Courseiva

CCNA Multicloud And Hybrid Questions

47 questions · Multicloud And Hybrid · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

A.Azure Application Gateway
B.Azure ExpressRoute Gateway
C.Azure Virtual Network NAT
D.Azure Traffic Manager
AnswerB

An ExpressRoute Gateway is required on the Azure side to terminate the ExpressRoute circuit.

Why this answer

The Azure ExpressRoute circuit connects to an Azure ExpressRoute Gateway (Virtual Network Gateway) deployed in the target Virtual Network to facilitate cross-cloud communication.

Practice this question →
2
Multi-Selecthard

An architect is designing a hybrid network using OCI FastConnect. Which THREE components are mandatory for setting up a Private Virtual Circuit using a FastConnect Partner? (Choose THREE)

Select 3 answers
A.Virtual Cloud Network (VCN)
B.OCI Web Application Firewall (WAF)
C.Customer-Premises Equipment (CPE) object
D.Dynamic Routing Gateway (DRG)
E.FastConnect Virtual Circuit
AnswersA, D, E

A VCN is required so the DRG can attach to it and route traffic to workloads.

Why this answer

To set up a partner FastConnect virtual circuit, you need a VCN, a DRG attached to that VCN, and a FastConnect Virtual Circuit object configured with the partner details which generates the service key for the partner.

Practice this question →
3
MCQmedium

You need to connect an on-premises datacenter to OCI using FastConnect with a Partner model. Which component must you configure in the OCI console before provisioning the virtual circuit with the FastConnect partner?

A.FastConnect Virtual Circuit with a partner provider
B.Local Peering Gateway
C.Customer-Premises Equipment (CPE) object
D.Internet Gateway
AnswerA

Creating the virtual circuit generates an Oracle OCID that you provide to your FastConnect partner.

Why this answer

To set up a Partner FastConnect, you must create a Dynamic Routing Gateway (DRG) and a FastConnect virtual circuit specifying the partner provider.

Practice this question →
4
Multi-Selecthard

An administrator is troubleshooting intermittent packet loss and latency spikes over an OCI FastConnect circuit connected to an on-premises datacenter. Which THREE diagnostic steps or tools are applicable within OCI? (Choose THREE)

Select 3 answers
A.Checking OCI Monitoring metrics for the FastConnect virtual circuit to review bandwidth utilization and error drops.
B.Using OCI Network Path Analyzer to simulate packet paths and verify reachability between VCN instances and on-premises IPs.
C.Modifying the OCI tenancy tenancy home region to reroute physical fiber cables.
D.Verifying BGP session status and logs on the DRG and on-premises routers to check for route flapping.
E.Rebooting the OCI IAM service to reset global routing tables.
AnswersA, B, D

OCI Monitoring provides metrics on traffic volume, drops, and interface health.

Why this answer

Troubleshooting hybrid network performance involves using OCI Network Path Analyzer to check reachability/routing, monitoring FastConnect virtual circuit metrics (such as bandwidth and error drops) in OCI Monitoring, and verifying BGP session stability.

Practice this question →
5
MCQhard

An architect is designing a high-availability hybrid cloud strategy utilizing OCI FastConnect and OCI Site-to-Site VPN to the same VCN. To ensure automatic failover from FastConnect to VPN without routing loops, what design pattern must be implemented on the OCI Dynamic Routing Gateway (DRG)?

A.Utilize separate DRG route tables for FastConnect and VPN attachments, ensuring VPN route rules have a more specific prefix or backup preference configured via static overrides if BGP fails.
B.Enable Equal-Cost Multi-Path (ECMP) routing on the DRG to split packets evenly across FastConnect and VPN.
C.Configure identical metric values for both FastConnect and VPN routes within a single DRG route table to load-balance traffic.
D.Attach both the FastConnect virtual circuit and the VPN tunnel to the default VCN route table directly, bypassing the DRG.
AnswerA

Setting up explicit route preferences or utilizing static backup routes ensures that traffic seamlessly fails over to the VPN when the FastConnect BGP session drops.

