1Z0-1157-26 Exam Questions & Answers

The Runner is responsible for executing the OpenAI Agents SDK agent loop. The uploaded course source identifies this directly as the Runner's role.

When Runner.run(), Runner.run_sync(), or Runner.run_streamed() is invoked, the Runner starts with an agent and user input, calls the configured model, evaluates the model output, and decides what happens next. If the output is final, execution terminates. If the model requests a tool call, the Runner executes the tool, appends the result, and calls the model again. If the model produces a handoff, the Runner updates the active agent and continues the loop. OpenAI's official documentation describes precisely this lifecycle.

The Runner is therefore an orchestration/runtime component rather than an agent-hosting deployment service. Authentication configuration exists separately, and function-tool JSON schemas are generated by the tool-definition mechanisms rather than being the Runner's primary responsibility.

This distinction is central to the SDK architecture: the Agent defines behavior and capabilities, while the Runner executes the iterative workflow.

Therefore, C is correct.

Study Guide reference/topic: OpenAI Responses API and Agents SDK --- Runner, agent loop, tool execution, handoffs, final output, and runtime orchestration.

For application-defined function tools, an LLM does not inherently execute the external operation itself. Instead, the model produces a structured tool-call request identifying the selected function and supplying arguments. The application or agent runtime then interprets that request, applies appropriate validation or authorization, invokes the corresponding implementation, and returns the result to the model for subsequent reasoning.

The OpenAI Responses API defines function calls as custom tools supplied by the developer that enable the model to request execution of application code using typed arguments. The OpenAI Agents SDK makes the separation explicit: a FunctionTool contains the tool name, description, parameter JSON schema, and an on_invoke_tool implementation that actually executes when the runtime processes the model-generated arguments.

This boundary is critical for security. The model proposes an action; controlled application/runtime logic performs the action. The model is therefore not automatically granted direct database, filesystem, network, or operating-system privileges merely because a tool has been described to it.

Options A, B, and D incorrectly remove this enforcement boundary. Consequently, C is the correct architectural description and matches the supplied question source.

Study Guide reference/topic: OpenAI Responses API and Agents SDK --- function calling, structured tool calls, application execution, validation, schemas, and security boundaries.

Oracle Autonomous AI Database includes a managed MCP Server that is natively integrated with the database rather than requiring customers to deploy and operate a separate MCP infrastructure tier. Oracle states that the service eliminates the need to manage customer-side MCP server infrastructure, directly reducing deployment and operational overhead. It also integrates with database identity, authorization, governance, auditing, network controls, database roles, Virtual Private Database policies, ACLs, and private endpoints.

Architecturally, this is significant because MCP-exposed Select AI Agent tools remain close to the database security boundary. The managed multi-tenant MCP layer can expose approved tools while relying on established database governance controls. Oracle's architecture describes a Unified Security Layer, managed MCP Server, and Select AI Agent Framework working together as an integrated stack.

The capability does not remove SQL, move database execution outside the database, or require a universal MCP host. Instead, its primary advantage is minimizing additional infrastructure while preserving strong database-native control over access and operations. Thus C is technically correct and matches the uploaded source.

Study Guide reference/topic: Agentic AI for Oracle AI Database --- Autonomous AI Database MCP Server, native security integration, governance, and managed MCP infrastructure.

Memory poisoning is an agent-security attack in which malicious, misleading, or attacker-controlled information is introduced into memory that the agent may reuse in future reasoning or actions. The uploaded course source defines it as malicious content inserted into persistent memory stores and identifies C as correct.

Oracle's current AI Agent Memory security guidance explains why persistent memory must be treated as a security-sensitive surface. Model-derived memories, summaries, context cards, metadata, and retrieved records can become persistent state and later be inserted into prompts. Oracle therefore advises treating memory-derived content as untrusted and emphasizes that write-capable memory paths can influence future prompts and retrieval results.

The broader agent-security definition is also explicit in OWASP's Agentic AI guidance: memory poisoning involves malicious data being persisted in agent memory so that it can influence future sessions or behaviors.

This differs from temporary context-window pressure, SQL injection, or physical RAM corruption. The essential security property is persistence: compromised memory can affect later reasoning long after the original malicious interaction.

Therefore, C is correct.

Study Guide reference/topic: Introduction to AI Agents --- agent memory, persistent state, memory poisoning, prompt injection persistence, and agent security.

Streamable HTTP is the standard MCP transport intended for remote or network-accessible client-server communication. Current MCP architecture documentation distinguishes it from STDIO by explaining that Streamable HTTP uses HTTP POST for client-to-server communication and can optionally use Server-Sent Events for streaming. It enables communication with remote MCP servers and can support standard HTTP authentication mechanisms.

The MCP transport specification further establishes two standard transport mechanisms: stdio and Streamable HTTP. With STDIO, the client launches an MCP server as a local subprocess and exchanges JSON-RPC messages through standard input and standard output. That pattern is therefore most appropriate for local process integration. By comparison, a Streamable HTTP server operates as an independent service and can handle multiple client connections, making it suitable for centralized or cloud-hosted MCP deployments.

Raw TCP sockets and local Unix pipes are not the standard remote MCP transport defined by the protocol. Therefore, C is correct and matches the supplied source material.

Study Guide reference/topic: Model Context Protocol (MCP) Fundamentals --- STDIO versus Streamable HTTP transport and remote MCP deployment.