1Z0-1072-26 Networking — 30 Questions

Question 1

Which OCI networking component is automatically created when you provision a Virtual Cloud Network using the VCN Wizard with 'Internet Connectivity'?

Accepted Answer

Internet Gateway. The VCN Wizard's 'Internet Connectivity' option automatically creates an Internet Gateway (IGW) and attaches it to the VCN, enabling outbound internet access for resources in public subnets. The IGW is a highly available, horizontally scaled, redundant component that provides NAT for instances with public IPs. It is the only component among the options that is directly associated with basic internet connectivity in a VCN.

Answer

Dynamic Routing Gateway

Answer

Local Peering Gateway

Answer

FastConnect Virtual Circuit

Question 2

You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?

Accepted Answer

Enable 'Preserve Client IP' in the backend set configuration.. To ensure that backend web servers see the original client IP address rather than the load balancer's IP, you must enable the 'Preserve client IP' option in the OCI Load Balancer backend set configuration. By default, the load balancer acts as a reverse proxy and masks the source IP.

Answer

Attach a NAT Gateway to the Load Balancer subnet.

Answer

Switch the load balancer shape to asymmetric routing mode.

Answer

Configure an Internet Gateway route on the backend servers.

Question 3

You are managing an OCI VCN with CIDR block 10.0.0.0/16. You want to create a subnet that can hold up to 500 usable IP addresses. Which subnet CIDR block should you choose?

Accepted Answer

10.0.0.0/23. A /23 CIDR block provides 512 total IP addresses. In OCI, 2 IP addresses are reserved by Oracle (network address and broadcast-equivalent), and 3 are reserved for internal DHCP/router operations, leaving 507 usable IP addresses, which satisfies the requirement for 500.

Answer

10.0.0.0/22

Answer

10.0.1.0/24

Answer

10.0.0.0/25

Question 4

An OCI architect needs to configure route tables for a VCN where traffic destined for 10.0.1.50/32 must be sent to a specific firewall virtual appliance VNIC (`ip-10-0-1-10`), while all other traffic goes to an Internet Gateway. How should the route table be configured?

Accepted Answer

Add a route rule with destination 10.0.1.50/32 and target as the private IP of the firewall appliance VNIC, and a rule with 0.0.0.0/0 pointing to the Internet Gateway.. OCI route tables support both specific CIDR destinations (including /32 host routes) and a default route. To send traffic for 10.0.1.50/32 to the firewall appliance while sending everything else to the Internet Gateway, you add a route rule with destination 10.0.1.50/32 targeting the firewall VNIC's private IP, plus a 0.0.0.0/0 rule targeting the Internet Gateway. OCI uses longest-prefix match, so the /32 wins for that specific host.

Answer

OCI route tables only support 0.0.0.0/0 and cannot target individual IP addresses.

Answer

Use a Service Gateway to route specific IP addresses.

Answer

Set the Internet Gateway as the target for 10.0.1.50/32 and the firewall appliance as the target for 0.0.0.0/0.

Question 5

An OCI Load Balancer has been configured with SSL termination. The backend servers require incoming traffic to also be encrypted using HTTPS. Which backend set protocol should you choose?

Accepted Answer

SSL (or HTTP with SSL enabled). If backend servers require encryption, you should configure the backend set to use SSL (HTTPS or TCP with SSL) so the load balancer encrypts traffic before forwarding it to the backend instances.

Answer

HTTP (unencrypted)

Answer

DNS

Answer

ICMP

Question 6

Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?

Accepted Answer

Failover routing. OCI Traffic Management Steering Policies support Failover routing (B), which directs traffic to a primary endpoint and automatically diverts to a standby endpoint when health checks detect the primary is unavailable. ASN-based routing (C) is also supported, allowing traffic to be steered based on the Autonomous System Number of the requesting client's network, useful for ISP- or network-specific routing decisions. Geolocation-based routing (E) is supported as well, routing DNS answers according to the geographic location of the querying client, such as by continent, country, or region. The remaining options do not belong: OCI Compartment quota limits (A) are an administrative governance constraint, not a DNS traffic-routing criterion, and SQL query performance metrics (D) are database workload measurements unrelated to Traffic Management steering.

Answer

OCI Compartment quota limits

Answer

SQL query performance metrics

Question 7

What is the smallest IPv4 CIDR block size supported for an OCI Virtual Cloud Network (VCN)?

Accepted Answer

/30. The smallest VCN CIDR block supported by OCI is /30, and the largest is /16.

Answer

/24

Answer

/32

Answer

/8

Question 8

Which THREE statements are correct regarding OCI BYOIP (Bring Your Own IP)?

Accepted Answer

You can create public IP pools from your imported BYOIP address ranges.. OCI BYOIP allows you to bring your own public IPv4 addresses to OCI, prefix lengths from /24 to /28 are typically supported for import, and you can create public IP pools from your prefix.

Answer

BYOIP prefixes can be assigned directly to private subnet VNICs without public IPs.

Answer

BYOIP is only supported for private IP addresses within an on-premises datacenter.

Answer

OCI automatically transfers ownership of the IP block to Oracle permanently.

Question 9

You are setting up DNS steering in OCI Traffic Management using a Response Pool. An endpoint in the pool fails its health check. How does OCI Traffic Management respond to DNS queries?

Accepted Answer

It automatically removes the unhealthy endpoint from DNS responses and routes traffic to healthy endpoints.. OCI Traffic Management does not 'remove' the endpoint from the pool configuration; rather, the Health Check service updates the status of the endpoint, and the Traffic Management steering policy dynamically excludes the unhealthy endpoint from the DNS response set until it passes health checks again.