Why this answer

To achieve active-passive failover between FastConnect and Site-to-Site VPN, you configure the DRG route tables such that routes learned via FastConnect have a preferred path (or lower priority metric if using static, but FastConnect uses BGP where AS-path prepending or local preference controls the path, whereas VPN connections can be configured with specific priorities in the DRG route rules). Specifically, DRG route tables allow you to set static routes or manage BGP preferences so that VPN routes act as backups.

Practice this question →
6
MCQmedium

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

A.You must physically patch your fiber into Oracle's Meet-Me-Room.
B.You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.
C.Traffic is routed exclusively over the public internet with guaranteed SLA.
D.Oracle installs a dedicated router inside your on-premises datacenter.
AnswerB

The Provider model leverages partner networks to reach OCI without a direct cage in an Oracle datacenters.

Why this answer

In the FastConnect Provider model, you connect via an OCI partner (such as Equinix, Megaport, or AT&T) who provides network connectivity to an OCI region, whereas the Colocation model requires you to have infrastructure physically installed in an Oracle-partner datacenter where OCI routers reside.

Practice this question →
7
MCQhard

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

A.Enable OCI Database Vault on the compute instances.
B.Replace the OCI Dynamic Routing Gateway with an Internet Gateway.
C.Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.
D.Recreate the Azure ExpressRoute circuit in a different Azure subscription.
AnswerC

Mismatched MTU sizes causing fragmentation can severely impact performance across cloud interconnects.

Why this answer

Checking the FastConnect virtual circuit status, monitoring traffic metrics, and checking for packet drops or incorrect routing paths via OCI Monitoring and Network Path Analyzer is the correct first diagnostic step.

Practice this question →
8
MCQhard

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

A.Configure an OCI Service Gateway to route traffic to Azure public endpoints.
B.Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.
C.Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.
D.Enable Oracle Autonomous Database cross-region data guard.
AnswerC

Service mesh cross-cloud communication requires robust private IP routing and open ports for control/data plane discovery.

Why this answer

A cross-cloud service mesh requires IP reachability between the control plane and data planes across the VCN and VNet, typically facilitated by the OCI-Azure Interconnect and properly configured routing and security rules.

Practice this question →
9
MCQeasy

What is the maximum supported MTU (Maximum Transmission Unit) size for traffic passing through an OCI FastConnect virtual circuit by default?

A.9000 bytes
B.1500 bytes
C.576 bytes
D.65535 bytes
AnswerA

OCI FastConnect supports Jumbo Frames up to 9000 bytes.

Why this answer

OCI supports standard 1500 bytes and Jumbo Frames up to 9000 bytes for FastConnect virtual circuits, depending on the DRG and VCN configuration.

Practice this question →
10
Multi-Selectmedium

When designing a high-performance hybrid architecture integrating an on-premises data center with OCI, which THREE key factors should be evaluated to optimize network throughput and reliability?

Select 3 answers
A.BGP timer tuning for faster convergence and failover detection
B.Maximum Transmission Unit (MTU) size configuration (supporting Jumbo Frames up to 9000 bytes)
C.Enabling public IP addresses on all internal database nodes
D.Configuring Local Peering Gateways for on-premises connectivity
E.Physical path diversity and carrier redundancy for FastConnect circuits
AnswersA, B, E

Tuning BGP keepalive and holddown timers allows faster detection of link failures.

Why this answer

When planning FastConnect or VPN connections, factors such as MTU size (Jumbo frames), redundant physical links or diverse paths, and BGP multipath or dead-peer detection timers heavily impact performance and reliability.

Practice this question →
11
MCQmedium

You need to connect multiple on-premises branch offices to a single OCI VCN using OCI Site-to-Site VPN. Each branch office uses overlapping private IP address ranges (e.g., 192.168.1.0/24). Which OCI component must you utilize to manage overlapping IP spaces and route traffic correctly?

A.Configure multiple DRG route tables and assign each branch office VPN attachment to a distinct DRG route table with custom import/export rules.
B.Attach an Internet Gateway to each VPN connection to translate overlapping subnets.
C.Deploy separate OCI Dynamic Routing Gateways (DRGs) for each branch office and use Local Peering Gateways.
D.Enable OCI Service Gateway to automatically perform NAT on overlapping customer networks.
AnswerA

Using multiple DRG route tables allows network administrators to isolate and control routing paths for different hybrid attachments.

