I85PREP
⌘ K
OCI Multicloud Architect Associate study materials
OCI Multicloud Architect Associate study resources

OCI Multicloud Architect Associate practice questions

One question at a time. Build your OCI Multicloud Architect Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Multicloud Fundamentals

In OCI's multicloud offerings, what does the term "multicloud" specifically refer to when Oracle describes its strategy?

  1. Running workloads across OCI and at least one other hyperscale cloud provider, such as AWS, Microsoft Azure, or Google Cloud Correct answer.
  2. Running Oracle Database on-premises alongside OCI Object Storage
  3. Running multiple OCI regions within a single tenancy for disaster recovery
  4. Running both virtual machines and bare metal shapes inside one OCI availability domain

Explanation

OCI uses multicloud to mean workloads spanning OCI plus another hyperscale provider, not merely multiple regions or shapes inside OCI. The distinguishing feature is cross-provider operation, often with low-latency interconnection.

Question 2Multicloud Fundamentals

Which OCI capability lets customers run OCI Database services physically located inside another hyperscaler's data center region?

  1. Oracle Interconnect for Microsoft Azure
  2. OCI Identity Domains federation
  3. OCI Full Stack Disaster Recovery
  4. Oracle Database@Azure, Database@AWS, and Database@Google Cloud Correct answer.

Explanation

The Database@ offerings place OCI-managed Oracle Database hardware and control plane inside another hyperscaler's regions. This is distinct from a network interconnection, which only links environments.

Question 3Multicloud Fundamentals

What is the primary purpose of Oracle Interconnect for Microsoft Azure?

  1. To provide a private, low-latency, high-bandwidth network connection between OCI and Azure regions Correct answer.
  2. To replicate OCI Block Volumes into Azure Storage accounts automatically
  3. To translate OCI IAM policies into Azure RBAC role assignments
  4. To host OCI Compute instances inside Azure availability zones

Explanation

The interconnect is a private peering solution that joins an OCI region and an Azure region, avoiding public internet traversal. It is a networking construct and does not perform storage replication, identity translation, or compute hosting.

Question 4Multicloud Fundamentals

A customer wants OCI workloads to consume an AWS service over a private connection rather than the public internet. Which OCI construct is designed for this?

  1. OCI NAT Gateway
  2. OCI Internet Gateway
  3. OCI Service Gateway
  4. OCI FastConnect to a partner, or the multicloud interconnection offering for AWS Correct answer.

Explanation

Private connectivity to another hyperscaler is delivered through dedicated interconnection offerings or FastConnect partner arrangements. Gateways inside a VCN only govern traffic within OCI or to Oracle services.

Question 5Multicloud Fundamentals

Which statement best describes the OCI region model that underpins multicloud architecture design?

  1. Each region contains one availability domain and no fault domains
  2. A realm is a single data center shared by all cloud providers in a metro area
  3. Availability domains span multiple geographic realms by default
  4. Regions are grouped into realms, and each region contains one or more availability domains with separate fault domains Correct answer.

Explanation

OCI organizes regions into realms, and each region holds one or more availability domains, which are further subdivided into fault domains. This hierarchy drives placement and resilience decisions in multicloud designs.

Question 6Multicloud Fundamentals

Which OCI service is the natural landing zone for data that must be shared between an OCI application and an application running in another hyperscaler?

  1. OCI Local NVMe storage on a bare metal shape
  2. OCI Object Storage with appropriate cross-cloud access Correct answer.
  3. OCI File Storage mounted over NFS
  4. OCI Block Volume

Explanation

Object Storage offers durable, API-accessible buckets that applications in another cloud can read and write over the network. Block, local NVMe, and NFS file systems are tied to specific compute instances or networks and are not designed for direct cross-cloud sharing.

Question 7Multicloud Fundamentals

In OCI multicloud designs, what does a "landing zone" typically provide?

