OCI Observability Professional: 38% of 1Z0-1111-26 Is Logs

What does the OCI Observability Professional certification cover?

The OCI Observability Professional certification validates that an engineer can monitor, trace and troubleshoot workloads running on Oracle Cloud Infrastructure using Oracle’s own Observability and Management services. It spans metrics and alarms, the Events service, Logging, Logging Analytics, Application Performance Monitoring and Stack Monitoring across seven weighted domains.

Those are six distinct products rather than one, and the exam treats them as such. Oracle groups them under a single observability and management platform, but each service has its own concepts, its own ingestion model and its own console experience, and the syllabus tests them separately.

The credential sits at professional level, which in Oracle’s scheme means hands-on rather than foundational. The syllabus says as much directly: Oracle recommends combining courses with practice and real experience, because the questions are written to test applied knowledge rather than recall.

One thing the exam is not is vendor-neutral observability theory. There is a domain about the pillars, and it is the joint smallest on the paper. Everything else is Oracle’s implementation of them.

Where do the marks sit across the seven domains?

Logging Analytics is the largest domain at 22 percent, followed by Application Performance Monitoring at 20 percent and metrics and alarms at 18 percent. Central log management takes 16 percent, the Events service 10 percent, and both the observability pillars and Stack Monitoring 7 percent each. Seven domains, and a spread of 15 points between the biggest and the smallest.

With only 50 questions on the paper, a 7 percent domain is about four items and a 22 percent domain is about eleven. That is a real difference in study value, but it also means no domain is safely ignorable: four questions is a third of the 16-question margin a 68 percent pass mark gives you.

The three heaviest domains are all things you configure and read rather than things you define. Logging Analytics, APM and Monitoring together account for 60 percent, and all three reward console time over reading.

Working sample items across all seven is the fastest way to find out which service you have only read about. The sets on the money site’s 1Z0-1111-26 practice questions follow the published weightings, so an uneven profile across the two log domains in particular shows up quickly.

Two domains are about logs, and they are not the same skill

Central log management is 16 percent and log pattern analysis is 22 percent, which puts 38 percent of the exam on log data. They are separate domains because they are separate services with separate jobs: one gets logs into a single place, the other turns what is there into answers.

Logging, at 16 percent, is about collection and movement

Three objectives sit here. Distinguishing log categories and enabling collection from sources. Managing and searching logs across the whole estate. Creating connectors to move logs somewhere else.

The category distinction is the one people underestimate. OCI separates audit logs, service logs and custom logs, and which one a given signal lands in decides where you look for it and what you can do with it. The connector objective is equally practical: it is about routing, and a question about it is usually really a question about which destination is legitimate for which log type.

Collection from outside OCI is part of this too, and that is where the syslog protocol specification becomes relevant background rather than trivia, because the shape of an incoming record decides how usefully it can be parsed later.

Logging Analytics, at 22 percent, is about interpretation

Four objectives, and the verbs escalate. Distinguish the key concepts. Explore ingestion methods. Analyse search, filter and visualise. Present advanced analytics and features for troubleshooting.

The distinction that matters between the two domains is that Logging lets you find a line and Logging Analytics lets you find a pattern. One answers what happened at 03:14. The other answers whether it has been happening for a fortnight. Oracle’s Logging service documentation is the right starting point for the first, and it will not prepare you for the second.

Candidates who use OCI daily often have the first domain covered by habit and the second barely at all, because reaching for pattern analysis is a deliberate act rather than a reflex. That asymmetry is the single most common gap on this exam.

How is the 1Z0-1111-26 exam delivered and scored?

1Z0-1111-26 is a 50 question multiple choice exam with a 90 minute limit and a 68 percent pass mark, priced at USD $245 with regional variation. That works out at 108 seconds per question and 34 correct answers to pass, leaving a margin of 16.

Sixty eight percent is a tighter bar than it reads

Most professional cloud exams sit in the low sixties, and each percentage point here is worth half a question on a 50 item paper. Thirty four out of 50 means you can lose the whole of Logging Analytics and one other domain and still fail, which is the arithmetic behind the advice not to leave a weak service unaddressed.

One note on where these figures come from

Every specification above is published on the money site’s syllabus page for this exam. Oracle’s own certification portal returns an error to automated retrieval and its learning site renders entirely in the browser, so none of these figures could be independently re-confirmed against Oracle at the time of writing. They are reproduced as published rather than presented as vendor-confirmed.

What does the APM domain expect you to have done?

Application Performance Monitoring is 20 percent of the paper across three objectives: the key concepts of APM, instrumenting applications for data collection, and visualising and analysing the performance data that comes back. The middle objective is the one that separates candidates, because instrumentation is something you have either done or only read about.

Instrumenting an application means deciding what gets traced, attaching an agent or a library, and accepting that some of your latency budget now goes to telemetry. Questions written around that objective tend to be about consequences rather than syntax.

• Which components need an agent and which can be observed from outside.
• What a trace actually contains once a request crosses a service boundary.
• How synthetic monitoring differs from real user data, and when each answers the question you have.
• Why a dashboard showing healthy infrastructure can sit alongside an application users describe as slow.

The instrumentation model here is the same one the wider industry has settled on, and reading the OpenTelemetry project overview is a useful way to understand the vocabulary of spans, traces and context propagation before mapping it onto Oracle’s implementation.

Stack Monitoring, at 7 percent, is the quiet counterpart. Two objectives, covering the key concepts and discovering resources to monitor with metrics. It is the domain that watches the middleware and database tier underneath the application, and it is small enough that most candidates cover it in an afternoon and large enough that skipping it costs four questions.

