1Z0-997-26 Multicloud And Hybrid — 25 Questions

Question 1

What is the maximum supported MTU (Maximum Transmission Unit) size for traffic passing through an OCI FastConnect virtual circuit by default?

Accepted Answer

9000 bytes. OCI FastConnect virtual circuits support a maximum MTU of 9000 bytes (jumbo frames) by default for traffic traversing the dedicated connection. This larger MTU reduces packet overhead and improves throughput for bulk data transfers between on-premises and OCI. The 9000-byte value is the standard jumbo frame size supported across OCI FastConnect offerings.

Answer

1500 bytes

Answer

576 bytes

Answer

65535 bytes

Question 2

You need to connect an on-premises datacenter to OCI using FastConnect with a Partner model. Which component must you configure in the OCI console before provisioning the virtual circuit with the FastConnect partner?

Accepted Answer

FastConnect Virtual Circuit with a partner provider. When using the FastConnect Partner model, the customer does not order the physical cross-connect directly from Oracle; instead, the partner provisions the layer 2 connectivity. However, the customer must still create the FastConnect Virtual Circuit in the OCI Console and associate it with the chosen partner and provider service, which then triggers the partner to provision the connection. This virtual circuit object is the prerequisite that binds the OCI side to the partner's infrastructure before the partner can complete provisioning.

Answer

Local Peering Gateway

Answer

Customer-Premises Equipment (CPE) object

Answer

Internet Gateway

Question 3

An architect is designing a multi-cloud disaster recovery strategy between OCI and AWS. Production data resides in an Oracle Autonomous Database on OCI, and application servers run in AWS EC2. To secure the network traffic between AWS and OCI without routing over the public internet, which approach should be implemented?

Accepted Answer

Configure an IPSec VPN tunnel between an AWS Virtual Private Gateway and an OCI Dynamic Routing Gateway.. The correct approach is to configure an IPSec VPN tunnel between an AWS Virtual Private Gateway and an OCI Dynamic Routing Gateway. This provides a secure, private connection over the internet without traversing the public internet for data traffic, as the IPSec tunnel encrypts all communication. It is a standard method for multi-cloud connectivity between AWS and OCI.

Answer

Peer an AWS VPC directly to an OCI VCN using Local Peering Gateways.

Answer

Attach an AWS Elastic IP directly to the OCI Autonomous Database.

Answer

Use OCI Object Storage pre-authenticated requests over HTTPS.

Question 4

Your security team requires that all data traversing the OCI-Azure Interconnect must be encrypted. Does the standard OCI-Azure Interconnect encrypt traffic natively at Layer 3?

Accepted Answer

No, native interconnect traffic is unencrypted; you must layer IPsec VPN over the interconnect if encryption is mandatory.. The standard OCI-Azure Interconnect (also known as Oracle Database@Azure or the multicloud interconnect) provides a private, dedicated Layer 3 network path between OCI and Azure, but it does not natively encrypt traffic at Layer 3. Encryption is not applied by default; if your security policy mandates encryption for data in transit, you must explicitly deploy an IPsec VPN over the interconnect (or use application-layer encryption). This is why option C is correct: the native interconnect is unencrypted, and IPsec is the standard way to add encryption.

Answer

Yes, Oracle and Microsoft automatically handle TLS 1.3 encryption for all packets.

Answer

Yes, all traffic is encrypted using MACsec by default.

Answer

No, and encryption is strictly prohibited by Oracle security policies.