  1. A preconfigured set of compartments, policies, networking, and guardrails that establishes a governed baseline tenancy structure Correct answer.
  2. A physical cage in an OCI data center reserved for a single customer
  3. A pricing discount tier negotiated for multicloud commitments
  4. A tool that automatically converts AWS CloudFormation templates into Terraform

Explanation

A landing zone codifies identity, compartment hierarchy, network topology, and policy guardrails so that new workloads start from a compliant baseline. It is a governance and architecture construct, not a physical space, discount, or template converter.

Question 8Multicloud Fundamentals

Which OCI feature allows a single identity to authenticate to OCI and be recognized by a partner cloud through federation?

  1. OCI Network Load Balancer
  2. OCI Identity Domains with SAML or OIDC federation Correct answer.
  3. OCI Bastion service
  4. OCI Vault master encryption keys

Explanation

Identity Domains support federation standards such as SAML and OIDC, enabling cross-provider single sign-on. Vault, Bastion, and load balancing address encryption, access brokering, and traffic distribution respectively.

Question 9Multicloud Fundamentals

An architect is designing a multicloud architecture where OCI hosts the database tier and Azure hosts the application tier. Which design choice most directly reduces cross-cloud latency for chatty database traffic?

  1. Enabling OCI Object Storage versioning on the database backup bucket
  2. Placing the OCI database in a region geographically near the Azure application region and using a private interconnect Correct answer.
  3. Enabling OCI Audit logging on the database compartment
  4. Increasing the Azure application's autoscaling maximum instance count

Explanation

Cross-cloud round-trip time is dominated by physical distance and path quality, so co-locating regions and using private interconnection addresses latency directly. The other options affect durability, capacity, or observability but not network latency.

Question 10Multicloud Fundamentals

A team wants an OCI application to read objects from an Amazon S3 bucket without exposing credentials in code. Which approach best fits OCI and multicloud security practice?

  1. Embed the credentials in a custom compute image used by the application
  2. Hard-code the AWS access key in the application configuration file
  3. Email the credentials to developers so they can set environment variables manually
  4. Store the AWS credentials in OCI Vault and retrieve them at runtime through the application's instance principal Correct answer.

Explanation

Centralizing secrets in OCI Vault and granting access through instance principals avoids static credentials in code or images. This supports rotation and least privilege across cloud boundaries.

Question 11Multicloud Fundamentals

When connecting an OCI VCN to another cloud provider's network, which OCI component terminates the private connection on the OCI side?

  1. A Dynamic Routing Gateway attached to the VCN Correct answer.
  2. A public load balancer in the VCN
  3. A VCN security list
  4. An OCI Object Storage namespace

Explanation

A Dynamic Routing Gateway provides the routing anchor for private connectivity such as FastConnect or site-to-site links into a VCN. Load balancers, object storage namespaces, and security lists do not terminate cross-cloud private links.

Question 12Multicloud Fundamentals

A company runs Oracle Exadata Database Service in OCI and a analytics platform in Google Cloud. They want the analytics platform to query the database with minimal data movement. Which pattern is most appropriate?

  1. Replicate the database into a second OCI region and let Google Cloud query it over the internet
  2. Export the full database nightly to CSV files in Google Cloud Storage
  3. Use the multicloud database offering with a private, low-latency link so the analytics platform queries the database in place Correct answer.
  4. Move the analytics platform into OCI and abandon the multicloud design

Explanation

Keeping the database in place and querying it over a private, low-latency connection avoids bulk data movement and preserves the multicloud split. Full exports and internet-based queries add latency, cost, and exposure.

Question 13Multicloud Fundamentals

Which OCI IAM construct should be used to grant a group of federated users from another cloud provider access to specific OCI compartments?

  1. A compute instance metadata entry
  2. A VCN route rule pointing at the identity provider
  3. A policy that references the federated identity domain group and targets the compartment Correct answer.
  4. A bucket lifecycle policy

Explanation

Access is granted by writing IAM policies that name the federated group as principal and scope permissions to compartments. Route rules, lifecycle policies, and metadata do not authorize identities.

Question 14Multicloud Fundamentals

What is the main architectural reason to use OCI's multicloud database offerings rather than running Oracle Database on a self-managed VM in another cloud?

