Oracle Cloud Infrastructure Network Professional 1Z0-1124-24

4. 4. A Cloud Engineer needs to enable routing between two Virtual Cloud Networks (VCN) from their tenancy. The VCNs are in the same region but in different compartments. After reviewing the IPv4 CIDR prefixes of the two VCNs, the engineer notices that there are no overlapping CIDR blocks.

Which three are valid Oracle Cloud Infrastructure (OCI) options for connecting and routing between the two VCNs?.

• A. Create two DRGs in the tenancy, attach one VCN to one of the DRGs, and attach the other VCN to the second DRG. In each of the DRGs, create a remote peering connection (RPC) and establish a connection from one RPC to the other. In each of the VCNs’ route table, add a route rule to the other VCN using the DRG as the next hop.

• B. Create a dynamic routing gateway (DRG) in the tenancy, add the two VCNs as VCN attachments, and add routes in each of the VCN route tables with the DRG as the next hop for the CIDR prefix of the other VCN.

• C. Add an LPG to each of the VCNs. In one of the LPGs, establish a peering connection to the other LPG. In each of the VCNs’ route table, add a route rule to the other VCN using the LPG as the next hop.

• D. Create a DRG in the tenancy, add one of the VCNs as a VCN attachment. In the other VCN, create a local peering gateway (LPG). Peer the DRG to the LPG. In the VCN attached to the DRG, add a route rule in the route table that points to the DRG as the next hop. In the other VCN, add a route rule in the route table that points to the LPG as the next hop.

• E. Create a DRG in the tenancy, add one of the VCNs as a VCN attachment. In the other VCN, create a local peering gateway (LPG). Peer the DRG to the LPG. In the VCN attached to the DRG, enable BGP routing for the route to propagate to the VCN. In the other VCN, add a route rule in the route table that points to the LPG as the next hop.

1. 1. As a Cloud Network Engineer, you are helping your Database team to provide access to six autonomous databases created in your Virtual Cloud Network (VCN). The databases store corporate data and need to be accessed from within the same VCN.

To complete your network architecture and provide such access, you are evaluating two options: Service gateways or Oracle Cloud Infrastructure (OCI) private endpoints.

Which statement is true about the differences between the two methods?

• A. With a service gateway, you would need one gateway, whereas in an architecture based on private endpoints, you would need six endpoints.

• B. If ever needed, service gateways and private endpoints would both support reverse connections from OCI back into your environment.

• C. To route traffic from within the VCN to the databases, in both cases you would need to configure routes in your routing tables. In the case of service gateways, the route would point to the gateway, and in the case of private endpoints the route would point to the endpoint.

2. 2. Your e-commerce website hosted on Oracle Cloud Infrastructure (OCI) experiences sudden spikes in traffic, which you suspect could be due to a distributed denial-of-service (DDoS) attack.

You want to mitigate the impact of these traffic spikes while ensuring legitimate users can access the site.

What feature of OCI Web Application Firewall (WAF) can help address this situation?

• A. Rate limiting to restrict the number of requests from a single IP

• B. Network Address List (NAL) for authorized users

• C. CAPTCHA challenge to all incoming traffic

3. 3. You are a Network Administrator working for a company that uses Oracle Cloud Infrastructure (OCI) Regional Web Application Firewall (WAF) to protect its web applications from Internet threats.

You have created a WAF policy and attached it to your load balancer. You want to block all traffic from IP addresses that are known to be malicious or belong to competitors and want to allow traffic from specific IP addresses that are trusted or belong to partners.
Additionally, you want to restrict access to certain parts of your web applications based on the user agent or the HTTP method. You also want to redirect users to a custom URL if they are denied access.

Which set of actions must you perform to meet these requirements?

• A. Create a firewall rule for each IP address category (malicious, competitor, trusted, partner) and use the BLOCK or ALLOW actions. Create an access control rule for each user agent or HTTP method condition and use the ALLOW or REDIRECT actions.

• B. Create a network address list for each IP address category (malicious, competitor, trusted,partner) and use it in your firewall rules. Create an access control rule for each user agent or HTTP method condition and use the ALLOW or REDIRECT actions.