Question 5

Which TWO of the following statements are correct regarding the OCI-Azure Interconnect? (Choose TWO)

Accepted Answer

It provides low-latency, dedicated private connectivity between OCI Virtual Cloud Networks and Azure Virtual Networks.. Option B is correct because the OCI-Azure Interconnect is a dedicated, private, low-latency interconnection that links OCI Virtual Cloud Networks (VCNs) to Azure Virtual Networks (VNets), avoiding the public internet for cross-cloud traffic. Option E is correct because the service is implemented by cross-connecting OCI FastConnect (Oracle's dedicated private connectivity product) with Azure ExpressRoute (Microsoft's equivalent) in supported multicloud regions such as Ashburn and London. Option A is wrong because the interconnect uses private peering over dedicated circuits, so Azure VMs do not require public IP addresses for cross-cloud routing. Option C is wrong because the interconnect is designed to let customers bypass standard internet egress charges, with Oracle and Microsoft waiving egress fees for traffic traversing the interconnect. Option D is wrong because availability is limited to specific supported multicloud regions, not every OCI region globally.

Answer

It requires public IP addresses on all Azure Virtual Machines for cross-cloud routing.

Answer

It requires the customer to pay standard OCI and Azure egress data transfer fees across the interconnect.

Answer

It is available in every OCI region globally without exception.

Question 6

An architect is designing a hybrid network using OCI FastConnect. Which THREE components are mandatory for setting up a Private Virtual Circuit using a FastConnect Partner? (Choose THREE)

Accepted Answer

Virtual Cloud Network (VCN). Option A (Virtual Cloud Network) is correct because the private virtual circuit must terminate into a VCN, which provides the subnets, route tables, and security rules that the on-premises traffic will reach. Option D (Dynamic Routing Gateway) is correct because the DRG is the OCI-side gateway that attaches to the VCN and serves as the termination point for the FastConnect virtual circuit, enabling route exchange between on-premises and OCI. Option E (FastConnect Virtual Circuit) is correct because the virtual circuit is the actual logical connection provisioned through the FastConnect Partner that carries traffic between the customer edge and the DRG. Option B (OCI Web Application Firewall) is not required for FastConnect connectivity; WAF is an application-layer security service and is unrelated to establishing a private virtual circuit. Option C (Customer-Premises Equipment object) is not mandatory in this partner-based scenario because the FastConnect Partner handles the physical/logical edge connectivity, so a customer-managed CPE object is not needed to create the private virtual circuit.

Answer

OCI Web Application Firewall (WAF)

Answer

Customer-Premises Equipment (CPE) object

Question 7

Which TWO methods can be used to achieve high availability for an OCI Site-to-Site VPN connection to an on-premises datacenter? (Choose TWO)

Accepted Answer

Setting up multiple Customer-Premises Equipment (CPE) objects and redundant VPN connections.. Option B is correct because OCI Site-to-Site VPN high availability is achieved by creating multiple CPE objects on the on-premises side and establishing redundant VPN connections (each with its own IPSec tunnels) to the Dynamic Routing Gateway, so a failure of one CPE or connection does not take down the site-to-site path. Option D is correct because OCI automatically provisions each Site-to-Site VPN connection with redundant IPSec tunnels terminating on separate Oracle VPN headend endpoints within the region, providing built-in tunnel-level redundancy without extra configuration. Option A is incorrect because "Ophalmic routing daemons" is not a real OCI networking feature and running routing daemons on compute instances does not provide VPN high availability. Option C is incorrect because OCI Bastion service provides managed SSH access to private subnets and has nothing to do with VPN redundancy. Option E is incorrect because attaching an Internet Gateway to VPN tunnel endpoints is not a supported HA mechanism; Internet Gateways serve public subnet traffic, not IPSec VPN termination.

Answer

Running Ophalmic routing daemons on OCI compute instances.

Answer

Enabling OCI Bastion service across all VPN subnets.

Answer

Attaching an Internet Gateway directly to the VPN tunnel endpoints.