Why this answer

When dealing with overlapping IP addresses from multiple branch offices connecting to OCI via VPN, Network Address Translation (NAT) must be implemented on the customer premises equipment (CPE) or via advanced routing features since standard OCI DRG routing expects unique CIDRs. Alternatively, OCI's NAT capabilities on DRG attachments can assist, but network design requires careful routing domain isolation. Wait, let's look at OCI DRG route tables.

OCI DRGs support multiple DRG route tables and attachments to handle complex multitenant and hybrid routing scenarios, but overlapping CIDRs typically require NAT on the CPE side. Let's refine the distractor or make sure the question targets DRG route tables for hybrid segmentation. Let's adjust the stem to multi-VCN routing to avoid ambiguity.

Practice this question →
12
MCQmedium

Your security team requires that all data traversing the OCI-Azure Interconnect must be encrypted. Does the standard OCI-Azure Interconnect encrypt traffic natively at Layer 3?

A.Yes, Oracle and Microsoft automatically handle TLS 1.3 encryption for all packets.
B.Yes, all traffic is encrypted using MACsec by default.
C.No, native interconnect traffic is unencrypted; you must layer IPsec VPN over the interconnect if encryption is mandatory.
D.No, and encryption is strictly prohibited by Oracle security policies.
AnswerC

Interconnect circuits do not provide native encryption; an IPsec tunnel must be built on top if encryption is required.

Why this answer

The OCI-Azure Interconnect uses dedicated Layer 2/Layer 3 circuits (ExpressRoute to FastConnect) which do not natively encrypt data in transit; customers must implement overlay encryption (like IPsec VPN) if encryption is required.

Practice this question →
13
MCQhard

An administrator has set up a FastConnect public peering session to access OCI Object Storage from an on-premises data center without traversing the public internet. However, on-premises hosts are still failing to resolve the Object Storage public IP addresses. What must be configured to ensure proper routing and resolution?

A.Configure the on-premises DNS to forward OCI service domain queries to the VCN resolver and advertise the required public IP prefixes over the BGP session.
B.Create a local peering gateway on the VCN and peer it with the FastConnect virtual circuit.
C.Deploy an OCI DRG and configure static routes pointing to the Object Storage service endpoints.
D.Attach a NAT Gateway to the VCN and configure default routes pointing traffic to the FastConnect circuit.
AnswerA

Public peering requires advertising public IP prefixes over BGP and configuring on-premises DNS to resolve OCI public endpoints correctly.

Why this answer

When using FastConnect public peering, on-premises DNS servers must be configured to resolve OCI object storage endpoints to public IPs that route over the FastConnect public virtual circuit, and BGP must advertise the correct public prefix routes.

Practice this question →
14
Multi-Selecthard

You are troubleshooting a cross-cloud connectivity issue between an OCI VCN and an Azure VNet via the OCI-Azure Interconnect. Traffic is dropping intermittently between the environments. Which THREE diagnostic steps or configuration checks should you perform?

Select 3 answers
A.Inspect OCI VCN route tables and Azure route tables to ensure return paths are correctly specified.
B.Attach an Internet Gateway to the Azure VNet to route private interconnect packets.
C.Configure an OCI Local Peering Gateway to bridge the Azure and OCI subnets.
D.Verify that BGP status on both the OCI DRG and Azure Virtual Network Gateway is in the Established state.
E.Check Network Security Groups (NSGs) in OCI and Network Security Groups in Azure for overly restrictive security rules.
AnswersA, D, E

Missing or incorrect route table rules will cause asymmetric routing or packet drops.

Why this answer

Troubleshooting the OCI-Azure Interconnect involves checking BGP route advertisement status, verifying Network Security Group (NSG) and route table rules on both clouds, and inspecting MTU matching across the circuit.

Practice this question →
15
MCQmedium

Your organization is implementing a multicloud strategy where workloads in OCI must securely communicate with workloads in AWS over a private connection. You decide to set up a third-party software virtual appliance (VPN gateway) inside an OCI VCN. What specific VCN configuration change is required to ensure that return traffic from OCI compute instances correctly routes back through the virtual appliance instance?

