Courseiva

CCNA Multicloud And Hybrid Questions

34 questions · Multicloud And Hybrid · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An enterprise architect is deploying the OCI-Azure Interconnect in the Ashburn region. Which specific Azure networking resource is directly associated with the Azure side of the ExpressRoute circuit created during the onboarding process?

A.Azure Application Gateway
B.Azure ExpressRoute Gateway
C.Azure Virtual Network NAT
D.Azure Traffic Manager
AnswerB

The ExpressRoute virtual network gateway terminates the Azure side of the ExpressRoute circuit provisioned by OCI-Azure Interconnect, providing the BGP peering endpoint required for private connectivity. It satisfies the Ashburn deployment's need for a directly associated Azure resource, unlike ExpressRoute circuits themselves, which are logical connectivity constructs rather than the gateway terminating traffic.

Why this answer

The Azure ExpressRoute Gateway is the specific Azure-side resource that terminates the ExpressRoute circuit and connects it to the Azure Virtual Network. During OCI-Azure Interconnect onboarding, the ExpressRoute circuit is created and then associated with an ExpressRoute Gateway in the designated Azure subscription and VNet. This gateway provides the private connectivity endpoint for traffic coming from OCI via the ExpressRoute peering.

Exam trap

The trap here is confusing Azure's various gateway types (VPN Gateway, Application Gateway, NAT Gateway) with the ExpressRoute Gateway, which is the only one that terminates an ExpressRoute circuit.

How to eliminate wrong answers

Option A is wrong because Azure Application Gateway is a layer-7 web traffic load balancer and WAF, not a private connectivity endpoint for ExpressRoute. Option C is wrong because Azure Virtual Network NAT provides outbound internet connectivity for subnets, not private circuit termination. Option D is wrong because Azure Traffic Manager is a DNS-based global traffic distribution service, unrelated to ExpressRoute circuit attachment.

Practice this question →
2
MCQmedium

You are setting up FastConnect and need to choose between the FastConnect Provider model and the FastConnect Colocation model. What is the key characteristic of the Provider model?

A.You must physically patch your fiber into Oracle's Meet-Me-Room.
B.You connect via an OCI partner network provider without needing physical equipment in an Oracle-partner datacenter.
C.Traffic is routed exclusively over the public internet with guaranteed SLA.
D.Oracle installs a dedicated router inside your on-premises datacenter.
AnswerB

The Provider model routes connectivity through an OCI partner's existing network, so no physical cross-connect or router equipment is required in an Oracle-partner datacentre. That removes the colocation hardware burden, which is the defining characteristic distinguishing it from the Colocation model.

Why this answer

In the FastConnect Provider model, you establish connectivity through an Oracle-approved partner (e.g., Equinix Fabric, Megaport, AT&T) that already has a presence in the Oracle Cloud region. You do not need to install or patch your own equipment in an Oracle Meet-Me-Room; the partner handles the Layer 2/3 handoff. This contrasts with the Colocation model, where you must physically deploy your router in a colocation facility connected to Oracle.

Exam trap

1Z0-997-26 often tests the confusion between Provider and Colocation models — candidates incorrectly assume Provider requires physical equipment in an Oracle facility, when that describes Colocation.

How to eliminate wrong answers

Option A is wrong because physically patching fiber into Oracle's Meet-Me-Room describes the Colocation model, not the Provider model. Option C is wrong because FastConnect never routes traffic over the public internet — that would be a Site-to-Site VPN or public internet path, and FastConnect provides a private dedicated or partner-hosted connection with SLAs. Option D is wrong because Oracle does not install routers inside customer datacenters; that is not part of any FastConnect model.

Practice this question →
3
MCQhard

An organization has configured an OCI-Azure Interconnect. Latency measurements between an OCI compute instance and an Azure VM exceed acceptable thresholds for a synchronous database replication application. Which diagnostic step should be taken first within OCI?

A.Enable OCI Database Vault on the compute instances.
B.Replace the OCI Dynamic Routing Gateway with an Internet Gateway.
C.Verify the MTU settings across the OCI VCN, DRG, Azure VNet, and ExpressRoute gateway to check for fragmentation issues.
D.Recreate the Azure ExpressRoute circuit in a different Azure subscription.
AnswerC

MTU mismatches between OCI VCN, DRG, ExpressRoute gateway and Azure VNet cause fragmentation or silent drops, inflating latency for synchronous replication. Verifying consistent MTU (typically 1500 or jumbo) across every hop is the fastest first diagnostic before deeper path analysis.

Why this answer

When latency across an OCI-Azure Interconnect exceeds thresholds, the first diagnostic step within OCI is to verify MTU settings end to end — OCI VCN, DRG, Azure VNet, and the ExpressRoute gateway. MTU mismatches cause fragmentation or dropped large packets, which manifest as high latency and retransmissions rather than outright connectivity loss. Checking MTU is a low-cost, high-value first step before touching circuits or subscriptions.

Exam trap

The trap is jumping to drastic remediation (recreating circuits, changing gateways) instead of performing the standard first-line diagnostic of verifying MTU and fragmentation across all interconnect hops.

How to eliminate wrong answers

Option A is wrong because OCI Database Vault is a security feature for protecting privileged database access and has no relationship to interconnect latency. Option B is wrong because replacing the DRG with an Internet Gateway would route traffic over the public internet, which would worsen latency and defeat the purpose of a dedicated interconnect. Option D is wrong because recreating the ExpressRoute circuit in a different Azure subscription is a drastic, disruptive action that does not address the likely root cause and is not a first diagnostic step.

Practice this question →
4
MCQhard

An architect is designing a multi-cloud application where microservices in OCI need to communicate securely with microservices in Azure. They decide to deploy a service mesh (such as Istio) spanning both OCI and Azure. What network prerequisite is essential across the OCI VCN and Azure VNet for the control plane to communicate?

A.Configure an OCI Service Gateway to route traffic to Azure public endpoints.
B.Deploy an OCI NAT Gateway to translate all Azure IP addresses to OCI public IPs.
C.Establish private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect with matching non-overlapping subnets and open firewall ports for control plane communication.
D.Enable Oracle Autonomous Database cross-region data guard.
AnswerC

The service mesh control plane requires direct pod-to-pod reachability across clouds. Private IP connectivity via OCI-Azure Interconnect, with non-overlapping CIDRs and firewall rules permitting control plane ports, satisfies this without exposing traffic to the public internet.

Why this answer

The essential prerequisite is private IP connectivity between the OCI VCN and Azure VNet via the OCI-Azure Interconnect, with non-overlapping subnets and open firewall ports for control plane communication. A service mesh control plane (e.g., Istio) requires direct network reachability between the control plane components and the sidecar proxies across both clouds. This is achieved through the private interconnect, ensuring secure, low-latency communication without public internet exposure.

Exam trap

The trap is selecting a service that provides private access to OCI services (Service Gateway) or outbound internet (NAT Gateway) instead of true private cross-cloud IP connectivity.

How to eliminate wrong answers

Option A is wrong because an OCI Service Gateway only provides private access to OCI services (like Object Storage), not to Azure endpoints. Option B is wrong because a NAT Gateway translates private IPs to public IPs for outbound internet, not for private cross-cloud communication. Option D is wrong because Autonomous Database Data Guard is unrelated to service mesh networking.