  1. It converts Oracle Database into a non-relational store
  2. It removes the need for any network connectivity between the application and database
  3. It provides OCI-managed automation, patching, and performance features while keeping the database near the application Correct answer.
  4. It guarantees zero cost for data egress between providers

Explanation

The value is managed lifecycle automation and Oracle-engineered performance delivered in the location where the application runs. Network connectivity is still required, egress has commercial terms, and the database engine remains relational.

Question 15Multicloud Fundamentals

A multicloud design must survive the loss of an entire hyperscaler region. Which approach best satisfies that requirement?

  1. Maintain a standby deployment in a second provider's region with tested failover and data replication Correct answer.
  2. Deploy all components in a single availability domain in one region
  3. Increase the boot volume size of the application servers
  4. Rely on OCI Object Storage versioning alone to restore service

Explanation

Surviving the loss of a whole region requires a deployment in a different region, ideally on a different provider, plus replication and rehearsed failover. Single-AZ placement, versioning alone, and larger boot volumes do not provide regional resilience.

Question 16Multicloud Fundamentals

Which practice best supports consistent network security across an OCI VCN and a second cloud provider's network in a multicloud architecture?

  1. Disable logging on both sides to reduce storage cost
  2. Define security groups and firewall rules from a common, documented intent model and enforce them with infrastructure as code in both clouds Correct answer.
  3. Rely only on the second provider's firewall and leave OCI subnets open
  4. Allow all traffic between the two clouds so that troubleshooting is simpler

Explanation

A single documented intent enforced through infrastructure as code keeps rules consistent and reviewable across providers. Permissive rules, one-sided enforcement, and disabled logging all weaken the security posture.

Question 17Multicloud Fundamentals

An application in Azure must call an OCI REST API securely without storing long-lived OCI user credentials. Which OCI mechanism is designed for this?

  1. OCI Console passwords shared among the team
  2. Resource principals for OCI Functions or other OCI-hosted resources Correct answer.
  3. Instance principals on an OCI compute instance
  4. API keys stored in the Azure Key Vault and copied into container images

Explanation

Resource principals let OCI-hosted resources such as Functions obtain short-lived credentials automatically, and cross-cloud calls can be brokered through such OCI-hosted components. Instance principals apply only to OCI compute, and shared or embedded credentials are unsafe.

Question 18Multicloud Fundamentals

Which OCI capability helps an architect estimate and control data transfer costs in a multicloud design?

  1. OCI Autonomous Database auto-scaling
  2. OCI VCN flow logs
  3. OCI Block Volume cloning
  4. OCI Budgets and Cost Analysis with tagging of cross-cloud traffic Correct answer.

Explanation

Budgets and Cost Analysis combined with consistent tagging make cross-cloud transfer spend visible and controllable. Cloning, auto-scaling, and flow logs serve other purposes and do not by themselves track cost.

Question 19Multicloud Fundamentals

A team is choosing between deploying an application natively in OCI and deploying it in another cloud while using OCI Database services. Which factor most strongly favors the multicloud database placement?

  1. The database has no network requirements
  2. The team prefers to manage database patching manually
  3. The application already runs in the other cloud and the database must stay close to it Correct answer.
  4. The team wants to avoid learning any OCI concepts

Explanation

Proximity to an existing application plus managed database operations is the core justification for multicloud database placement. Avoiding OCI knowledge, ignoring networking, or preferring manual patching are not sound architectural drivers.

Question 20Multicloud Fundamentals

Which OCI service provides centralized key management that a multicloud architecture can use to protect data at rest in OCI while separating key custody from data?

  1. OCI Data Catalog
  2. OCI Vault Correct answer.
  3. OCI Streaming
  4. OCI API Gateway

Explanation

Vault stores and manages encryption keys and secrets in hardware security modules, enabling separation of key custody from stored data. Streaming, Data Catalog, and API Gateway address messaging, metadata, and API exposure.

Question 21Multicloud Fundamentals

An architect must explain why a multicloud design sometimes accepts higher operational complexity. Which justification is most defensible?