Question 8

An administrator is troubleshooting intermittent packet loss and latency spikes over an OCI FastConnect circuit connected to an on-premises datacenter. Which THREE diagnostic steps or tools are applicable within OCI? (Choose THREE)

Accepted Answer

Checking OCI Monitoring metrics for the FastConnect virtual circuit to review bandwidth utilization and error drops.. Option A is correct because OCI Monitoring exposes FastConnect virtual circuit metrics such as BitsInRate/BitsOutRate, bandwidth utilization, and error/drop counters that directly reveal congestion or physical-layer problems causing intermittent loss and latency. Option B is correct because Network Path Analyzer performs reachability and path analysis between VCN resources and on-premises IPs, showing the exact hops and any configuration or routing break along the FastConnect/DRG path. Option D is correct because BGP session state and logs on the DRG and customer edge routers expose route flapping, session resets, or prefix withdrawals that produce intermittent packet loss and latency spikes. Option C is wrong because a tenancy's home region is an IAM/identity construct and cannot reroute physical fiber; FastConnect path changes are done via provider cross-connects or redundant virtual circuits. Option E is wrong because IAM is an identity service and rebooting it has no effect on global routing tables, which are handled by VCN route tables, DRG route tables, and BGP.

Answer

Modifying the OCI tenancy tenancy home region to reroute physical fiber cables.

Answer

Rebooting the OCI IAM service to reset global routing tables.

Question 9

Which TWO factors should be evaluated when choosing between an OCI FastConnect Colocation model and a Provider model? (Choose TWO)

Accepted Answer

Whether the customer wants to use an OCI partner (like Equinix or Megaport) to reach OCI from external datacenters.. Option A is correct because the Provider model specifically involves using an OCI partner such as Equinix or Megaport to provision connectivity to OCI from external datacenters, so evaluating whether the customer wants to work through such a partner is a key factor in choosing between the two models. Option C is correct because the Colocation model requires the customer to have existing physical infrastructure, such as a cage or rack, in an Oracle-partner colocation facility where the FastConnect cross-connect can be established, making this a decisive factor. Option B is incorrect because FastConnect is a dedicated private connectivity service and does not route traffic over the public internet for cost savings. Option D is incorrect because Oracle does not require root administrator access to a customer's on-premises firewall for FastConnect. Option E is incorrect because IPv4 versus IPv6 addressing in the VCN is irrelevant to the choice between Colocation and Provider FastConnect models.

Answer

Whether the customer wants to route FastConnect traffic over the public internet for cost savings.

Answer

Whether Oracle requires root administrator access to the customer's on-premises firewall.

Answer

Whether the Virtual Cloud Network uses IPv6 or IPv4 addressing.

Question 10

Which TWO configuration items must match on both the OCI CPE/VPN gateway and the on-premises customer-premises equipment (CPE) router to successfully establish an IPSec VPN tunnel? (Choose TWO)

Accepted Answer

IKE (Internet Key Exchange) phase 1 and phase 2 encryption and authentication algorithms.. Successful IPsec VPN establishment requires matching Phase 1 (IKE) and Phase 2 (IPsec) cryptographic parameters, pre-shared keys (PSK), and proper public IP addressing.

Answer

The OCI console password of the administrator who created the VPN.

Answer

The Oracle Cloud Infrastructure region home datacenter geographic coordinates.

Question 11

An administrator has set up a FastConnect public peering session to access OCI Object Storage from an on-premises data center without traversing the public internet. However, on-premises hosts are still failing to resolve the Object Storage public IP addresses. What must be configured to ensure proper routing and resolution?

Accepted Answer

Configure the on-premises DNS to forward OCI service domain queries to the VCN resolver and advertise the required public IP prefixes over the BGP session.. FastConnect public peering gives private connectivity to OCI public service IPs, but name resolution still requires DNS. On-premises DNS must forward OCI service domain queries (e.g., objectstorage.<region>.oraclecloud.com) to the VCN resolver, and the on-premises routers must advertise the OCI public IP prefixes over BGP so return traffic uses the FastConnect circuit rather than the internet. This combination ensures both resolution and routing work without traversing the public internet.

Answer

Create a local peering gateway on the VCN and peer it with the FastConnect virtual circuit.

Answer

Deploy an OCI DRG and configure static routes pointing to the Object Storage service endpoints.

