Free 1z0-1124-25: Oracle Cloud Infrastructure 2025 Networking Professional Exam Questions and Answers

Which OCI service or feature is best suited for capturing and analyzing network traffic metadata to identify anomalies and troubleshoot connectivity issues between VCN resources?

• AA. Network Security Groups (NSGs)
• BB. Flow Logs
• CC. Route Tables
• DD. Service Gateway

When analyzing Flow Logs for a subnet, how can you filter logs to isolate traffic that was rejected due to a specific security list rule?

• AA. By filtering on the "action" field with the value "REJECT" and the "securityListRule" field with the rule ID
• BB. By filtering on the "status" field with the value "DENIED" and the "securityRule" field with the rule name
• CC. By filtering on the "direction" field with the value "EGRESS" and the "port" field with the rule port
• DD. By filtering on the "type" field with the value "SECURITY" and the "rule" field with the rule number

You are designing an OCI VCN for a new application with the following requirements: The application servers in a private subnet must be able to download software updates from public repositories on the internet; the application servers must NOT be directly accessible from the public internet; the application servers must also be able to access Oracle Cloud Infrastructure Registry (OCIR) within the same region to pull container images. Which combination of VCN Gateways BEST meets these requirements?

• AA. Internet Gateway and Service Gateway
• BB. NAT Gateway and Internet Gateway
• CC. NAT Gateway and Service Gateway
• DD. Dynamic Routing Gateway (DRG) and Internet Gateway

Your team is deploying a critical, highly available application that relies on accessing a MySQL Database Service instance within OCI. The application requires a stable and predictable endpoint for database connectivity, even during database failover events. Which endpoint configuration is most suitable to ensure seamless application connectivity in this high-availability scenario?

• AA. Using the public IP address of the MySQL Database Service instance.
• BB. Using a DNS hostname that resolves to the floating private IP address of the active MySQL Database Service instance.
• CC. Using the private IP address of the primary MySQL Database Service instance directly.
• DD. Using a Service Gateway to connect to the MySQL Database Service endpoint.

Your company has a FastConnect circuit established between your on-premises data center and OCI. However, you have a specific regulatory requirement to encrypt all traffic, even over dedicated connections like FastConnect. You need to implement IPSec encryption without significantly impacting the available bandwidth of your FastConnect circuit. Which is the most effective approach to implement IPSec encryption over your existing FastConnect circuit, while maintaining high bandwidth?

• AA. Configure a Site-to-Site VPN using the OCI Dynamic Routing Gateway (DRG) over theFastConnect virtual circuit. Use a low-overhead encryption algorithm like AES-GCM.
• BB. Deploy virtual firewall appliances within OCI and your on-premises network and configure IPSec tunnels between them, routing all traffic through the firewalls. Use a high- security encryption algorithm like AES-256.
• CC. Terminate IPSec VPN on compute instances in a public subnet on the OCI side.
• DD. Establish a second, separate Site-to-Site VPN connection to OCI over the public internet, and route all sensitive traffic over this VPN, while routing non-sensitive traffic over the FastConnect circuit.

Your company is migrating its publicly accessible website to OCI. You want to ensure the highest level of security and prevent DNS spoofing or cache poisoning attacks. You've decided to implement DNSSEC. Which of the following is the most important first step in enabling DNSSEC for your domain using OCI DNS?

• AA. Create a Traffic Management Steering Policy with the "DNSSEC" option enabled.
• BB. Generate a Key Signing Key (KSK) and a Zone Signing Key (ZSK) using a third-party tool and upload them to OCI DNS.
• CC. Enable DNSSEC on the OCI DNS zone for your domain and obtain the Delegation Signer (DS) record from OCI DNS.
• DD. Configure the OCI DNS resolver to validate all incoming DNS responses using DNSSEC.

Consider a scenario where you have several private subnets within your VCN, and instances in these subnets need to access different OCI Object Storage buckets across various compartments. How can you efficiently manage and secure private access to Object Storage for all these subnets while adhering to the principle of least privilege?

• AA. Configure a single Internet Gateway and use IAM policies to control access at the bucket level.
• BB. Deploy a single NAT Gateway and manage access using Network Security Groups (NSGs) for each subnet.
• CC. Implement a Service Gateway within the VCN and utilize IAM policies and route tables to direct traffic to the appropriate Object Storage service endpoints.
• DD. Create a Private Endpoint for each Object Storage bucket within each private subnet.

You are troubleshooting an issue where a compute instance in a private subnet within a VCN cannot reach OCI Object Storage. You have verified that a Service Gateway is configured for the VCN and that the route table associated with the subnet has a route rule directing traffic for OCI Services to the Service Gateway. However, the instance still cannot connect. What is the MOST likely cause of the problem?

• AA. The instance requires a public IP address to access OCI Object Storage.
• BB. The security list or network security group associated with the subnet or instance is not configured to allow outbound traffic to the OCI Object Storage service CIDR block.
• CC. The Service Gateway is not configured to allow access to OCI Object Storage.
• DD. The instance is not configured with the Oracle Cloud Agent.

You're designing a multi-region deployment of your application on OCI. You want to use OCI's global load balancing capabilities, but also require the WAF to protect against attacks close to the user. Which configuration provides the best balance between global load balancing and regional WAF protection?

• AA. Use OCI Global Load Balancer (GLB) with a single regional WAF protecting the backend servers in one region.
• BB. Use OCI GLB to distribute traffic to regional Load Balancers, each fronted by a regional WAF.
• CC. Configure the WAF in front of the OCI GLB itself to inspect all traffic globally.
• DD. Configure the OCI GLB to distribute traffic based on source IP address to specific regions, and enable WAF on the regional Load Balancer.

A company wants to leverage a best-of-breed approach for their application stack. They plan to use OCI for its Autonomous Database, Azure for its container orchestration (AKS), and AWS for its object storage (S3). Considering cost optimization and minimizing data egress charges, which strategy is the MOST efficient for transferring large datasets between these services?

• AA. Moving data directly between OCI Autonomous Database, Azure AKS, and AWS S3 using public internet, as this is the most cost-effective option
• BB. Establishing a hub-and-spoke model, using a central cloud provider as the data transfer hub, incurring egress charges from each cloud to the hub and then ingress charges from the hub to the destination cloud
• CC. Utilizing a third-party data integration platform that is strategically located at a network peering point between OCI, Azure, and AWS
• DD. Using Storage Gateway service on each cloud and replicate data from one gateway to the other