1Z0-1072-26 Networking Practice Test 7 — 15 Questions

Question 1

Which THREE statements regarding OCI VCN Route Tables are correct?

Accepted Answer

Each subnet in a VCN must be associated with a route table.. Route tables contain rules that map destination CIDR blocks to target gateways. Each subnet must be associated with a route table, and route tables can be shared across multiple subnets.

Answer

Route tables perform firewall packet inspection like Network Security Groups.

Answer

A subnet can be associated with multiple route tables simultaneously.

Question 2

You are managing an OCI VCN and want to monitor all dropped packets due to security list violations across all subnets. Which OCI feature should you enable?

Accepted Answer

OCI VCN Flow Logs configured to capture rejected traffic. OCI VCN Flow Logs capture traffic information including dropped/rejected packets due to security list or NSG blocks when configured to log 'REJECT' or 'ALL' traffic.

Answer

Service Gateway audit logs

Answer

Internet Gateway access logs

Answer

NAT Gateway traffic logging

Question 3

What is the maximum MTU (Maximum Transmission Unit) supported on standard OCI VCN virtual network interfaces (VNICs)?

Accepted Answer

9000 bytes (Jumbo Frames). Standard OCI VNICs support an MTU of 9000 bytes (Jumbo Frames), as well as the standard 1500 bytes.

Answer

576 bytes

Answer

1500 bytes

Answer

65535 bytes

Question 4

An OCI customer has a primary database in Ashburn and a standby database in Phoenix. They need to replicate database traffic over a dedicated, highly secure private connection between the two regions. Which OCI networking architecture best achieves this requirement?

Accepted Answer

Attach DRGs to the VCNs in Ashburn and Phoenix and establish a Remote Peering Connection (RPC).. To connect VCNs across two OCI regions privately, you attach a Dynamic Routing Gateway to each VCN and establish a Remote Peering Connection (RPC) between the DRGs. This creates a dedicated, encrypted private connection over Oracle's backbone network, ideal for cross-region database replication. This is the standard OCI inter-region VCN peering architecture.

Answer

Route database traffic through regional Internet Gateways.

Answer

Use Local Peering Gateways (LPGs) between Ashburn and Phoenix.

Answer

Configure NAT Gateways with public IP tunneling across regions.

Question 5

You are configuring an OCI Load Balancer and need to distribute incoming requests across backend servers based on the client's source IP address so that requests from the same client always go to the same backend server. Which load balancing policy should you choose?

Accepted Answer

IP Hash. The IP Hash load balancing policy hashes the client's source IP address to route requests from the same client to the same backend server, ensuring session persistence.

Answer

Least Connections

Answer

Random

Answer

Weighted Round Robin

Question 6

Which TWO methods can be used to assign public IP addresses to OCI compute instances?

Accepted Answer

Reserved public IP. OCI supports Ephemeral public IPs (which exist for the lifetime of the instance) and Reserved public IPs (persistent public IPs that can be reassigned).

Answer

Dynamic public IP lease via DHCP

Answer

Static NAT Gateway public IP

Answer

Service Gateway public IP allocation

Question 7

An OCI administrator creates a subnet route table with a route rule pointing 0.0.0.0/0 to an Internet Gateway. However, compute instances in this subnet cannot reach the internet. Upon checking the instance details, you notice the instances have private IP addresses only and no public IP assigned. What is missing?

Accepted Answer

The compute instances need a public IP address (ephemeral or reserved) assigned to their VNICs.. Instances in a public subnet require a public IP address (ephemeral or reserved) in addition to the subnet's route to the Internet Gateway in order to communicate bi-directionally with the public internet.

Answer

The VCN CIDR block must be changed to /8.

Answer

A Service Gateway must be attached to the VCN.

Answer

A NAT Gateway must be attached to the public subnet.

Question 8

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?

