1Z0-1072-26 Practice Test 27 — 15 Questions

Question 1

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

Answer

Local Peering Gateway (LPG) access control lists

Answer

Security Lists associated with the database subnet

Answer

Dynamic Routing Gateway (DRG) security policies

Question 2

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Accepted Answer

An NSG can contain VNICs from multiple different subnets within the same VCN.. NSGs apply only to a specified set of VNICs and are independent of VCN subnets. They support both stateful and stateless rules.

Answer

Every subnet must have at least one NSG associated with it by default.

Answer

NSGs can span across multiple different VCNs in the same region.

Answer

NSGs replace Security Lists entirely and Security Lists are deprecated.

Question 3

Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?

Accepted Answer

OCI FastConnect. OCI offers FastConnect for dedicated private connections and Site-to-Site VPN for encrypted IPSec connections over the public internet.

Answer

Internet Gateway

Answer

Service Gateway

Answer

Local Peering Gateway

Question 4

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Accepted Answer

In the IPSec Connection details page under the DRG. When you create an IPSec connection under the DRG details, OCI automatically provisions two redundant VPN tunnels, displaying their respective public IP addresses in the IPSec Connection details page.

Answer

In the NAT Gateway configuration settings

Answer

In the FastConnect Virtual Circuit overview

Answer

In the VCN Details page under Internet Gateway

Question 5

What is the default retention period for audit logs in OCI?

Accepted Answer

365 days. Audit logs are retained for 365 days by default.

Answer

90 days

Answer

Unlimited

Answer

30 days

Question 6

What is the smallest IPv4 CIDR block size supported for an OCI Virtual Cloud Network (VCN)?

Accepted Answer

/30. The smallest VCN CIDR block supported by OCI is /30, and the largest is /16.

Answer

/24

Answer

/32

Answer

/8

Question 7

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

Accepted Answer

To provide a customizable, isolated virtual network in OCI for your cloud resources.. A VCN is a customizable, private software-defined network that you set up in OCI, resembling a traditional physical network.

Answer

To store backup files and unstructured object data.

Answer

To host public DNS domain names on the internet.

Answer

To execute serverless container functions.

Question 8

Which TWO actions can you perform on an OCI Virtual Cloud Network (VCN) after it has been created?

Accepted Answer

Create new subnets within the VCN. After creating a VCN, you can add new subnet CIDRs, add/remove gateways, modify route tables, and update security lists. However, you cannot change the primary VCN CIDR block once created.

Answer

Rename the underlying VCN OCID

Answer

Modify the primary CIDR block of the VCN

Answer

Convert a regional subnet into an Availability Domain-specific subnet

Question 9

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 10

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

Accepted Answer

Service Gateway. A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Answer

NAT Gateway

Question 11

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Accepted Answer

Add a route in the private subnet route table with a destination of 0.0.0.0/0 and the target as the NAT Gateway.. A NAT Gateway allows instances in a private subnet to initiate connections to the internet, but prevents inbound connections from the internet. The route table associated with the private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Answer

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Answer

Configure a Service Gateway with a route to 0.0.0.0/0.

Answer

Assign a public IP address to the instances within the private subnet.

Question 12

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Accepted Answer

Public subnets have route table rules pointing to an Internet Gateway, while private subnets do not.. Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.

Answer

Private subnets require IPv6 addressing.

Answer

Private subnets cannot use Security Lists.

Answer

Public subnets cannot communicate with Oracle Database services.

Question 13

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

Accepted Answer

Security Lists. Security Lists (at the subnet level) and Network Security Groups (at the VNIC level) are the two primary virtual firewall features used in OCI to control ingress and egress traffic.

Answer

Service Gateway

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Question 14

You are configuring a Public Load Balancer in OCI. You want to ensure that incoming traffic is encrypted using TLS 1.3. Where do you configure the SSL certificate and TLS protocol version?

Accepted Answer

On the Load Balancer Listener configuration. SSL certificates and TLS protocol preferences are configured on the Load Balancer Listener settings.

Answer

In the VCN route table settings

Answer

On the NAT Gateway configuration page

Answer

In the backend set health check policy

Question 15

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

Accepted Answer

Add a route rule with destination service cidr (e.g. All Services in Oracle Services Network) and target as the Service Gateway.. To direct traffic to the Service Gateway, the subnet route table must have a route rule where the destination is the Oracle Services Network (or a specific service region prefix) and the target is the Service Gateway.

Answer

No route table changes are required once the Service Gateway is attached to the VCN.

Answer

Add a route rule pointing to the Dynamic Routing Gateway.

Answer

Add a route rule with destination 0.0.0.0/0 and target as the Service Gateway.