A.Configure a Local Peering Gateway on the appliance subnet.
B.Disable 'Source/Destination Check' on the virtual appliance's VNIC and update the VCN route table to point traffic to the appliance's private IP.
C.Enable 'Source/Destination Check' on the virtual appliance's VNIC.
D.Attach an Internet Gateway to the virtual appliance instance to route packets to AWS.
AnswerB

Disabling Source/Destination Check allows the virtual appliance to act as a router/firewall forwarding packets across networks.

Why this answer

When deploying third-party firewall or routing appliances in OCI to handle hybrid or multicloud traffic, you must disable 'Source/Destination Check' on the VNIC of the appliance instance so it can forward traffic not addressed to it directly.

Practice this question →
16
MCQeasy

An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?

A.OCI Site-to-Site VPN
B.OCI FastConnect
C.OCI Internet Gateway
D.Oracle Database Gateway
AnswerB

FastConnect provides private connectivity between your data center and OCI with higher bandwidth and predictability.

Why this answer

OCI FastConnect provides a dedicated, private connection with higher bandwidth options and more reliable network performance compared to internet-based VPNs, making it the ideal choice for connecting on-premises data centers to OCI.

Practice this question →
17
Multi-Selecthard

An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)

Select 3 answers
A.MACsec encryption on FastConnect dedicated circuits
B.OCI Site-to-Site IPSec VPN tunnels
C.Application-level encryption such as TLS 1.3 or HTTPS
D.OCI Internet Gateway packet inspection
E.OCI Local Peering Gateways with default encryption
AnswersA, B, C

MACsec provides Layer 2 encryption across FastConnect dedicated connections.

Why this answer

Data in transit can be secured using OCI Site-to-Site IPSec VPN, MACsec encryption on FastConnect circuits, or application-layer encryption (such as TLS/HTTPS).

Practice this question →
18
MCQhard

An administrator needs to configure DNS resolution between an on-premises datacenter and OCI. On-premises servers must resolve hostnames of compute instances in an OCI VCN. Which OCI service component must be utilized to achieve this?

A.OCI Internet Gateway DNS proxy
B.OCI Email Delivery DNS records
C.OCI Private DNS Resolver with a Listener and forwarding rules
D.OCI Load Balancer DNS plugin
AnswerC

OCI Private DNS Resolver listeners accept DNS queries from on-premises and resolve VCN records or forward queries.

Why this answer

To enable conditional forwarding from on-premises to OCI, or vice versa, you configure OCI Private DNS Resolver endpoints and rules.

Practice this question →
19
Multi-Selectmedium

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Select 2 answers
A.Automatically peering AWS VPC route tables directly from the DRG console.
B.Using route distributions to control which routes are imported into or exported from a DRG route table.
C.Importing static or dynamic routes from FastConnect and VPN attachments into DRG route tables.
D.Enabling Ophaned route garbage collection on Internet Gateways.
E.Converting OCI VCN subnets into Azure Subnets via DRG translation rules.
AnswersB, C

Route distributions provide fine-grained control over route propagation in DRGs.

Why this answer

DRG route tables allow importing and exporting routes between attachments. You can use route distributions to filter imported or exported routes based on match conditions.

Practice this question →
20
MCQeasy

What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?

A.To authenticate OCI console users via single sign-on.
B.To encrypt all payloads traversing the FastConnect physical fiber.
C.To assign public IP addresses to OCI compute instances.
D.To uniquely identify routing domains and enable dynamic exchange of network routes between OCI and on-premises routers.
AnswerD

ASNs are mandatory identifiers for establishing BGP peering and route advertisement.

Why this answer

BGP ASNs uniquely identify routing domains and are required to establish BGP peering sessions for dynamic route exchange over FastConnect.

Practice this question →
21
MCQeasy

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

A.SSL/TLS v1.3 with RSA key exchange
B.SSH tunneling with Blowfish cipher
C.PPTP with MPPE 128-bit encryption
D.IKEv2 with AES-256 encryption and SHA-2 hashing
AnswerD

OCI natively supports IKEv1 and IKEv2 with robust encryption standards such as AES-256 and SHA-2.

Why this answer

OCI Site-to-Site VPN supports industry-standard IPsec VPN protocols, including Internet Key Exchange version 2 (IKEv2) and strong encryption algorithms like AES-256 with SHA-2.

