1Z0-1151-25 Question 61
Select 2Your organization hosts critical applications on AWS and is planning to run Oracle Autonomous Database on Oracle Cloud Infrastructure (OCI). They require a private, low-latency connection between OCI and AWS and also want a backup path over the public internet to ensure business continuity in case of a primary link failure. Which two statements are correct about implementing this multi-cloud connectivity solution?
- A
Using Oracle FastConnect with BGP peering to a DRG ensures private routing between AWS and OCI without traversing the public Internet.
- B
An IPsec site-to-site VPN can be configured to the same DRG to provide a backup path if the private circuit goes down.
- C
Policy-based VPN tunnels are mandatory for all OCI multicloud VPN configurations.
- D
You must advertise all public OCI service endpoints to AWS to ensure private routing functionality between the two clouds.
Show answer and explanation
Correct answers: A, B
Explanation
In a multicloud deployment between AWS and OCI, FastConnect provides a dedicated, private link to the OCI environment, and site-to-site IPsec VPN offers an alternate path in case of primary link failure. When configuring these connections, use BGP for dynamic route management and ensure the DRG is properly set up with both FastConnect and VPN attachments. Refer to the OCI documentation for best practices on setting up DRG routing, BGP peering, and configuring fallback VPN tunnels in a multicloud architecture.
- A. Correct.
Option 1 is correct. FastConnect supports BGP peering with the OCI Dynamic Routing Gateway (DRG). When used with AWS Direct Connect or equivalent private connectivity, traffic remains on private networks instead of the public Internet, reducing latency and improving security.
- B. Correct.
Option 2 is correct. A site-to-site IPsec VPN tunnel to the same DRG can serve as a backup connection if the dedicated FastConnect link becomes unavailable. This approach provides redundancy and helps maintain continuity for critical workloads.
- C. Incorrect.
Option 3 is incorrect. OCI supports both route-based and policy-based VPN tunnels, but route-based VPNs are the typical and recommended approach for most OCR (Oracle Cloud Router) and DRG connectivity scenarios. Policy-based VPN is not mandatory for multicloud configurations.
- D. Incorrect.
Option 4 is incorrect. You do not need to advertise or route all public OCI endpoints to AWS. Instead, you configure private BGP routes for the relevant subnets/services. Advertising public endpoints to AWS for private routing is not a standard practice for achieving private connectivity.