• C. Create both a firewall and network rules for each IP address category (malicious, competitor,trusted, partner) and use the BLOCK or ALLOW actions. Create an access control rule for each user agent or HTTP method condition and use the REDIRECT or DENY actions.

5. 5. A global company is migrating its applications to Oracle Cloud Infrastructure (OCI). The company has over 15 business units. Each business unit designs and maintains applications that are hosted in its own OCI tenancies in separate application Virtual Cloud Networks (VCNs) in the same OCI region.

   Each business unit's applications are designed to get data from a central shared-services VCN. The company wants the network connectivity architecture to provide granular security controls. The architecture must also be able to scale as more business units may be added in the future.
   
   Which solution meets these requirements in the most scalable manner?

• A. Create VCN peering connections between the central shared-services VCN and each application VCN in each business unit’s OCI tenancy by using a local peering gateway in the shared services VCN for each business unit.

• B. Create a dynamic routing gateway. Create an IPSec attachment to each application VCN. Create a VPN connection from each VCN to the shared services VCN. Provide full mesh connectivity among all the VCNs. Traffic will be encrypted end to end from the application to the shared services VCN.

• C. Create a dynamic routing gateway. Create a cross-tenancy VCN attachment to each application VCN. Modify the routing tables of each attachment to import the shared-services VCN.

6. 6. You are architecting a Proof of Concept (PoC) for a major Oracle Cloud Infrastructure (OCI) customer. In the PoC architecture, the customer has one large Virtual Cloud Network (VCN) hosting multiple subnets, including an applications subnet where they have 72 web servers.
   To provide access to OCI bucket storage from the servers, you deploy a service gateway. The Chief Information Security Officer (CISO) raises security concerns that although the bucket storage content is controlled by the company, the service gateway traffic between their cloud footprint and the buckets needs to be fully inspected.
   
   Which architecture provides a valid solution to the issue raised by the Security team?

(1 Point)

• A. Deploy a third-party firewall appliance in a separate private subnet and update the route table on the service gateway to first send the inbound traffic to the private IP address of the firewall. No changes are required to the applications subnet.

  
  

• B. Deploy a third-party firewall appliance in a separate private subnet and update the route table on the service gateway to first send the inbound traffic to the private IP address of the firewall. The routing table of the applications subnet must be manually updated.

  
  

• C. Have the OCI service gateway perform in-depth and Layer 3 and 7 security inspections and provide the documentation to the CISO for their approval.

  
  

7. 7. You are enabling access to the Oracle Services Network from your on-premises environment by using a transitive routing design. All components have been configured properly except the Services Gateway (SGW).
   
   After you create the SGW, what is the proper configuration to allow devices from the Oracle Services Network (OSN) to communicate with devices in your on-premises data center?

• A. Create a new routing table in your VCN with a destination of 172.16.0.0/16 and a target of the DRG. Associate this routing table to your SGW.

• B. Go to your SGW and create a new routing table with a destination of 172.16.0.0/16 and a target of the DRG. Click Enable.

• C. Go to your DRG and export the routes from your on-premises network to your SGW dynamically by using BGP.

8. 8. Your customer is a large company with different departments, each with their own Virtual Cloud Network (VCN). Your on-premises network needs access to the different VCNs, but you don't want the administration overhead of maintaining a secure connection from each VCN to the on-premises network. Instead, you want to use a single FastConnect or Site-to-Site VPN.

To accomplish this (as shown in the diagram), you use transit routing over a hub-and-spoke design to force traffic through a packet inspection device in the hub VCN.

Which three must you configure for this to work properly?

• A. Create a static route in the dynamic routing gateway pointing to your on-premises network.

• B. Set up rules in the hub VCN route tables that will direct traffic from each local peering gateway (LPG) on the hub VCN to the dynamic routing gateway (DRG), and from the DRG to each LPG.

• C. Assign the Network Security Group to the local peering gateway.

• D. Associate VCN route tables from the hub VCN with the hub VCN’s local peering gateways and dynamic routing gateway attachment.

• E. Establish a connection between each spoke VCN and the hub VCN.