Practice this question →
22
MCQmedium

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

A.Local Peering mode
B.Dynamic Routing (BGP) mode
C.FastConnect Partner mode
D.Static Routing mode
AnswerD

Static routing mode allows you to specify static CIDR blocks for the on-premises network.

Why this answer

OCI Site-to-Site VPN supports both dynamic routing (BGP) and static routing. You must select static routing and define the static CIDR routes for your on-premises network.

Practice this question →
23
Multi-Selecthard

An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)

Select 3 answers
A.Dynamic Routing Gateway (DRG) for hybrid ingress/egress
B.OCI Internet Gateway for public IP resolution
C.OCI Email Delivery service for database alert routing
D.Virtual Cloud Network (VCN) acting as the transit and hosting environment
E.Private Endpoints associated with the Autonomous Database instance
AnswersA, D, E

The DRG terminates the FastConnect or VPN connection from on-premises.

Why this answer

Private hybrid access to Autonomous Database requires a Dynamic Routing Gateway (DRG) connected via FastConnect or VPN, a VCN, and a Service Gateway or Private Endpoint depending on whether it is Autonomous Database Dedicated/Shared (Shared uses Private Endpoints in the VCN, and hybrid traffic reaches them via DRG and VCN routing).

Practice this question →
24
MCQmedium

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

A.DRG attachments and DRG Route Tables
B.Local Peering Gateway chaining
C.Internet Gateway route forwarding
D.Service Gateway cross-region peering
AnswerA

DRG route tables allow granular routing control across multiple VCN and hybrid attachments.

Why this answer

The DRG v2 architecture includes DRG attachments and DRG route tables, allowing you to centrally manage routing between multiple VCNs, remote VCN peering, and hybrid connections (FastConnect/VPN).

Practice this question →
25
MCQhard

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

A.Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.
B.Configure an OCI Internet Gateway to peer with GCP Cloud DNS.
C.Attach a GCP VPC as a secondary VCN in the OCI console.
D.Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.
AnswerD

SDN exchange providers allow cross-connection between FastConnect and GCP Interconnect at Layer 2/3.

Why this answer

Using a third-party network virtualization appliance (such as Megaport Cloud Router or Equinix Fabric) to bridge OCI FastConnect and GCP Interconnect provides private multicloud connectivity.

Practice this question →
26
MCQmedium

You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?

A.8 tunnels
B.4 tunnels
C.1 tunnel
D.2 tunnels
AnswerD

OCI provisions two tunnels by default for redundancy and high availability.

Why this answer

Each OCI Site-to-Site VPN connection provides two redundant IPsec tunnels terminating on different Oracle-side VPN gateway public IPs.

Practice this question →
27
MCQeasy

Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?

A.Local Peering Gateway
B.NAT Gateway
C.Dynamic Routing Gateway (DRG)
D.Internet Gateway
AnswerC

The DRG is the hub for connecting VCNs to FastConnect, VPNs, and remote VCN peerings.

Why this answer

The Dynamic Routing Gateway (DRG) acts as the single router hub for all hybrid and inter-VCN connectivity in OCI.

Practice this question →
28
MCQhard

Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?

A.Configure a local peering route to the Azure ExpressRoute circuit.
B.Add a route pointing the Azure VNet CIDR to the Internet Gateway.
C.Add a route in the DRG route table pointing the Azure VNet CIDR to the FastConnect virtual circuit attachment.
D.Attach an Azure VNet directly as a subnet inside the OCI VCN.
AnswerC

The DRG route table must direct traffic destined for Azure's CIDR blocks to the cross-cloud ExpressRoute virtual circuit.

Why this answer

The DRG must have an import route distribution or static/dynamic route entries pointing the Azure VNet CIDR blocks toward the virtual circuit attachment associated with the Azure ExpressRoute.

Practice this question →
29
Multi-Selectmedium

Which TWO of the following statements are correct regarding the OCI-Azure Interconnect? (Choose TWO)

Select 2 answers
A.It requires public IP addresses on all Azure Virtual Machines for cross-cloud routing.
B.It provides low-latency, dedicated private connectivity between OCI Virtual Cloud Networks and Azure Virtual Networks.
C.It requires the customer to pay standard OCI and Azure egress data transfer fees across the interconnect.
D.It is available in every OCI region globally without exception.
E.It connects OCI FastConnect directly to Azure ExpressRoute in supported multicloud regions.
AnswersB, E

The primary goal is low-latency private connectivity between VCNs and VNets.