Practice this question →
5
Multi-Selectmedium

When designing a high-performance hybrid architecture integrating an on-premises data center with OCI, which THREE key factors should be evaluated to optimize network throughput and reliability?

Select 3 answers
A.BGP timer tuning for faster convergence and failover detection
B.Maximum Transmission Unit (MTU) size configuration (supporting Jumbo Frames up to 9000 bytes)
C.Enabling public IP addresses on all internal database nodes
D.Configuring Local Peering Gateways for on-premises connectivity
E.Physical path diversity and carrier redundancy for FastConnect circuits
AnswersA, B, E

Tuning BGP keepalive and hold timers shortens failure detection, accelerating route withdrawal and failover across the FastConnect or VPN path. This directly satisfies the stem's reliability and throughput goal by minimising black-hole traffic during an on-premises link failure, though aggressive values risk session flapping on lossy circuits.

Why this answer

Option A is correct because tuning BGP timers (e.g., reducing Keepalive and Hold-time values) on the FastConnect virtual circuit and on-premises CPE accelerates route convergence and failover detection, which directly improves reliability and recovery time during path failures. Option B is correct because configuring MTU consistently across the hybrid path—supporting Jumbo Frames up to 9000 bytes on FastConnect and the on-premises network—reduces packet fragmentation and per-packet overhead, thereby increasing effective throughput for bulk data transfers. Option E is correct because physical path diversity and carrier redundancy for FastConnect circuits (e.g., multiple diverse physical connections or redundant providers) eliminate single points of failure and ensure continued connectivity if one circuit or path degrades.

Option C does not belong because exposing internal database nodes with public IP addresses weakens security and has no bearing on throughput or reliability optimization. Option D does not belong because Local Peering Gateways connect VCNs within the same OCI region, not on-premises networks, so they are irrelevant to hybrid on-premises-to-OCI connectivity.

Exam trap

The trap is selecting options that are either security anti-patterns (public IPs on DB nodes) or irrelevant to hybrid connectivity (Local Peering Gateways).

Practice this question →
6
MCQmedium

An enterprise has an OCI tenancy and an AWS account. They want to enable private connectivity between a VCN in OCI and a VPC in AWS without using the public internet. They have an existing FastConnect circuit in OCI and an AWS Direct Connect circuit in AWS. Which solution should the architect recommend?

A.Set up an IPSec VPN between the OCI VCN and the AWS VPC over the public internet.
B.Use OCI-Azure Interconnect to connect OCI to AWS.
C.Use OCI FastConnect and AWS Direct Connect with a shared colocation facility to cross-connect the two circuits.
D.Create a Remote Peering Connection between the OCI VCN and the AWS VPC.
AnswerC

By cross-connecting the OCI FastConnect and AWS Direct Connect circuits in a shared colocation facility, traffic remains on private physical links and never touches the public internet. This is a common multicloud interconnection pattern. It leverages existing dedicated circuits and provides private, high-bandwidth connectivity between OCI and AWS.

Why this answer

Cross-connecting FastConnect and Direct Connect in a shared colocation facility provides private, dedicated connectivity between OCI and AWS without public internet. This is a standard multicloud interconnection approach. The other options either use the public internet, are for Azure, or use OCI-only peering features that do not extend to AWS.

Exam trap

The trap here is assuming OCI has a native cross-cloud interconnect product for AWS similar to OCI-Azure Interconnect; for AWS, colocation cross-connects are the common approach.

Practice this question →
7
MCQmedium

Your organization is implementing a multicloud strategy where workloads in OCI must securely communicate with workloads in AWS over a private connection. You decide to set up a third-party software virtual appliance (VPN gateway) inside an OCI VCN. What specific VCN configuration change is required to ensure that return traffic from OCI compute instances correctly routes back through the virtual appliance instance?

A.Configure a Local Peering Gateway on the appliance subnet.
B.Disable 'Source/Destination Check' on the virtual appliance's VNIC and update the VCN route table to point traffic to the appliance's private IP.
C.Enable 'Source/Destination Check' on the virtual appliance's VNIC.
D.Attach an Internet Gateway to the virtual appliance instance to route packets to AWS.
AnswerB

Disabling Source/Destination Check lets the appliance's VNIC forward traffic not addressed to itself, while the route table directs return traffic to the appliance's private IP. Both changes are required for the virtual appliance to act as a transit gateway.

Why this answer

A third-party virtual appliance (e.g., a VPN gateway VM) that forwards traffic not destined for itself must have Source/Destination Check disabled on its VNIC, otherwise OCI drops packets whose source/destination IPs don't match the VNIC. You must also update the VCN route table to steer traffic to the appliance's private IP so return traffic is symmetric.

Exam trap

1Z0-997-26 often tests the default Source/Destination Check behavior, so candidates assume enabling it (or leaving it default) is correct when the opposite is required for any forwarding appliance.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway connects two VCNs in the same region and has nothing to do with routing traffic through a virtual appliance. Option C is wrong because enabling Source/Destination Check (the default) causes OCI to drop forwarded packets, breaking the appliance's routing function. Option D is wrong because an Internet Gateway provides public internet access, not private connectivity to AWS, and would expose traffic rather than keep it private.

Practice this question →
8
MCQeasy

An enterprise requires a dedicated, private connection between their on-premises data center and Oracle Cloud Infrastructure (OCI). The connection must bypass the public internet and offer high bandwidth, predictable performance. Which OCI networking service should be deployed?

A.OCI Site-to-Site VPN
B.OCI FastConnect
C.OCI Internet Gateway
D.Oracle Database Gateway
AnswerB

FastConnect provides a dedicated private peering or cross-connect into OCI, carrying traffic outside the public internet. This satisfies the bypass-internet and predictable-bandwidth constraints, unlike IPSec VPN, which traverses the internet and offers variable latency and throughput.

Why this answer

OCI FastConnect provides a dedicated, private physical connection between an on-premises data center and OCI, bypassing the public internet entirely. It offers high bandwidth (1 Gbps to 100 Gbps per connection), predictable low latency, and is the recommended service when the requirement is a private, high-performance link rather than an encrypted tunnel over the internet.

Exam trap

The trap is confusing 'private' with 'encrypted' — candidates may pick Site-to-Site VPN thinking it is more secure, but the question specifically requires bypassing the public internet and high predictable bandwidth, which only FastConnect provides.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN uses IPsec tunnels over the public internet, which does not bypass the internet and offers less predictable performance and lower bandwidth than FastConnect. Option C is wrong because an Internet Gateway provides public internet access to resources in a VCN and is the opposite of a private dedicated connection. Option D is wrong because Oracle Database Gateway is a software component for accessing non-Oracle databases from Oracle databases, not a network connectivity service.

Practice this question →
9
Multi-Selecthard

An enterprise is integrating their on-premises network with OCI and requires secure, encrypted hybrid connectivity. Which THREE mechanisms or features can be utilized to secure data in transit between on-premises and OCI? (Choose THREE)

Select 3 answers
A.MACsec encryption on FastConnect dedicated circuits
B.OCI Site-to-Site IPSec VPN tunnels
C.Application-level encryption such as TLS 1.3 or HTTPS
D.OCI Internet Gateway packet inspection
E.OCI Local Peering Gateways with default encryption
AnswersA, B, C

MACsec secures FastConnect dedicated circuits at Layer 2, encrypting all traffic traversing the physical cross-connect before it reaches OCI's edge. This satisfies the stem's requirement for encrypted hybrid connectivity without relying on IPsec overlays, and it operates independently of the on-premises routing topology, protecting data in transit directly on the dedicated link.

