1Z0-997-26 Multicloud And Hybrid Practice Test 3 — 15 Questions

Question 1

An administrator needs to configure DNS resolution between an on-premises datacenter and OCI. On-premises servers must resolve hostnames of compute instances in an OCI VCN. Which OCI service component must be utilized to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OCI Private DNS Resolver with a Listener and forwarding rules. OCI Private DNS Resolver provides a Listener endpoint in the VCN that on-premises DNS servers can forward queries to, and forwarding rules direct specific domains to on-premises resolvers. This enables bidirectional DNS resolution between on-premises and OCI VCN hostnames. It is the only OCI-native component designed for hybrid DNS.

Answer

OCI Internet Gateway DNS proxy

Answer

OCI Email Delivery DNS records

Answer

OCI Load Balancer DNS plugin

Question 2

What is the primary function of an OCI Service Gateway?

Accepted Answer

To provide private access to Oracle public services without using public IP addresses or the internet. An OCI Service Gateway provides a private, secure path for resources in a VCN to access Oracle public services (such as Object Storage, Autonomous Database, and OCI Streaming) without traversing the internet or using public IP addresses. Traffic from the VCN to the service goes over the Oracle network fabric, staying private. This is the primary function of a Service Gateway in OCI networking.

Answer

To translate private IP addresses to public IP addresses for internet bound traffic

Answer

To connect on-premises datacenters to OCI via FastConnect

Answer

To load balance HTTP/HTTPS traffic across multiple backend servers

Question 3

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

Accepted Answer

Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.. A 'Tunnel Up' status only confirms that IKE Phase 1 and Phase 2 completed and the IPSec SA is established; it does not guarantee that traffic is permitted or routed. The most common cause of ping failure with an up tunnel is that Security Lists, NSGs, or the instance's OS firewall are dropping ICMP or the relevant traffic.

Answer

The FastConnect virtual circuit is disabled.

Answer

The OCI VCN does not have an Internet Gateway attached.

Answer

The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.

Question 4

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

Accepted Answer

Static Routing mode. OCI Site-to-Site VPN supports two routing modes: Dynamic Routing (BGP) and Static Routing. When the on-premises firewall requires static routing, you must select Static Routing mode and manually specify the on-premises and OCI CIDR prefixes that should be routed over the tunnel.

Answer

Local Peering mode

Answer

Dynamic Routing (BGP) mode

Answer

FastConnect Partner mode

Question 5

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

Accepted Answer

Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.. OCI and GCP do not have a native direct interconnect between them, so private low-latency connectivity requires a Layer 2 fabric provider. FastConnect on the OCI side and Cloud Interconnect on the GCP side both terminate at the same Equinix Fabric or Megaport switch, where a virtual cross-connect joins the two circuits. This keeps traffic off the public internet and gives deterministic latency.

Answer

Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.

Answer

Configure an OCI Internet Gateway to peer with GCP Cloud DNS.

Answer

Attach a GCP VPC as a secondary VCN in the OCI console.

Question 6

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

Accepted Answer

Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.. The essential prerequisite is private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect, with non-overlapping subnets and open firewall ports for control plane communication. A service mesh control plane (e.g., Istio) requires direct network reachability between the control plane components and the sidecar proxies across both clouds. This is achieved through the private interconnect, ensuring secure, low-latency communication without public internet exposure.

Answer

Configure an OCI Service Gateway to route traffic to Azure public endpoints.

Answer

Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.

Answer

Enable Oracle Autonomous Database cross-region data guard.

Question 7

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

Accepted Answer

You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.. In the FastConnect Provider model, you establish connectivity through an Oracle-approved partner (e.g., Equinix Fabric, Megaport, AT&T) that already has a presence in the Oracle Cloud region. You do not need to install or patch your own equipment in an Oracle Meet-Me-Room; the partner handles the Layer 2/3 handoff. This contrasts with the Colocation model, where you must physically deploy your router in a colocation facility connected to Oracle.

Answer

You must physically patch your fiber into Oracle's Meet-Me-Room.

Answer

Traffic is routed exclusively over the public internet with guaranteed SLA.

Answer

Oracle installs a dedicated router inside your on-premises datacenter.

Question 8

Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?

Accepted Answer

Dynamic Routing Gateway (DRG). The Dynamic Routing Gateway (DRG) is the OCI virtual router that serves as the central hub for all private connectivity between VCNs and external networks, including FastConnect and IPSec VPN. It supports route tables, route distribution, and attachments to multiple VCNs and on-premises connections.

Answer

Local Peering Gateway

Answer

NAT Gateway

Answer

Internet Gateway

Question 9

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

Accepted Answer

In the DRG route table import/export distribution or static route configuration for the VPN attachment.. To restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN, you must control route propagation on the OCI side. This is done by configuring the DRG route table associated with the VPN attachment, specifically the import distribution and static route configuration, to filter which routes are accepted from on-premises.

Answer

On the OCI Bastion service configuration page.

