1Z0-1072-25 Question 173
Select 2Your organization has deployed two VCNs in the same region (VCN1 and VCN2) connected through a Local Peering Gateway (LPG). VCN1 hosts an application server in a private subnet, while VCN2 hosts a web server in a public subnet. However, the application server in VCN1 cannot reach the web server in VCN2. You run Network Path Analyzer, and it reports that the path is blocked but cannot pinpoint whether the issue is with routing or security rules. Which two actions should you take next to troubleshoot this connectivity problem? (Choose two.)
- A
Check all security lists or Network Security Groups (NSGs) in both subnets to confirm correct ingress and egress rules.
- B
Verify that each VCN� route table includes a route to the other VCN� CIDR block via the Local Peering Gateway.
- C
Attach an Internet Gateway to VCN1 and route outbound traffic from the private subnet to the web server in VCN2.
- D
Create a NAT Gateway in each VCN and configure a route rule to forward traffic to the NAT Gateway for inter-VCN communication.
- E
Re-run the Network Path Analyzer with an advanced inspection mode to automatically identify and fix incorrect route table entries.
Show answer and explanation
Correct answers: A, B
Explanation
When using Network Path Analyzer in OCI to troubleshoot inter-VCN communication over a Local Peering Gateway, verifying both routing configuration (route tables pointing to the LPG) and security rules (in security lists or NSGs) is essential. Network Path Analyzer can indicate a blocked path but does not automatically correct misconfigurations. For more information, refer to the OCI documentation on Network Path Analyzer and Local Peering Gateways.
- A. Correct.
Correct. Security lists or NSGs must allow traffic on the needed ports and IP ranges between the private subnet in VCN1 and the public subnet in VCN2. If rules are too restrictive, the path will be blocked.
- B. Correct.
Correct. For Local Peering Gateways, each VCN route table must explicitly include a route to the other VCN� CIDR block, using the LPG as the target. Missing or incorrect route rules will break communication.
- C. Incorrect.
Incorrect. An Internet Gateway is not necessary for communication via Local Peering. Internet Gateways are used to enable outbound/inbound connections to the public internet.
- D. Incorrect.
Incorrect. NAT Gateways enable private subnets to initiate connections to the internet, not to route traffic between two VCNs via local peering. They do not resolve inter-VCN routing issues.
- E. Incorrect.
Incorrect. While re-running Network Path Analyzer can provide more details, it does not automatically fix route tables. You must manually inspect and update routes and security rules after the analysis.