Why this answer

Option A is correct because MACsec (IEEE 802.1AE) can be enabled on OCI FastConnect dedicated circuits, providing Layer 2 point-to-point encryption of traffic between the on-premises edge and the OCI edge without requiring IPsec. Option B is correct because OCI Site-to-Site IPSec VPN uses IKE/IPsec to encrypt traffic over the public internet (or over FastConnect private virtual circuits), securing data in transit between the on-premises CPE and the OCI VPN headend. Option C is correct because application-level encryption such as TLS 1.3 or HTTPS encrypts the payload end-to-end at Layer 7, protecting data in transit regardless of the underlying transport path.

Option D is not correct because an Internet Gateway simply provides public connectivity and does not perform packet inspection or encryption; security inspection would require a firewall or NGFW, not the gateway itself. Option E is not correct because Local Peering Gateways connect VCNs within the same region and do not provide encryption by default, nor do they secure on-premises-to-OCI transit.

Exam trap

1Z0-997-26 often tests the misconception that OCI gateways (Internet, Local Peering, Service) provide built-in encryption — they do not; encryption must come from MACsec, IPSec, or application-layer TLS.

Practice this question →
10
MCQhard

An administrator needs to configure DNS resolution between an on-premises datacenter and OCI. On-premises servers must resolve hostnames of compute instances in an OCI VCN. Which OCI service component must be utilized to achieve this?

A.OCI Internet Gateway DNS proxy
B.OCI Email Delivery DNS records
C.OCI Private DNS Resolver with a Listener and forwarding rules
D.OCI Load Balancer DNS plugin
AnswerC

A private DNS resolver listener accepts queries from on-premises systems over a FastConnect or VPN connection, then applies forwarding rules to direct those queries to the VCN's private zones. This satisfies the requirement that on-premises servers resolve OCI compute instance hostnames, which public DNS cannot provide.

Why this answer

OCI Private DNS Resolver provides a Listener endpoint in the VCN that on-premises DNS servers can forward queries to, and forwarding rules direct specific domains to on-premises resolvers. This enables bidirectional DNS resolution between on-premises and OCI VCN hostnames. It is the only OCI-native component designed for hybrid DNS.

Exam trap

1Z0-997-26 often tests the misconception that an Internet Gateway or Load Balancer can handle DNS forwarding, when only the Private DNS Resolver provides hybrid DNS resolution.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway is a routing construct and has no DNS proxy capability. Option B is wrong because Email Delivery is an SMTP service for outbound email, unrelated to DNS resolution. Option D is wrong because a Load Balancer does not provide DNS forwarding or resolver functionality; its DNS name is just an endpoint record.

Practice this question →
11
Multi-Selectmedium

When configuring DRG route tables and route distributions in OCI for hybrid connectivity, which TWO routing actions or concepts are supported? (Choose TWO)

Select 2 answers
A.Automatically peering AWS VPC route tables directly from the DRG console.
B.Using route distributions to control which routes are imported into or exported from a DRG route table.
C.Importing static or dynamic routes from FastConnect and VPN attachments into DRG route tables.
D.Enabling Ophaned route garbage collection on Internet Gateways.
E.Converting OCI VCN subnets into Azure Subnets via DRG translation rules.
AnswersB, C

Route distributions define which routes a DRG route table imports from an attachment or exports to it, letting architects filter and scope reachability per attachment. This is a supported DRG routing concept, distinct from static route entries added directly to the table.

Why this answer

Option B is correct because OCI DRG route distributions are exactly the mechanism that governs route import and export behavior between a DRG route table and its attachments, letting you control which routes are learned (imported) or advertised (exported) for each attachment type. Option C is correct because DRG route tables can receive routes from FastConnect virtual circuits and IPSec VPN attachments, including both static routes you configure and dynamic routes learned via BGP, which are then used for hybrid path selection. Option A is wrong because OCI's DRG console has no capability to peer with or manipulate AWS VPC route tables; cross-cloud routing requires customer-managed gateways and BGP, not native DRG peering.

Option D is wrong because 'orphaned route garbage collection' is not an OCI feature, and Internet Gateways do not participate in DRG route table management. Option E is wrong because a DRG cannot translate OCI VCN subnets into Azure subnets; there is no such DRG translation rule concept in OCI.

Exam trap

1Z0-997-26 often tests whether candidates understand that DRG route distributions control import/export of routes between attachments, and candidates who confuse this with VCN route tables or security lists pick incorrect answers.

Practice this question →
12
MCQeasy

What is the primary purpose of configuring Border Gateway Protocol (BGP) Autonomous System Numbers (ASNs) when establishing an OCI FastConnect connection?

A.To authenticate OCI console users via single sign-on.
B.To encrypt all payloads traversing the FastConnect physical fiber.
C.To assign public IP addresses to OCI compute instances.
D.To uniquely identify routing domains and enable dynamic exchange of network routes between OCI and on-premises routers.
AnswerD

BGP ASNs uniquely identify each routing domain, letting OCI's dynamic routing gateway and your on-premises routers peer and exchange reachable prefixes automatically. This satisfies FastConnect's requirement for dynamic route propagation over the private virtual circuit, rather than relying on static routes that cannot adapt to topology changes.

Why this answer

BGP ASNs are used to uniquely identify routing domains and enable the dynamic exchange of network routes between OCI and on-premises routers. When establishing FastConnect, each side is assigned an ASN, and BGP peering uses these ASNs to exchange reachability information, allowing automatic route propagation.

Exam trap

The trap is confusing ASNs with IP addresses or encryption; candidates must remember that ASNs are purely for routing protocol identification and dynamic route exchange.

How to eliminate wrong answers

Option A is wrong because ASNs are not used for user authentication; SSO is handled by IAM. Option B is wrong because ASNs do not encrypt traffic; encryption is provided by IPSec VPN or MACsec, not BGP. Option C is wrong because ASNs do not assign public IP addresses; IP addressing is separate from routing protocol identifiers.

Practice this question →
13
MCQeasy

Your company maintains a hybrid architecture with an OCI Site-to-Site VPN connecting an on-premises data center to an OCI VCN. Due to compliance requirements, all IPsec tunnel traffic must use robust encryption with a specific hashing algorithm. Which protocol suite and encryption standard are natively supported by OCI Site-to-Site VPN?

A.SSL/TLS v1.3 with RSA key exchange
B.SSH tunneling with Blowfish cipher
C.PPTP with MPPE 128-bit encryption
D.IKEv2 with AES-256 encryption and SHA-2 hashing
AnswerD

OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, meeting the compliance requirement for robust encryption with a specific hashing algorithm. IKEv1 and weaker hashes such as SHA-1 fall short of the mandated standard.

Why this answer

OCI Site-to-Site VPN natively supports IKEv2 with AES-256 encryption and SHA-2 hashing, which meets robust compliance requirements for encrypted tunnel traffic. IKEv2 is the recommended key exchange protocol, and AES-256 with SHA-2 provides strong confidentiality and integrity for IPsec tunnels. This combination is the standard supported configuration for OCI VPN.

