Objective : Identify a VPN disadvantage for large dataset migration.

Option A : VPNs can be secure with IPSec; not inherently less secure—incorrect.

Option B : VPNs are automatable with IaC (e.g., Terraform)—incorrect.

Option C : Public internet limits VPN throughput due to bandwidth and latency variability—correct disadvantage.

Option D : VPNs are compatible with OCI services—incorrect.

Conclusion : Option C is the key disadvantage.

Oracle notes:

"Public internet-based VPNs face throughput limitations due to bandwidth and latency variability, impacting large data migrations.” This supports Option C. Reference: VPN Limitations - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/settingupIPSec.htm#limitations).

Requirements : HA and redundancy for on-premises-to-OCI connectivity.

Option A : Single FastConnect lacks redundancy—incorrect.

Option B : Single VPN over internet has no redundancy and poor performance—incorrect.

Option C : Dual FastConnect with diverse paths ensures HA and redundancy via separate routes—correct.

Option D : Internet Gateway with public IPs isn’t dedicated or redundant—incorrect.

Conclusion : Option C is the recommended approach.

Oracle advises:

"For high availability, use dual FastConnect connections with diverse paths to eliminate single points of failure in hybrid connectivity." This supports Option C. Reference: FastConnect High Availability - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/fastconnect.htm#ha).

Goal : Secure, granular access control to ADB from private subnet instances.

Option A : Public endpoint with NSGs exposes ADB to the internet, increasing risk despite NSG restrictions—less secure than private options.

Option B : Service Gateway provides private access to OCI services, but it’s not specific to ADB instances and lacks the instance-level granularity of private endpoints.

Option C : Private ADB endpoint assigns a private IP within the VCN, keeping traffic internal. NSGs allow precise, stateful control to specific instances, offering the most granular security.

Option D : DRG is for external connections (e.g., on-premises), not internal VCN-to-ADB access.

Conclusion : Option C provides the most secure and granular control.

Oracle documentation notes:

"Private endpoints for Autonomous Database provide a private IP within your VCN, ensuring traffic stays off the public internet. Use NSGs for fine-grained access control to specific instances." This supports Option C. Reference: Autonomous Database Networking - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Database/Tasks/adbconnecting.htm).

Requirements : Private, low-latency cross-region VCN connectivity.

Option A : RPCs with route table updates enable private, direct peering via DRG—correct.

Option B : IPSec VPN adds latency over internet—incorrect.

Option C : Service Gateways are for OCI services—incorrect.

Option D : NAT Gateways use public IPs, not private—incorrect.

Conclusion : Option A is necessary.

Oracle states:

"Use Remote Peering Connections (RPCs) with DRG to connect VCNs across regions privately. Update route tables for CIDR routing." This supports Option A. Reference: Remote VCN Peering - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/remoteVCNpeering.htm).

Zero Trust Principles: Require explicit, identity-based access controls at every network stage.

Evaluate OCI Services:

Internet Gateway: Enables public internet access, no identity-based control.

Service Gateway: Provides private service access, no granular routing control.

NSGs: Offer stateful, identity-based rules at the VNIC level.

DRG: Facilitates routing, not identity-based access control.

NSG Fit: NSGs allow rules based on VNIC identity, source/destination IP, and ports, aligning with Zero Trust.

Conclusion: NSGs are the best fit for granular, identity-based routing control.

NSGs are pivotal for Zero Trust in OCI. The Oracle Networking Professional study guide states, "Network Security Groups provide granular, stateful security rules that can be applied to specific VNICs, enabling identity-based access controls essential for Zero Trust architectures" (OCI Networking Documentation, Section: Network Security Groups). Unlike security lists (subnet-level), NSGs offer instance-level precision.

Objective : Securely transition from self-signed to trusted CA certificates.

Option A : Importing self-signed certificates into OCI Certificates doesn’t improve security—incorrect.

Option B : Immediate replacement risks outages if clients don’t trust the new CA—unrecommended.

Option C : Gradual replacement with OCI Certificates, updating client truststores, ensures security and minimizes disruption—correct.

Option D : Bypassing validation via WAF weakens security—incorrect.