Why this answer

The OCI-Azure Interconnect provides low-latency, high-throughput direct connectivity between OCI and Azure in supported regions. It utilizes FastConnect on the OCI side and ExpressRoute on the Azure side, and does not incur egress data transfer charges between the clouds.

Practice this question →
30
MCQmedium

You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?

A.Traffic cannot be routed between the on-premises network and OCI over FastConnect.
B.Traffic automatically fails over to the Internet Gateway.
C.OCI automatically falls back to an unencrypted IPSec VPN tunnel.
D.The FastConnect port is administratively disabled by Oracle.
AnswerA

BGP is required for route propagation; without it, connectivity over FastConnect is down.

Why this answer

Without BGP, route prefixes are not exchanged, meaning traffic cannot be routed between the on-premises network and the OCI VCN over FastConnect.

Practice this question →
31
MCQhard

You are designing an active-active hybrid architecture between an on-premises datacenter and OCI using two separate FastConnect circuits connected to two different DRG attachments. How does OCI determine path selection when receiving identical BGP route advertisements from both circuits?

A.OCI automatically enforces round-robin load balancing regardless of BGP advertisements.
B.Active-active routing is not supported; OCI randomly drops packets on duplicate routes.
C.OCI always selects the circuit with the lower OCID alphabetically.
D.The DRG uses standard BGP best path selection criteria, including AS Path length and Local Preference.
AnswerD

OCI respects standard BGP attributes for route selection across multiple hybrid connections.

Why this answer

OCI DRGs evaluate standard BGP attributes (such as AS Path length and Local Preference) to determine best path selection for incoming hybrid routes.

Practice this question →
32
Multi-Selectmedium

Which TWO factors should be evaluated when choosing between an OCI FastConnect Colocation model and a Provider model? (Choose TWO)

Select 2 answers
A.Whether the customer wants to use an OCI partner (like Equinix or Megaport) to reach OCI from external datacenters.
B.Whether the customer wants to route FastConnect traffic over the public internet for cost savings.
C.Whether the customer has existing physical infrastructure or a cage in an Oracle-partner colocation facility.
D.Whether Oracle requires root administrator access to the customer's on-premises firewall.
E.Whether the Virtual Cloud Network uses IPv6 or IPv4 addressing.
AnswersA, C

The Provider model leverages third-party network providers to reach OCI.

Why this answer

The Colocation model requires the customer to have physical presence (rack/cage) in the Oracle datacenter or meet-me-room, whereas the Provider model allows connection via a network partner from their existing datacenters or pops.

Practice this question →
33
MCQhard

An architect is designing a multi-cloud disaster recovery strategy between OCI and AWS. Production data resides in an Oracle Autonomous Database on OCI, and application servers run in AWS EC2. To secure the network traffic between AWS and OCI without routing over the public internet, which approach should be implemented?

A.Configure an IPSec VPN tunnel between an AWS Virtual Private Gateway and an OCI Dynamic Routing Gateway.
B.Peer an AWS VPC directly to an OCI VCN using Local Peering Gateways.
C.Attach an AWS Elastic IP directly to the OCI Autonomous Database.
D.Use OCI Object Storage pre-authenticated requests over HTTPS.
AnswerA

An IPsec VPN tunnel between AWS VGW and OCI DRG allows secure cross-cloud traffic over encrypted tunnels.

Why this answer

Establishing a Site-to-Site VPN connection between an AWS Virtual Private Gateway (VGW) and an OCI Dynamic Routing Gateway (DRG) provides secure private connectivity over the internet or via AWS Direct Connect/OCI FastConnect partner exchanges.

Practice this question →
34
MCQhard

An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?

A.Deploy an OCI NAT Gateway inside the VCN.
B.Re-address one of the virtual networks to ensure non-overlapping IP address spaces.
C.Configure a Dynamic Routing Gateway route table with static overriding rules.
D.Enable FastConnect MACsec encryption.
AnswerB

Overlapping IP spaces cannot be routed directly across an ExpressRoute/FastConnect interconnect without re-addressing or complex NAT appliances.