Exam trap

1Z0-997-26 often tests whether candidates confuse application-layer encryption protocols (SSL/TLS) with network-layer VPN protocols (IPsec/IKEv2), leading them to select TLS-based answers for site-to-site VPN questions.

How to eliminate wrong answers

Option A is wrong because SSL/TLS v1.3 with RSA key exchange is used for application-layer encryption such as HTTPS, not for site-to-site IPsec VPN tunnels. Option B is wrong because SSH tunneling with Blowfish is a deprecated and weak cipher suite not used for OCI Site-to-Site VPN. Option C is wrong because PPTP with MPPE 128-bit is an obsolete and insecure VPN protocol that OCI does not support for Site-to-Site VPN.

Practice this question →
14
MCQmedium

You are configuring an OCI Site-to-Site VPN. Your on-premises firewall requires static routing instead of BGP. Which OCI VPN mode must you select when creating the IPSec connection?

A.Local Peering mode
B.Dynamic Routing (BGP) mode
C.FastConnect Partner mode
D.Static Routing mode
AnswerD

Static Routing mode satisfies the on-premises firewall's requirement for static routing rather than BGP. In OCI Site-to-Site VPN, this mode uses Oracle-defined static routes for the IPSec tunnels instead of dynamically exchanging prefixes via BGP, so the connection establishes correctly with a peer that cannot run BGP.

Why this answer

OCI Site-to-Site VPN supports two routing modes: Dynamic Routing (BGP) and Static Routing. When the on-premises firewall requires static routing, you must select Static Routing mode and manually specify the on-premises and OCI CIDR prefixes that should be routed over the tunnel.

Exam trap

1Z0-997-26 often tests whether candidates know that OCI VPN offers both BGP and static routing modes, and that choosing the wrong mode when the CPE lacks BGP support causes the tunnel to come up but no routes to be exchanged.

How to eliminate wrong answers

Option A is wrong because Local Peering is a VCN-to-VCN peering relationship within OCI, not a VPN routing mode. Option B is wrong because Dynamic Routing (BGP) mode requires BGP peering between the DRG and the customer edge router, which the on-premises firewall cannot support in this scenario. Option C is wrong because FastConnect Partner mode refers to connecting through an OCI FastConnect partner for dedicated private connectivity, not a Site-to-Site VPN routing option.

Practice this question →
15
Multi-Selecthard

An organization is implementing a hybrid cloud topology where on-premises applications need to access OCI Autonomous Database privately. Which THREE OCI networking components or services are involved in this private connection architecture? (Choose THREE)

Select 3 answers
A.Dynamic Routing Gateway (DRG) for hybrid ingress/egress
B.OCI Internet Gateway for public IP resolution
C.OCI Email Delivery service for database alert routing
D.Virtual Cloud Network (VCN) acting as the transit and hosting environment
E.Private Endpoints associated with the Autonomous Database instance
AnswersA, D, E

The Dynamic Routing Gateway provides the ingress and egress path between the on-premises network and the OCI VCN, terminating the FastConnect or VPN attachment. Without it, private traffic from on-premises cannot reach the Autonomous Database's private endpoint.

Why this answer

Option A is correct because the Dynamic Routing Gateway (DRG) is the OCI edge router that terminates the FastConnect or Site-to-Site VPN from on-premises and exchanges routes with the VCN, enabling private hybrid ingress/egress without traversing the public internet. Option D is correct because the Virtual Cloud Network (VCN) is the foundational software-defined network that hosts the subnets, route tables, and gateways through which the private traffic transits to reach the Autonomous Database. Option E is correct because a private endpoint (using a private IP in a VCN subnet) is what allows the Autonomous Database to be reached privately rather than through its public endpoint, and it is the target of the on-premises traffic.

Option B is not part of this design because an Internet Gateway only enables public IP connectivity to and from the internet, which contradicts the requirement for a private connection. Option C is unrelated because OCI Email Delivery is a messaging service for sending email notifications, not a networking component involved in private database connectivity.

Exam trap

The trap is selecting an Internet Gateway or other unrelated service because candidates think any gateway can provide connectivity; they forget that private access requires a DRG, VCN, and private endpoint, not public components.

Practice this question →
16
MCQmedium

You need to connect multiple VCNs in different regions to a single on-premises datacenter via FastConnect. Which DRG feature enables you to route traffic efficiently across multiple VCNs and remote connections?

A.DRG attachments and DRG Route Tables
B.Local Peering Gateway chaining
C.Internet Gateway route forwarding
D.Service Gateway cross-region peering
AnswerA

DRG attachments connect each VCN and the on-premises FastConnect circuit to the DRG, while DRG Route Tables control which attachment receives traffic. This satisfies the stem's requirement to route efficiently across multiple regional VCNs and remote connections.

Why this answer

A Dynamic Routing Gateway (DRG) with attachments for each VCN and the on-premises FastConnect virtual circuit, combined with DRG Route Tables, enables centralized routing across multiple VCNs in different regions and the on-premises network. DRG Route Tables let you control which routes are imported and distributed per attachment.

Exam trap

1Z0-997-26 often tests the misconception that Local Peering Gateways or Service Gateways can provide cross-region or hybrid routing, when only DRG attachments and DRG Route Tables handle that scale.

How to eliminate wrong answers

Option B is wrong because Local Peering Gateways only connect VCNs within the same region and cannot chain across regions or to on-premises. Option C is wrong because an Internet Gateway routes public traffic and does not provide private cross-region or hybrid routing. Option D is wrong because a Service Gateway provides private access to OCI services (like Object Storage) and does not peer cross-region or route to on-premises.

Practice this question →
17
MCQhard

An enterprise has workloads running in OCI and Google Cloud Platform (GCP). They require low-latency, private connectivity between OCI and GCP without traffic traversing the public internet. Which architectural design pattern achieves this?

A.Peer an OCI Dynamic Routing Gateway directly to a GCP Virtual Private Cloud using a Google Cloud Interconnect cable.
B.Configure an OCI Internet Gateway to peer with GCP Cloud DNS.
C.Attach a GCP VPC as a secondary VCN in the OCI console.
D.Connect OCI FastConnect and GCP Interconnect using a Layer 2 software-defined interconnection provider like Megaport or Equinix Fabric.
AnswerD

Megaport or Equinix Fabric provides a Layer 2 software-defined interconnection linking OCI FastConnect to GCP Interconnect, so traffic stays on private provider networks. This satisfies the stem's low-latency, private OCI-to-GCP requirement without public internet traversal.

Why this answer

OCI and GCP do not have a native direct interconnect between them, so private low-latency connectivity requires a Layer 2 fabric provider. FastConnect on the OCI side and Cloud Interconnect on the GCP side both terminate at the same Equinix Fabric or Megaport switch, where a virtual cross-connect joins the two circuits. This keeps traffic off the public internet and gives deterministic latency.

Exam trap

1Z0-997-26 often tests whether candidates believe OCI has a native direct interconnect to every cloud — the trap is picking a direct DRG-to-VPC peering option that does not exist for GCP.

How to eliminate wrong answers

Option A is wrong because an OCI DRG cannot peer directly to a GCP VPC — GCP Cloud Interconnect is a Layer 2/3 service that requires a partner fabric, not a direct DRG-to-VPC BGP session. Option B is wrong because an Internet Gateway routes to the public internet and Cloud DNS is a name resolution service, not a connectivity path. Option C is wrong because a GCP VPC cannot be attached as a secondary VCN in OCI — VCNs are OCI-native constructs and cross-cloud VPC attachment is not a supported feature.

