1Z0-1072-26 Networking Practice Test 6 — 15 Questions

Question 1

An OCI architect configures a Hub-and-Spoke architecture using DRG version 2. Hub VCN contains security appliances. Spoke VCN-A needs to inspect all outbound internet traffic through the security appliances in the Hub VCN before it hits the Internet Gateway. How should the Spoke VCN route table be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Spoke VCN route table with 0.0.0.0/0 pointing to the DRG, and configure the DRG to route traffic to the Hub VCN security appliance.. To direct spoke internet traffic through a firewall appliance in the hub VCN, the spoke VCN subnet route table must have a route for 0.0.0.0/0 pointing to the DRG attachment, and the DRG route table routes that traffic to the hub security appliance VNIC.

Answer

Attach an Internet Gateway directly to the Spoke VCN private subnet.

Answer

Configure a NAT Gateway in every spoke VCN.

Answer

Use a Local Peering Gateway for internet inspection.

Question 2

What is the primary purpose of an OCI Service Gateway?

Accepted Answer

To privately connect a VCN to Oracle services like Object Storage without using the public internet.. A Service Gateway enables private connectivity from a VCN to Oracle services in the Oracle Services Network without traversing the public internet.

Answer

To load balance HTTP traffic across backend servers.

Answer

To provide internet access to public subnets.

Answer

To connect on-premises datacenters to cloud subnets.

Question 3

You have a web application behind an OCI Public Load Balancer. You want to restrict access so that only clients coming from a specific corporate external IP address range can access your application. Where should you configure this restriction?

Accepted Answer

Load Balancer Access Control Rules (Rule Sets) or Security Lists on the Load Balancer subnet. A Public Load Balancer in OCI supports Access Control Rules (Rule Sets) that allow or deny traffic based on source CIDR blocks, and Security Lists on the load balancer's subnet can also restrict ingress by source IP. Configuring the corporate IP range as an allow rule in the load balancer's rule set (or a security list ingress rule) restricts access at the network edge before traffic reaches the backend.

Answer

Database security groups

Answer

Service Gateway route table

Answer

NAT Gateway routing rules

Question 4

Which THREE components are required when configuring OCI VCN Remote Peering between two regions?

Accepted Answer

Remote Peering Connection (RPC) between the two DRGs. Remote VCN peering across regions requires a Dynamic Routing Gateway (DRG) attached to each VCN, a Remote Peering Connection (RPC) established between the two DRGs, and matching route table/security rules.

Answer

Local Peering Gateway (LPG)

Answer

Internet Gateway in both VCNs

Question 5

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

Accepted Answer

Mismatched IKE security parameters (Phase 1 or Phase 2) or blocked UDP ports 500/4500 on the firewall.. VPN tunnel down status is commonly caused by mismatched IKE security parameters (Phase 1/Phase 2 pre-shared key, encryption/authentication algorithms, Diffie-Hellman groups) or blocked UDP ports 500/4500 on local firewalls.

Answer

The NAT Gateway is misconfigured.

Answer

The FastConnect virtual circuit is disabled.

Answer

The VCN subnet route table is missing a route to 0.0.0.0/0.

Question 6

Which TWO statements are true regarding OCI IP addresses and VNICs?

Accepted Answer

Every VNIC is assigned at least one primary private IP address.. Every VNIC has a primary private IP address assigned from its subnet CIDR block, and can optionally have secondary private IP addresses and public IP addresses (ephemeral or reserved).

Answer

Private IP addresses are permanent and can never be unassigned from a VNIC.

Answer

A VNIC can only belong to one subnet at a time, but can span multiple VCNs.

Answer

VNICs in private subnets can be assigned public IP addresses directly.

Question 7

You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?

Accepted Answer

OCI VCNs do not support IP multicast; the application must be redesigned to use unicast.. OCI Virtual Cloud Networks (VCNs) operate at Layer 3 and do not support IP multicast traffic. Application architectures must be redesigned to use unicast or alternative synchronization mechanisms.

Answer

Attach a NAT Gateway configured for multicast translation.

Answer

Configure an Internet Gateway with multicast proxy enabled.

Answer

Enable multicast routing on the Dynamic Routing Gateway (DRG).

Question 8

Which THREE statements regarding OCI IPv6 implementation in VCNs are correct?

Accepted Answer

Security lists and NSGs support rules for IPv6 traffic filtering.. OCI supports IPv6 addressing. You can assign IPv6 CIDR blocks (/56) to your VCN, assign IPv6 subnets (/64) to subnets, and configure security rules and route tables for IPv6 traffic.

Answer

IPv6 is mandatory for all new VCN creation in OCI.