Why this answer

When IP address spaces overlap between interconnected clouds, Network Address Translation (NAT) must be implemented, or the networks must be re-addressed to be non-overlapping because standard routing cannot resolve overlapping prefixes.

Practice this question →
35
MCQeasy

Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?

A.OCI Storage Gateway
B.OCI API Gateway
C.OCI Site-to-Site VPN
D.OCI Bastion Service
AnswerC

OCI Site-to-Site VPN provides secure IPsec tunnels to on-premises networks.

Why this answer

The OCI Site-to-Site VPN service uses IPsec tunnels connecting an on-premises customer-premises equipment (CPE) to an OCI Dynamic Routing Gateway (DRG).

Practice this question →
36
Multi-Selecteasy

Which TWO of the following are valid deployment models or connection types supported by OCI FastConnect?

Select 2 answers
A.FastConnect direct model
B.FastConnect public internet gateway model
C.FastConnect partner (Provider) model
D.FastConnect IPsec tunnel overlay model
E.FastConnect satellite uplink model
AnswersA, C

You can connect directly to an Oracle router from your colocation facility.

Why this answer

OCI FastConnect supports provider-specific connections (Layer 2 or Layer 3 via partners) and direct connections where the customer connects directly to an Oracle router in a FastConnect location.

Practice this question →
37
Multi-Selectmedium

Which TWO methods can be used to achieve high availability for an OCI Site-to-Site VPN connection to an on-premises datacenter? (Choose TWO)

Select 2 answers
A.Running Ophalmic routing daemons on OCI compute instances.
B.Setting up multiple Customer-Premises Equipment (CPE) objects and redundant VPN connections.
C.Enabling OCI Bastion service across all VPN subnets.
D.Configuring redundant IPSec tunnels provided automatically by OCI on separate Oracle gateway endpoints.
E.Attaching an Internet Gateway directly to the VPN tunnel endpoints.
AnswersB, D

Using multiple CPEs and VPN connections protects against on-premises hardware failures.

Why this answer

OCI automatically provides two tunnels per VPN connection. Additionally, customers can deploy multiple CPE devices or multiple VPN connections to ensure redundancy against CPE failure or Oracle gateway maintenance.

Practice this question →
38
MCQmedium

You are configuring the OCI-Azure Interconnect to link an OCI Virtual Cloud Network (VCN) with an Azure Virtual Network (VNet). You have already established the FastConnect and ExpressRoute circuits. What is the mandatory next step to enable cross-cloud routing between the OCI Dynamic Routing Gateway (DRG) and the Azure Virtual Network Gateway?

A.Configure an OCI Service Gateway to route traffic to Azure services directly.
B.Attach the Azure VNet directly to an OCI Local Peering Gateway (LPG).
C.Establish a BGP session between the OCI DRG and the Azure Virtual Network Gateway over the FastConnect/ExpressRoute circuit.
D.Deploy an OCI NAT Gateway to translate Azure private IP addresses into OCI public IP addresses.
AnswerC

Cross-cloud connectivity requires BGP peering configuration to exchange routing information between the OCI DRG and Azure Virtual Network Gateway.

Why this answer

Oracle and Microsoft manage the interconnect partners, but the routing configuration requires peering the OCI Dynamic Routing Gateway (DRG) with the Azure Virtual Network Gateway using the specific peering mechanisms provided by the Oracle Interconnect for Azure setup wizard or manual BGP peering over the circuit.

Practice this question →
39
MCQeasy

What is the primary function of an OCI Service Gateway?

A.To translate private IP addresses to public IP addresses for internet bound traffic
B.To provide private access to Oracle public services without using public IP addresses or the internet
C.To connect on-premises datacenters to OCI via FastConnect
D.To load balance HTTP/HTTPS traffic across multiple backend servers
AnswerB

Service Gateways provide optimized, private routing to regional OCI services.

Why this answer

A Service Gateway allows private access from a VCN to Oracle Cloud services (such as Object Storage) without traversing the public internet.