  1. It removes the need for cross-cloud network monitoring
  2. It eliminates the need for identity federation
  3. It can satisfy data residency, vendor negotiation leverage, or best-of-breed service requirements that a single provider cannot meet Correct answer.
  4. It guarantees lower total cost in every scenario

Explanation

Multicloud complexity is justified by concrete drivers such as residency obligations, avoiding lock-in, or using differentiated services. Cost savings are not guaranteed, and federation and monitoring remain necessary.

Question 22Multicloud Fundamentals

A regulated customer requires that data never leave a specific country while still using services from two cloud providers. Which multicloud design principle applies?

  1. Disable encryption so that auditors can inspect data easily
  2. Replicate data to the cheapest region worldwide to reduce storage cost
  3. Place each provider's resources in regions located within the required jurisdiction and keep replication within that boundary Correct answer.
  4. Route all traffic through a third country to balance load

Explanation

Data residency is satisfied by keeping every region that stores or processes the data inside the required jurisdiction, including replicas. Cost-driven global replication, third-country routing, and disabled encryption all violate the requirement.

Question 23Multicloud Fundamentals

An architect is comparing a hub-and-spoke topology where OCI is the hub against a fully meshed cross-cloud topology. Which statement correctly captures a key trade-off?

  1. Hub-and-spoke removes the need for any routing configuration
  2. Full mesh guarantees lower latency than any hub design in all cases
  3. Hub-and-spoke centralizes inspection and routing but introduces a single transit dependency, while full mesh reduces transit hops but multiplies peering and policy complexity Correct answer.
  4. Full mesh always reduces total cost because it eliminates all routing devices

Explanation

A hub concentrates security inspection and routing but makes the hub a critical dependency, whereas a mesh shortens paths at the cost of many peerings and policies. Neither topology guarantees lower cost or latency universally, and hub designs still require routing.

Question 24Multicloud Fundamentals

A company wants OCI to be the system of record for identity while allowing users to sign in through an external identity provider. Which configuration achieves this with the least duplication?

  1. Create duplicate local OCI users for every external user and assign policies individually
  2. Share a single administrator account across all users
  3. Federate the external identity provider into an OCI Identity Domain and map external groups to OCI groups used in policies Correct answer.
  4. Grant the default Administrators group to all federated users

Explanation

Federating the external provider into an Identity Domain and mapping groups to OCI groups keeps a single source of truth and lets policies reference groups rather than individuals. Duplicate users, shared accounts, and blanket admin grants undermine accountability.

Question 25Multicloud Fundamentals

An application spans OCI and another cloud and must tolerate the failure of a single cross-cloud link. Which design element is most important?

  1. A single interconnect sized for peak load
  2. A redundant connectivity path, such as a second interconnect or a VPN backup, combined with health-checked failover routing Correct answer.
  3. A longer TLS certificate validity period
  4. A larger object storage bucket for logs

Explanation

Tolerating link failure requires path redundancy plus automated detection and failover so traffic shifts to the surviving path. A single link, larger buckets, and longer certificate lifetimes do not address connectivity failure.

Question 26Multicloud Fundamentals

In an OCI multicloud architecture, what is the primary role of a dynamic group when granting a workload in another cloud access to OCI resources?

  1. It defines a set of OCI compute instances that are automatically patched together.
  2. It matches resources by attributes so that policies can grant them access without static credentials. Correct answer.
  3. It creates a peering relationship between an OCI VCN and a remote cloud network.
  4. It groups OCI users who share the same MFA device for easier administration.

Explanation

Dynamic groups in OCI IAM match resources such as compute instances or functions based on attributes like compartment or tag, allowing policies to grant those resources permissions without embedding user credentials. This is the standard mechanism for workload identity in multicloud designs. The other options describe unrelated IAM or networking functions.

Question 27Multicloud Fundamentals

A company wants to run an OCI Autonomous Database inside an Azure data center alongside an application hosted in Microsoft Azure, with private connectivity and low latency. Which OCI offering is purpose-built for this scenario?