Practice this question →
18
MCQmedium

You are configuring redundant OCI Site-to-Site VPN tunnels to your on-premises datacenter. OCI automatically provisions how many tunnels per VPN connection by default for high availability?

A.8 tunnels
B.4 tunnels
C.1 tunnel
D.2 tunnels
AnswerD

OCI provisions two IPsec tunnels per Site-to-Site VPN connection by default, each terminating on a distinct VPN headend endpoint within the same availability domain. This satisfies the high-availability requirement in the stem, since a single headend failure leaves the second tunnel operational without manual reconfiguration.

Why this answer

OCI Site-to-Site VPN automatically provisions two tunnels per VPN connection by default, each terminating on a separate VPN headend in a different availability domain. This redundancy is built in so that if one tunnel or headend fails, traffic can fail over to the other. The two-tunnel design is a core HA characteristic of the OCI IPSec VPN service.

Exam trap

The trap is assuming OCI provisions a single tunnel (or a larger number like four or eight) per VPN connection, when the documented default is exactly two tunnels for high availability.

How to eliminate wrong answers

Option A is wrong because eight tunnels is not the default; OCI does not provision eight IPSec tunnels per VPN connection. Option B is wrong because four tunnels is not the default either — while you can create additional VPN connections, each connection still comes with two tunnels. Option C is wrong because a single tunnel would provide no redundancy and contradicts the HA design of OCI Site-to-Site VPN, which always provisions two.

Practice this question →
19
MCQeasy

Which OCI construct serves as the central hub for routing traffic between VCNs and hybrid network connections such as FastConnect and IPSec VPN?

A.Local Peering Gateway
B.NAT Gateway
C.Dynamic Routing Gateway (DRG)
D.Internet Gateway
AnswerC

The Dynamic Routing Gateway acts as the virtual router that terminates FastConnect and IPSec VPN attachments while peering with VCNs, satisfying the hub requirement. Unlike a Local Peering Gateway, which only links VCNs within one region, the DRG provides transitive routing between on-premises connections and multiple VCNs.

Why this answer

The Dynamic Routing Gateway (DRG) is the OCI virtual router that serves as the central hub for all private connectivity between VCNs and external networks, including FastConnect and IPSec VPN. It supports route tables, route distribution, and attachments to multiple VCNs and on-premises connections.

Exam trap

The trap is confusing the DRG with the Internet Gateway or NAT Gateway — the DRG is specifically for private hybrid and inter-VCN routing, while the other gateways handle public Internet traffic.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway (LPG) only connects two VCNs within the same region and does not handle FastConnect or IPSec VPN. Option B is wrong because a NAT Gateway provides outbound Internet access for private subnets and does not route hybrid traffic. Option D is wrong because an Internet Gateway provides inbound/outbound Internet connectivity for public subnets and is not used for FastConnect or IPSec VPN termination.

Practice this question →
20
MCQhard

Your company operates a hybrid application where frontend servers in Azure need to communicate with backend databases in OCI using private IP addresses via the OCI-Azure Interconnect. Which routing configuration is required on the OCI Dynamic Routing Gateway (DRG) attached to your VCN?

A.Configure a local peering route to the Azure ExpressRoute circuit.
B.Add a route pointing the Azure VNet CIDR to the Internet Gateway.
C.Add a route in the DRG route table pointing the Azure VNet CIDR to the FastConnect virtual circuit attachment.
D.Attach an Azure VNet directly as a subnet inside the OCI VCN.
AnswerC

The DRG route table must map the Azure VNet CIDR to the FastConnect virtual circuit attachment, so traffic destined for Azure private IPs is forwarded over the interconnect rather than dropped or sent to the wrong attachment.

Why this answer

In an OCI-Azure Interconnect architecture, the OCI DRG is attached to the FastConnect virtual circuit that connects to Azure ExpressRoute (via the interconnect partner). To route traffic from the OCI VCN to the Azure VNet, you must add a route in the DRG route table that points the Azure VNet CIDR to the FastConnect virtual circuit attachment. This ensures that packets destined for Azure private IPs are forwarded over the private interconnect rather than to an internet or local peering path.

Exam trap

The trap is confusing the DRG route table with the VCN route table, or assuming that an Internet Gateway or local peering can be used for cross-cloud private routing — candidates must know that the DRG route table must point the remote CIDR to the FastConnect virtual circuit attachment.

How to eliminate wrong answers

Option A is wrong because local peering routes are used to connect VCNs within OCI (or to on-premises via a DRG in a different context), not to route to an Azure ExpressRoute circuit — there is no 'local peering route' to an ExpressRoute circuit. Option B is wrong because routing Azure VNet CIDR to an Internet Gateway would send traffic over the public internet, violating the private connectivity requirement and failing to use the interconnect. Option D is wrong because an Azure VNet cannot be attached as a subnet inside an OCI VCN — VNets and VCNs are separate cloud constructs, and the interconnect is a network-to-network connection, not a subnet extension.

Practice this question →
21
MCQmedium

You are configuring BGP for an OCI FastConnect virtual circuit. What happens if BGP peering fails between your on-premises router and the OCI Dynamic Routing Gateway?

A.Traffic cannot be routed between the on-premises network and OCI over FastConnect.
B.Traffic automatically fails over to the Internet Gateway.
C.OCI automatically falls back to an unencrypted IPSec VPN tunnel.
D.The FastConnect port is administratively disabled by Oracle.
AnswerA

BGP peering is the control plane that advertises routes between the on-premises router and the Dynamic Routing Gateway. If the session drops, learned prefixes are withdrawn, so no routes exist and traffic cannot traverse the FastConnect virtual circuit.

Why this answer

BGP is the routing protocol that exchanges prefixes between the on-premises customer edge router and the OCI Dynamic Routing Gateway over a FastConnect virtual circuit. If the BGP session goes down, no routes are learned or advertised, so the DRG has no path to the on-premises network and traffic cannot be routed over FastConnect. The physical circuit may remain up, but without BGP the Layer 3 reachability is gone.

Exam trap

1Z0-997-26 often tests whether candidates assume OCI provides automatic failover between FastConnect and VPN, when in fact failover requires explicit customer configuration and BGP session state is the determining factor for route availability.

How to eliminate wrong answers

Option B is wrong because OCI does not automatically fail over FastConnect traffic to an Internet Gateway; Internet Gateway is a separate attachment for public internet access and has no knowledge of on-premises routes. Option C is wrong because OCI does not automatically fall back to an IPSec VPN tunnel; if a VPN is configured as a backup, failover depends on the customer's own routing configuration and BGP preferences, not automatic OCI behavior. Option D is wrong because Oracle does not administratively disable the FastConnect port when BGP fails; the port stays up and the customer can troubleshoot or re-establish the BGP session.

Practice this question →
22
MCQhard

You are designing an active-active hybrid architecture between an on-premises datacenter and OCI using two separate FastConnect circuits connected to two different DRG attachments. How does OCI determine path selection when receiving identical BGP route advertisements from both circuits?

