Be able to design hybrid and multicloud connectivity: choose Site-to-Site VPN versus FastConnect, attach VCNs to a DRG, and use Service Gateway for private OCI service access. The most important thing is getting redundancy and routing right for each scenario.
Start practicing
Multicloud And Hybrid — choose a session length
Free · No account required
Domain overview
This domain covers connecting OCI to on-premises networks and other clouds: Site-to-Site VPN, FastConnect, DRG routing, Service Gateway, and the OCI-Azure Interconnect. Questions are scenario-based, asking you to pick the right component, redundancy model, or routing feature for hybrid and multicloud designs.
Exam objectives
Redundant Site-to-Site VPN tunnel counts and IPSec high-availability design per VPN connection
FastConnect virtual circuits, DRG attachment, and routing to on-premises from multiple VCNs
OCI-Azure Interconnect prerequisites, FastConnect plus ExpressRoute pairing, and peering requirements
Service Gateway use for private access to OCI services without internet or NAT
Assuming a single Site-to-Site VPN tunnel provides high availability; OCI provisions multiple tunnels by default per connection.
Forgetting that connecting multiple regional VCNs to one datacenter requires a DRG with proper attachments and route tables.
Confusing Service Gateway with NAT Gateway; Service Gateway only reaches OCI services, not the public internet.
Click any question to see the full explanation and answer options, or start a focused practice session above.
You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?
2An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?
3Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?
4You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?
5An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?
6An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?
7You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?
8When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?
9Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?
10What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?
11You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?
12Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?
13An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?
14An administrator needs to configure DNS resolution between an on-premises datacenter and OCI. On-premises servers must resolve hostnames of compute instances in an OCI VCN. Which OCI service component must be utilized to achieve this?
15What is the primary function of an OCI Service Gateway?
16You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?
17You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?
18An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?
19An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?
20You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?
21Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?
22An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?
23You are designing an active-active hybrid architecture between an on-premises datacenter and OCI using two separate FastConnect circuits connected to two different DRG attachments. How does OCI determine path selection when receiving identical BGP route advertisements from both circuits?
24What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?
25An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)
26When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)
27An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)
28An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?
29An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)
30You are configuring the OCI-Azure Interconnect to link an OCI Virtual Cloud Network (VCN) with an Azure Virtual Network (VNet). You have already established the FastConnect and ExpressRoute circuits. What is the mandatory next step to enable cross-cloud routing between the OCI Dynamic Routing Gateway (DRG) and the Azure Virtual Network Gateway?
31Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?
32Your organization is implementing a multicloud strategy where workloads in OCI must securely communicate with workloads in AWS over a private connection. You decide to set up a third-party software virtual appliance (VPN gateway) inside an OCI VCN. What specific VCN configuration change is required to ensure that return traffic from OCI compute instances correctly routes back through the virtual appliance instance?
33When designing a high-performance hybrid architecture integrating an on-premises data center with OCI, which THREE key factors should be evaluated to optimize network throughput and reliability?
34An enterprise has an OCI tenancy and an AWS account. They want to enable private connectivity between a VCN in OCI and a VPC in AWS without using the public internet. They have an existing FastConnect circuit in OCI and an AWS Direct Connect circuit in AWS. Which solution should the architect recommend?
Be able to design hybrid and multicloud connectivity: choose Site-to-Site VPN versus FastConnect, attach VCNs to a DRG, and use Service Gateway for private OCI service access. The most important thing is getting redundancy and routing right for each scenario.
The Courseiva 1Z0-997-26 question bank contains 34 questions in the Multicloud And Hybrid domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Multicloud And Hybrid domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included