  1. OCI Container Engine for Kubernetes
  2. Oracle Database@Azure Correct answer.
  3. OCI FastConnect
  4. OCI Interconnect

Explanation

Oracle Database@Azure places OCI-managed Oracle Database services, including Autonomous Database, directly inside Azure data centers, providing private, low-latency connectivity to Azure applications. FastConnect and Interconnect are networking services that connect networks but do not host the database in Azure. OKE is a Kubernetes service unrelated to database placement.

Question 28Multicloud Fundamentals

When an OCI tenancy federates with an external identity provider, which statement best describes how users from that provider are authenticated?

  1. The external identity provider issues tokens that OCI validates, and OCI maps the federated identity to an OCI identity for authorization. Correct answer.
  2. The external identity provider directly manages OCI IAM policies and compartments on behalf of the user.
  3. OCI issues a local password to each federated user, which the user must reset every 90 days.
  4. Federated users bypass OCI IAM entirely and are authorized solely by the external provider's group membership.

Explanation

Federation allows an external identity provider to authenticate users and issue assertions or tokens that OCI trusts. OCI then maps the federated identity to an OCI IAM identity so that OCI policies and groups control authorization. The external provider does not manage OCI policies directly, and local passwords are not issued for federated users.

Question 29Multicloud Fundamentals

Which OCI capability allows an application running in another cloud to access an OCI Object Storage bucket over the public internet without exposing long-lived API keys in its code?

  1. A dynamic group combined with instance principals on the remote cloud VM.
  2. A VCN service gateway with a route rule to Object Storage.
  3. Pre-authenticated requests (PARs) with a defined expiration. Correct answer.
  4. A customer secret key stored in an environment variable.

Explanation

Pre-authenticated requests grant time-limited access to a specific Object Storage resource without requiring the caller to hold OCI credentials. They are well suited to external or cross-cloud access where embedding API keys is undesirable. Dynamic groups and instance principals apply to OCI resources, and a service gateway only serves traffic from within a VCN.

Question 30Multicloud Fundamentals

What is the main purpose of OCI's multicloud networking offerings such as FastConnect and Interconnect in a multicloud architecture?

  1. To host Oracle Database services inside a partner cloud's data centers.
  2. To replicate OCI IAM policies automatically to a partner cloud.
  3. To provide a managed Kubernetes control plane spanning both clouds.
  4. To provide private, dedicated network connectivity between OCI and another cloud provider. Correct answer.

Explanation

FastConnect and Interconnect establish private, dedicated network links between OCI and other cloud or on-premises environments, avoiding the public internet for sensitive traffic. They do not replicate IAM policies, host databases, or provide a cross-cloud Kubernetes control plane. Those functions belong to other OCI or partner services.

Question 31Multicloud Fundamentals

An architect needs to ensure that data stored in OCI Object Storage and replicated to another cloud remains encrypted with keys that the company controls centrally. Which OCI service should be used?

  1. OCI Logging
  2. OCI Vault Correct answer.
  3. OCI Cloud Guard
  4. OCI Data Safe

Explanation

OCI Vault is the centralized key management service that creates and manages master encryption keys used to protect data at rest in OCI services such as Object Storage. Cloud Guard, Data Safe, and Logging provide security posture, database security, and log management respectively, but not customer-managed key storage. Centralized key control is the defining function of Vault.

Question 32Multicloud Fundamentals

A team is deploying an application in OCI that must call a service in another cloud using short-lived credentials obtained at runtime. Which OCI feature best supports this pattern?

  1. Pre-authenticated requests scoped to the entire tenancy.
  2. Resource principals with instance or function principals. Correct answer.
  3. A customer secret key rotated manually each quarter.
  4. Static user API keys stored in OCI Vault.

Explanation

Resource principals allow OCI compute instances and functions to obtain short-lived security tokens automatically, eliminating the need to embed long-lived credentials. This is the recommended pattern for workloads that need to authenticate to other services at runtime. Static keys, broad PARs, and manually rotated secrets all involve long-lived credentials or excessive scope.

