Oracle Updated 1z0-1124-25 Exam Questions and Answers by walter

Requirement: Private communication between VCNs in different OCI regions via DRG.

Option A: LPGs are for same-region VCN peering, not cross-region—incorrect.

Option B: Service Gateways are for OCI service access, not VCN-to-VCN routing—incorrect.

Option C: Attaching both VCNs to a single DRG (via Remote Peering Connections implicitly) and configuring route tables enables cross-region communication over OCI’s backbone. This is the standard approach.

Option D: Internet Gateways use public IPs, which is insecure and not private—incorrect.

Conclusion: Option C is the necessary configuration for DRG-based cross-region connectivity.

Oracle documentation confirms:

"To connect VCNs in different regions, attach each to a DRG using Remote Peering Connections (RPCs). Configure DRG route tables to route traffic between VCN CIDRs."Option C reflects this setup (RPCs are implied). Reference:VCN Peering Overview - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Network/Tasks/remoteVCNpeering.htm).

Objective: Improve OCI-AWS data transfer performance.

Option A: Region distance affects latency—valid.

Option B: Dedicated interconnect boosts bandwidth and stability—valid.

Option C: Compute pricing doesn’t influence inter-cloud bandwidth—invalid.

Option D: WAN optimization can enhance transfer efficiency—valid.

Conclusion: Option C is not a design consideration for performance.

Oracle notes:

"To optimize OCI-AWS connectivity, consider region proximity, dedicated interconnects, or WAN optimization. Compute pricing is unrelated to network performance."This excludes Option C. Reference:Hybrid Cloud Networking - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Network/Concepts/hybridcloud.htm).

Requirements:App tier (public) needs internet; DB tier (private) must not.

Components:

Internet Gateway:Full internet access for public subnets.

NAT Gateway:Outbound-only internet for private subnets.

Service Gateway:Private OCI service access.

Evaluate Options:

A:Reversed roles; public subnet doesn’t need Service Gateway; incorrect.

B:NAT for public is unnecessary with Internet Gateway; inefficient.

C:NAT for public is wrong; Service Gateway doesn’t block DB internet; incorrect.

D:Internet Gateway for app, NAT for DB if needed, aligns with policy; correct.

Conclusion:Option D is most secure and efficient.

Subnet roles dictate gateway use. The Oracle Networking Professional study guide states, "Public subnets use an Internet Gateway for full internet access, while private subnets can use a NAT Gateway for outbound-only access, ensuring no direct internet exposure" (OCI Networking Documentation, Section: VCN Gateways). Option D balances security and functionality.

Goal: Apply least privilege for Cloud Shell to run diagnostics (ping, traceroute, nc) within a VCN.

Option A: Read permission on all virtual-network-family resources is too broad, granting unnecessary access beyond diagnostics—violates least privilege.

Option B: Instance Principals use temporary credentials tied to the Cloud Shell instance, enhancing security. A dynamic group with “read” and “use” permissions on NSGs and VNICs allows inspecting configurations and running diagnostics (e.g., via VNICs), meeting the exact need—correct.

Option C: Inspect permission only provides metadata access, insufficient for running diagnostics (e.g., no “use” for traffic)—incorrect.

Option D: Use permission on virtual-network-family at tenancy level is overly permissive, granting access to all network resources—violates least privilege.

Conclusion: Option B is the most restrictive and secure, aligning with least privilege.

Oracle states:

"Instance Principals allow services like Cloud Shell to authenticate without static credentials. Policies with ‘read’ and ‘use’ on specific resources (e.g., network-security-groups, vnics) enable diagnostics while adhering to least privilege."This supports Option B. Reference:Instance Principals - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Identity/Tasks/instanceprincipals.htm).