1Z0-1072-25 Question 176
Single answerYou need to troubleshoot a sporadic connectivity issue affecting a compute instance in a private subnet. You want to capture only inbound TCP traffic coming from a specific external IP address (203.0.113.50) to diagnose the problem. Which approach correctly meets these requirements using OCI Capture Filters and Virtual Test Access Points (VTAP)?
- A
Create a capture filter specifying source IP as 203.0.113.50, protocol as TCP, and attach it to a new VTAP with the target set to a network monitoring instance.
- B
Enable VCN Flow Logs for all traffic in the private subnet and export logs to your Object Storage bucket for analysis.
- C
Modify the instance� security list to allow only traffic from 203.0.113.50 on TCP and rely on standard traffic flow logs for capturing details.
- D
Create a VTAP that mirrors all outbound traffic from the private subnet without specifying a capture filter, and send it to your monitoring instance.
Show answer and explanation
Correct answer: A
Explanation
Virtual Test Access Points (VTAP) in Oracle Cloud Infrastructure allow you to capture mirrored traffic for detailed analysis, while capture filters let you specify exactly which traffic to mirror (e.g., by source IP, destination IP, and protocol). This combination offers a targeted approach to troubleshooting network issues. Refer to the OCI Networking documentation on VTAP and capture filters for step-by-step guidance on setup and best practices.
- A. Correct.
Correct. By creating a capture filter with the exact source IP and protocol set to TCP, then attaching this filter to a VTAP configured for the specific instance or subnet, you capture only the relevant traffic from 203.0.113.50. This targeted approach reduces unnecessary data and helps isolate the connectivity issue effectively.
- B. Incorrect.
Incorrect. VCN Flow Logs provide visibility into accepted and rejected traffic and are useful for broad traffic analysis. However, they do not mirror or capture traffic packets for detailed forensic analysis the way a VTAP does, and you cannot apply a finer-grained capture filter with Flow Logs alone.
- C. Incorrect.
Incorrect. Adjusting the security list might prevent unauthorized traffic but does not provide mirrored packets for detailed inspection. Security lists control traffic flow rather than capturing packets for analysis, so this does not fulfill the requirement to capture the data itself.
- D. Incorrect.
Incorrect. Creating a VTAP without specifying a capture filter would mirror a large volume of unnecessary traffic, including outbound traffic, complicating your analysis. The goal is to capture only inbound TCP packets from a specific IP, so you must define a capture filter.