Question 1

Your security team has mandated that all traffic to Oracle Cloud Infrastructure Object Storage must
be encrypted end-to-end and must not be routed over the public internet. You are designing a
solution where compute instances within a private subnet will frequently upload and download data
from Object Storage. Which of the following options provides the most secure and compliant
solution?

Accepted Answer

C

Explanation: Requirements: End-to-end encryption, no public internet for Object Storage access. Options Analysis: Service Gateway: Private access to Object Storage. NAT Gateway: Public internet access; unsuitable. Private Endpoint: Alternative private access, but newer feature. HTTPS: Ensures in-transit encryption. Evaluate Options: A: Encryption at rest doesn’t cover transit; incomplete. B: NAT uses public internet; violates policy; incorrect. C: Service Gateway with HTTPS ensures full encryption and privacy; correct. D: Private Endpoint with HTTPS is valid but less common than Service Gateway; slightly less optimal historically. Conclusion: Service Gateway with HTTPS is most secure and compliant. Service Gateway is standard for private Object Storage access. The Oracle Networking Professional study guide states, "A Service Gateway with HTTPS API calls ensures end-to-end encrypted traffic to Object Storage without public internet traversal" (OCI Networking Documentation, Section: Service Gateway). This meets security mandates effectively. Reference: Oracle Cloud Infrastructure Documentation - Service Gateway.

Question 2

When analyzing Flow Logs for a subnet, how can you filter logs to isolate traffic that was rejected due to a specific security list rule?

Accepted Answer

A

Explanation: Goal: Filter Flow Logs for traffic rejected by a specific security list rule. Option A: “action” = “REJECT” identifies rejected traffic; “securityListRule” with rule ID pinpoints the exact rule—correct. Option B: “status” and “securityRule” aren’t standard Flow Log fields (“action” and “securityListRule” are)—incorrect. Option C: “direction” and “port” filter traffic but don’t specify rejection or rule—incorrect. Option D: “type” and “rule” aren’t valid Flow Log fields—incorrect. Conclusion: Option A is the precise filtering method. Oracle states: "In Flow Logs, use the ‘action’ field (‘REJECT’) and ‘securityListRule’ field (rule ID) to filter traffic rejected by a specific security list rule.” This validates Option A. Reference: Flow Logs Fields - Oracle Help Center (docs.oracle.com/en- us/iaas/Content/Network/Concepts/flowlogs.htm#fields).

Question 3

You’re designing a multi-region deployment of your application on OCI. You want to use OCI’s global
load balancing capabilities, but also require the WAF to protect against attacks close to the user.
Which configuration provides the best balance between global load balancing and regional WAF
protection?

Accepted Answer

B

Explanation: Goal: Balance global load balancing with regional WAF protection near users. Option A: Single WAF in one region creates a bottleneck and increases latency—insufficient. Option B: GLB distributes globally to regional Load Balancers, each with a WAF, ensuring protection close to users—correct. Option C: WAF before GLB centralizes protection, adding latency and a single failure point— incorrect. Option D: Source IP routing with regional WAFs is less optimal than GLB’s health-based routing—less effective. Conclusion: Option B optimizes both goals. Oracle states: "OCI GLB distributes traffic across regions. Pair with regional Load Balancers and WAFs for localized protection and optimal performance." This supports Option B. Reference: Global Load Balancer Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Balance/Concepts/globalbalance.htm).

Question 4

You are managing a Site-to-Site VPN connection between your on-premises network and OCI. You
notice that the VPN tunnel is frequently dropping and re-establishing. You have verified the internet
connectivity at both ends and confirmed that the IKE (Internet Key Exchange) parameters are
correctly configured. Which of the following is the most likely cause of the intermittent VPN tunnel
disconnections?

Accepted Answer

C

Explanation: Symptoms: VPN tunnel drops intermittently despite stable internet and IKE settings. VPN Components: Requires IKE (UDP 500/4500) and ESP (IP 50) traffic. Evaluate Options: A: Incorrect CPE IP would prevent tunnel establishment, not intermittent drops; incorrect. B: DRG outage would cause full downtime, not intermittent; unlikely. C: Security rules blocking IKE/ESP intermittently (e.g., rate limiting) is common; most likely. D: NAT-Traversal issues typically prevent initial setup, not intermittent drops; less likely. Conclusion: Security rule misconfiguration is the most probable cause. VPN stability depends on unblocked IKE and ESP traffic. The Oracle Networking Professional study guide notes, "Intermittent VPN tunnel drops are often caused by security rules or firewalls blocking IKE (UDP 500/4500) or ESP (IP Protocol 50) traffic" (OCI Networking Documentation, Section: Site-to- Site VPN Troubleshooting). This aligns with the scenario’s symptoms. Reference: Oracle Cloud Infrastructure Documentation - Site-to-Site VPN.