A.OCI automatically enforces round-robin load balancing regardless of BGP advertisements.
B.Active-active routing is not supported; OCI randomly drops packets on duplicate routes.
C.OCI always selects the circuit with the lower OCID alphabetically.
D.The DRG uses standard BGP best path selection criteria, including AS Path length and Local Preference.
AnswerD

Each DRG attachment forms a separate eBGP session, so the DRG applies standard BGP best-path selection — Local Preference first, then AS Path length — to identical prefixes. ECMP only occurs when attributes tie, so advertisement differences determine which FastConnect circuit carries traffic.

Why this answer

OCI DRG attachments for FastConnect behave like standard BGP peers. When identical prefixes are advertised over two circuits, the DRG runs the standard BGP best-path algorithm — comparing attributes such as Weight, Local Preference, AS Path length, Origin, MED, and finally router ID — to pick a single best path per prefix. Equal-cost multipath (ECMP) can occur only when the relevant attributes tie, otherwise one circuit becomes preferred for that prefix.

Exam trap

The trap here is assuming OCI invents its own proprietary path-selection logic (round-robin, OCID ordering, random drops) when in reality the DRG simply honours standard BGP best-path rules.

How to eliminate wrong answers

Option A is wrong because OCI does not perform round-robin load balancing across BGP-learned paths; path selection is deterministic based on BGP attributes, not per-packet rotation. Option B is wrong because active-active FastConnect is fully supported — duplicate routes are resolved by BGP best-path selection, not random packet drops. Option C is wrong because OCIDs are Oracle resource identifiers and have no role in BGP route selection; the DRG never inspects OCIDs to choose a circuit.

Practice this question →
23
MCQhard

An administrator is designing a hybrid cloud architecture where OCI workloads need to access an Azure SQL Database over the OCI-Azure Interconnect. The OCI VCN and Azure VNet have overlapping IP address spaces (10.0.0.0/16). What is the mandatory architectural requirement to make this cross-cloud communication possible?

A.Deploy an OCI NAT Gateway inside the VCN.
B.Re-address one of the virtual networks to ensure non-overlapping IP address spaces.
C.Configure a Dynamic Routing Gateway route table with static overriding rules.
D.Enable FastConnect MACsec encryption.
AnswerB

The OCI-Azure Interconnect routes packets between VCN and VNet CIDRs, so identical 10.0.0.0/16 ranges create ambiguous destinations that routing cannot resolve. Re-addressing one network to non-overlapping space is therefore mandatory before any cross-cloud traffic can flow.

Why this answer

OCI-Azure Interconnect (via FastConnect and ExpressRoute) requires that the OCI VCN CIDR and Azure VNet CIDR do not overlap, because routing between the two environments relies on standard IP routing tables that cannot distinguish between identical prefixes. When both sides use 10.0.0.0/16, the DRG and Azure route tables would have ambiguous next-hop decisions, causing traffic to be dropped or misrouted. Re-addressing one of the virtual networks to a unique, non-overlapping CIDR is the only way to ensure deterministic routing across the interconnect.

Exam trap

1Z0-997-26 often tests the misconception that a NAT Gateway or static routes can solve overlapping IP address spaces in cross-cloud interconnects, but the fundamental requirement is always non-overlapping CIDRs.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway only translates private IPs to public IPs for outbound internet access; it does not resolve overlapping CIDR conflicts between two private networks and cannot be used for cross-cloud private peering. Option C is wrong because static routes in a DRG route table cannot override the fundamental ambiguity created by overlapping prefixes—the router still cannot determine which destination is correct when the same prefix exists on both sides. Option D is wrong because MACsec encryption on FastConnect provides Layer 2 link encryption and does not address IP address overlap; it is a security feature, not a routing or addressing solution.

Practice this question →
24
MCQeasy

Which OCI service is primarily used to establish an encrypted site-to-site IPSec VPN connection between an on-premises datacenter and an OCI Virtual Cloud Network?

A.OCI Storage Gateway
B.OCI API Gateway
C.OCI Site-to-Site VPN
D.OCI Bastion Service
AnswerC

OCI Site-to-Site VPN terminates IPSec tunnels on the dynamic routing gateway, encrypting traffic between on-premises customer-premises equipment and the VCN over the public internet. This satisfies the stem's encrypted site-to-site requirement without dedicated private circuits.

Why this answer

OCI Site-to-Site VPN is the managed service that creates an IPSec VPN connection between an on-premises customer-premises equipment (CPE) device and a Dynamic Routing Gateway attached to a VCN. It supports IKEv1 and IKEv2 with AES encryption and SHA-2 hashing, providing encrypted tunnels over the public internet. This is the native OCI service for encrypted site-to-site connectivity.

Exam trap

1Z0-997-26 often tests whether candidates confuse OCI Bastion Service (which provides SSH access to instances) with Site-to-Site VPN (which provides network-level encrypted connectivity), causing them to pick the wrong service for hybrid connectivity.

How to eliminate wrong answers

Option A is wrong because OCI Storage Gateway is a service for integrating on-premises storage with OCI Object Storage and File Storage, not for network connectivity. Option B is wrong because OCI API Gateway is for publishing and managing APIs, not for establishing network tunnels. Option D is wrong because OCI Bastion Service provides secure shell access to compute instances without public IPs, not site-to-site VPN connectivity between networks.

Practice this question →
25
MCQmedium

You are configuring the OCI-Azure Interconnect to link an OCI Virtual Cloud Network (VCN) with an Azure Virtual Network (VNet). You have already established the FastConnect and ExpressRoute circuits. What is the mandatory next step to enable cross-cloud routing between the OCI Dynamic Routing Gateway (DRG) and the Azure Virtual Network Gateway?

A.Configure an OCI Service Gateway to route traffic to Azure services directly.
B.Attach the Azure VNet directly to an OCI Local Peering Gateway (LPG).
C.Establish a BGP session between the OCI DRG and the Azure Virtual Network Gateway over the FastConnect/ExpressRoute circuit.
D.Deploy an OCI NAT Gateway to translate Azure private IP addresses into OCI public IP addresses.
AnswerC

Establishing a BGP session between the OCI DRG and the Azure Virtual Network Gateway is what actually exchanges routes across the FastConnect/ExpressRoute circuit. Without peering, the physical circuits carry no reachability information, so the VCN and VNet cannot route traffic. This satisfies the mandatory cross-cloud routing requirement after circuit provisioning.

Why this answer

After establishing the FastConnect and ExpressRoute circuits, the mandatory step to enable cross-cloud routing is to establish a BGP session between the OCI DRG and the Azure Virtual Network Gateway over the interconnected circuits. BGP exchanges routes between the two clouds so that the VCN and VNet can route traffic to each other. Without BGP peering, the physical circuits are up but no routes are exchanged.

Exam trap

The trap is assuming that simply provisioning FastConnect and ExpressRoute enables routing; candidates forget that BGP peering between the DRG and Azure VNG is the mandatory step to exchange routes.

How to eliminate wrong answers

Option A is wrong because a Service Gateway is used within OCI to access OCI services (Object Storage, etc.) privately, not to route to Azure. Option B is wrong because a Local Peering Gateway connects VCNs within the same OCI region; it cannot attach to an Azure VNet. Option D is wrong because a NAT Gateway translates private IPs to public IPs for outbound internet access; it is not used for cross-cloud private routing and would not translate Azure private IPs.