Answer

Inside the OCI Identity and Access Management (IAM) policy console.

Answer

By modifying the VCN DHCP options.

Question 10

You are designing an active-active hybrid architecture between an on-premises datacenter and OCI using two separate FastConnect circuits connected to two different DRG attachments. How does OCI determine path selection when receiving identical BGP route advertisements from both circuits?

Accepted Answer

The DRG uses standard BGP best path selection criteria, including AS Path length and Local Preference.. OCI DRG attachments for FastConnect behave like standard BGP peers. When identical prefixes are advertised over two circuits, the DRG runs the standard BGP best-path algorithm — comparing attributes such as Weight, Local Preference, AS Path length, Origin, MED, and finally router ID — to pick a single best path per prefix. Equal-cost multipath (ECMP) can occur only when the relevant attributes tie, otherwise one circuit becomes preferred for that prefix.

Answer

OCI automatically enforces round-robin load balancing regardless of BGP advertisements.

Answer

Active-active routing is not supported; OCI randomly drops packets on duplicate routes.

Answer

OCI always selects the circuit with the lower OCID alphabetically.

Question 11

What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?

Accepted Answer

To uniquely identify routing domains and enable dynamic exchange of network routes between OCI and on-premises routers.. BGP ASNs are used to uniquely identify routing domains and enable the dynamic exchange of network routes between OCI and on-premises routers. When establishing FastConnect, each side is assigned an ASN, and BGP peering uses these ASNs to exchange reachability information, allowing automatic route propagation.

Answer

To authenticate OCI console users via single sign-on.

Answer

To encrypt all payloads traversing the FastConnect physical fiber.

Answer

To assign public IP addresses to OCI compute instances.

Question 12

An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)

Accepted Answer

MACsec encryption on FastConnect dedicated circuits. Option A is correct because MACsec (IEEE 802.1AE) can be enabled on OCI FastConnect dedicated circuits, providing Layer 2 point-to-point encryption of traffic between the on-premises edge and the OCI edge without requiring IPsec. Option B is correct because OCI Site-to-Site IPSec VPN uses IKE/IPsec to encrypt traffic over the public internet (or over FastConnect private virtual circuits), securing data in transit between the on-premises CPE and the OCI VPN headend. Option C is correct because application-level encryption such as TLS 1.3 or HTTPS encrypts the payload end-to-end at Layer 7, protecting data in transit regardless of the underlying transport path. Option D is not correct because an Internet Gateway simply provides public connectivity and does not perform packet inspection or encryption; security inspection would require a firewall or NGFW, not the gateway itself. Option E is not correct because Local Peering Gateways connect VCNs within the same region and do not provide encryption by default, nor do they secure on-premises-to-OCI transit.

Answer

OCI Internet Gateway packet inspection

Answer

OCI Local Peering Gateways with default encryption

Question 13

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Accepted Answer

Using route distributions to control which routes are imported into or exported from a DRG route table.. Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering. Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Answer

Automatically peering AWS VPC route tables directly from the DRG console.

Answer

Enabling Ophaned route garbage collection on Internet Gateways.

Answer

Converting OCI VCN subnets into Azure Subnets via DRG translation rules.

Question 14

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Accepted Answer

Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.. Option A is correct because cross-cloud DR commonly relies on database-level replication such as Oracle Data Guard, which can ship redo from an OCI Autonomous Database to a standby database running in AWS, giving a low-RPO failover target for the data tier. Option B is correct because OCI Traffic Management Steering policies (health-check-based failover, weighted, or geolocation steering) can direct DNS resolution to OCI or AWS endpoints and automatically shift traffic when health checks fail, which is a standard cross-cloud traffic-failover mechanism. Option E is correct because private cross-cloud connectivity for DR is typically built with redundant IPsec VPN tunnels between an OCI Dynamic Routing Gateway (DRG) and an AWS Virtual Private Gateway (VGW), providing encrypted, resilient transport that survives a single tunnel failure. Option C is not valid because AWS VPCs are logical software-defined networks; there are no physical VPC switches to place in OCI Meet-Me-Rooms, and Meet-Me-Rooms are for physical network/carrier interconnects, not VPC hardware. Option D is not valid because OCI IAM identity domains cannot be natively replicated into AWS IAM; cross-cloud identity is achieved through federation (SAML/OIDC) or identity brokering, not native replication between the two proprietary IAM systems.

Answer

Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.

Answer

Replicating OCI IAM identity domains natively inside AWS IAM without federation.

Question 15

An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?

Accepted Answer

OCI FastConnect. OCI FastConnect provides a dedicated, private physical connection between an on-premises data center and OCI, bypassing the public internet entirely. It offers high bandwidth (1 Gbps to 100 Gbps per connection), predictable low latency, and is the recommended service when the requirement is a private, high-performance link rather than an encrypted tunnel over the internet.

Answer

OCI Site-to-Site VPN

Answer

OCI Internet Gateway

Answer

Oracle Database Gateway