Question 5

In a hybrid cloud migration, which OCI component is essential for dynamically routing traffic between on-premises networks and OCI Virtual Cloud Networks (VCNs), facilitating seamless communication?

Accepted Answer

B

Explanation: Objective: Identify the OCI component for dynamic routing in a hybrid setup. Option A: Internet Gateway enables public internet access, not private hybrid routing—incorrect. Option B: DRG is a virtual router that dynamically routes traffic between on-premises networks and VCNs via FastConnect or VPN, using protocols like BGP—correct. Option C: Service Gateway provides private access to OCI services, not on-premises connectivity— incorrect. Option D: LPG peers VCNs within the same region, not with on-premises—incorrect. Conclusion: DRG is essential for hybrid dynamic routing. Oracle documentation confirms: "The Dynamic Routing Gateway (DRG) enables dynamic routing between your on-premises network and VCNs, supporting hybrid cloud connectivity via FastConnect or VPN." This validates Option B. Reference: Dynamic Routing Gateway Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm).

Question 6

When setting up cross-tenancy VCN peering using Local Peering Gateways (LPGs), which IAM permission is required in the target tenancy to accept the peering request?

Accepted Answer

A

Explanation: Requirement: IAM permission to accept cross-tenancy LPG peering. Option A: “Manage” allows creating and accepting peering—correct. Option B: “Use” permits using existing LPGs, not accepting requests—incorrect. Option C: “Inspect” is read-only, insufficient—incorrect. Option D: “Read” on virtual-network-family doesn’t cover LPG management—incorrect. Conclusion: Option A is required. Oracle states: "To accept a cross-tenancy peering request, the target tenancy needs ‘manage local-peering- gateways’ permission." This confirms Option A. Reference: Local VCN Peering - Oracle Help Center (docs.oracle.com/en- us/iaas/Content/Network/Tasks/localVCNpeering.htm).

Question 7

When configuring transitive routing with a DRG across multiple VCNs and on-premises networks,
which key configuration step ensures that traffic from one VCN is correctly routed through the DRG
to an on-premises destination?

Accepted Answer

B

Explanation: Transitive Routing Goal: Traffic from a VCN to an on-premises network via DRG. DRG Role: Acts as a virtual router connecting VCNs and on-premises networks. Routing Options: Static Routes: Manually defined, less scalable for dynamic environments. Dynamic Routing (BGP): Automatically exchanges routes, ideal for hybrid setups. Evaluate Options: A: Static routes work but require manual updates; less efficient. B: BGP dynamically propagates routes, ensuring correct routing; best fit. C: LPG is for intra-region peering, not on-premises connectivity; incorrect. D: Service Gateway is for OCI services, not on-premises; incorrect. Conclusion: BGP ensures scalable, accurate routing through the DRG. The DRG supports transitive routing with dynamic protocols like BGP. The Oracle Networking Professional study guide states, "For transitive routing between VCNs and on-premises networks via a DRG, configuring BGP on the DRG and CPE enables automatic route propagation, ensuring traffic is correctly routed" (OCI Networking Documentation, Section: Dynamic Routing Gateway). BGP is preferred over static routes for hybrid cloud scenarios. Reference: Oracle Cloud Infrastructure Documentation - Dynamic Routing Gateway.

Question 8

A company has deployed a VCN in OCI with multiple subnets. Security requirements dictate that
instances in different subnets within the same VCN should not be able to directly communicate with
each other unless explicitly permitted. You are tasked with implementing this policy. What is the
most appropriate approach to meet this requirement?

Accepted Answer

C

Explanation: Requirement: Restrict inter-subnet communication unless permitted. Options Analysis: A: Removing default route breaks all routing, overly restrictive; incorrect. B: Separate VCNs are excessive, complex; less practical. C: NSGs provide granular, explicit control; optimal approach. D: External firewall adds complexity, not VCN-native; inefficient. NSG Advantage: Instance-level rules enforce policy within VCN. Conclusion: NSGs are the most appropriate solution. NSGs enable precise security within a VCN. The Oracle Networking Professional study guide states, "Network Security Groups (NSGs) allow you to define strict ingress and egress rules for instances, ensuring inter-subnet communication is explicitly permitted as per security policies" (OCI Networking Documentation, Section: Network Security Groups). This is more efficient than VCN separation or external firewalls. Reference: Oracle Cloud Infrastructure Documentation - Network Security Groups.

