1Z0-1072-25 Question 91
Select 2Your organization wants a secure, site-to-site VPN connection between its on-premises data center and an Oracle Cloud Infrastructure VCN. The on-premises router supports BGP, and you plan to use dynamic routing to simplify route management. Which two steps must you complete to properly establish BGP-based site-to-site VPN connectivity? (Choose two)
- A
Create an IPSec connection on the DRG using BGP as the routing type for each tunnel.
- B
Configure your on-premises router to establish a BGP session using the IP addresses assigned to each tunnel by OCI.
- C
Attach an Internet Gateway to your VCN so the on-premises router can advertise routes through it.
- D
Set up a NAT Gateway to translate on-premises IP addresses into OCI private IP addresses.
Show answer and explanation
Correct answers: A, B
Explanation
To set up dynamic routing over a site-to-site VPN in OCI, you must create an IPSec connection that uses BGP and configure your on-premises router for BGP adjacency with the DRG. Using an Internet Gateway or NAT Gateway does not fulfill the requirements for dynamic routing over a private VPN tunnel. For more detailed guidance, refer to Oracle Cloud Infrastructure VPN Connect best practices and configuration steps in the official OCI documentation.
- A. Correct.
You must create an IPSec connection with the DRG that supports BGP. This choice specifies that dynamic routing is used, rather than static routing, ensuring BGP route exchange.
- B. Correct.
You must configure your on-premises router to form a BGP adjacency with the DRG. This lets the on-premises router dynamically learn and advertise routes through OCI, rather than relying on manually defined paths.
- C. Incorrect.
An Internet Gateway is for internet-bound traffic, not for site-to-site VPN. Attaching an IGW does not enable BGP route exchange between the on-premises router and the DRG.
- D. Incorrect.
A NAT Gateway is used for outbound internet requests originating from private subnets. It is not required for establishing site-to-site VPN tunnels or exchanging BGP routes.