1Z0-1072-26 Networking Practice Test 8 — 15 Questions

Question 1

You are troubleshooting a web application where users are reporting intermittent connection failures when accessing your OCI Public Load Balancer. You check the load balancer metrics and notice that the `DroppedConnections` metric is spiking. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The load balancer has reached its maximum bandwidth or connection rate limit, or backend instances are overwhelmed.. The DroppedConnections metric on an OCI Load Balancer increments when the load balancer cannot accept or complete a connection — typically because it has hit its bandwidth or new-connections-per-second limit, or because backend servers are too slow to respond and connections time out. Intermittent user-facing failures combined with a spiking DroppedConnections metric point directly to capacity saturation on the load balancer or its backends. NAT Gateway, route table, and DNS TTL issues would produce different symptoms (total unreachability, routing failures, or stale resolution) rather than intermittent drops under load.

Answer

The NAT Gateway is misconfigured.

Answer

The VCN route table is missing a default route.

Answer

The DNS record has an incorrect TTL.

Question 2

Which THREE statements regarding OCI VCN DNS and Hostname resolution are correct?

Accepted Answer

Instances in a VCN can resolve each other using their assigned hostnames.. Option A is correct because OCI's VCN Resolver automatically provides internal DNS resolution, allowing instances within a VCN to resolve each other by their assigned hostnames (e.g., instance FQDN in the vcn.oraclevcn.com domain) without any additional DNS infrastructure. Option C is correct because the VCN Resolver supports forwarding rules that send DNS queries for specific domains to on-premises DNS servers, enabling hybrid DNS resolution over FastConnect or VPN. Option D is correct because OCI allows you to create custom private DNS zones (via the DNS service) and associate them with one or more VCNs, so instances can resolve custom internal names. Option B is wrong because OCI fully supports hosting public DNS zones through the OCI DNS service. Option E is wrong because OCI provides built-in VCN hostname resolution via the VCN Resolver; deploying external BIND servers is not required for basic resolution.

Answer

Public DNS zones cannot be hosted on OCI.

Answer

OCI requires you to deploy external bind DNS servers for basic VCN hostname resolution.

Question 3

Which TWO networking components are required when establishing an OCI Site-to-Site VPN connection using dynamic routing (BGP)?

Accepted Answer

Dynamic Routing Gateway (DRG) configured with BGP ASN. Site-to-Site VPN with dynamic routing requires a CPE object, a DRG attached to the VCN, an IPSec connection with tunnels configured, and BGP ASN configuration on both the OCI side and CPE side.

Answer

Internet Gateway attached to private subnets

Answer

Local Peering Gateway (LPG)

Answer

NAT Gateway for BGP packet translation

Question 4

You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?

Accepted Answer

It automatically routes all DNS queries to the secondary endpoint in Phoenix.. A Failover steering policy routes all traffic to the highest-priority healthy endpoint (Ashburn). If Ashburn fails health checks, it automatically fails over to the secondary endpoint (Phoenix).

Answer

It drops all DNS queries until Ashburn recovers.

Answer

It returns an NXDOMAIN error to the client.

Answer

It round-robins queries between both endpoints equally.

Question 5

An Oracle Cloud Infrastructure (OCI) architect needs to provision a web application that must be accessible directly from the public internet. Which component must be attached to the Virtual Cloud Network (VCN) to allow inbound traffic from the internet?

Accepted Answer

Internet Gateway. An Internet Gateway is a routing component that connects the edge of a VCN with the public internet, enabling bidirectional communication for public resources.

Answer

Service Gateway

Answer

Dynamic Routing Gateway

Answer

NAT Gateway

Question 6

Your development team needs instances residing in a private subnet to download software patches and updates from the Oracle Cloud Infrastructure (OCI) Object Storage service without exposing those instances to the public internet. Which gateway should you configure?

Accepted Answer

Service Gateway. A Service Gateway routes traffic from a VCN to supported Oracle services, such as Object Storage, within the Oracle network fabric without going over the public internet.

Answer

Internet Gateway

Answer

NAT Gateway

Answer

Local Peering Gateway

Question 7

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

Accepted Answer

NAT Gateway. A NAT (Network Address Translation) Gateway allows private subnet instances to initiate outbound connections to the internet while preventing any unsolicited inbound internet traffic.

Answer

Local Peering Gateway

Answer

Internet Gateway

Answer

Dynamic Routing Gateway

Question 8

An administrator configured a Network Security Group (NSG) and a Security List for a compute instance in a subnet. The Security List denies port 443 inbound, but the NSG associated with the instance's primary VNIC explicitly allows port 443 inbound from any source. What will happen when external traffic attempts to access the instance on port 443?

Accepted Answer

Traffic will be allowed because Security List and NSG rules are additive.. OCI security rules are evaluated additively. If either the Security List or the applicable NSG allows the traffic, the traffic is permitted. Therefore, port 443 traffic will be allowed.

Answer

Traffic will be blocked due to the default stateless nature of NSGs.

Answer

Traffic will be dropped because both components must explicitly allow the traffic for it to pass.

Answer

Traffic will be dropped because Security Lists take precedence over Network Security Groups.

Question 9

You are deploying a Public Load Balancer in OCI to distribute incoming web traffic across multiple backend compute instances in different availability domains. You notice that backend health checks are failing. Which component's configuration should you check first to ensure health check probes can reach the backend instances?

Accepted Answer

Security lists or Network Security Groups of the backend instances to allow traffic from the Load Balancer subnet.. Load Balancer backend health checks originate from the Load Balancer's subnet. Security Lists or NSGs attached to the backend instances must allow inbound traffic from the Load Balancer subnet on the backend application ports and health check ports.

