP Host, MCP Client, MCP Server, and client-server architecture.

===============

MCP uses JSON-RPC 2.0 as the underlying message protocol for communication between MCP clients and MCP servers. JSON-RPC provides a structured representation for requests, responses, errors, and one-way notifications while remaining independent of the underlying transport. This separation is important because the same protocol semantics can operate over STDIO or Streamable HTTP.

The MCP architecture documentation states that the data layer implements a JSON-RPC 2.0-based exchange protocol defining message structures and semantics. It also explains that the transport layer abstracts communication details, allowing the same JSON-RPC message format to operate across supported transports. The MCP specification similarly requires messages between clients and servers to follow JSON-RPC structures, including methods, parameters, IDs for requests, and result/error structures for responses.

SOAP/XML is a different web-service protocol family; GraphQL is primarily a query language and API runtime; Protocol Buffers is a binary serialization technology. None is the MCP-defined wire-message format. Therefore, option B is correct and agrees with the uploaded answer key.

Study Guide reference/topic: Model Context Protocol (MCP) Fundamentals — JSON-RPC 2.0, requests, responses, notifications, and transport independence.

===============

For application-defined function tools, an LLM does not inherently execute the external operation itself. Instead, the model produces a structured tool-call request identifying the selected function and supplying arguments. The application or agent runtime then interprets that request, applies appropriate validation or authorization, invokes the corresponding implementation, and returns the result to the model for subsequent reasoning.

The OpenAI Responses API defines function calls as custom tools supplied by the developer that enable the model to request execution of application code using typed arguments. The OpenAI Agents SDK makes the separation explicit: a FunctionTool contains the tool name, description, parameter JSON schema, and an on_invoke_tool implementation that actually executes when the runtime processes the model-generated arguments.

This boundary is critical for security. The model proposes an action; controlled application/runtime logic performs the action. The model is therefore not automatically granted direct database, filesystem, network, or operating-system privileges merely because a tool has been described to it.

Options A, B, and D incorrectly remove this enforcement boundary. Consequently, C is the correct architectural description and matches the supplied question source.

Study Guide reference/topic: OpenAI Responses API and Agents SDK — function calling, structured tool calls, application execution, validation, schemas, and security boundaries.

Oracle AI Vector Search defines VECTOR_DISTANCE as the primary SQL function for calculating the distance between two vectors. When the function is called without explicitly specifying a distance metric, Oracle specifies COSINE as the default metric for ordinary, non-BINARY vectors. Cosine distance measures the angular relationship between vector representations and is widely used for semantic similarity because embeddings with similar meaning tend to point in similar directions in vector space. Oracle treats BINARY vectors differently: their default metric is HAMMING. Euclidean, or L2, distance is supported but must be selected when required; it is not the general default. Levenshtein distance applies to string-edit comparisons, while bitwise XOR is not the default Oracle vector-distance metric. Therefore, for the scenario stated in the question, option C is the verified answer. Oracle Docs

===============

Input guardrails are checks applied to the initial user input before or alongside execution of the primary agent workflow. Their purpose is to validate whether incoming content satisfies defined security, safety, relevance, or policy requirements and to interrupt execution when an unacceptable condition is detected.

The official OpenAI Agents SDK documentation states that input guardrails receive the same initial input supplied to the agent and can trigger a tripwire that stops execution. Guardrails can therefore be used to detect malicious or otherwise disallowed user requests before they propagate through an expensive or action-capable agent workflow. Blocking execution is particularly important for security-sensitive cases because it can prevent the agent from consuming tokens or executing tools when the input fails validation.

Option B describes output guardrails , which run against the final agent output. Role-based tool authorization is a separate tool-access control problem, while audit logging is normally implemented through observability, tracing, or application-level compliance mechanisms rather than defining the primary input-guardrail function.

Therefore, D is the correct answer and agrees with the supplied course source.

Study Guide reference/topic: OpenAI Responses API and Agents SDK — input guardrails, output guardrails, tripwires, safety validation, and execution blocking.

===============

Tool selection in the OpenAI Agents SDK is model-driven. Each function tool exposes structured metadata that gives the model enough information to determine whether the tool is appropriate and how it should be invoked. The SDK represents a function tool using a name , description , and JSON parameter schema . OpenAI's SDK reference explicitly defines these properties as information shown to the LLM, while function-tool helpers automatically generate the parameter schema from the Python function signature and derive descriptions from documentation when available.

During an agent run, the model evaluates the user's request together with the available tool definitions. It can then select an appropriate tool and generate arguments conforming to that tool's schema. This mechanism is fundamentally semantic and contextual: meaningful names and descriptions tell the model what a tool does, while schemas describe the arguments required to execute it.

There is no rule requiring the first registered tool to be selected, every tool to be invoked, or random selection. Such behavior would undermine agentic reasoning and dynamic orchestration. Consequently, B is the technically correct answer and is explicitly identified as correct in the uploaded question set.

Study Guide reference/topic: OpenAI Responses API and Agents SDK — Function Tools, tool metadata, JSON schemas, tool selection, and model-driven invocation.

===============