Question 9

You are troubleshooting an issue where a compute instance in a private subnet within a VCN cannot
reach OCI Object Storage. You have verified that a Service Gateway is configured for the VCN and that
the route table associated with the subnet has a route rule directing traffic for OCI Services to the
Service Gateway. However, the instance still cannot connect. What is the MOST likely cause of the
problem?

Accepted Answer

B

Explanation: Problem: Instance in private subnet can’t reach Object Storage despite Service Gateway and routing. Option A: Service Gateway enables private access; public IP isn’t required—incorrect. Option B: Security lists/NSGs act as firewalls; if outbound traffic to Object Storage CIDR isn’t allowed, connectivity fails—most likely and correct. Option C: Service Gateway defaults to all OCI services unless restricted; less likely given setup verification—incorrect. Option D: Oracle Cloud Agent is for management, not connectivity—incorrect. Conclusion: Option B is the most probable cause. Oracle states: "For private access to Object Storage via a Service Gateway, ensure security lists or NSGs allow outbound traffic to the Object Storage CIDR block." This supports Option B. Reference: Service Gateway Troubleshooting - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/servicegateway.htm#troubleshooting).

Question 10

Your company is migrating its on-premises data center to OCI. A critical security requirement is to
maintain centralized logging and auditing of all network traffic traversing the OCI Network Firewall.
You need to ensure that every session that passes through the firewall is logged and can be analyzed
for security events. Which OCI service should you configure in conjunction with the Network Firewall
to achieve this centralized logging?

Accepted Answer

C

Explanation: Requirement: Centralized logging of Network Firewall traffic for analysis. OCI Services: Audit Service: Logs API calls, not network traffic. Logging Analytics: Analyzes logs but needs log ingestion. Service Connector Hub with Logging: Moves firewall logs to OCI Logging. Cloud Guard: Monitors security posture, not detailed logging. Evaluate Options: A: Audit Service is for API events; incorrect. B: Logging Analytics requires log source; incomplete. C: Service Connector Hub with Logging captures and stores firewall logs; best fit. D: Cloud Guard is for threat detection, not logging; incorrect. Conclusion: Service Connector Hub with OCI Logging meets the requirement. OCI Network Firewall logs require integration with OCI Logging. The Oracle Networking Professional study guide states, "Service Connector Hub can be configured to transfer Network Firewall logs to OCI Logging for centralized storage and analysis, meeting auditing requirements" (OCI Networking Documentation, Section: Network Firewall Logging). This ensures every session is logged and auditable. Reference: Oracle Cloud Infrastructure Documentation - Service Connector Hub.

Question 11

Your organization requires that all backups of critical application data stored in OCI Object Storage
from an instance within a private subnet must remain within the Oracle Cloud Infrastructure network
and not traverse the public internet. Which OCI networking component should you configure to
enable this secure and private access to Object Storage?

Accepted Answer

C

Explanation: Requirement: Private access to Object Storage from a private subnet. Components: Internet Gateway: Public internet access; unsuitable. NAT Gateway: Outbound internet; unsuitable. Service Gateway: Private OCI service access; fits requirement. Network Firewall: Security, not routing; incorrect. Evaluate Options: A: Public internet; violates policy. B: Public internet; violates policy. C: Keeps traffic in OCI network; correct. D: Doesn’t enable access; incorrect. Conclusion: Service Gateway ensures private access. Service Gateway is designed for private OCI service access. The Oracle Networking Professional study guide explains, "A Service Gateway allows private subnet instances to access Object Storage without traversing the public internet, ensuring secure data transfer within OCI" (OCI Networking Documentation, Section: Service Gateway). This meets the security requirement. Reference: Oracle Cloud Infrastructure Documentation - Service Gateway.

Question 12

A company wants to leverage a best-of-breed approach for their application stack. They plan to use
OCI for its Autonomous Database, Azure for its container orchestration (AKS), and AWS for its object
storage (S3). Considering cost optimization and minimizing data egress charges, which strategy is the
MOST efficient for transferring large datasets between these services?

Accepted Answer

C

Explanation: Goal: Efficient, cost-optimized data transfer minimizing egress charges. Option A: Public internet incurs high egress costs—incorrect. Option B: Hub-and-spoke doubles egress/ingress charges—less efficient. Option C: Third-party platform at peering points reduces egress by leveraging direct connections— correct. Option D: Storage Gateway is for hybrid, not multicloud efficiency—incorrect. Conclusion: Option C is the most efficient strategy. Oracle states: "A third-party integration platform at peering points minimizes egress charges by using direct interconnects for multicloud data transfers.” This validates Option C. Reference: Multicloud Cost Optimization - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Concepts/multicloud.htm#costoptimization).

