1Z0-1072-26 Networking — 40 Questions

Question 1

Which THREE statements are correct regarding OCI BYOIP (Bring Your Own IP)?

Accepted Answer

You can create public IP pools from your imported BYOIP address ranges.. OCI BYOIP allows you to bring your own public IPv4 addresses to OCI, prefix lengths from /24 to /28 are typically supported for import, and you can create public IP pools from your prefix.

Answer

BYOIP prefixes can be assigned directly to private subnet VNICs without public IPs.

Answer

BYOIP is only supported for private IP addresses within an on-premises datacenter.

Answer

OCI automatically transfers ownership of the IP block to Oracle permanently.

Question 2

Which THREE statements regarding OCI FastConnect redundancy and high availability are correct?

Accepted Answer

You can configure multiple BGP sessions across redundant virtual circuits.. FastConnect supports redundant connections, redundant physical cross-connects or partner ports, and dual BGP sessions to ensure high availability.

Answer

FastConnect does not support BGP dynamic routing when redundancy is enabled.

Answer

FastConnect redundant circuits must share the exact same physical cross-connect port.

Answer

FastConnect automatically provides 100% SLA without requiring redundant circuits on customer end.

Question 3

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

Answer

Local Peering Gateway (LPG) access control lists

Answer

Security Lists associated with the database subnet

Answer

Dynamic Routing Gateway (DRG) security policies

Question 4

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

Accepted Answer

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.. BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Answer

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Answer

The Security List on the DRG attachment blocks ICMP traffic.

Answer

The public subnet has an incorrect Internet Gateway route.

Question 5

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

Accepted Answer

Dynamic Routing Gateway (DRG). A Dynamic Routing Gateway (DRG) version 2 acts as a virtual router that provides a single point of entry for your network traffic and supports attachments to multiple VCNs across regions, as well as on-premises connections via FastConnect or VPN.

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway

Question 6

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

Accepted Answer

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG. OCI DNS provides a Resolver where you can set up custom DNS forwarders to route DNS queries for specific on-premises domains to your corporate DNS servers via the DRG.

Answer

A NAT Gateway configured with DNS proxy settings

Answer

A public DNS zone for your on-premises domain

Answer

An Internet Gateway with custom host file mappings

Question 7

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

Accepted Answer

Service Gateway. A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Answer

NAT Gateway

Question 8

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

Accepted Answer

Health check policy defining protocol, port, and optional URL path. Load balancer health checks regularly probe backend servers using specific protocols, ports, and paths to verify that instances are available and healthy.

Answer

A NAT Gateway attached to the backend server subnet

Answer

A security list allowing all incoming traffic from the internet

Answer

An active Service Gateway

Question 9

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Accepted Answer

Add a route in the private subnet route table with a destination of 0.0.0.0/0 and the target as the NAT Gateway.. A NAT Gateway allows instances in a private subnet to initiate connections to the internet, but prevents inbound connections from the internet. The route table associated with the private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Answer

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Answer

Configure a Service Gateway with a route to 0.0.0.0/0.

Answer

Assign a public IP address to the instances within the private subnet.

Question 10

Two VCNs (VCN-A and Vcn-B) reside in the same OCI region but in different compartments. You need to establish a low-latency, high-bandwidth connection between them using local VCN peering. Which component is NOT required for this setup?

Accepted Answer

Internet Gateway attached to VCN-A. Local VCN peering requires a Local Peering Gateway (LPG) in each VCN, matching route table rules in both VCNs, and security rules permitting traffic. An Internet Gateway is not required because local peering traffic stays entirely within the Oracle backbone network.

Answer

Local Peering Gateway (LPG) in VCN-A

Answer

Route table rules pointing to the LPG

Answer

Local Peering Gateway (LPG) in VCN-B

Question 11

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Accepted Answer

Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.. Backend instances must allow incoming traffic from the load balancer's subnet or security list on the application ports. Updating the backend instance security lists or NSGs resolves the timeout.

Answer

Configure a NAT Gateway on the load balancer subnet.

Answer

Change the load balancer shape from Flexible to 100 Mbps.

Answer

Attach an Internet Gateway to the backend subnet route table.

Question 12

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Accepted Answer

An NSG can contain VNICs from multiple different subnets within the same VCN.. NSGs apply only to a specified set of VNICs and are independent of VCN subnets. They support both stateful and stateless rules.

Answer

Every subnet must have at least one NSG associated with it by default.

Answer

NSGs can span across multiple different VCNs in the same region.

Answer

NSGs replace Security Lists entirely and Security Lists are deprecated.

Question 13

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Accepted Answer

IPSec Connection between the CPE and the DRG. A Site-to-Site VPN requires a Customer-Premises Equipment (CPE) object representing your gateway, a Dynamic Routing Gateway (DRG) attached to your VCN, and an IPSec Connection containing tunnels configured with static or dynamic routing.

Answer

Internet Gateway attached to the private subnets

Answer

Local Peering Gateway (LPG)

Question 14

Which TWO types of traffic can be routed through an OCI Service Gateway?

Accepted Answer

Traffic to OCI Object Storage in the same region. A Service Gateway routes traffic destined for the Oracle Services Network, which includes regional services like Object Storage and Autonomous Database, as well as public Oracle services.

Answer

General web browsing traffic to external websites like google.com

Answer

Traffic destined for an on-premises datacenter via FastConnect

Answer

Peer traffic to another VCN in a different region

Question 15

Which OCI networking component is automatically created when you provision a Virtual Cloud Network using the VCN Wizard with 'Internet Connectivity'?

Accepted Answer

Internet Gateway. The VCN Wizard with internet connectivity automatically sets up a VCN, a public subnet, a private subnet, an Internet Gateway, a NAT Gateway, and a Service Gateway.

Answer

Dynamic Routing Gateway

Answer

Local Peering Gateway

Answer

FastConnect Virtual Circuit

Question 16

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

Accepted Answer

Dynamic Routing Gateway (DRG). Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, and a remote peering connection established between the two DRGs.

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Answer

Internet Gateway

Question 17

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

Accepted Answer

Check the subnet security lists or NSGs for a matching egress rule allowing outbound traffic to the internet.. Security lists or NSGs associated with the private subnet must have an egress rule allowing outbound traffic to 0.0.0.0/0 (all ports or specific ports like 80/443). Without matching egress rules, traffic hitting the NAT gateway will be dropped.

Answer

Check if the instances have public IP addresses assigned.

Answer

Check if an Internet Gateway is also attached to the VCN.

Answer

Check if a Service Gateway is attached to the VCN.

Question 18

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Accepted Answer

Public subnets have route table rules pointing to an Internet Gateway, while private subnets do not.. Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.

Answer

Private subnets require IPv6 addressing.

Answer

Private subnets cannot use Security Lists.

Answer

Public subnets cannot communicate with Oracle Database services.

Question 19

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

Accepted Answer

1. An OCI VCN can have a maximum of one Internet Gateway attached to it at any given time.

Answer

2

Answer

Unlimited

Answer

5

Question 20

You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?

Accepted Answer

Enable 'Preserve Client IP' in the backend set configuration.. To preserve client source IP addresses, you should enable 'Backend Set - SSL/TCP' or configure proxy protocol / appropriate backend header settings depending on the listener type, but specifically in OCI Load Balancer, backend sets support preserving client IP headers.

Answer

Attach a NAT Gateway to the Load Balancer subnet.

Answer

Switch the load balancer shape to asymmetric routing mode.

Answer

Configure an Internet Gateway route on the backend servers.