Free 1z0-1124-25: Oracle Cloud Infrastructure 2025 Networking Professional Exam Questions and Answers

Instances in a private subnet must download operating system patches from public repositories on the internet. Hosts on the internet must not be able to initiate connections to these instances. Which VCN gateway meets this requirement?

• AA. Internet gateway
• BB. NAT gateway
• CC. Dynamic routing gateway
• DD. Service gateway

An administrator is planning a new VCN that will attach to the same DRG as an existing VCN (10.1.0.0/16) and an on-premises network. The on-premises network advertises 10.0.0.0/16 and 10.2.0.0/15. The new VCN must hold three subnets of /20 each, and the CIDR block must not overlap with any existing network. Which CIDR block should the administrator assign to the new VCN?

• AA. 10.0.128.0/18
• BB. 10.3.0.0/18
• CC. 10.4.0.0/18
• DD. 10.4.128.0/19

A company is migrating workloads from an AWS VPC to an OCI VCN over several months. It must replicate 30 TB of data over a private path with consistent latency, and it also needs an encrypted backup path if the primary path fails. The two networks use non-overlapping CIDR blocks. Which two actions meet these requirements? (Choose two.)

Select 2 answers.

• AA. Order a FastConnect virtual circuit through a network exchange partner that also hosts an AWS Direct Connect connection
• BB. Build an IPSec VPN between the AWS virtual private gateway and the OCI DRG to serve as the backup path
• CC. Create a remote peering connection between the OCI DRG and the AWS Transit Gateway to carry the replication traffic
• DD. Attach an internet gateway to the VCN and replicate data over HTTPS by using public IP addresses on both sides

A company runs a reporting application in a Microsoft Azure VNet with the address space 10.20.0.0/16. The reporting database is in an OCI VCN with the CIDR block 10.20.64.0/20. The company wants private, low-latency connectivity between the two networks through the Oracle Interconnect for Azure, without using the internet. Which action is required before traffic can flow between the VNet and the VCN?

• AA. Build an IPSec tunnel from the DRG to an Azure VPN gateway and disable BGP on the virtual circuit
• BB. Re-address either the VCN or the VNet so that the two CIDR blocks no longer overlap
• CC. Create a local peering gateway in the VCN and a matching virtual network peering in the Azure VNet
• DD. Add a NAT gateway to the VCN and route all Azure-bound traffic from the database subnet through it

An administrator is planning public IP address usage for compute instances in a region. Which two statements are true about public IP addresses in OCI? (Choose two.)

Select 2 answers.

• AA. A reserved public IP address can be unassigned and then assigned to a resource in a different region of the tenancy
• BB. An ephemeral public IP address exists only for the lifetime of the resource it is assigned to
• CC. A reserved public IP address stays allocated to the tenancy after the instance using it is terminated, until it is deleted
• DD. An ephemeral public IP address can be unassigned from one instance and assigned to another instance in the same VCN

A hub VCN contains a third-party firewall appliance with a private IP address in a hub subnet. Two spoke VCNs, VCN-A and VCN-B, are attached to the same DRG, and the hub VCN is also attached to that DRG. All traffic between VCN-A and VCN-B must pass through the firewall in the hub. The subnet route tables in the spokes already send traffic for the other spoke to the DRG. What should the administrator configure to complete the design?

• AA. Place a NAT gateway in the hub VCN and add rules in the spoke subnet route tables that target the NAT gateway as the next hop
• BB. Create a local peering gateway between VCN-A and VCN-B and add a route rule for the other spoke CIDR to each gateway
• CC. Associate the spoke attachments with a DRG route table that imports routes from every other spoke attachment, and leave the hub attachment on its default route table
• DD. Associate the spoke attachments with a DRG route table that forwards spoke traffic to the hub attachment, and associate the hub attachment with a VCN route table that targets the firewall private IP

Which two are steering policy types available in OCI DNS Traffic Management? (Choose two.)

Select 2 answers.

• AA. Geolocation steering
• BB. Path-based steering
• CC. Latency-based steering
• DD. Failover

A company publishes a customer portal through a public Flexible Load Balancer in OCI. The security team needs to block requests that originate from a list of countries and to limit each client IP address to 100 requests per minute. The solution must not require changes to the application servers. What should the administrator do?

• AA. Create a WAF policy with a geolocation access control rule and a rate limiting rule, then attach it to the load balancer
• BB. Configure a network security group on the load balancer that denies the listed country ranges and caps requests per minute for each source
• CC. Deploy OCI Network Firewall in the VCN and route inbound traffic through it using an application rule that rate limits HTTP requests
• DD. Add deny entries for the listed countries and a per-IP connection limit to the security list of the load balancer subnet

A company is designing two services in one VCN. A syslog collector receives UDP traffic on port 514 from thousands of devices, and the backend servers must see the original client IP address. A customer portal is served over HTTPS and must be protected by OCI WAF. Which two design choices meet the requirements? (Choose two.)

Select 2 answers.

• AA. Use a Network Load Balancer for the portal and attach a WAF policy to it for HTTPS inspection
• BB. Use a Network Load Balancer with a UDP listener for the syslog collector and preserve the client source IP
• CC. Use a Flexible Load Balancer with a UDP listener on port 514 to distribute the syslog traffic
• DD. Use a Flexible Load Balancer for the portal and attach a WAF policy to it

A company deploys an OCI Network Firewall in a dedicated subnet and routes all outbound traffic from its private application subnets through it. The security team reports that the intrusion prevention rules do not detect malware downloaded over HTTPS from external sites. What should the administrator configure in the firewall policy so that this traffic can be inspected?

• AA. Create a decryption rule that uses an SSL inbound inspection profile, with the private key of each external web site stored in OCI Vault
• BB. Attach a WAF policy to the firewall subnet and enable the protection rule that scans outbound request bodies for known malware signatures
• CC. Add a URL list to the security rule and set the rule action to Allow so that the firewall can read the requested paths in each session
• DD. Create a decryption rule that uses an SSL forward proxy decryption profile, with an intermediate CA certificate and key from OCI Vault as the mapped secret