Question 13

You are designing a highly available web application on OCI. The application needs to be accessible
globally with traffic being routed to the nearest region based on user location. Additionally, you need
to implement sophisticated traffic management policies, such as A/B testing and weighted traffic
distribution based on application version. You also require protection against DDoS attacks. Which
OCI load balancing solution is best suited for these requirements?

Accepted Answer

C

Explanation: Requirements: Global access, geo-routing, advanced traffic management, DDoS protection. Load Balancer Options: Regional LB: Single-region, no global routing or advanced policies. NLB: Layer 4, no HTTP-based traffic management or DDoS features. Global LB with Steering Policies: Layer 7, supports geo-routing and policies. Flexible LB: Not a specific OCI service. Assess Fit: A: Lacks global and advanced features; unsuitable. B: No Layer 7 or DDoS protection; incorrect. C: Meets all requirements with geo-routing, steering policies, and WAF integration; best fit. D: Non-existent service; incorrect. Conclusion: Global LB with steering policies is the best solution. The Global Load Balancer with Traffic Management Steering Policies supports global applications. The Oracle Networking Professional study guide explains, "Global Load Balancer enables geo-based routing and advanced traffic policies like A/B testing and weighted distribution, integrating with OCI WAF for DDoS protection" (OCI Networking Documentation, Section: Load Balancing - Traffic Management). This aligns with all specified requirements. Reference: Oracle Cloud Infrastructure Documentation - Traffic Management.

Question 14

Your organization is deploying a critical database application on OCI. To ensure high availability, you
have deployed the database instances across multiple availability domains (ADs) within a single
region. You need to distribute client connections to the database instances and ensure that the load
balancer can handle long-lived TCP connections with minimal overhead. Session persistence is not
required. Which OCI load balancing solution would you choose in this scenario to minimize latency
and connection establishment overhead?

Accepted Answer

B

Explanation: Requirements: Low-latency, minimal overhead for TCP connections, no session persistence. Load Balancer Types: Application Load Balancer (ALB): Layer 7, higher overhead, suited for HTTP/HTTPS. Network Load Balancer (NLB): Layer 4, low overhead, ideal for TCP/UDP. Evaluate Options: A: ALB with HTTP checks is for HTTP traffic, adds overhead; unsuitable. B: NLB with TCP checks is optimized for TCP, low latency; best fit. C: ALB with TCP checks still has Layer 7 overhead; less efficient. D: “Flexible Load Balancer” isn’t a specific OCI service; incorrect. Conclusion: NLB minimizes latency and overhead for TCP connections. The Network Load Balancer is designed for high-performance TCP scenarios. The Oracle Networking Professional study guide states, "Network Load Balancer operates at Layer 4, providing low-latency, high-throughput load balancing for TCP/UDP traffic with minimal overhead, ideal for database connections" (OCI Networking Documentation, Section: Load Balancing). TCP health checks ensure instance availability without session persistence complexity. Reference: Oracle Cloud Infrastructure Documentation - Network Load Balancer.

Question 15

You are designing a highly available web application in OCI. You’ve created a VCN with two public
subnets across different Availability Domains (ADs). You need to enable IPv6 support for the
application to cater to a growing number of IPv6-only clients. You plan to use a Load Balancer to
distribute traffic to backend compute instances in the public subnets. Which of the following
approaches ensures the highest level of resilience and IPv6 connectivity for your application?

Accepted Answer

D

Explanation: Requirements: HA and IPv6 support for public web app. Option A: ULA is private, not routable; NAT for IPv6 is inefficient—incorrect. Option B: ULA doesn’t support public IPv6 clients—incorrect. Option C: Public IPv6 CIDR is correct, but IPv4-only LB with NAT lacks direct IPv6—less resilient. Option D: Public IPv6 CIDR with dual-stack LB and instances ensures full IPv6 support and HA across ADs—correct. Conclusion: Option D maximizes resilience and connectivity. Oracle states: "For public IPv6 applications, use a public IPv6 CIDR block and configure Load Balancers and instances for both IPv4 and IPv6 to ensure resilience." This supports Option D. Reference: IPv6 in OCI - Oracle Help Center (docs.oracle.com/en- us/iaas/Content/Network/Tasks/managingIPv6.htm).

Free Oracle 1Z0-1124-25 Actual Exam Questions