Answer

It returns a 504 Gateway Timeout error to the DNS client.

Answer

It shuts down the VCN associated with the endpoint.

Answer

It continues to send traffic to the failed endpoint until manual intervention occurs.

Question 10

Which THREE statements regarding OCI FastConnect redundancy and high availability are correct?

Accepted Answer

You can configure multiple BGP sessions across redundant virtual circuits.. FastConnect supports redundant connections, redundant physical cross-connects or partner ports, and dual BGP sessions to ensure high availability.

Answer

FastConnect does not support BGP dynamic routing when redundancy is enabled.

Answer

FastConnect redundant circuits must share the exact same physical cross-connect port.

Answer

FastConnect automatically provides 100% SLA without requiring redundant circuits on customer end.

Question 11

An OCI customer has configured an IPSec VPN connection with static routing. They add a new subnet with CIDR 10.0.5.0/24 to their VCN, but on-premises hosts cannot communicate with instances in this new subnet. What must be updated in the IPSec VPN configuration?

Accepted Answer

Add the new VCN subnet CIDR (10.0.5.0/24) to the static routes in the OCI IPSec Connection configuration.. When using static routing for an OCI Site-to-Site VPN, you must define the static route rules (on-premises networks and VCN static routes) in the OCI IPSec connection configuration so Oracle knows which traffic to tunnel.

Answer

Recreate the Customer-Premises Equipment (CPE) object.

Answer

Switch the VPN from static routing to a NAT Gateway.

Answer

Update the VCN Internet Gateway routing table.

Question 12

Your organization has two Virtual Cloud Networks (VCN-A and VCN-B) in the same OCI region with overlapping CIDR blocks (10.0.0.0/16). You need to establish private communication between instances in VCN-A and VCN-B. Which networking feature should you implement?

Accepted Answer

Remote Peering Connection (RPC). Oracle Cloud Infrastructure (OCI) does not support direct peering or routing between VCNs with overlapping CIDR blocks. Standard features like Local Peering Gateways (LPGs) and Remote Peering Connections (RPCs) explicitly require non-overlapping CIDRs. To handle overlapping CIDRs, you must redesign the network architecture (re-IP the VCNs) as OCI does not provide native overlapping CIDR encapsulation within DRGs for VCN-to-VCN traffic.

Question 13

Your company requires a dedicated, highly reliable, encrypted connection from your on-premises datacenter to your OCI Virtual Cloud Network, bypassing the public internet entirely. The link must support speeds up to 10 Gbps and provide failover redundancy. Which OCI service meets this requirement?

Accepted Answer

FastConnect with MACsec or layered IPsec VPN. FastConnect provides a dedicated, private connection between your datacenter and OCI. For encryption across FastConnect, you can layer an IPsec VPN over the FastConnect circuit.

Answer

Oracle Cloud Infrastructure Public Load Balancer with SSL termination

Answer

Site-to-Site VPN over Public Internet

Answer

Remote Peering Connection (RPC)

Question 14

Which TWO of the following are valid characteristics of OCI Virtual Cloud Networks (VCNs)?

Accepted Answer

A VCN is a regional resource that spans all Availability Domains in that region.. VCNs span all availability domains within a region and reside within a single OCI region.

Answer

A VCN can span multiple OCI geographic regions simultaneously.

Answer

The maximum size of a VCN CIDR block is /8.

Answer

A VCN is restricted to a single Availability Domain by default.

Question 15

Your organization uses OCI DNS Zones for managing domain names. You need to configure a private DNS zone for your internal applications within a specific VCN so that instances can resolve hostnames internally without exposing records externally. Which feature should you configure?

Accepted Answer

Private DNS Zone with attached VCN resolver views. To resolve hostnames internally within a specific VCN using OCI DNS without exposing records externally, you need to create a Private DNS Zone and attach (associate) it with the VCN. The option references 'attached VCN resolver views', whereas the correct OCI feature terminology is simply associating the Private DNS Zone with the VCN.

Answer

Dynamic Routing Gateway DNS proxy

Answer

Internet Gateway DNS forwarding rules

Answer

Public DNS Zone with restricted Access Control Lists

Question 16

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

Answer

Local Peering Gateway (LPG) access control lists

Answer

Security Lists associated with the database subnet

Answer

Dynamic Routing Gateway (DRG) security policies

Question 17

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

Accepted Answer

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.. BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Answer

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Answer

The Security List on the DRG attachment blocks ICMP traffic.

Answer

The public subnet has an incorrect Internet Gateway route.

Question 18

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

Accepted Answer

Dynamic Routing Gateway (DRG). The Dynamic Routing Gateway (DRG) is OCI's virtual router that acts as the single transit hub between on-premises networks and multiple VCNs, including VCNs in different regions. A single FastConnect or IPSec connection terminates on the DRG, and the DRG can be attached to many VCNs across regions, enabling transitive routing. This is exactly the central transit hub role described in the question.

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway

Question 19

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

Accepted Answer

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG. OCI's VCN Resolver supports custom DNS forwarders that send queries for specific domains to on-premises DNS servers reachable through the DRG (over FastConnect or Site-to-Site VPN). This is the correct mechanism for hybrid DNS resolution where VCN instances need to resolve on-premises hostnames.

Answer

A NAT Gateway configured with DNS proxy settings

Answer

A public DNS zone for your on-premises domain

Answer

An Internet Gateway with custom host file mappings

Question 20

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

Accepted Answer

Service Gateway. A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Answer

NAT Gateway