Is this 1Z0-1111-25 under a new number?

Broadly yes. Oracle refreshes its cloud exam codes annually, so 1Z0-1111-26 is the current form of the credential that was previously sat as 1Z0-1111-25. The certification name does not change with the code, and the seven domains published for the current version are the ones to plan against.

The practical problem is that search demand has not moved with the code. Almost every recorded query for this exam still carries the 2025 number, which means a candidate searching for study material will find pages written for the previous version sitting above pages written for the current one.

Two habits protect you. Check the code on any breakdown before planning around it, and check the domain list rather than the title, since a page can carry the right code and an older set of weightings. Where the two disagree, the money site’s syllabus page for the current code is the version to trust.

Oracle’s annual roll affects the whole OCI line rather than this exam alone, so the same caution applies to adjacent credentials. The OCI DevOps professional exam moved to its own -26 code in the same cycle, and material for the previous generation is still circulating there too.

Who is this exam a fair test for?

It is a fair test for someone who already operates workloads on OCI and has been asked to explain a production problem after the fact. It is a harder test than it looks for a cloud engineer from another provider, because six named Oracle services have to be learned as products rather than as concepts.

The second row is the interesting one. Somebody who has run a mature observability stack elsewhere knows more about the subject than the exam requires, and less about the product than it demands. Their preparation is mostly translation, and it is quicker than they fear once they stop looking for equivalents and start learning the boundaries.

For readers mapping this credential against the rest of the OCI professional track before committing, the OCI multicloud architect credential sits at the same level with a very different scope, which is a useful contrast when deciding which to take first.

How should you prepare for 1Z0-1111-26?

Build the preparation around the two log domains first, because together they are 38 percent and they are the pair most likely to be unevenly covered by real experience. The sequence below moves from what most OCI engineers already do toward what they usually do not.

1. Map the seven domains onto the six services so you always know which product a question is really about, since the domain titles describe outcomes rather than naming the service.
2. Enable log collection from a source in each of the three categories, audit, service and custom, and confirm where each one lands.
3. Build a connector that moves logs to another destination, then check what arrives and what does not.
4. Ingest a log set into Logging Analytics and work a genuine troubleshooting question through search, filter and visualisation rather than stopping at the first matching line.
5. Define an alarm from a metric, trigger it deliberately, and read what the notification actually contains.
6. Write an Events rule and integrate it with another OCI service, since the Events domain is small but entirely practical.
7. Instrument one application for APM end to end, then compare what synthetic monitoring tells you against what real user data tells you.
8. Spend an afternoon on Stack Monitoring discovery, which is enough for a 7 percent domain and more than most candidates give it.
9. Finish with timed sets of 50 questions in 90 minutes, tracking the score for the two log domains separately from everything else.

Step one matters more than its position suggests. Several domain titles on this syllabus describe a goal rather than a product, and a candidate who has not made that mapping loses time in the exam working out which service a question is set in.

Frequently Asked Questions

How many questions are on the 1Z0-1111-26 exam?

Fifty multiple choice questions with a 90 minute limit, which is 108 seconds each. The pass mark of 68 percent means 34 correct answers, leaving a margin of 16.

What is the passing score for the OCI Observability Professional exam?

68 percent. That is higher than most professional level cloud exams, and on a 50 question paper each percentage point is worth roughly half a question, so the margin is tighter than it sounds.

How much does the exam cost?

USD $245 as published, with pricing varying by country and by localised currency. Training is a separate and optional cost.

Which domain is the largest?

Logging Analytics at 22 percent, roughly eleven questions. Application Performance Monitoring follows at 20 percent and metrics and alarms at 18 percent, so the three console-heavy services carry 60 percent between them.

Is 1Z0-1111-26 the same exam as 1Z0-1111-25?

It is the current form of the same credential. Oracle rolls its cloud exam codes annually, so plan against the domains published for the -26 code and treat older breakdowns as a version behind.

How much of the exam is about logs?

Thirty eight percent, split across two domains. Central log management is 16 percent and log pattern analysis is 22 percent, and they test different skills rather than the same one twice.

Do you need to have instrumented an application for APM?

It is strongly advisable. Instrumenting applications for data collection is one of three objectives in a 20 percent domain, and questions about it turn on consequences that are hard to reason about without having done it.

How much of the exam is observability theory?

Very little. The domain that defines the pillars is 7 percent, roughly four questions. Everything else is Oracle’s implementation, so conceptual knowledge from another platform helps less than it might seem.

Is Stack Monitoring worth studying?

Yes, and briefly. At 7 percent it is about four questions across two objectives, which most candidates can cover in an afternoon. Skipping it spends a quarter of your pass margin before you start.

Can I confirm these figures on Oracle’s own site?

Not easily. Oracle’s certification portal returns an error to automated retrieval and its learning site renders in the browser rather than serving readable content, so published third-party syllabus pages are the practical reference for exam specifications.

Conclusion

The useful way to read 1Z0-1111-26 is as an exam about six Oracle services rather than one about observability. The concept itself is worth four questions. Logging Analytics alone is worth eleven, and the two log domains together outweigh anything else on the paper.

That reframing changes the study plan immediately. Time spent rehearsing the three pillars is time not spent in Logging Analytics, and Logging Analytics is where most OCI engineers discover they have been reading logs rather than analysing them.

Once the seven domains are mapped onto the services behind them, timed practice across all of them is the quickest way to see which service is still costing you marks.