1Z0-997-26 Multicloud And Hybrid Practice Test 2 — 15 Questions

Question 1

A financial services company runs a latency-sensitive trading application in OCI and an analytics workload in Azure. They need private, low-latency connectivity between the two clouds and want to use the existing OCI FastConnect circuit as the underlying transport. Which OCI capability should the architect use to extend the private connectivity to Azure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI-Azure Interconnect via FastConnect. OCI-Azure Interconnect is the Oracle-supported solution that leverages FastConnect to provide private, low-latency connectivity to Azure ExpressRoute. It avoids the public internet, uses dedicated edge connectivity, and is designed for multicloud architectures requiring predictable performance. The other options either use the public internet or are not OCI-supported mechanisms for connecting to Azure.

Answer

IPSec VPN over the public internet between OCI and Azure

Answer

Azure ExpressRoute Global Reach with OCI FastConnect

Answer

OCI Remote Peering Connection between OCI and Azure VNets

Question 2

A company is deploying a hybrid architecture where an OCI VCN connects to an on-premises data center using a Site-to-Site VPN. The on-premises security team requires that all traffic between specific on-premises subnets and OCI subnets be encrypted and that the OCI side initiates the connection. Which OCI VPN configuration should the architect use?

Accepted Answer

Site-to-Site VPN with static routing and OCI as the initiator. OCI Site-to-Site VPN can be configured with static routing and OCI as the initiator. This ensures the tunnel is established from the OCI side, meeting the security team's requirement. Static routing is appropriate when dynamic routing is not needed or supported. The other options either have the wrong initiator or use dynamic routing unnecessarily.

Answer

Site-to-Site VPN with BGP dynamic routing and the on-premises CPE as the initiator

Answer

Site-to-Site VPN with static routing and the on-premises CPE as the initiator

Answer

Site-to-Site VPN with BGP dynamic routing and OCI as the initiator

Question 3

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

Accepted Answer

Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit. To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 4

An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?

Accepted Answer

Re-address one of the virtual networks to ensure non-overlapping IP address spaces.. OCI-Azure Interconnect (via FastConnect and ExpressRoute) requires that the OCI VCN CIDR and Azure VNet CIDR do not overlap, because routing between the two environments relies on standard IP routing tables that cannot distinguish between identical prefixes. When both sides use 10.0.0.0/16, the DRG and Azure route tables would have ambiguous next-hop decisions, causing traffic to be dropped or misrouted. Re-addressing one of the virtual networks to a unique, non-overlapping CIDR is the only way to ensure deterministic routing across the interconnect.

Answer

Deploy an OCI NAT Gateway inside the VCN.

Answer

Configure a Dynamic Routing Gateway route table with static overriding rules.

Answer

Enable FastConnect MACsec encryption.

Question 5

Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?

Accepted Answer

OCI Site-to-Site VPN. OCI Site-to-Site VPN is the managed service that creates an IPSec VPN connection between an on-premises customer-premises equipment (CPE) device and a Dynamic Routing Gateway attached to a VCN. It supports IKEv1 and IKEv2 with AES encryption and SHA-2 hashing, providing encrypted tunnels over the public internet. This is the native OCI service for encrypted site-to-site connectivity.

Answer

OCI Storage Gateway

Answer

OCI API Gateway

Answer

OCI Bastion Service

Question 6

You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?

Accepted Answer

2 tunnels. OCI Site-to-Site VPN automatically provisions two tunnels per VPN connection by default, each terminating on a separate VPN headend in a different availability domain. This redundancy is built in so that if one tunnel or headend fails, traffic can fail over to the other. The two-tunnel design is a core HA characteristic of the OCI IPSec VPN service.

Answer

8 tunnels

Answer

4 tunnels

Answer

1 tunnel

Question 7

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

Accepted Answer

Azure ExpressRoute Gateway. The Azure ExpressRoute Gateway is the specific Azure-side resource that terminates the ExpressRoute circuit and connects it to the Azure Virtual Network. During OCI-Azure Interconnect onboarding, the ExpressRoute circuit is created and then associated with an ExpressRoute Gateway in the designated Azure subscription and VNet. This gateway provides the private connectivity endpoint for traffic coming from OCI via the ExpressRoute peering.

Answer

Azure Application Gateway

Answer

Azure Virtual Network NAT

Answer

Azure Traffic Manager

Question 8

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

Accepted Answer

Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.. When latency across an OCI-Azure Interconnect exceeds thresholds, the first diagnostic step within OCI is to verify MTU settings end to end — OCI VCN, DRG, Azure VNet, and the ExpressRoute gateway. MTU mismatches cause fragmentation or dropped large packets, which manifest as high latency and retransmissions rather than outright connectivity loss. Checking MTU is a low-cost, high-value first step before touching circuits or subscriptions.