Answer

Attach a NAT Gateway to the VCN and configure default routes pointing traffic to the FastConnect circuit.

Question 12

You need to connect multiple on-premises branch offices to a single OCI VCN using OCI Site-to-Site VPN. Each branch office uses overlapping private IP address ranges (e.g., 192.168.1.0/24). Which OCI component must you utilize to manage overlapping IP spaces and route traffic correctly?

Accepted Answer

Configure multiple DRG route tables and assign each branch office VPN attachment to a distinct DRG route table with custom import/export rules.. When multiple branch offices use overlapping private IP ranges, a single DRG cannot distinguish routes by prefix alone. OCI allows you to create multiple DRG route tables and assign each VPN attachment to a distinct route table, then use import/export rules to control which routes are learned and advertised per attachment. This provides the isolation needed to route traffic correctly despite overlapping CIDRs.

Answer

Attach an Internet Gateway to each VPN connection to translate overlapping subnets.

Answer

Deploy separate OCI Dynamic Routing Gateways (DRGs) for each branch office and use Local Peering Gateways.

Answer

Enable OCI Service Gateway to automatically perform NAT on overlapping customer networks.

Question 13

An architect is designing a high-availability hybrid cloud strategy utilizing OCI FastConnect and OCI Site-to-Site VPN to the same VCN. To ensure automatic failover from FastConnect to VPN without routing loops, what design pattern must be implemented on the OCI Dynamic Routing Gateway (DRG)?

Accepted Answer

Utilize separate DRG route tables for FastConnect and VPN attachments, ensuring VPN route rules have a more specific prefix or backup preference configured via static overrides if BGP fails.. To achieve deterministic FastConnect-primary/VPN-backup failover without loops, the DRG must use separate route tables per attachment so that the VPN routes are only installed as backup (via static route overrides or less-preferred BGP attributes). This prevents the DRG from ECMP-load-balancing or looping traffic between the two paths when BGP on FastConnect withdraws.

Answer

Enable Equal-Cost Multi-Path (ECMP) routing on the DRG to split packets evenly across FastConnect and VPN.

Answer

Configure identical metric values for both FastConnect and VPN routes within a single DRG route table to load-balance traffic.

Answer

Attach both the FastConnect virtual circuit and the VPN tunnel to the default VCN route table directly, bypassing the DRG.

Question 14

Which TWO of the following are valid deployment models or connection types supported by OCI FastConnect?

Accepted Answer

FastConnect direct model. Option A (FastConnect direct model) is correct because OCI FastConnect supports a direct private physical connection between the customer's on-premises network and Oracle Cloud Infrastructure, provisioned through a colocation facility where Oracle has a presence. Option C (FastConnect partner model) is correct because FastConnect can also be established through an Oracle-approved FastConnect partner/provider, which delivers the private connectivity on the customer's behalf. The unmarked options do not belong: FastConnect is a dedicated private interconnect, not a public internet gateway model (B), not an IPsec tunnel overlay (D, which describes VPN Connect), and not a satellite uplink service (E).

Answer

FastConnect public internet gateway model

Answer

FastConnect IPsec tunnel overlay model

Answer

FastConnect satellite uplink model

Question 15

You are troubleshooting a cross-cloud connectivity issue between an OCI VCN and an Azure VNet via the OCI-Azure Interconnect. Traffic is dropping intermittently between the environments. Which THREE diagnostic steps or configuration checks should you perform?

