1Z0-1072-25 Question 82
Single answerYour organization has set up an IPsec VPN connection from an on-premises data center to an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) using a Dynamic Routing Gateway (DRG). Although the tunnel is up, on-premises systems cannot reach compute instances in a private subnet of the VCN. Which single action should you take first to ensure end-to-end connectivity?
- A
Enable Internet Gateway access and configure a default route in the public subnet� route table pointing to the Internet Gateway.
- B
Create and configure a DRG route table rule to direct incoming on-premises traffic to the private subnet.
- C
Configure a NAT Gateway for the private subnet to route inbound packets to on-premises systems.
- D
Deploy a Service Gateway in each subnet to handle all inbound IPsec VPN traffic from the DRG.
Show answer and explanation
Correct answer: B
Explanation
To establish full connectivity over an IPsec VPN, you must configure proper routing rules in both the on-premises and OCI environments. In OCI, the DRG uses its own route tables to direct incoming traffic to specific subnets in the VCN. Reference the OCI documentation on 'Managing DRG Route Tables' to ensure any packets arriving via the VPN can reach the intended subnet.
- A. Incorrect.
Incorrect. An Internet Gateway is used for outbound internet traffic, not for tunneling on-premises traffic. Configuring a default route to the Internet Gateway is irrelevant to establishing internal connectivity from on premises.
- B. Correct.
Correct. When on-premises traffic arrives at the DRG, the DRG needs a route table entry to know where to forward the packets within the VCN. Without this rule, traffic will not be routed from the DRG to the private subnet.
- C. Incorrect.
Incorrect. A NAT Gateway is used for outbound connections to the internet from private subnets, not for inbound traffic from on premises. Adding a NAT Gateway does not solve routing issues for inbound VPN traffic.
- D. Incorrect.
Incorrect. A Service Gateway is used for private access to Oracle services such as Object Storage within OCI. It does not handle general on-premises to VCN traffic. Service Gateways do not replace the need for proper DRG routing.