Answer

Enable OCI Database Vault on the compute instances.

Answer

Replace the OCI Dynamic Routing Gateway with an Internet Gateway.

Answer

Recreate the Azure ExpressRoute circuit in a different Azure subscription.

Question 9

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

Accepted Answer

DRG attachments and DRG Route Tables. A Dynamic Routing Gateway (DRG) with attachments for each VCN and the on-premises FastConnect virtual circuit, combined with DRG Route Tables, enables centralized routing across multiple VCNs in different regions and the on-premises network. DRG Route Tables let you control which routes are imported and distributed per attachment.

Answer

Local Peering Gateway chaining

Answer

Internet Gateway route forwarding

Answer

Service Gateway cross-region peering

Question 10

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

Accepted Answer

Customer-Premises Equipment (CPE). The Customer-Premises Equipment (CPE) object represents the on-premises VPN device in OCI. Before creating an IPSec connection, you must create a CPE object that specifies the public IP address of the on-premises device. This allows OCI to establish the IPSec tunnels to that endpoint.

Answer

NAT Gateway

Answer

Service Gateway

Answer

Virtual Cloud Network (VCN)

Question 11

Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?

Accepted Answer

Add a route in the DRG route table pointing the Azure VNet CIDR to the FastConnect virtual circuit attachment.. In an OCI-Azure Interconnect architecture, the OCI DRG is attached to the FastConnect virtual circuit that connects to Azure ExpressRoute (via the interconnect partner). To route traffic from the OCI VCN to the Azure VNet, you must add a route in the DRG route table that points the Azure VNet CIDR to the FastConnect virtual circuit attachment. This ensures that packets destined for Azure private IPs are forwarded over the private interconnect rather than to an internet or local peering path.

Answer

Configure a local peering route to the Azure ExpressRoute circuit.

Answer

Add a route pointing the Azure VNet CIDR to the Internet Gateway.

Answer

Attach an Azure VNet directly as a subnet inside the OCI VCN.

Question 12

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

Accepted Answer

Higher bandwidth, lower latency, and predictable performance. FastConnect is a dedicated private physical connection between on-premises and OCI, bypassing the public internet. This yields higher, more consistent bandwidth, lower and more predictable latency, and reduced jitter compared to an IPSec VPN, which traverses the public internet and is subject to variable paths and congestion. That predictability is the primary reason enterprises choose FastConnect for latency-sensitive or high-throughput workloads.

Answer

Ability to route traffic over public cellular networks

Answer

Zero configuration required on the on-premises router

Answer

Automatic encryption of all traffic at Layer 2 by default

Question 13

You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?

Accepted Answer

Traffic cannot be routed between the on-premises network and OCI over FastConnect.. BGP is the routing protocol that exchanges prefixes between the on-premises customer edge router and the OCI Dynamic Routing Gateway over a FastConnect virtual circuit. If the BGP session goes down, no routes are learned or advertised, so the DRG has no path to the on-premises network and traffic cannot be routed over FastConnect. The physical circuit may remain up, but without BGP the Layer 3 reachability is gone.

Answer

Traffic automatically fails over to the Internet Gateway.

Answer

OCI automatically falls back to an unencrypted IPSec VPN tunnel.

Answer

The FastConnect port is administratively disabled by Oracle.

Question 14

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

Accepted Answer

BGP (Border Gateway Protocol). Both OCI FastConnect and Site-to-Site VPN use BGP to dynamically exchange routes between the on-premises customer edge router and the OCI Dynamic Routing Gateway. BGP is the standard exterior gateway protocol for hybrid cloud routing and supports dynamic failover and prefix advertisement.

Answer

RIP (Routing Information Protocol)

Answer

EIGRP (Enhanced Interior Gateway Routing Protocol)

Answer

OSPF (Open Shortest Path First)

Question 15

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

Accepted Answer

Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.. To achieve high availability across availability domains, the SD-WAN instances in OCI should be deployed in different Availability Domains (or Fault Domains) within the region and configured with BGP or clustering for failover. This ensures that a single AD or fault domain failure does not take down the SD-WAN overlay connecting OCI to AWS. BGP provides dynamic route failover between the instances.

Answer

In the same subnet, pinned to a single physical host.

Answer

Inside the OCI Control Plane root compartment.

Answer

On bare metal instances without any virtual cloud networks.