Accepted Answer

Inspect OCI VCN route tables and Azure route tables to ensure return paths are correctly specified.. Option A is correct because asymmetric or missing return routes are a leading cause of intermittent drops in cross-cloud traffic; you must verify that OCI VCN route tables point the Azure CIDR to the DRG and that Azure route tables (UDRs) point the OCI CIDR back to the Virtual Network Gateway. Option D is correct because the OCI-Azure Interconnect relies on BGP peering between the OCI DRG and the Azure VPN/Virtual Network Gateway; if the BGP session is not in the Established state, routes will be withdrawn and traffic will drop intermittently. Option E is correct because overly restrictive security rules in OCI Network Security Groups or Azure Network Security Groups can silently block or intermittently drop packets, so both must be audited for the required ports and CIDRs. Option B is incorrect because an Internet Gateway routes traffic to the public internet and is not used for private interconnect traffic. Option C is incorrect because a Local Peering Gateway only connects VCNs within the same OCI region and cannot bridge to Azure.

Answer

Attach an Internet Gateway to the Azure VNet to route private interconnect packets.

Answer

Configure an OCI Local Peering Gateway to bridge the Azure and OCI subnets.

Question 16

A financial services company runs a latency-sensitive trading application in OCI and an analytics workload in Azure. They need private, low-latency connectivity between the two clouds and want to use the existing OCI FastConnect circuit as the underlying transport. Which OCI capability should the architect use to extend the private connectivity to Azure?

Accepted Answer

OCI-Azure Interconnect via FastConnect. OCI-Azure Interconnect is the Oracle-supported solution that leverages FastConnect to provide private, low-latency connectivity to Azure ExpressRoute. It avoids the public internet, uses dedicated edge connectivity, and is designed for multicloud architectures requiring predictable performance. The other options either use the public internet or are not OCI-supported mechanisms for connecting to Azure.

Answer

IPSec VPN over the public internet between OCI and Azure

Answer

Azure ExpressRoute Global Reach with OCI FastConnect

Answer

OCI Remote Peering Connection between OCI and Azure VNets

Question 17

A company is deploying a hybrid architecture where an OCI VCN connects to an on-premises data center using a Site-to-Site VPN. The on-premises security team requires that all traffic between specific on-premises subnets and OCI subnets be encrypted and that the OCI side initiates the connection. Which OCI VPN configuration should the architect use?

Accepted Answer

Site-to-Site VPN with static routing and OCI as the initiator. OCI Site-to-Site VPN can be configured with static routing and OCI as the initiator. This ensures the tunnel is established from the OCI side, meeting the security team's requirement. Static routing is appropriate when dynamic routing is not needed or supported. The other options either have the wrong initiator or use dynamic routing unnecessarily.

Answer

Site-to-Site VPN with BGP dynamic routing and the on-premises CPE as the initiator

Answer

Site-to-Site VPN with static routing and the on-premises CPE as the initiator

Answer

Site-to-Site VPN with BGP dynamic routing and OCI as the initiator

Question 18

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit. To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 19

An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?

Accepted Answer

Re-address one of the virtual networks to ensure non-overlapping IP address spaces.. OCI-Azure Interconnect (via FastConnect and ExpressRoute) requires that the OCI VCN CIDR and Azure VNet CIDR do not overlap, because routing between the two environments relies on standard IP routing tables that cannot distinguish between identical prefixes. When both sides use 10.0.0.0/16, the DRG and Azure route tables would have ambiguous next-hop decisions, causing traffic to be dropped or misrouted. Re-addressing one of the virtual networks to a unique, non-overlapping CIDR is the only way to ensure deterministic routing across the interconnect.

Answer

Deploy an OCI NAT Gateway inside the VCN.

Answer

Configure a Dynamic Routing Gateway route table with static overriding rules.

Answer

Enable FastConnect MACsec encryption.

Question 20

Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?

Accepted Answer

OCI Site-to-Site VPN. OCI Site-to-Site VPN is the managed service that creates an IPSec VPN connection between an on-premises customer-premises equipment (CPE) device and a Dynamic Routing Gateway attached to a VCN. It supports IKEv1 and IKEv2 with AES encryption and SHA-2 hashing, providing encrypted tunnels over the public internet. This is the native OCI service for encrypted site-to-site connectivity.

Answer

OCI Storage Gateway

Answer

OCI API Gateway

Answer

OCI Bastion Service