1Z0-1123-25 Question 17
Select 2You have an existing IPsec VPN from your on-premises data center to a DRG attached to a VCN in the Ashburn region. Now, you plan to create a new VCN in the Phoenix region for a phased application migration. During the migration, on-premises users must access workloads in both regions. Which two steps are required to enable on-premises traffic to reach the new Phoenix VCN through the existing Ashburn VPN?
- A
Attach the new VCN in Phoenix directly to the existing DRG in Ashburn to reuse the established IPsec VPN.
- B
Provision a new DRG in the Phoenix region, attach it to the Phoenix VCN, and create a remote peering connection with the DRG in Ashburn.
- C
Set up a local peering gateway between the Ashburn and Phoenix VCNs to enable cross-region traffic, and update the route tables for on-premises traffic.
- D
Update route tables in both the Ashburn and Phoenix VCNs to include routes to each other's subnets via the remote peering or DRG attachments.
Show answer and explanation
Correct answers: B, D
Explanation
To connect an on-premises environment to multiple OCI regions through a single IPsec VPN, each region housing a VCN must have its own DRG. These DRGs are then joined via a remote peering connection (RPC), enabling cross-region communication. Local peering gateways only allow connectivity within the same region, so they are unsuitable for inter-region traffic. After establishing remote peering, updating the route tables in both VCNs (and ensuring the on-premises side recognizes those routes) is critical for accurate traffic flow. For more details, refer to Oracle Documentation on Remote Peering Connections and DRG Architecture Best Practices.
- A. Incorrect.
Option 1 is incorrect. A Dynamic Routing Gateway (DRG) is region-specific and cannot be directly attached to a VCN in a different region. You cannot simply 'reuse' the Ashburn DRG for Phoenix; you need a separate DRG in Phoenix or a remote peering connection between DRGs in both regions.
- B. Correct.
Option 2 is correct. Creating a DRG in the Phoenix region and attaching the new VCN to it, then establishing a remote peering connection (RPC) between the Phoenix and Ashburn DRGs, is the proper way to extend on-premises connectivity across regions without creating an additional IPsec VPN.
- C. Incorrect.
Option 3 is incorrect. Local peering gateways (LPGs) enable traffic exchange between VCNs within the same region. They do not provide cross-region connectivity; you must use remote peering for that purpose.
- D. Correct.
Option 4 is correct. Once the DRGs are peered, you must update the relevant route tables in both regions to properly forward traffic between the on-premises network, the Ashburn VCN, and the Phoenix VCN. Without these route table updates, traffic will not traverse the remote peering connection.