1Z0-1072-26 Networking Practice Test 3 — 15 Questions

Question 1

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

Accepted Answer

1. OCI allows only one Internet Gateway per Virtual Cloud Network (VCN). This is a hard limit set by the service to simplify routing and avoid conflicts. The Internet Gateway is a regional resource that provides a single point of internet access for the VCN, and multiple gateways are not supported.

Answer

2

Answer

Unlimited

Answer

5

Question 2

Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?

Accepted Answer

OCI FastConnect. OCI offers FastConnect for dedicated private connections and Site-to-Site VPN for encrypted IPSec connections over the public internet.

Answer

Internet Gateway

Answer

Service Gateway

Answer

Local Peering Gateway

Question 3

Which THREE characteristics of OCI Security Lists are correct?

Accepted Answer

Security list rules are stateful by default.. Option A is correct because OCI security list rules are stateful by default, meaning return traffic for an allowed connection is automatically permitted without needing a corresponding inbound or outbound rule. Option B is correct because security lists are attached to a subnet, and their rules apply to all VNICs in that subnet. Option C is correct because OCI security lists allow you to configure rules as stateless, in which case you must explicitly define rules for both request and response traffic. Option D is incorrect because a subnet can have multiple security lists associated with it, not just one. Option E is incorrect because security lists are bound at the subnet level, whereas network security groups (NSGs) are the construct that can be assigned to individual VNICs.

Answer

A subnet can have a maximum of only one security list.

Answer

Security lists can be assigned to individual VNICs independently of subnets.

Question 4

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

Accepted Answer

A Private DNS Zone associated with the VCN via a VCN view. OCI DNS private zones are resolved only within the VCNs they are associated with, and the association is made through a VCN view. You create a private zone for internal.corp, create or use a VCN view, and attach the zone to that view so instances in the VCN can query the records. This keeps internal names off the public internet and lets the VCN resolver answer queries for the private domain.

Answer

A Public DNS Zone with an Internet Gateway

Answer

A Service Gateway pointing to the DNS service

Answer

A NAT Gateway with DNS forwarding rules

Question 5

An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?

Accepted Answer

The DRG attachment for Vcn-B is associated with a DRG route table that lacks the import route distribution for the on-premises network.. In DRG transit routing, each VCN attachment is associated with a DRG route table, and that route table must import routes from the appropriate route distribution (e.g., the distribution containing on-premises routes learned via FastConnect). If VCN-B's attachment uses a route table that does not import the on-premises distribution, VCN-B has no route to on-premises even though VCN-A does.

Answer

VCN CIDRs must be identical for transit routing to function.

Answer

FastConnect only supports a single VCN attachment at a time.

Answer

Vcn-B must use an Internet Gateway instead of a DRG.

Question 6

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

Accepted Answer

A Private Virtual Circuit allows direct access to your VCN using private IP addresses.. Option B is correct because a Private Virtual Circuit (PVC) on OCI FastConnect provides a private Layer 3 connection between your on-premises network and a VCN, letting you reach resources using their private IP addresses without traversing the public internet. Option E is correct because FastConnect virtual circuits use BGP to exchange routes dynamically between the customer edge (CE) router and the Oracle edge, enabling dynamic routing across private virtual circuits. Option A is wrong because FastConnect public virtual circuits support BGP dynamic routing, not only static routing. Option C is wrong because a FastConnect virtual circuit is attached to a Dynamic Routing Gateway (DRG) to reach a VCN. Option D is wrong because FastConnect is a dedicated private connectivity service that does not traverse the public internet and does not require IPSec encryption.

Answer

Only static routing is supported on FastConnect public virtual circuits.

Answer

You cannot attach a FastConnect virtual circuit to a Dynamic Routing Gateway.

Answer

FastConnect virtual circuits must traverse the public internet with IPSec encryption.

Question 7

Which THREE features are supported by OCI Load Balancer?

Accepted Answer

TCP layer 4 load balancing. OCI Load Balancer supports TCP layer 4 load balancing (option A) because it can distribute raw TCP traffic based on IP address and port without inspecting application-layer content, which is the defining behavior of a Layer 4 load balancer. It also supports HTTP/HTTPS layer 7 load balancing (option C), allowing it to route requests based on HTTP headers, paths, hostnames, and cookies, and to perform health checks at the application layer. SSL termination (option D) is supported because the load balancer can decrypt incoming TLS/SSL traffic at the listener and forward plaintext or re-encrypted traffic to backend servers, offloading certificate processing from the backends. Option B is incorrect because OCI Load Balancer is not a Next-Gen Firewall and does not perform automatic packet filtering or deep packet inspection like a security appliance. Option E is incorrect because OCI Load Balancer distributes traffic to backend compute instances (or backend sets), not directly to database query engines, and it has no native database query routing capability.

