1Z0-1072-25 Question 170
Single answerYour on-premises environment cannot connect to a private Compute instance in an OCI Virtual Cloud Network (VCN) that is attached to a Dynamic Routing Gateway (DRG). After verifying your security rules and ensuring that the DRG is correctly attached to both on-premises and your VCN, you suspect a routing issue. Which action in Network Path Analyzer is most critical for pinpointing the exact hop�such as a route table or security configuration�that is blocking traffic?
- A
Configure the on-premises network� public IP and the instance� public IP as the source and target, and let Network Path Analyzer ignore private subnets and DRG route tables.
- B
Use the instance� private IP address as the target and specify the on-premises network� private IP as the source, ensuring each hop is checked for correct route and security configurations.
- C
Rely on automatically discovered source and destination IPs in the same compartment, and let the analyzer run only at the region level to detect all route errors automatically.
- D
Focus on the path within the VCN by setting up a test between two private IP addresses in the same subnet without specifying the DRG, since on-premises traffic is always routed correctly by default.
Show answer and explanation
Correct answer: B
Explanation
To troubleshoot on-premises connectivity to private subnets effectively, Network Path Analyzer must analyze the entire path, including the DRG, route tables, and security configurations. According to Oracle documentation on Network Path Analyzer, specifying the correct source and destination IP addresses is key to revealing all relevant hops. In this scenario, using the on-premises private IP as the source and the private IP of the Compute instance as the target ensures that each potential point of failure�such as route misconfigurations on the DRG or incorrect security list settings�can be inspected and diagnosed accurately.
- A. Incorrect.
Option 1 is incorrect. Using only public IP addresses neglects the critical path through the DRG to the private subnets, making it impossible to detect where routing might fail on private networks or within DRG route tables.
- B. Correct.
Option 2 is correct. Pointing the source to the on-premises private IP and the target to the OCI instance� private IP lets Network Path Analyzer traverse each relevant hop, from the DRG configuration through route tables and security rules, identifying exactly where traffic is blocked.
- C. Incorrect.
Option 3 is incorrect. Automatically discovered IPs can be useful for internal paths, but restricting the analysis to the region level may skip or misrepresent the on-premises route, preventing detailed visibility into how packets traverse the DRG or on-premises edge.
- D. Incorrect.
Option 4 is incorrect. Testing only within the VCN won�t reveal issues relating to the on-premises environment or DRG routing. The assumption that on-premises traffic is 'always routed correctly' is not valid, especially when diagnosing real traffic flow problems.