1Z0-1072-26 Networking Practice Test 4 — 15 Questions

Question 1

Which TWO statements regarding OCI VCN Local Peering are correct?

Accepted Answer

The peered VCNs must reside in the same OCI region.. Option B is correct because OCI Local Peering Gateway (LPG) connections only work between VCNs that are in the same OCI region; cross-region connectivity requires Remote Peering via Dynamic Routing Gateways (DRGs) and a DRG attachment. Option C is correct because locally peered VCNs must have non-overlapping CIDR blocks, since overlapping address space would create ambiguous routing and the peering cannot be established. Option A is incorrect because local peering uses the LPG-to-LPG link and does not require an Internet Gateway in either VCN. Option D is incorrect because peered VCNs can reside in different compartments within the same tenancy, as long as the required IAM policies permit the LPG creation and peering. Option E is incorrect because traffic between locally peered VCNs stays on the OCI private network and never traverses the public internet.

Answer

Local peering requires an Internet Gateway in both VCNs.

Answer

Peered VCNs must belong to the exact same compartment.

Answer

Traffic between locally peered VCNs traverses the public internet.

Question 2

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

Accepted Answer

HTTP/HTTPS listener. To inspect HTTP headers and perform layer 7 load balancing (such as path-based routing or SSL termination with HTTP inspection), you must configure an HTTP/HTTPS listener.

Answer

ICMP listener

Answer

TCP listener

Answer

UDP listener

Question 3

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

Accepted Answer

Local Peering Gateway (or DRG) and route table rules pointing to the peer VCN CIDR, with no NAT or Internet Gateway.. To allow peering without internet access, you need a peering connection (LPG or DRG) and proper route table rules pointing to the peer. You should omit any Internet Gateway or NAT Gateway to prevent internet access.

Answer

NAT Gateway and a route table pointing 0.0.0.0/0 to the peer VCN.

Answer

Service Gateway pointing to the peered VCN CIDR.

Answer

Internet Gateway attached to the private subnet route table.

Question 4

You are configuring a Site-to-Site VPN connection and need to test connectivity between an on-premises host and an OCI compute instance. The ping fails. You check the security lists and notice that ICMP traffic is blocked. Which rule type must you add to the security list to allow incoming ping requests?

Accepted Answer

An Ingress rule allowing ICMP traffic (Type 8, Code 0 or All). To allow ping (ICMP Type 8, Code 0 for Echo Request) into a subnet, you must add a stateful Ingress Security List rule specifying ICMP as the protocol.

Answer

A Service Gateway rule for ping requests

Answer

An Egress rule allowing TCP port 80

Answer

A NAT Gateway rule for ICMP translation

Question 5

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

Accepted Answer

Select subnets in two different Availability Domains during load balancer creation.. When provisioning an OCI Public Load Balancer, you select a primary subnet in one AD and a secondary subnet in another AD to ensure high availability across ADs.

Answer

Attach a NAT Gateway to both Availability Domains.

Answer

Configure an LPG between the two AD subnets.

Answer

Deploy two separate load balancers and use an Internet Gateway to load balance between them.

Question 6

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

Accepted Answer

Configure a Listener Rule Set with an HTTP-to-HTTPS redirect rule.. OCI Load Balancers support rule sets, including HTTP redirect rules, allowing you to create a rule that redirects incoming HTTP traffic to HTTPS.

Answer

Change the security list egress rules.

Answer

Use a Service Gateway to forward port 80 to 443.

Answer

Attach a NAT Gateway to port 80.

Question 7

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Accepted Answer

Dynamic Routing Gateway (DRG) attached to the VCN. Option B is correct because the Dynamic Routing Gateway (DRG) is the OCI-side virtual router that must be attached to the VCN to terminate the IPSec tunnels of a Site-to-Site VPN; without a DRG there is no OCI endpoint for the VPN. Option E is correct because the Customer-Premises Equipment (CPE) object represents the public IP address of your on-premises VPN gateway, and it is a required building block referenced when creating the IPSec connection that forms the redundant tunnels. The Service Gateway (A) is only for private access to OCI services such as Object Storage, the Local Peering Gateway (C) connects VCNs within the same region, and the NAT Gateway (D) provides outbound internet access for private subnets — none of these terminate or represent an IPSec VPN endpoint, so they are not required for a Site-to-Site VPN.

Answer

Service Gateway

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway

Question 8

You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?

Accepted Answer

Provide the Oracle Industry Partner token to your FastConnect provider so they can complete the provisioning from their network.. In the Oracle provider model for FastConnect, after creating the virtual circuit in the OCI Console, OCI generates an Oracle Industry Partner token (OCID). The customer must give this token to the FastConnect provider so the provider can complete the cross-connect provisioning on their network. The token is the handoff artifact between OCI and the partner.

Answer

Configure the token as the BGP ASN on your on-premises router.

