1Z0-1072-26 Networking Practice Test 3 — 15 Questions

Question 1

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the IPSec Connection details page under the DRG. When you create an IPSec connection under the DRG details, OCI automatically provisions two redundant VPN tunnels, displaying their respective public IP addresses in the IPSec Connection details page.

Answer

In the NAT Gateway configuration settings

Answer

In the FastConnect Virtual Circuit overview

Answer

In the VCN Details page under Internet Gateway

Question 2

Which TWO statements are true regarding OCI VCN subnets?

Accepted Answer

Subnets can be designated as either public or private upon creation.. Subnets can be regional or availability domain-specific (though regional subnets are recommended), and they can be designated as either public or private during creation.

Answer

Subnets can span across multiple different VCNs.

Answer

Every subnet must have an Internet Gateway attached directly to it.

Answer

A subnet's CIDR block can be modified after it is created.

Question 3

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

Accepted Answer

Virtual Cloud Networks (VCNs). DRG version 2 supports attachments to VCNs, Site-to-Site VPN IPSec connections, FastConnect virtual circuits, and remote peer DRGs for cross-region peering.

Answer

Internet Gateways

Answer

Local Peering Gateways (LPGs)

Question 4

An OCI Load Balancer has been configured with SSL termination. The backend servers require incoming traffic to also be encrypted using HTTPS. Which backend set protocol should you choose?

Accepted Answer

SSL (or HTTP with SSL enabled). If backend servers require encryption, you should configure the backend set to use SSL (HTTPS or TCP with SSL) so the load balancer encrypts traffic before forwarding it to the backend instances.

Answer

HTTP (unencrypted)

Answer

DNS

Answer

ICMP

Question 5

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

Accepted Answer

Add a route rule with destination service cidr (e.g. All Services in Oracle Services Network) and target as the Service Gateway.. To direct traffic to the Service Gateway, the subnet route table must have a route rule where the destination is the Oracle Services Network (or a specific service region prefix) and the target is the Service Gateway.

Answer

No route table changes are required once the Service Gateway is attached to the VCN.

Answer

Add a route rule pointing to the Dynamic Routing Gateway.

Answer

Add a route rule with destination 0.0.0.0/0 and target as the Service Gateway.

Question 6

What is the primary function of an OCI Internet Gateway?

Accepted Answer

To provide bi-directional communication between a VCN and the public internet for public subnets.. An Internet Gateway provides a path for bi-directional communication between your VCN and the public internet.

Answer

To provide private access to regional Oracle Object Storage.

Answer

To connect on-premises datacenters to OCI over dedicated circuits.

Answer

To route traffic between two VCNs in the same region.

Question 7

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

Accepted Answer

OCI DNS. OCI DNS is the managed Domain Name System service that enables customers to create and manage public and private DNS zones.

Answer

OCI Load Balancer

Answer

OCI VCN Resolver

Answer

OCI Traffic Management

Question 8

Which TWO statements regarding OCI VCN Local Peering are correct?

Accepted Answer

The peered VCNs must reside in the same OCI region.. Local peering connects two VCNs in the same region so their instances can communicate privately using private IP addresses. Both VCNs must have non-overlapping CIDRs and matching LPG/route configurations.

Answer

Local peering requires an Internet Gateway in both VCNs.

Answer

Peered VCNs must belong to the exact same compartment.

Answer

Traffic between locally peered VCNs traverses the public internet.

Question 9

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

Accepted Answer

HTTP/HTTPS listener. To inspect HTTP headers and perform layer 7 load balancing (such as path-based routing or SSL termination with HTTP inspection), you must configure an HTTP/HTTPS listener.

Answer

ICMP listener

Answer

TCP listener

Answer

UDP listener

Question 10

Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?

Accepted Answer

Failover routing. OCI Traffic Management steering policies support multiple traffic steering strategies including Failover, Load Balancer, Geolocation, ASN-based, and Compute-based routing.

Answer

OCI Compartment quota limits

Answer

SQL query performance metrics

Question 11

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

Accepted Answer

Local Peering Gateway (or DRG) and route table rules pointing to the peer VCN CIDR, with no NAT or Internet Gateway.. To allow peering without internet access, you need a peering connection (LPG or DRG) and proper route table rules pointing to the peer. You should omit any Internet Gateway or NAT Gateway to prevent internet access.

Answer

NAT Gateway and a route table pointing 0.0.0.0/0 to the peer VCN.

Answer

Service Gateway pointing to the peered VCN CIDR.

Answer

Internet Gateway attached to the private subnet route table.

Question 12

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An Ingress rule allowing ICMP traffic (Type 8, Code 0 or All). To allow ping (ICMP Type 8, Code 0 for Echo Request) into a subnet, you must add a stateful Ingress Security List rule specifying ICMP as the protocol.

Answer

A Service Gateway rule for ping requests

Answer

An Egress rule allowing TCP port 80

Answer

A NAT Gateway rule for ICMP translation

Question 13

What is the smallest IPv4 CIDR block size supported for an OCI Virtual Cloud Network (VCN)?

Accepted Answer

/30. The smallest VCN CIDR block supported by OCI is /30, and the largest is /16.

Answer

/24

Answer

/32

Answer

/8

Question 14

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

Accepted Answer

Select subnets in two different Availability Domains during load balancer creation.. When provisioning an OCI Public Load Balancer, you select a primary subnet in one AD and a secondary subnet in another AD to ensure high availability across ADs.

Answer

Attach a NAT Gateway to both Availability Domains.

Answer

Configure an LPG between the two AD subnets.

Answer

Deploy two separate load balancers and use an Internet Gateway to load balance between them.

Question 15

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

Accepted Answer

Configure a Listener Rule Set with an HTTP-to-HTTPS redirect rule.. OCI Load Balancers support rule sets, including HTTP redirect rules, allowing you to create a rule that redirects incoming HTTP traffic to HTTPS.

Answer

Change the security list egress rules.

Answer

Use a Service Gateway to forward port 80 to 443.

Answer

Attach a NAT Gateway to port 80.