Practice this question →
26
MCQeasy

What is the primary function of an OCI Service Gateway?

A.To translate private IP addresses to public IP addresses for internet bound traffic
B.To provide private access to Oracle public services without using public IP addresses or the internet
C.To connect on-premises datacenters to OCI via FastConnect
D.To load balance HTTP/HTTPS traffic across multiple backend servers
AnswerB

A Service Gateway lets resources in a VCN reach Oracle public services such as Object Storage over the Oracle network fabric, keeping traffic off the internet and requiring no public IP addresses or NAT gateway, which satisfies the private-access constraint.

Why this answer

An OCI Service Gateway provides a private, secure path for resources in a VCN to access Oracle public services (such as Object Storage, Autonomous Database, and OCI Streaming) without traversing the internet or using public IP addresses. Traffic from the VCN to the service goes over the Oracle network fabric, staying private. This is the primary function of a Service Gateway in OCI networking.

Exam trap

The trap is confusing Service Gateway with NAT Gateway or Internet Gateway; candidates often think any gateway that provides 'access' is the same, but Service Gateway is specifically for private access to Oracle services, not for internet or on-premises connectivity.

How to eliminate wrong answers

Option A is wrong because translating private IPs to public IPs for internet-bound traffic is the function of a NAT Gateway, not a Service Gateway. Option C is wrong because connecting on-premises datacenters to OCI via FastConnect is the role of a Dynamic Routing Gateway (DRG) combined with FastConnect, not a Service Gateway. Option D is wrong because load balancing HTTP/HTTPS traffic across backend servers is performed by an OCI Load Balancer, not a Service Gateway.

Practice this question →
27
Multi-Selecthard

An enterprise multicloud architect is planning disaster recovery for workloads running across OCI and AWS. Which THREE strategies are commonly employed for cross-cloud disaster recovery architectures? (Choose THREE)

Select 3 answers
A.Configuring database replication (such as Oracle Data Guard) between OCI Autonomous Database and a database running in AWS.
B.Using OCI Traffic Management Steering to fail over DNS traffic between OCI and AWS endpoints based on health checks.
C.Physically merging AWS VPC physical switches into OCI Meet-Me-Rooms.
D.Replicating OCI IAM identity domains natively inside AWS IAM without federation.
E.Establishing redundant IPsec VPN tunnels between OCI DRG and AWS VGW for secure private connectivity.
AnswersA, B, E

Oracle Data Guard replicates redo across clouds, providing a standby database in AWS for failover. This satisfies the cross-cloud disaster recovery requirement by maintaining a synchronised data copy outside OCI, enabling recovery when the primary region is unavailable.

Why this answer

Option A is correct because cross-cloud DR commonly relies on database-level replication such as Oracle Data Guard, which can ship redo from an OCI Autonomous Database to a standby database running in AWS, giving a low-RPO failover target for the data tier. Option B is correct because OCI Traffic Management Steering policies (health-check-based failover, weighted, or geolocation steering) can direct DNS resolution to OCI or AWS endpoints and automatically shift traffic when health checks fail, which is a standard cross-cloud traffic-failover mechanism. Option E is correct because private cross-cloud connectivity for DR is typically built with redundant IPsec VPN tunnels between an OCI Dynamic Routing Gateway (DRG) and an AWS Virtual Private Gateway (VGW), providing encrypted, resilient transport that survives a single tunnel failure.

Option C is not valid because AWS VPCs are logical software-defined networks; there are no physical VPC switches to place in OCI Meet-Me-Rooms, and Meet-Me-Rooms are for physical network/carrier interconnects, not VPC hardware. Option D is not valid because OCI IAM identity domains cannot be natively replicated into AWS IAM; cross-cloud identity is achieved through federation (SAML/OIDC) or identity brokering, not native replication between the two proprietary IAM systems.

Exam trap

The trap is selecting plausible-sounding but technically impossible options (like physically merging switches or natively replicating IAM) because they sound like 'deep integration' — the exam tests whether you know that cross-cloud DR relies on replication, DNS steering, and VPN/interconnect, not physical or identity-layer merging.

Practice this question →
28
MCQeasy

Which protocol is used by OCI FastConnect and Site-to-Site VPN to dynamically exchange routing information with on-premises routers?

A.RIP (Routing Information Protocol)
B.BGP (Border Gateway Protocol)
C.EIGRP (Enhanced Interior Gateway Routing Protocol)
D.OSPF (Open Shortest Path First)
AnswerB

BGP is the dynamic routing protocol that both OCI FastConnect and Site-to-Site VPN use to exchange prefixes with on-premises routers. It satisfies the stem's requirement for dynamic route exchange, advertising learned routes automatically rather than relying on static configuration, and supports path selection across redundant FastConnect or VPN connections.

Why this answer

Both OCI FastConnect and Site-to-Site VPN use BGP to dynamically exchange routes between the on-premises customer edge router and the OCI Dynamic Routing Gateway. BGP is the standard exterior gateway protocol for hybrid cloud routing and supports dynamic failover and prefix advertisement.

Exam trap

1Z0-997-26 often tests the assumption that OSPF or EIGRP might be used for hybrid routing, but OCI standardizes on BGP for both FastConnect and Site-to-Site VPN route exchange.

How to eliminate wrong answers

Option A is wrong because RIP is a legacy distance-vector interior protocol with a 15-hop limit and slow convergence, and OCI does not use it for FastConnect or VPN route exchange. Option C is wrong because EIGRP is a Cisco-proprietary interior gateway protocol not supported by OCI for hybrid routing. Option D is wrong because OSPF is an interior gateway protocol for within an autonomous system, not for exchanging routes between an enterprise and OCI's autonomous system.

Practice this question →
29
MCQmedium

An administrator wants to restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN connection. Where should this route filtering be implemented on the OCI side?

A.On the OCI Bastion service configuration page.
B.In the DRG route table import/export distribution or static route configuration for the VPN attachment.
C.Inside the OCI Identity and Access Management (IAM) policy console.
D.By modifying the VCN DHCP options.
AnswerB

The DRG route table controls import and export route distribution for the IPSec VPN attachment, letting you filter which on-premises subnet prefixes are advertised or accepted. This satisfies the requirement to restrict which on-premises subnets can reach the VCN.

Why this answer

To restrict which on-premises subnets can communicate with an OCI VCN over an IPSec VPN, you must control route propagation on the OCI side. This is done by configuring the DRG route table associated with the VPN attachment, specifically the import distribution and static route configuration, to filter which routes are accepted from on-premises.

Exam trap

The trap is selecting IAM or security lists, which control access but not route propagation; candidates must remember that route filtering for hybrid connections is done at the DRG route table level.

How to eliminate wrong answers

Option A is wrong because the OCI Bastion service provides secure SSH access to compute instances and does not control network routing. Option C is wrong because IAM policies manage access to OCI resources, not network route filtering. Option D is wrong because DHCP options configure DNS and search domains for instances, not routing or subnet-level access control.

Practice this question →
30
MCQmedium

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

A.Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.
B.The FastConnect virtual circuit is disabled.
C.The OCI VCN does not have an Internet Gateway attached.
D.The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.
AnswerA

A 'Tunnel Up' state confirms only IKE and IPSec negotiation succeeded; it does not prove traffic passes. Security Lists, NSGs or instance OS firewalls commonly drop ICMP, so ping fails while the tunnel remains up, matching the stem's symptom.