Answer

IPv6 addresses in OCI require a NAT Gateway for outbound internet access.

Question 9

What is the maximum number of VCNs allowed per region in an OCI tenancy by default (subject to service limits)?

Accepted Answer

50 (default service limit). The default service limit for VCNs per region in an OCI tenancy is typically 50, but can be increased upon request.

Answer

1

Answer

Unlimited

Answer

5

Question 10

You are troubleshooting a connection to a database instance in a private subnet. You need to verify if security list rules are blocking incoming traffic to port 1521. Which tool in OCI can you use to test reachability between an application instance and the database instance?

Accepted Answer

OCI Network Path Analyzer. OCI Network Path Analyzer is a diagnostic tool that analyzes network reachability between two endpoints in your VCN, checking route tables, security lists, and NSGs to determine if traffic can flow.

Answer

NAT Gateway packet tracer

Answer

OCI Load Balancer health check

Answer

Service Gateway connectivity tester

Question 11

Which TWO metrics are available for monitoring OCI Public Load Balancers in OCI Monitoring service?

Accepted Answer

BackendSetHealthyInstanceCount. Option C (BackendSetHealthyInstanceCount) is correct because OCI Monitoring exposes this load balancer metric to report how many backend servers in a given backend set are passing health checks, which is essential for availability monitoring. Option E (BytesProcessed) is correct because the Load Balancer service publishes this metric to show the total volume of traffic processed by the load balancer, useful for throughput and capacity analysis. The other options are not load balancer metrics: DatabaseCPUUtilization (A) belongs to the Database service, BlockStorageIOPS (B) is a Block Volume metric, and ComputeInstanceVCPUTime (D) is a Compute instance metric, so none of them are available for OCI Public Load Balancers in Monitoring.

Answer

DatabaseCPUUtilization

Answer

BlockStorageIOPS

Answer

ComputeInstanceVCPUTime

Question 12

You are configuring an OCI Public Load Balancer and notice that backend instances are marked as unhealthy. Upon inspecting the health check URL on the backend server via curl, it returns HTTP 200. What is the most likely reason the load balancer still reports them as unhealthy?

Accepted Answer

Security lists or NSGs on the backend instances are blocking traffic from the Load Balancer subnet on the listener/health check port.. If backend servers return HTTP 200 locally but are unhealthy in the load balancer, security list rules or NSGs on the backend subnet are likely blocking incoming health check probes from the load balancer subnet.

Answer

The VCN has an Internet Gateway attached.

Answer

The load balancer shape is set to 10 Gbps instead of 100 Mbps.

Answer

The NAT Gateway is misconfigured.

Question 13

What is the primary function of an OCI Dynamic Routing Gateway (DRG)?

Accepted Answer

To provide a private connection between your VCN and on-premises networks or other VCNs.. An OCI Dynamic Routing Gateway (DRG) is a virtual router that provides a private path between a VCN and networks outside OCI, such as on-premises networks over FastConnect or Site-to-Site VPN, or other VCNs in the same or different regions. It is the attachment point for IPSec VPN, FastConnect virtual circuits, and remote peering, and it participates in dynamic routing protocols like BGP. This makes it the correct answer for private connectivity.

Answer

To provide public internet access for public subnets.

Answer

To load balance web requests across backend servers.

Answer

To provide access to regional Object Storage.

Question 14

An OCI customer has a VCN with CIDR 10.0.0.0/16 and wants to peer it with another VCN having CIDR 10.1.0.0/16. However, they also have an on-premises network connected via FastConnect using the CIDR 10.0.0.0/14. What routing challenge does this create?

Accepted Answer

The on-premises CIDR (10.0.0.0/14) subsumes the VCN CIDRs, creating overlapping prefix routing conflicts.. The on-premises CIDR (10.0.0.0/14) encompasses both VCN CIDRs (10.0.0.0/16 and 10.1.0.0/16). This creates overlapping address spaces where the more specific VCN routes might conflict or cause unpredictable routing behavior between hybrid and cloud peers.

Answer

FastConnect does not support CIDRs larger than /16.

Answer

The Internet Gateway will drop all 10.x.x.x traffic.

Answer

Peered VCNs cannot use private IP addresses.

Question 15

Which TWO types of targets can be specified in an OCI VCN route table rule?

Accepted Answer

NAT Gateway. Route table targets in OCI include Internet Gateways, NAT Gateways, Service Gateways, Dynamic Routing Gateways, Local Peering Gateways, and private IPs of VNICs (such as firewalls).

Answer

Block Volume

Answer

Identity and Access Management (IAM) Policy

Answer

Object Storage Bucket