1Z0-1072-26 Networking Practice Test 2 — 15 Questions

Question 1

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

Answer

Local Peering Gateway (LPG) access control lists

Answer

Security Lists associated with the database subnet

Answer

Dynamic Routing Gateway (DRG) security policies

Question 2

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

Accepted Answer

BGP peering IP addresses or Autonomous System Numbers (ASNs) are misconfigured between the Oracle router and on-premises router.. BGP status 'Idle' typically indicates that the BGP peer IP configuration is incorrect, or there is an issue with the virtual circuit provisioning state, or access control lists/firewalls are blocking TCP port 179.

Answer

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Answer

The Security List on the DRG attachment blocks ICMP traffic.

Answer

The public subnet has an incorrect Internet Gateway route.

Question 3

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

Accepted Answer

Dynamic Routing Gateway (DRG). The Dynamic Routing Gateway (DRG) is OCI's virtual router that acts as the single transit hub between on-premises networks and multiple VCNs, including VCNs in different regions. A single FastConnect or IPSec connection terminates on the DRG, and the DRG can be attached to many VCNs across regions, enabling transitive routing. This is exactly the central transit hub role described in the question.

Answer

NAT Gateway

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway

Question 4

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

Accepted Answer

Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG. OCI's VCN Resolver supports custom DNS forwarders that send queries for specific domains to on-premises DNS servers reachable through the DRG (over FastConnect or Site-to-Site VPN). This is the correct mechanism for hybrid DNS resolution where VCN instances need to resolve on-premises hostnames.

Answer

A NAT Gateway configured with DNS proxy settings

Answer

A public DNS zone for your on-premises domain

Answer

An Internet Gateway with custom host file mappings

Question 5

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

Accepted Answer

Service Gateway. A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Answer

NAT Gateway

Question 6

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

Accepted Answer

Health check policy defining protocol, port, and optional URL path. Load balancer health checks regularly probe backend servers using specific protocols, ports, and paths to verify that instances are available and healthy.

Answer

A NAT Gateway attached to the backend server subnet

Answer

A security list allowing all incoming traffic from the internet

Answer

An active Service Gateway

Question 7

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Accepted Answer

Add a route in the private subnet route table with a destination of 0.0.0.0/0 and the target as the NAT Gateway.. A NAT Gateway allows instances in a private subnet to initiate connections to the internet, but prevents inbound connections from the internet. The route table associated with the private subnet must have a route pointing 0.0.0.0/0 to the NAT Gateway.

Answer

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Answer

Configure a Service Gateway with a route to 0.0.0.0/0.

Answer

Assign a public IP address to the instances within the private subnet.

Question 8

Two VCNs (VCN-A and Vcn-B) reside in the same OCI region but in different compartments. You need to establish a low-latency, high-bandwidth connection between them using local VCN peering. Which component is NOT required for this setup?

Accepted Answer

Internet Gateway attached to VCN-A. Local VCN peering requires a Local Peering Gateway (LPG) in each VCN, matching route table rules in both VCNs, and security rules permitting traffic. An Internet Gateway is not required because local peering traffic stays entirely within the Oracle backbone network.

Answer

Local Peering Gateway (LPG) in VCN-A

Answer

Route table rules pointing to the LPG

Answer

Local Peering Gateway (LPG) in VCN-B

Question 9

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Accepted Answer

Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.. The best practice is to add a security rule in the backend subnet's security list (or network security group) to allow traffic from the load balancer subnet's CIDR on the application port. This ensures that the load balancer can forward traffic to the backend instances. The load balancer's security list allowing port 443 is necessary but not sufficient; the backend must also permit traffic from the load balancer.

Answer

Configure a NAT Gateway on the load balancer subnet.

Answer

Change the load balancer shape from Flexible to 100 Mbps.

Answer

Attach an Internet Gateway to the backend subnet route table.

Question 10

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Accepted Answer

An NSG can contain VNICs from multiple different subnets within the same VCN.. NSGs apply only to a specified set of VNICs and are independent of VCN subnets. They support both stateful and stateless rules.

Answer

Every subnet must have at least one NSG associated with it by default.

Answer

NSGs can span across multiple different VCNs in the same region.

Answer

NSGs replace Security Lists entirely and Security Lists are deprecated.

Question 11

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Accepted Answer

IPSec Connection between the CPE and the DRG. Option B is correct because the IPSec Connection is the actual tunnel resource in OCI that links the on-premises CPE to the DRG, carrying encrypted traffic over the internet using IKE/IPSec. Option D is correct because a Dynamic Routing Gateway (DRG) must be attached to the VCN to serve as the OCI-side termination point for the Site-to-Site VPN and to route traffic to and from the on-premises network. Option E is correct because the Customer-Premises Equipment (CPE) object is an OCI representation of the on-premises VPN device (its public IP and routing/BGP details) and is a mandatory input when creating the IPSec connection. Option A is incorrect because an Internet Gateway is used for public subnet internet access, not for Site-to-Site VPN termination, and the VPN attaches to the DRG instead. Option C is incorrect because a Local Peering Gateway connects VCNs within the same region and has no role in connecting an on-premises datacenter to OCI.

Answer

Internet Gateway attached to the private subnets

Answer

Local Peering Gateway (LPG)

Question 12

Which TWO types of traffic can be routed through an OCI Service Gateway?

Accepted Answer

Traffic to OCI Object Storage in the same region. Option D is correct because an OCI Service Gateway provides private access from a VCN to Oracle Services Network (OSN) services such as Object Storage in the same region, without requiring an Internet Gateway or NAT Gateway. Option E is correct because Autonomous Database is also an Oracle Services Network service reachable through the Service Gateway in the same region, keeping traffic on the Oracle network. Options A, B, and C are incorrect: general web browsing requires an Internet Gateway (or NAT Gateway for private subnets), on-premises connectivity via FastConnect uses a Dynamic Routing Gateway (DRG) with a FastConnect virtual circuit, and cross-region VCN peering uses Remote Peering Connections (RPCs) over a DRG, not a Service Gateway.

Answer

General web browsing traffic to external websites like google.com

Answer

Traffic destined for an on-premises datacenter via FastConnect

Answer

Peer traffic to another VCN in a different region

Question 13

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

Accepted Answer

Dynamic Routing Gateway (DRG). Cross-region VCN peering in OCI requires a Dynamic Routing Gateway (DRG) in each VCN, with a remote peering connection (RPC) established between the two DRGs. The DRG is the virtual router that provides the path for traffic between VCNs in different regions. Local peering gateways only work within a single region, so they cannot satisfy this requirement.

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Answer

Internet Gateway

Question 14

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

Accepted Answer

Check the subnet security lists or NSGs for a matching egress rule allowing outbound traffic to the internet.. Security lists or NSGs associated with the private subnet must have an egress rule allowing outbound traffic to 0.0.0.0/0 (all ports or specific ports like 80/443). Without matching egress rules, traffic hitting the NAT gateway will be dropped.

Answer

Check if the instances have public IP addresses assigned.

Answer

Check if an Internet Gateway is also attached to the VCN.

Answer

Check if a Service Gateway is attached to the VCN.

Question 15

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Accepted Answer

Public subnets have route table rules pointing to an Internet Gateway, while private subnets do not.. Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.

Answer

Private subnets require IPv6 addressing.

Answer

Private subnets cannot use Security Lists.

Answer

Public subnets cannot communicate with Oracle Database services.