Answer

Attach the token directly to the instance security list.

Answer

Paste the token into the OCI VCN route table settings.

Question 9

An enterprise has multiple VCNs peered to a central hub VCN using a DRG. A security auditor notes that Vcn-A can communicate with Vcn-C because transit routing is enabled on the DRG. The security policy dictates that Vcn-A must never communicate with Vcn-C. How can you block this specific inter-VCN traffic while keeping other routes intact?

Accepted Answer

Modify the DRG route tables and import/export route distributions to prevent Vcn-A and Vcn-C from exchanging routes.. In DRG version 2, you can create custom DRG route tables and fine-tune import/export route distributions to prevent specific attachments from learning each other's routes, thereby blocking unwanted transit paths.

Answer

Attach a NAT Gateway to the hub VCN.

Answer

Delete the Internet Gateway from Vcn-A.

Answer

Change the subnet CIDR of Vcn-C so it no longer overlaps.

Question 10

Which TWO statements are true regarding OCI VCN Flow Logs?

Accepted Answer

Flow logs capture information about traffic flowing through VNICs in your VCN.. Option A is correct because OCI VCN Flow Logs capture metadata about IP traffic traversing the VNICs (VNIC-level flow data) within a VCN, including source/destination IPs, ports, protocol, and action. Option E is correct because when creating a flow log you can set the capture filter to log accepted traffic, rejected traffic, or all traffic, giving you flexibility in what security-relevant events are recorded. The unmarked options are incorrect: flow logs are not limited to public subnets (they work with any subnet/VNIC), they do not encrypt database data at rest (that is handled by OCI Block Volume/Bucket encryption and TDE for databases), and they do not require an Internet Gateway to export logs since flow logs are delivered to OCI Object Storage or OCI Streaming via the service's internal path.

Answer

Flow logs are only supported on public subnets.

Answer

Flow logs automatically encrypt your database data at rest.

Answer

Flow logs require an Internet Gateway to export logs out of the VCN.

Question 11

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

Accepted Answer

Security Lists. Security Lists (at the subnet level) and Network Security Groups (at the VNIC level) are the two primary virtual firewall features used in OCI to control ingress and egress traffic.

Answer

Service Gateway

Answer

Dynamic Routing Gateway

Answer

Internet Gateway

Question 12

You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?

Accepted Answer

Backend servers are taking longer to process requests than the load balancer idle timeout threshold.. A 504 Gateway Timeout from an OCI Public Load Balancer almost always means the backend did not respond within the listener's configured idle/response timeout window. When the LB's idle timeout (default 60 seconds for HTTP listeners) expires before the backend finishes processing, the LB closes the connection and returns 504 to the client. The fix is to raise the idle timeout or optimize backend response time.

Answer

The Internet Gateway has exceeded its bandwidth limit.

Answer

The NAT Gateway is blocking incoming HTTP traffic.

Answer

The VCN route table is missing a default route.

Question 13

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

Accepted Answer

Associate VCN-1 and VCN-2 attachments with different DRG route tables, ensuring only VCN-1's route table imports routes from the on-premises attachment.. DRG route tables control route import and distribution per attachment, so associating VCN-1 and VCN-2 attachments with different DRG route tables lets you selectively import the on-premises routes only into VCN-1's route table. VCN-2's attachment uses a route table that does not import the on-premises routes, so it has no path to the on-premises network. This is the standard OCI segmentation pattern for DRG v2.

Answer

Configure a NAT Gateway on VCN-2 to drop on-premises packets.

Answer

Place VCN-1 and VCN-2 in different OCI tenancies.

Answer

Attach VCN-2 to an Internet Gateway instead of the DRG.

Question 14

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

Accepted Answer

To provide a customizable, isolated virtual network in OCI for your cloud resources.. A VCN is a customizable, private software-defined network that you set up in OCI, resembling a traditional physical network.

Answer

To store backup files and unstructured object data.

Answer

To host public DNS domain names on the internet.

Answer

To execute serverless container functions.

Question 15

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

Accepted Answer

Web: 172.16.1.0/24, App: 172.16.2.0/24, DB: 172.16.3.0/26. Option B is the only combination where all three subnets fall inside the VCN CIDR 172.16.0.0/16 and do not overlap. Web (172.16.1.0/24) provides 256 addresses for 100 hosts, App (172.16.2.0/24) provides 256 addresses for 200 hosts, and DB (172.16.3.0/26) provides 64 addresses for 50 hosts — all within the /16 and mutually exclusive.

Answer

Web: 10.0.1.0/24, App: 10.0.2.0/24, DB: 10.0.3.0/24

Answer

Web: 172.16.0.0/15, App: 172.16.0.0/16, DB: 172.16.1.0/24

Answer

Web: 172.16.1.0/24, App: 172.16.1.0/24, DB: 172.16.3.0/24