1Z0-1124-25 Exam Questions & Answers

Problem Context: BGP session is established, but no routes are exchanged, and basic config (ASNs, IPs) is correct.

Option A Analysis: Misconfigured keepalive timers would cause the session to drop intermittently. Since the session is confirmed as established, this is unlikely. Keepalives affect session stability, not route exchange.

Option B Analysis: A mismatch in BGP authentication keys (e.g., MD5 passwords) would prevent the session from establishing. Given the session is up, this is not the issue.

Option C Analysis: BGP prefix lists or route maps filter advertised routes. If either the on-premises router or OCI applies a filter (intentionally or misconfigured), it could block route advertisements despite an established session. This is a common issue in BGP setups and aligns with the symptoms.

Option D Analysis: MTU mismatches could cause packet loss or fragmentation, but BGP uses TCP (small packets), and session establishment indicates MTU isn't the primary issue. Route exchange failures are more likely due to filtering than MTU.

Conclusion: Option C is the most likely cause, as filtering directly prevents route exchange without affecting session status.

From Oracle's FastConnect documentation:

'Once a BGP session is established, routes are exchanged based on the prefixes advertised by each side. Route maps, prefix lists, or filters on either the CPE or OCI side can restrict which routes are advertised or accepted.'

'If no routes appear in the routing table despite an active session, verify that no filters are blocking advertisements.'

This supports Option C as the most likely cause. Reference: FastConnect Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/fastconnect.htm).

Requirements: End-to-end encryption, no public internet for Object Storage access.

Options Analysis:

Service Gateway: Private access to Object Storage.

NAT Gateway: Public internet access; unsuitable.

Private Endpoint: Alternative private access, but newer feature.

HTTPS: Ensures in-transit encryption.

Evaluate Options:

A: Encryption at rest doesn't cover transit; incomplete.

B: NAT uses public internet; violates policy; incorrect.

C: Service Gateway with HTTPS ensures full encryption and privacy; correct.

D: Private Endpoint with HTTPS is valid but less common than Service Gateway; slightly less optimal historically.

Conclusion: Service Gateway with HTTPS is most secure and compliant.

Service Gateway is standard for private Object Storage access. The Oracle Networking Professional study guide states, 'A Service Gateway with HTTPS API calls ensures end-to-end encrypted traffic to Object Storage without public internet traversal' (OCI Networking Documentation, Section: Service Gateway). This meets security mandates effectively.

Requirements: Low latency, high security with encryption for migration.

Option A: VPN with IPSec offers encryption but has higher latency over public internet---less optimal.

Option B: ExpressRoute and FastConnect provide a private, low-latency link; TLS adds end-to-end encryption---correct and best combination.

Option C: Data Factory with HTTPS is encrypted but slow and not real-time---incorrect.

Option D: VPN with Load Balancer SSL termination breaks end-to-end encryption---incorrect.

Conclusion: Option B balances performance and security.

Oracle notes:

'For latency-sensitive migrations, use FastConnect with ExpressRoute via colocation, enhanced by TLS for secure, high-performance data transfer.''

This supports Option B. Reference: Multicloud Connectivity - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Concepts/multicloud.htm).

Problem: Private subnet instances can't access Object Storage via Service Gateway.

Setup Check: Route rules point to Service Gateway; NSGs allow traffic.

Evaluate Causes:

A: Incorrect CIDR labels block Object Storage access; likely.

B: Internet Gateway irrelevant for Service Gateway; incorrect.

C: NSGs confirmed open, security lists secondary; less likely.

D: NAT Gateway not used here; incorrect.

Conclusion: Misconfigured Service Gateway CIDR is the most likely issue.

Service Gateway requires specific CIDR labels. The Oracle Networking Professional study guide states, 'For private subnets to access Object Storage via a Service Gateway, the gateway must be configured with the correct regional Oracle Services CIDR label' (OCI Networking Documentation, Section: Service Gateway Configuration). Misconfiguration prevents access despite proper routing.

Objective: Identify the feature for dynamic route learning via DRG.

Option A: Service Gateway is for OCI services---incorrect.

Option B: LPG is for VCN peering---incorrect.

Option C: BGP enables dynamic route exchange between DRG and on-premises---correct.

Option D: Internet Gateway is for public access---incorrect.

Conclusion: Option C is the correct feature.

Oracle notes:

'BGP on the DRG dynamically learns routes from on-premises networks over FastConnect or VPN, propagating them to VCNs.'

This confirms Option C. Reference: BGP with DRG - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm#BGP).