Accepted Answer

Service Gateway. Service Gateway provides private access to Oracle services like Object Storage across the Oracle network backbone.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

Local Peering Gateway

Question 9

What is the primary purpose of an OCI Local Peering Gateway (LPG)?

Accepted Answer

To enable private communication between two VCNs in the same OCI region.. An LPG enables you to peer one VCN with another VCN in the same OCI region so that their instances can communicate privately.

Answer

To route traffic to regional Oracle services.

Answer

To connect an on-premises datacenter to a VCN.

Answer

To provide outbound internet access for private subnets.

Question 10

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

Accepted Answer

It distributes traffic across multiple endpoints according to assigned weights and health checks.. Load Balancer steering distributes traffic across a pool of endpoints based on specified weights and health status, similar to load balancing algorithms.

Answer

It routes all traffic to a single primary datacenter until manual failover occurs.

Answer

It routes users based strictly on their geographic location.

Answer

It routes traffic based on client ASN numbers.

Question 11

Which THREE statements regarding OCI NAT Gateway behavior are correct?

Accepted Answer

Instances behind a NAT Gateway can initiate outbound connections to the internet.. NAT Gateways allow private subnet instances to initiate outbound connections to the internet, they scale automatically, and they do not accept inbound connections initiated from the internet.

Answer

NAT Gateways require compute instances to have public IP addresses.

Answer

NAT Gateways replace the need for an Internet Gateway in public subnets.

Question 12

What is the maximum number of Availability Domains (ADs) in a typical multi-AD OCI region?

Accepted Answer

3. Standard multi-AD OCI regions contain exactly 3 Availability Domains.

Answer

1

Answer

5

Answer

2

Question 13

Which TWO protocols are supported for OCI Site-to-Site VPN IPSec tunnels?

Accepted Answer

IKEv1. OCI Site-to-Site VPN IPSec tunnels support IKEv1 (Option B) and IKEv2 (Option E) as the Internet Key Exchange protocols used to negotiate the IPSec security associations, with IKEv2 being the recommended default for new tunnels because it offers improved security and performance. IKEv1 is also supported for backward compatibility with older on-premises VPN devices. BGP over SSL (Option A) is not an IPSec tunnel protocol; BGP is a routing protocol that can run over the tunnel, but SSL is unrelated to IPSec IKE negotiation. HTTPS tunneling (Option C) is not used for OCI IPSec VPNs, and SNMPv3 (Option D) is a network management protocol, not a tunnel negotiation protocol.

Answer

BGP over SSL

Answer

HTTPS tunneling

Answer

SNMPv3

Question 14

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

Accepted Answer

VCN Resolver custom forwarders. The OCI VCN Resolver supports custom forwarders, which let you forward DNS queries for specific domains to your own DNS servers (for example, on-premises or third-party resolvers) while still resolving internet names through the VCN resolver. This is the feature that satisfies resolving both custom internal domain names and public internet domains from the same VCN. You configure forwarding rules that match the internal domain and point to the target nameserver IPs.

Answer

Internet Gateway DNS proxy

Answer

Service Gateway name server

Answer

NAT Gateway DNS translation

Question 15

An OCI customer has an architecture where VCN-A, VCN-B, and VCN-C are connected to a central DRG in a Hub-and-Spoke topology. VCN-A needs to communicate with VCN-B, but VCN-C must be completely isolated from VCN-A. How should the DRG route tables and attachments be configured?

Accepted Answer

Use custom DRG route tables for each attachment, ensuring VCN-A's route table does not import routes from VCN-C's attachment.. To isolate VCN-C from VCN-A, you assign VCN-A and VCN-C attachments to separate DRG route tables. VCN-A's route table imports routes for VCN-B but does not import routes for VCN-C, and vice versa.

Answer

Configure NAT Gateways on all spoke VCNs.

Answer

Attach an Internet Gateway to VCN-C to block internal DRG traffic.

Answer

Delete all subnets in VCN-C.