Online Access Free 1z0-1124-25 Exam Questions

You are automating the deployment of a highly available OKE cluster across multiple availability domains (ADs) using Terraform. The OKE cluster needs to communicate with a database service running on a Compute instance in a separate private subnet within the same VCN. During the Terraform deployment, you encounter an error indicating that the Kubernetes pods cannot resolve the private IP address of the database instance. You've verified that DNS resolution works correctly for other resources within the VCN. What is the MOST probable reason for this DNS resolutionfailure?

• A.The security list associated with the database subnet does not allow ingress traffic from the OKE cluster' s node pool subnet on port 53 (DNS).
• B.The OKE cluster's node pool subnet is not associated with a route table that has a rule for the VCN's DNS resolver.
• C.The OKE cluster was created with a public endpoint only, and therefore cannot resolve private IP addresses.
• D.The CoreDNS pods within the OKE cluster are not configured to use the VCN's DNS resolver.

Your company is deploying a high-throughput, low-latency financial application on OCI. This application relies on raw TCP connections and requires connection persistence to maintain session state. You anticipate extremely high traffic volume and need a load balancer that can handle millions of concurrent connections with minimal overhead. You also want to use private endpoints. Which OCI load balancing option provides the most appropriate solution to meet these stringent performance and security requirements?

• A.Global Load Balancer with TCP load balancing and Cookie-based Persistence
• B.Regional Load Balancer with HTTP load balancing and Source IP Hash Persistence
• C.Network Load Balancer with TCP load balancing and 5-Tuple Hash Persistence
• D.Regional Load Balancer with TCP load balancing and IP Hash Persistence

You are designing a hybrid cloud architecture connecting your on-premises network to OCI. You have established a Site-to-Site VPN between your on-premises network and an OCI DRG. You have two VCNs attached to the DRG: VCN-A (10.0.0.0/16) and VCN-B (10.1.0.0/16). You need to ensure that only VCN-A can communicate with the on-premises network (192.168.1.0/24), while VCN-B should remain isolated. What is the MOST effective and secure method to achieve this connectivity requirement using DRG route tables?

• A.Create two DRG route tables: DRG-RT-A and DRG-RT-B. In DRG-RT-A, add a route rule for
  192.168.1.0/24 pointing to the VPN attachment. Associate DRG-RT-A with the VCN-A attachment. In DRG-RT-B, add a route rule for 192.168.1.0/24 pointing to the VPN attachment and associate DRG- RT-B with the VCN-B attachment. Then, use security lists to block all traffic between VCN-B and the on-premises network.
• B.Create a single DRG route table. Add a route rule to the DRG route table for 192.168.1.0/24 pointing to the VPN attachment. Associate this route table with the VCN-A attachment. Associate a default DRG route table that contains no routes for the VPN attachment with the VCN-Battachment.
• C.Create two DRG route tables: DRG-RT-A and DRG-RT-B. In DRG-RT-A, add a route rule for
  192.168.1.0/24 pointing to the VPN attachment. Associate DRG-RT-A with the VCN-A attachment.
  Associate DRG-RT-B (containing no routes for 192.168.1.0/24) with the VCN-B attachment.
• D.Create a single DRG route table. Add a route rule to the DRG route table for 192.168.1.0/24 pointing to the VPN attachment. Associate this route table with both the VCN-A and VCN-B attachments.
  Implement Network Security Groups (NSGs) on VCN-B to block all traffic to and from 192.168.1.0/24.

You are designing an OCI networking architecture for a multi-tier application using Infrastructure as Code (IaC). The architecture includes an OKE cluster for the front-end, a set of Compute instances for the back- end, and an Autonomous Database. You want to ensure that all traffic between these components is encrypted. You are using Transport Layer Security (TLS) for end-to-end encryption but are concerned about the overhead of encrypting all traffic within the VCN. Which approach provides the MOST balanced approach to security and performance, minimizing the overhead of encryption while still protecting sensitive data?

• A.Use Network Security Groups (NSGs) and Security Lists to control access between components but do not implement any additional encryption within the VCN.
• B.Implement TLS encryption for traffic between the OKE cluster and the Compute instances and use Oracle Database Vault to encrypt data at rest and in transit for the Autonomous Database.
• C.Implement mutual TLS (mTLS) for all traffic between the OKE cluster, the Compute instances, and the Autonomous Database.
• D.Implement TLS encryption only between the OKE cluster and the load balancer. Rely on the inherent security of the OCI network for traffic within the VCN.

Consider a scenario where you have several private subnets within your VCN, and instances in these subnets need to access different OCI Object Storage buckets across various compartments. How can you efficiently manage and secure private access to Object Storage for all these subnets while adhering to the principle of least privilege?

• A.Deploy a single NAT Gateway and manage access using Network Security Groups (NSGs) for each subnet.
• B.Create a Private Endpoint for each Object Storage bucket within each private subnet.
• C.Configure a single Internet Gateway and use IAM policies to control access at the bucket level.
• D.Implement a Service Gateway within the VCN and utilize IAM policies and route tables to direct traffic to the appropriate Object Storage service endpoints.