Question 33Multicloud Fundamentals

Which statement best explains why a multicloud architecture might use OCI as the primary region for a database tier while running the application tier in another cloud?

  1. To take advantage of OCI's database performance and pricing while leveraging the other cloud's application ecosystem. Correct answer.
  2. To eliminate the need for data replication between the tiers.
  3. To avoid the need for any network connectivity between the two clouds.
  4. To ensure that the application tier automatically inherits OCI IAM policies.

Explanation

A common multicloud pattern places the database where it runs best and the application where its ecosystem and services are strongest. OCI is often chosen for Oracle Database performance and cost, while another cloud may offer richer application services. This pattern still requires network connectivity and does not remove the need for replication or separate IAM.

Question 34Multicloud Fundamentals

What is the primary benefit of using a hub-and-spoke network topology with OCI as the hub in a multicloud design?

  1. It automatically replicates OCI policies to all spoke clouds.
  2. It eliminates the need for a VPN or FastConnect between clouds.
  3. It guarantees that no data traverses the public internet.
  4. It centralizes connectivity and security inspection, reducing the number of peer connections. Correct answer.

Explanation

A hub-and-spoke topology concentrates cross-cloud traffic through a central hub, which simplifies routing, security inspection, and the number of connections that must be managed. It does not by itself guarantee private paths, replicate policies, or remove the need for underlying connectivity. Those outcomes depend on additional configuration.

Question 35Multicloud Fundamentals

Which OCI service should an architect use to monitor and audit API activity across an OCI tenancy in a multicloud deployment?

  1. OCI Monitoring
  2. OCI Service Connector Hub
  3. OCI Notifications
  4. OCI Audit Correct answer.

Explanation

OCI Audit records API calls and control-plane activity in a tenancy, providing the audit trail needed for compliance and security investigations. Monitoring tracks metrics and alarms, Notifications delivers messages, and Service Connector Hub moves data between services. Only Audit provides the API activity log itself.

Question 36Multicloud Fundamentals

A company requires that data stored in OCI and replicated to another cloud be encrypted with customer-managed keys that are not exportable. Which OCI Vault key type satisfies this requirement?

  1. A key managed by the other cloud provider's key service.
  2. A key imported from an external HSM and marked exportable.
  3. A key stored in an OCI Object Storage bucket as a text file.
  4. A software-protected master encryption key stored in Vault. Correct answer.

Explanation

OCI Vault can store master encryption keys in a software-protected or HSM-protected manner, and keys generated and held in Vault are not exportable by design. Imported keys may have different export characteristics, and keys managed by another provider or stored as files do not meet the requirement for OCI-controlled, non-exportable keys. The correct choice is a Vault-managed key.

Question 37Multicloud Fundamentals

Which OCI feature allows an architect to define and enforce network security rules consistently across multiple VCNs in a multicloud architecture?

  1. Security zones
  2. Network security groups (NSGs) Correct answer.
  3. DHCP options
  4. Route tables

Explanation

Network security groups apply sets of security rules to groups of VNICs, allowing consistent policy enforcement across resources in one or more VCNs. Security zones enforce broader security posture, while route tables and DHCP options control routing and IP configuration. NSGs are the construct specifically for reusable network security rules.

Question 38Multicloud Fundamentals

What is the main reason an architect would choose OCI Interconnect over a site-to-site VPN for connecting an OCI VCN to another cloud provider?

  1. Interconnect provides dedicated private bandwidth with more predictable performance than internet-based VPN. Correct answer.
  2. Interconnect automatically encrypts all traffic with customer-managed keys.
  3. Interconnect is always less expensive than a VPN for any traffic volume.
  4. Interconnect eliminates the need for routing configuration between the clouds.

Explanation

OCI Interconnect offers dedicated private connectivity through a partner, which typically provides more consistent latency and bandwidth than a VPN over the public internet. Encryption, cost, and routing still require configuration and depend on the design. VPN remains a valid lower-cost option for smaller or less latency-sensitive workloads.