Why this answer

A 'Tunnel Up' status only confirms that IKE Phase 1 and Phase 2 completed and the IPSec SA is established; it does not guarantee that traffic is permitted or routed. The most common cause of ping failure with an up tunnel is that Security Lists, NSGs, or the instance's OS firewall are dropping ICMP or the relevant traffic.

Exam trap

1Z0-997-26 often tests the misconception that 'Tunnel Up' means end-to-end connectivity works, when it only proves the IPSec control plane is established — the data plane can still be blocked by security rules.

How to eliminate wrong answers

Option B is wrong because FastConnect is a separate dedicated connection and is not involved in an IPSec VPN tunnel; disabling it would not explain this issue. Option C is wrong because an Internet Gateway is not required for Site-to-Site VPN traffic, which traverses the DRG and the VPN tunnel, not the internet gateway. Option D is wrong because a misconfigured BGP ASN would typically prevent the tunnel or route exchange from coming up, but the question states the tunnel is already Up, so the control plane is functioning.

Practice this question →
31
MCQhard

An enterprise architect is connecting AWS and OCI using a third-party SD-WAN appliance deployed in both clouds. The appliances are deployed on OCI compute instances and AWS EC2 instances. To ensure high availability across availability domains, where should the OCI SD-WAN instances be placed?

A.In the same subnet, pinned to a single physical host.
B.Inside the OCI Control Plane root compartment.
C.On bare metal instances without any virtual cloud networks.
D.Across different Availability Domains or Fault Domains within the region, configured with BGP or clustering.
AnswerD

Placing the SD-WAN appliances across separate Availability Domains or Fault Domains within the region isolates them from a single domain failure, satisfying the high-availability constraint. BGP or clustering then provides failover and path selection between the instances.

Why this answer

To achieve high availability across availability domains, the SD-WAN instances in OCI should be deployed in different Availability Domains (or Fault Domains) within the region and configured with BGP or clustering for failover. This ensures that a single AD or fault domain failure does not take down the SD-WAN overlay connecting OCI to AWS. BGP provides dynamic route failover between the instances.

Exam trap

The trap is thinking that a single subnet or a single physical host provides high availability; the exam expects you to know that AD or FD separation plus BGP/clustering is required for true HA.

How to eliminate wrong answers

Option A is wrong because placing both instances in the same subnet pinned to a single physical host creates a single point of failure; it does not provide AD-level redundancy. Option B is wrong because the OCI Control Plane root compartment is a logical IAM construct, not a deployment location for compute instances; you cannot place SD-WAN appliances there. Option C is wrong because bare metal instances still require a VCN and subnet for networking; deploying without a VCN is not possible, and it does not address AD redundancy.

Practice this question →
32
MCQeasy

What is the primary benefit of using OCI FastConnect over an IPSec VPN connection?

A.Ability to route traffic over public cellular networks
B.Zero configuration required on the on-premises router
C.Automatic encryption of all traffic at Layer 2 by default
D.Higher bandwidth, lower latency, and predictable performance
AnswerD

FastConnect provides a dedicated private physical circuit, bypassing the public internet entirely. This yields higher, more consistent bandwidth and lower, predictable latency than an IPSec VPN, whose encrypted tunnels traverse variable internet paths and are subject to congestion and jitter.

Why this answer

FastConnect is a dedicated private physical connection between on-premises and OCI, bypassing the public internet. This yields higher, more consistent bandwidth, lower and more predictable latency, and reduced jitter compared to an IPSec VPN, which traverses the public internet and is subject to variable paths and congestion. That predictability is the primary reason enterprises choose FastConnect for latency-sensitive or high-throughput workloads.

Exam trap

The trap is confusing FastConnect's private, dedicated nature with automatic encryption; candidates often pick 'automatic encryption at Layer 2' when FastConnect is actually unencrypted by default and encryption must be added separately.

How to eliminate wrong answers

Option A is wrong because FastConnect is a dedicated fiber/partner-provided private circuit, not a cellular or public-network routing mechanism; cellular is irrelevant to this comparison. Option B is wrong because FastConnect requires configuration on the customer edge router (BGP peering, VLAN, cross-connect), so 'zero configuration' is false. Option C is wrong because FastConnect does not automatically encrypt traffic at Layer 2 by default; encryption is optional (e.g., MACsec on some partners, or IPSec over FastConnect), and the default is a private but unencrypted Layer 2/3 path.

Practice this question →
33
MCQmedium

You are configuring a FastConnect dedicated circuit between your corporate datacenter and OCI. You need to enable dynamic routing where BGP routes are automatically propagated between the Dynamic Routing Gateway (DRG) and your on-premises routers. Which OCI construct must be attached to the DRG to achieve this?

A.Local Peering Gateway
B.Dynamic Routing Gateway (DRG) attachment with a Virtual Circuit
C.NAT Gateway
D.Internet Gateway
AnswerB

A Virtual Circuit attachment on the DRG terminates the FastConnect dedicated circuit and runs BGP with your on-premises routers, enabling automatic route propagation. The DRG itself cannot peer directly over the physical cross-connect; the Virtual Circuit provides the Layer 3 BGP session satisfying the dynamic routing requirement.

Why this answer

To enable dynamic routing with BGP between on-premises and OCI over FastConnect, you must create a DRG attachment of type Virtual Circuit. This attachment binds the FastConnect virtual circuit to the DRG and allows BGP sessions to be established, enabling automatic route propagation. Without this attachment, the DRG cannot exchange routes with the on-premises router.

Exam trap

The trap is confusing the DRG attachment type with other gateways; candidates may think any gateway attached to the DRG enables BGP, but only a Virtual Circuit attachment supports dynamic routing over FastConnect.

How to eliminate wrong answers

Option A is wrong because a Local Peering Gateway connects VCNs within the same region and does not support BGP or FastConnect. Option C is wrong because a NAT Gateway provides outbound internet access for private subnets and is unrelated to dynamic routing over FastConnect. Option D is wrong because an Internet Gateway enables public internet connectivity and does not participate in BGP route exchange with on-premises networks.

Practice this question →
34
MCQeasy

When setting up an OCI Site-to-Site VPN, which on-premises device representation must you create in the OCI Console before configuring the IPSec connection?

A.NAT Gateway
B.Service Gateway
C.Customer-Premises Equipment (CPE)
D.Virtual Cloud Network (VCN)
AnswerC

The Customer-Premises Equipment object represents your on-premises VPN device in OCI, supplying its public IP address and vendor details so OCI can build the IPSec tunnels; it must exist before you create the IPSec connection referencing it.

Why this answer

The Customer-Premises Equipment (CPE) object represents the on-premises VPN device in OCI. Before creating an IPSec connection, you must create a CPE object that specifies the public IP address of the on-premises device. This allows OCI to establish the IPSec tunnels to that endpoint.

Exam trap

The trap is confusing the CPE object with other OCI networking components like NAT Gateway or Service Gateway, which serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because a NAT Gateway is an OCI resource for outbound internet access from a VCN, not for representing on-premises devices. Option B is wrong because a Service Gateway provides private access to OCI services, not on-premises connectivity. Option D is wrong because a VCN is the virtual network itself, not a representation of the on-premises device.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Multicloud And Hybrid questions.

Start 20-question session