1Z0-1072-25 Question 86
Single answerYour organization has deployed two VCNs in the same OCI region to separate different application environments. Both VCNs must communicate privately with each other and share a single high-bandwidth connection to an on-premises data center. To minimize complexity, you want a unified point of connectivity for on-prem traffic. Which approach should you choose?
- A
Establish local VCN peering between the two VCNs, but only attach the primary VCN to a DRG for on-premises FastConnect.
- B
Attach both VCNs to a single DRG, configure local VCN peering between them, and use a single FastConnect circuit on the DRG for on-premises connectivity.
- C
Use remote VCN peering between the VCNs and configure multiple IPSec VPN tunnels for on-premises connectivity, splitting traffic between the tunnels.
- D
Configure separate DRGs for each VCN, forgo local VCN peering in favor of routing traffic through the on-premises connection, and maintain separate FastConnect circuits per VCN.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, local VCN peering is used to enable private communication between VCNs within the same region. To provide a shared on-premises connection for both VCNs, each VCN is attached to a single DRG where routes can be centrally managed. FastConnect offers high bandwidth and performance and can be configured on that DRG as the unified connection point. This approach simplifies routing and avoids deploying multiple VPN tunnels or DRGs, aligning with OCI best practices for hub-and-spoke architectures.
- A. Incorrect.
Incorrect. While local VCN peering is necessary for private communication in the same region, only attaching one VCN to the DRG will not support transitive routing for on-prem traffic from the second VCN without additional complexities and routing rules.
- B. Correct.
Correct. Attaching both VCNs to a single DRG and establishing local peering ensures that each VCN can communicate privately. Using a single FastConnect circuit on the DRG simplifies on-premises connectivity and provides a high-bandwidth option for both VCNs.
- C. Incorrect.
Incorrect. Remote VCN peering is typically used for VCNs in different regions, not within the same region. Furthermore, multiple IPSec tunnels would add unnecessary complexity if a high-bandwidth, dedicated FastConnect link is already planned.
- D. Incorrect.
Incorrect. Maintaining separate DRGs for each VCN and separate FastConnect circuits duplicates costs and complicates routing. Local VCN peering within a single DRG is the simpler, more cost-effective solution for VCNs in the same region.