Question 39Multicloud Fundamentals

Which OCI capability helps an architect understand and control data transfer charges when data moves between OCI and another cloud?

  1. OCI Cost Analysis and budgets with compartment-level tagging. Correct answer.
  2. OCI Data Safe masking policies.
  3. OCI Container Engine for Kubernetes node pools.
  4. OCI Cloud Guard security zones.

Explanation

Cost Analysis and budgets, combined with consistent tagging, let an architect attribute and monitor egress and other charges across compartments and workloads. Cloud Guard, Data Safe, and OKE address security, data masking, and container orchestration respectively. Only cost management tooling provides visibility into data transfer spend.

Question 40Multicloud Fundamentals

A regulated workload must keep data within a specific country while using services from two cloud providers. Which design approach best satisfies this requirement?

  1. Deploy both providers' services in regions located within that country and restrict replication to those regions. Correct answer.
  2. Replicate data to a global bucket and rely on access controls to prevent cross-border access.
  3. Use a single region in one country and access the other provider's services over the public internet.
  4. Use the lowest-latency regions regardless of country and rely on encryption for compliance.

Explanation

Data residency requirements are met by ensuring that all storage and processing occur in regions within the required country and that replication does not cross borders. Encryption and access controls do not override residency obligations, and relying on a single in-country region while accessing another provider's services over the internet may still move data outside the country. The design must constrain both providers' regions.

Question 41OCI Multicloud Networking

In an OCI multicloud deployment using Oracle Database@Azure, which network construct is created inside the Azure virtual network to connect Azure resources to the Oracle-managed infrastructure?

  1. A delegated subnet in the Azure VNet associated with the Oracle Database@Azure resource Correct answer.
  2. A private endpoint backed by an Azure Private Link service
  3. A VNet peering between the Azure VNet and an OCI VCN
  4. An Azure ExpressRoute circuit to an OCI dynamic routing gateway

Explanation

Oracle Database@Azure resources are placed in an Azure VNet subnet that is delegated to the Oracle service, so the database is reachable from the surrounding Azure network without crossing clouds. Peering, Private Link, and ExpressRoute are separate connectivity options used for other multicloud patterns, not for hosting the delegated Oracle subnet.

Question 42OCI Multicloud Networking

Which OCI component terminates the customer-side connection of a dedicated private circuit used for multicloud connectivity into an OCI region?

  1. The internet gateway attached to the VCN
  2. The dynamic routing gateway attached to the VCN Correct answer.
  3. The NAT gateway in the public subnet
  4. The service gateway for Object Storage

Explanation

A dynamic routing gateway (DRG) is the virtual router in OCI that terminates private connectivity such as FastConnect or site-to-site VPN and exchanges routes with the attached VCN. Internet, NAT, and service gateways handle internet or Oracle-services traffic and do not terminate dedicated private circuits.

Question 43OCI Multicloud Networking

An architect wants workloads in an OCI VCN to reach an Azure VNet privately without traversing the public internet. Which OCI capability is purpose-built to interconnect OCI with other cloud providers in supported regions?

  1. Cross-cloud interconnection through a partner or colocation fabric attached to the DRG Correct answer.
  2. A public load balancer with a reserved public IP address
  3. A remote VCN peering across OCI regions using an RPC
  4. A local VCN peering between two OCI VCNs in the same region

Explanation

OCI multicloud connectivity relies on private interconnection, typically through FastConnect to a partner or colocation fabric that also connects to the other cloud provider's private network, attached to the DRG. OCI VCN peering only links OCI VCNs, and a public load balancer exposes traffic over the internet.

Question 44OCI Multicloud Networking

When configuring a site-to-site VPN between an on-premises or other-cloud gateway and an OCI DRG, which pair of values must match on both sides for the IPsec tunnel to establish?

  1. The instance shape and the boot volume size
  2. The pre-shared key and the IPsec security association parameters Correct answer.
  3. The OCI tenancy OCID and the compartment OCID
  4. The VCN CIDR and the subnet CIDR

Explanation

IPsec tunnel establishment requires the pre-shared key and the security association settings, such as encryption and hashing algorithms and lifetimes, to match on both peers. CIDRs, tenancy identifiers, and compute attributes are unrelated to tunnel negotiation.