Practice this question →
40
Multi-Selecthard

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Select 3 answers
A.Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.
B.Using OCI Traffic Management Steering to fail over DNS traffic between OCI and AWS endpoints based on health checks.
C.Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.
D.Replicating OCI IAM identity domains natively inside AWS IAM without federation.
E.Establishing redundant IPsec VPN tunnels between OCI DRG and AWS VGW for secure private connectivity.
AnswersA, B, E

Database-level replication ensures data synchronization for DR across clouds.

Why this answer

Multicloud DR strategies include active-passive database replication (e.g., Oracle Data Guard between OCI and custom cloud deployments), DNS-based global traffic management (like OCI Traffic Management Steering), and cloud-to-cloud VPN/interconnect backup links.

Practice this question →
41
MCQeasy

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

A.RIP (Routing Information Protocol)
B.BGP (Border Gateway Protocol)
C.EIGRP (Enhanced Interior Gateway Routing Protocol)
D.OSPF (Open Shortest Path First)
AnswerB

BGP is the industry standard protocol used for dynamic routing in OCI hybrid connections.

Why this answer

Border Gateway Protocol (BGP) is the routing protocol used to dynamically exchange routes over FastConnect and dynamic routing VPN tunnels.

Practice this question →
42
MCQmedium

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

A.On the OCI Bastion service configuration page.
B.In the DRG route table import/export distribution or static route configuration for the VPN attachment.
C.Inside the OCI Identity and Access Management (IAM) policy console.
D.By modifying the VCN DHCP options.
AnswerB

Route filtering and propagation control for hybrid attachments are managed via DRG route tables and route distributions.

Why this answer

In OCI DRGs using DRG route tables and import/export route distributions, you can control which routes are accepted or advertised, or you can manage prefixes in the CPE/VPN static route configurations.

Practice this question →
43
MCQmedium

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

A.Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.
B.The FastConnect virtual circuit is disabled.
C.The OCI VCN does not have an Internet Gateway attached.
D.The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.
AnswerA

Even with a working VPN tunnel, OCI security rules and OS firewalls must permit the traffic.

Why this answer

If the tunnel is up, Layer 3/IPsec is established. Failure to ping usually stems from VCN Security Lists, Route Tables, or OS-level host firewalls (iptables/firewalld) blocking ICMP or return traffic.

Practice this question →
44
MCQhard

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

A.In the same subnet, pinned to a single physical host.
B.Inside the OCI Control Plane root compartment.
C.On bare metal instances without any virtual cloud networks.
D.Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.
AnswerD

Deploying across ADs/FDs prevents a single point of failure for the multicloud connectivity tier.

Why this answer

To ensure high availability and fault tolerance against infrastructure failures, SD-WAN appliance instances should be deployed across different Availability Domains (ADs) or Fault Domains (FDs) behind an OCI Load Balancer or using BGP failover.

Practice this question →
45
MCQeasy

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

A.Ability to route traffic over public cellular networks
B.Zero configuration required on the on-premises router
C.Automatic encryption of all traffic at Layer 2 by default
D.Higher bandwidth, lower latency, and predictable performance
AnswerD

FastConnect bypasses the public internet for dedicated, high-performance connectivity.

Why this answer

FastConnect provides higher bandwidth, lower latency, and more predictable network performance compared to internet-based IPSec VPNs.

Practice this question →
46
MCQmedium

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

A.Local Peering Gateway
B.Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit
C.NAT Gateway
D.Internet Gateway
AnswerB

FastConnect virtual circuits terminate at the DRG, enabling BGP session establishment.

Why this answer

A Virtual Circuit must be created and associated with the FastConnect provider/colocation port, and the DRG must be attached to a Virtual Cloud Network (VCN) via DRG attachments, but for BGP peering, the FastConnect virtual circuit terminates directly on the DRG.

Practice this question →
47
MCQeasy

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

A.NAT Gateway
B.Service Gateway
C.Customer-Premises Equipment (CPE)
D.Virtual Cloud Network (VCN)
AnswerC

A CPE object represents your on-premises router or firewall in OCI.

Why this answer

You must create a Customer-Premises Equipment (CPE) object in OCI representing the public IP address and routing parameters of your on-premises router.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Multicloud And Hybrid questions.

Start 20-question session