1Z0-1072-25 Question 79
Single answerYour company has created an IPsec VPN connection between its on-premises data center and an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) containing a private subnet. However, on-premises clients cannot reach the database system deployed in that private subnet. Which action should you take to enable this connectivity?
- A
A. Add a route rule to the private subnet's route table that forwards on-premises traffic to the Dynamic Routing Gateway (DRG).
- B
B. Associate a NAT Gateway with the private subnet so on-premises requests are routed through the internet.
- C
C. Create a Service Gateway and add its IP address range to the private subnet� route table.
- D
D. Deploy a Local Peering Gateway to enable secure traffic from on-premises to the private subnet.
Show answer and explanation
Correct answer: A
Explanation
To ensure connectivity from on-premises to a private subnet in OCI, you must have a valid VPN/IPsec connection to a Dynamic Routing Gateway (DRG) and configure a route table rule in the private subnet to direct traffic destined for on-premises IP ranges to the DRG. This is the critical step that ensures return traffic knows how to reach on-premises networks. For more information, refer to the Oracle Cloud Infrastructure documentation on VCN connectivity and route table configuration best practices.
- A. Correct.
A. Correct. Even if a VPN connection to the DRG is established, traffic from the private subnet must have an appropriate route rule sending on-premises traffic to the DRG. Without a route rule pointing on-premises-bound traffic to the DRG, the packets cannot be routed properly.
- B. Incorrect.
B. Incorrect. A NAT Gateway is used for outbound connections from private subnets to the internet, not for on-premises inbound requests.
- C. Incorrect.
C. Incorrect. A Service Gateway is used to connect to OCI public services (such as Object Storage) without traversing the internet. It does not facilitate connectivity from on-premises.
- D. Incorrect.
D. Incorrect. A Local Peering Gateway is used for peering between two VCNs in the same region. It does not handle traffic from on-premises data centers.