Question 45OCI Multicloud Networking

A company uses Oracle Interconnect for Azure to connect an OCI VCN to an Azure VNet. What must be configured in both clouds so that traffic is routed between the two networks?

  1. Identical private IP address ranges in both networks
  2. DNS forwarding between the two cloud resolvers only
  3. A single shared public IP address for both networks
  4. Route rules in the OCI VCN and user-defined routes in Azure that point to the interconnect Correct answer.

Explanation

Cross-cloud routing requires each side to know how to reach the other network: OCI route tables send traffic to the DRG and Azure user-defined routes send traffic toward the interconnect. Overlapping address ranges break routing, and DNS or shared public IPs do not provide data-path forwarding.

Question 46OCI Multicloud Networking

Which statement accurately describes the address space requirement for OCI and Azure networks joined by a multicloud interconnect?

  1. The VCN and VNet CIDR ranges must not overlap Correct answer.
  2. Only the subnet ranges must overlap while the VCN and VNet ranges differ
  3. The VCN and VNet CIDR ranges must overlap to enable direct routing
  4. Address overlap is irrelevant because the interconnect performs NAT

Explanation

Private interconnection between OCI and Azure behaves like a routed network, so the VCN and VNet address spaces must be non-overlapping to avoid ambiguous routes. The interconnect does not automatically translate addresses, and overlapping subnets would create routing conflicts.

Question 47OCI Multicloud Networking

An architect needs OCI compute instances to resolve hostnames of Azure virtual machines across an Oracle Interconnect for Azure connection. Which combination is required?

  1. A service gateway in the VCN with a DNS label
  2. An internet gateway with a NAT rule for port 53
  3. Conditional DNS forwarding between the OCI resolver and the Azure DNS resolver Correct answer.
  4. A public DNS zone hosted in both clouds

Explanation

Cross-cloud name resolution is achieved by configuring conditional forwarders so each cloud's resolver forwards queries for the other cloud's zones to the peer resolver over the private interconnect. Public zones, service gateways, and NAT rules do not provide private cross-cloud resolution.

Question 48OCI Multicloud Networking

What is the role of the Oracle Cloud Infrastructure FastConnect virtual circuit in a multicloud architecture?

  1. It provides a dedicated private connection between the customer network or partner fabric and the OCI DRG Correct answer.
  2. It assigns public IP addresses to compute instances
  3. It replicates block volumes between availability domains
  4. It encrypts all traffic between OCI regions using IPsec

Explanation

FastConnect provides dedicated private connectivity from a customer or partner edge location to an OCI DRG, which is the foundation for private multicloud links. It does not perform IPsec encryption of inter-region traffic, assign public IPs, or replicate block volumes.

Question 49OCI Multicloud Networking

A DRG in OCI must advertise the VCN CIDR to a remote Azure network over a private interconnect. Which DRG attachment type is required for the VCN?

  1. A NAT gateway attachment
  2. A local peering gateway attachment
  3. A VCN attachment to the DRG Correct answer.
  4. A service gateway attachment

Explanation

The VCN must be attached to the DRG so the DRG can learn and advertise the VCN's routes toward the remote network. Service, local peering, and NAT gateways do not attach a VCN to a DRG for route exchange.

Question 50OCI Multicloud Networking

An OCI VCN connects to Azure through Oracle Interconnect for Azure. Traffic from an OCI private subnet must reach an Azure service while preserving the source IP for Azure firewall rules. Which OCI route table configuration achieves this?

  1. Route the subnet traffic to the NAT gateway
  2. Route the subnet traffic to the DRG Correct answer.
  3. Route the subnet traffic to the service gateway
  4. Route the subnet traffic to the internet gateway

Explanation

Traffic destined for the Azure network must be routed to the DRG, which forwards it over the private interconnect while preserving the private source address. Internet, NAT, and service gateways either exit to the internet, translate addresses, or reach Oracle services only.