Answer

The Service Gateway rules to enable Oracle Object Storage communication.

Answer

The Internet Gateway route table associated with the private subnets.

Answer

The Dynamic Routing Gateway route table to ensure BGP routes are propagated.

Question 10

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

Accepted Answer

DRG route tables and import/export route distribution maps. DRG route tables allow you to customize how traffic flows between attachments. By using DRG attachments and custom route tables on the DRG, you can route traffic from Spoke1 to the Hub VCN attachment, and then from the Hub back out to Spoke2.

Answer

Local Peering Gateways with cross-region peering attachments

Answer

Virtual Circuit FastConnect multipath routing

Answer

Internet Gateway route translation rules

Question 11

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Accepted Answer

The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.. The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.

Answer

The Security List must have a stateful egress rule allowing all protocols to the internet.

Answer

The Local Peering Gateway route table must map the on-premises subnet.

Answer

The NAT Gateway route table must be updated with the on-premises CIDR.

Question 12

When designing network security in OCI, you can use Security Lists and Network Security Groups (NSGs). Which TWO statements accurately compare or contrast them?

Accepted Answer

Security Lists apply to all VNICs in a given subnet, while NSGs apply to a specifically selected set of VNICs.. Option B is correct because Security Lists are subnet-scoped: every VNIC in a subnet automatically inherits the Security List rules attached to that subnet, whereas an NSG is a VNIC-scoped construct that applies only to the specific VNICs (in the same VCN) that you explicitly add to it. Option C is correct because NSG rules can use another NSG as the source or destination, which lets you write rules based on workload roles rather than hard-coded CIDR blocks. Option A is wrong because Security Lists and NSGs can be used simultaneously on the same VNIC, and OCI evaluates the union of their rules. Option D is wrong because Security Lists cannot reference other Security Lists by OCID, and they are VCN-scoped, not cross-VCN. Option E is wrong because both Security Lists and NSGs support stateful rules (and NSGs also support stateless rules), so the claim that NSGs are only stateless and Security Lists only stateful is false.

Answer

You cannot use Security Lists and Network Security Groups together for the same VNIC.

Answer

Security Lists can reference other Security Lists by OCID across different VCNs.

Answer

Network Security Groups can only contain stateless rules, whereas Security Lists only contain stateful rules.

Question 13

Which THREE gateways can be attached to a Dynamic Routing Gateway (DRG) in OCI?

Accepted Answer

FastConnect Virtual Circuits. In OCI, a Dynamic Routing Gateway (DRG) is a virtual router that provides a path for private traffic between a VCN and destinations outside the VCN, and it can be attached to FastConnect Virtual Circuits (option A), which are the private virtual connections provisioned over an Oracle FastConnect partner or dedicated connection, enabling private connectivity between on-premises networks and OCI. A DRG can also be attached to Site-to-Site VPN (option C), where IPsec tunnels terminate on the DRG to provide encrypted connectivity between on-premises networks and the VCN. Additionally, a DRG can be attached to Virtual Cloud Networks (option E) via VCN attachments, which is the fundamental attachment that connects a VCN to the DRG so that traffic can be routed between the VCN and the other attached gateways. Local Peering Gateways (option B) are used to peer VCNs within the same region and attach to VCNs, not to a DRG, and Internet Gateways (option D) provide public internet access for a VCN and attach directly to a VCN, not to a DRG.

Answer

Local Peering Gateways

Answer

Internet Gateways

Question 14

An architect is configuring an OCI Public Load Balancer to handle high volumes of incoming client traffic. Which THREE features or capabilities are supported by OCI Public Load Balancers?

Accepted Answer

Multiple backend sets associated with a single listener via rule sets. Option A is correct because OCI Load Balancer rule sets allow a single listener to route traffic to multiple backend sets based on conditions, enabling flexible traffic distribution for high-volume scenarios. Option C is correct because OCI Public Load Balancers support path-based routing rules (via rule sets) that inspect the URL path and forward requests to different backend sets, which is essential for multi-service architectures. Option D is correct because OCI Load Balancers natively support SSL/TLS termination, including uploading and managing certificates, offloading encryption from backend compute instances. Option B is not correct because OCI Load Balancers do not run BGP with on-premises routers; BGP is used by OCI FastConnect or Site-to-Site VPN, not by the load balancer itself. Option E is not correct because OCI Load Balancers do not automatically translate IPv6 client traffic to IPv4 backends without dual-stack configuration; IPv6 support requires the load balancer and backend to be configured appropriately.

Answer

Native BGP routing directly from the Load Balancer IP to on-premises routers

Answer

Automatic translation of IPv6 client traffic into native IPv4 backend compute instances without dual-stack configuration

Question 15

Your OCI environment requires secure hybrid connectivity using an IPsec VPN over a Dynamic Routing Gateway (DRG). Which THREE parameters or components must be correctly configured to ensure successful IPsec VPN tunnel establishment?

Accepted Answer

IPsec connection tunnels configured with appropriate pre-shared keys (PSK) and cryptographic parameters. Establishing an IPsec VPN tunnel requires a Customer-Premises Equipment (CPE) object representing your on-premises router public IP, a DRG attached to your VCN, and IPsec connection tunnels configured with correct static or BGP routing and pre-shared keys.

Answer

A Local Peering Gateway (LPG) bridging the VPN tunnel to the database subnet

Answer

An Internet Gateway attached to the private subnets handling the VPN traffic