Conclusion : Option C is the most secure and recommended method.

Oracle advises:

"Replace self-signed certificates with OCI Certificates from a trusted CA. Perform a phased rollout and update client truststores to avoid disruptions." This validates Option C. Reference: OCI Certificates Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Security/Certificates/overview.htm).

Objective: Enable transitive routing via a network appliance (e.g., firewall) between VCNs.

Transitive Routing Setup: DRG connects VCNs; appliance processes traffic.

Key Requirement: DRG must route traffic to the appliance’s private IP.

Evaluate Options:

A: Service Gateway is for OCI services, not transitive routing; incorrect.

B: Static routes on DRG to appliance ensure correct traffic flow; essential.

C: Load Balancer is optional, not essential for routing; incorrect.

D: LPG is for intra-region VCN peering, not appliance-DRG connection; incorrect.

Conclusion: DRG static routes to the appliance are critical for transitive routing.

Transitive routing with a network appliance requires explicit routing configuration. The Oracle Networking Professional study guide notes, "To enable transitive routing through a network appliance, configure static routes in the DRG route table pointing to the appliance’s private IP as the next hop" (OCI Networking Documentation, Section: Transitive Routing with DRG). This ensures traffic is processed by the appliance between VCNs.

Requirements : HA and IPv6 support for public web app.

Option A : ULA is private, not routable; NAT for IPv6 is inefficient—incorrect.

Option B : ULA doesn’t support public IPv6 clients—incorrect.

Option C : Public IPv6 CIDR is correct, but IPv4-only LB with NAT lacks direct IPv6—less resilient.

Option D : Public IPv6 CIDR with dual-stack LB and instances ensures full IPv6 support and HA across ADs—correct.

Conclusion : Option D maximizes resilience and connectivity.

Oracle states:

"For public IPv6 applications, use a public IPv6 CIDR block and configure Load Balancers and instances for both IPv4 and IPv6 to ensure resilience." This supports Option D. Reference: IPv6 in OCI - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingIPv6.htm).

Objective: Filter BGP routes on OCI to accept only specific on-premises prefixes.

BGP Attributes Overview:

AS Path Prepending: Lengthens AS path to influence route preference, not filtering.

MED: Influences exit point selection, not route acceptance.

RD/RT: Used in MPLS VPNs for tenant isolation, not simple prefix filtering.

Prefix Lists: Directly filter prefixes based on IP ranges.

Evaluate Options:

A: AS Path Prepending affects preference, not filtering; unsuitable.

B: MED influences path selection, not route rejection; incorrect.

C: RD/RT is for VPN contexts, not applicable here.

D: Prefix Lists explicitly allow/deny prefixes, meeting the requirement.

Conclusion: Prefix Lists on the FastConnect virtual circuit provide precise control over accepted routes.

Prefix Lists are the most effective BGP tool for filtering routes in OCI. The Oracle Networking Professional study guide notes, "Prefix Lists can be applied to FastConnect virtual circuits to filter BGP advertisements, ensuring only approved prefixes are learned by OCI" (OCI Networking Documentation, Section: FastConnect and BGP). This prevents routing conflicts by rejecting unwanted prefixes, aligning with the security and control requirements.

Requirements: Low latency, high bandwidth, multi-region VCNs via one FastConnect, minimal cost/overhead.

DRG Strategy:

Multiple DRGs: Increases cost and complexity.

Single DRG: Centralizes management, reduces FastConnect attachments.

Evaluate Options:

A: Multiple DRGs and FastConnects; costly and complex; incorrect.

B: Remote peering connections imply RPC, not standard DRG attachments; less precise.

C: Single DRG with remote peering attachments; efficient and correct terminology; optimal.

D: LPGs are intra-region, not cross-region; incorrect.

Conclusion: Single DRG with remote peering attachments is most efficient.

A single DRG optimizes multi-region setups. The Oracle Networking Professional study guide notes, "For connecting multiple VCNs across regions to a single FastConnect, use one DRG with remote peering attachments to minimize cost and management overhead" (OCI Networking Documentation, Section: DRG with FastConnect). Option C aligns with OCI’s recommended architecture.