Answer

Automatic packet filtering like a Next-Gen Firewall

Answer

Direct database query routing without backend compute instances

Question 8

You have deployed an OCI VCN with a CIDR of 192.168.0.0/16. You want to peer this VCN with another VCN that has a CIDR of 192.168.64.0/18. Will this local peering succeed?

Accepted Answer

No, because the VCN CIDR blocks overlap.. Local peering between VCNs requires that their CIDR blocks do not overlap. Here, VCN1 has 192.168.0.0/16, which includes all addresses from 192.168.0.0 to 192.168.255.255. VCN2 has 192.168.64.0/18, which falls entirely within that range (192.168.64.0 to 192.168.127.255). Therefore, the CIDR blocks overlap, and local peering will fail.

Answer

Yes, as long as both VCNs are in the same compartment.

Answer

No, because VCNs must have identical CIDR sizes to peer.

Answer

Yes, because the second VCN CIDR is a subnet of the first.

Question 9

What is the primary function of an OCI NAT Gateway?

Accepted Answer

To allow private subnet instances to initiate outbound connections to the internet while blocking inbound connections.. A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software patches) without accepting inbound connections from the internet.

Answer

To peer two VCNs in the same region.

Answer

To allow inbound internet traffic to reach private database instances securely.

Answer

To connect on-premises datacenters to OCI VCNs.

Question 10

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Accepted Answer

In the IPSec Connection details page under the DRG. When you create an IPSec connection under the DRG details, OCI automatically provisions two redundant VPN tunnels, displaying their respective public IP addresses in the IPSec Connection details page.

Answer

In the NAT Gateway configuration settings

Answer

In the FastConnect Virtual Circuit overview

Answer

In the VCN Details page under Internet Gateway

Question 11

Which TWO statements are true regarding OCI VCN subnets?

Accepted Answer

Subnets can be designated as either public or private upon creation.. Option B is correct because when you create an OCI VCN subnet you must choose its type as either public or private, which determines whether resources in it can have public IP addresses and be reached from the internet via an Internet Gateway. Option D is correct because OCI subnets are regional resources that can span all Availability Domains within a region, unlike subnets in some other clouds that are tied to a single AD. Option A is incorrect because a subnet belongs to exactly one VCN and cannot span multiple VCNs. Option C is incorrect because an Internet Gateway is attached to the VCN, not to individual subnets, and private subnets do not require one. Option E is incorrect because a subnet's CIDR block is fixed at creation and cannot be modified afterward.

Answer

Subnets can span across multiple different VCNs.

Answer

Every subnet must have an Internet Gateway attached directly to it.

Answer

A subnet's CIDR block can be modified after it is created.

Question 12

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

Accepted Answer

Virtual Cloud Networks (VCNs). A DRG version 2 can attach Virtual Cloud Networks (VCNs) via a DRG attachment, which is the standard way to connect a VCN to the DRG for routing traffic to on-premises or other networks, so option A is correct. It can also terminate IPSec VPN tunnels through a DRG attachment of type IPSec tunnel, enabling Site-to-Site VPN connectivity between on-premises networks and OCI, making option D correct. FastConnect virtual circuits can be attached to a DRG version 2 as well, allowing private dedicated connectivity between on-premises networks and OCI, so option E is correct. Internet Gateways are attached to VCNs, not to DRGs, so option B is incorrect. Local Peering Gateways (LPGs) are used for VCN-to-VCN peering within the same region and attach to VCNs, not to DRGs, so option C is incorrect.

Answer

Internet Gateways

Answer

Local Peering Gateways (LPGs)

Question 13

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

Accepted Answer

Add a route rule with destination service cidr (e.g. All Services in Oracle Services Network) and target as the Service Gateway.. To direct traffic to the Service Gateway, the subnet route table must have a route rule where the destination is the Oracle Services Network (or a specific service region prefix) and the target is the Service Gateway.

Answer

No route table changes are required once the Service Gateway is attached to the VCN.

Answer

Add a route rule pointing to the Dynamic Routing Gateway.

Answer

Add a route rule with destination 0.0.0.0/0 and target as the Service Gateway.

Question 14

What is the primary function of an OCI Internet Gateway?

Accepted Answer

To provide bi-directional communication between a VCN and the public internet for public subnets.. An Internet Gateway provides a path for bi-directional communication between your VCN and the public internet.

Answer

To provide private access to regional Oracle Object Storage.

Answer

To connect on-premises datacenters to OCI over dedicated circuits.

Answer

To route traffic between two VCNs in the same region.

Question 15

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

Accepted Answer

OCI DNS. OCI DNS is the managed Domain Name System service that enables customers to create and manage public and private DNS zones.

Answer

OCI Load Balancer

Answer

OCI VCN Resolver

Answer

OCI Traffic Management