I85PREP
⌘ K
OCI Multicloud Architect Professional study materials
OCI Multicloud Architect Professional study resources

OCI Multicloud Architect Professional practice questions

One question at a time. Build your OCI Multicloud Architect Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which statement best describes the purpose of Oracle Interconnect for Microsoft Azure in a multicloud architecture?

  1. It allows OCI IAM identities to authenticate directly against Microsoft Entra ID without any federation configuration
  2. It provides a private, low-latency, dedicated network link between an OCI region and a Microsoft Azure region through a colocation point Correct answer.
  3. It migrates on-premises VMware workloads into Azure and then synchronizes them with OCI every hour
  4. It replicates OCI Block Volume data into Azure Blob Storage automatically for disaster recovery

Explanation

Oracle Interconnect for Microsoft Azure is a private interconnect offering that links an OCI region to an Azure region through a shared colocation provider, giving predictable latency and avoiding the public internet. It is a networking construct, not a storage replication engine, identity provider, or workload migration service.

Question 2Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

What is the first prerequisite an architect must satisfy before Oracle Interconnect for Microsoft Azure can be provisioned between two regions?

  1. The customer must own a /24 public IPv4 address block registered to their organization
  2. Both the OCI region and the Azure region must be located in the same supported metropolitan area with an available FastConnect partner Correct answer.
  3. Azure ExpressRoute Global Reach must be disabled on the Azure subscription
  4. The OCI tenancy must be upgraded to a paid account with at least one Exadata DB system running

Explanation

The interconnect is delivered by colocation partners, so the OCI and Azure regions must be geographically close enough to be served by a supported partner in the same metro. The offering is region-pair specific, which is why Oracle publishes a supported region matrix.

Question 3Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

On the Azure side, which component is paired with an OCI FastConnect virtual circuit to build the cross-cloud private connection?

  1. An Azure ExpressRoute circuit provisioned through the same connectivity provider Correct answer.
  2. An Azure Private Endpoint attached to a storage account
  3. An Azure VPN Gateway using IKEv2 site-to-site tunnels
  4. An Azure Route Server peered with a virtual network gateway

Explanation

Oracle Interconnect for Microsoft Azure pairs an OCI FastConnect virtual circuit with an Azure ExpressRoute circuit, both ordered through the same partner at the colocation facility. The two circuits are cross-connected inside the partner fabric.

Question 4Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect needs OCI compute in one region to reach an Azure SQL managed instance over the private interconnect. Which Azure construct must exist so the traffic lands in the correct virtual network?

  1. A service endpoint for Microsoft.Storage on the subnet
  2. A public IP address on the managed instance
  3. A NAT gateway attached to the target subnet
  4. A virtual network gateway of type ExpressRoute attached to the target virtual network Correct answer.

Explanation

ExpressRoute circuits terminate into a virtual network through an ExpressRoute virtual network gateway, which is the entry point for traffic arriving from the interconnect. Without that gateway the circuit cannot inject routes into the virtual network.

Question 5Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which OCI component terminates the FastConnect virtual circuit inside an OCI region?

  1. A local peering gateway between two VCNs
  2. An internet gateway attached to the public subnet
  3. A NAT gateway in the regional hub VCN
  4. A dynamic routing gateway attached to the relevant virtual cloud network Correct answer.

Explanation

FastConnect virtual circuits attach to a dynamic routing gateway, which exchanges routes with the on-premises or partner edge and injects them into the attached VCN. The DRG is the routing anchor for all private connectivity into OCI.

Question 6Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

What does the term 'multicloud' most precisely mean in the context of this exam?

  1. Operating a private cloud alongside a single public cloud region
  2. Running multiple availability domains inside a single cloud provider's region
  3. Using services from two or more distinct cloud providers, with intentional integration between them Correct answer.
  4. Deploying the same application tier across several compartments in one tenancy

Explanation

Multicloud means consuming services from more than one cloud provider and, in an architecture context, integrating them deliberately rather than running isolated silos. Multiple availability domains or compartments within one provider describe high availability, not multicloud.

Question 7Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which capability does Oracle Interconnect for Microsoft Azure provide that a standard internet-based IPsec VPN between the clouds does not?

  1. Built-in layer 7 firewall inspection of cross-cloud traffic
  2. Automatic encryption of all traffic with keys managed solely by Oracle
  3. Dynamic bandwidth that scales without any configuration change
  4. Predictable latency through a dedicated partner-fabric path that avoids public internet variability Correct answer.

Explanation

The value of the dedicated interconnect is deterministic routing over partner fabric rather than best-effort internet paths, which yields more consistent latency and jitter. Encryption, bandwidth changes, and layer 7 inspection are handled by separate services or configuration.

Question 8Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

In a multicloud design, which OCI feature lets an architect centrally control and audit cross-cloud routing from a single hub VCN?

  1. Per-VCN internet gateways in every spoke network
  2. A separate FastConnect circuit for every application VCN
  3. Security lists applied only at the edge subnet
  4. A hub-and-spoke topology built on a dynamic routing gateway with attached VCNs and remote peering Correct answer.

Explanation

A hub VCN anchored on a DRG allows spokes and the Azure side to exchange routes through one controlled point, simplifying policy and audit. Attaching each workload VCN directly to its own circuit multiplies cost and operational overhead.

Question 9Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An application in OCI must call an Azure service over the interconnect. The OCI subnet uses 10.10.0.0/24 and the Azure virtual network uses 10.10.1.0/24. What is the primary consequence of this addressing choice?

  1. Traffic will silently fall back to the public internet
  2. The FastConnect circuit will refuse to activate
  3. The address ranges overlap when summarized and will cause routing ambiguity across the interconnect Correct answer.
  4. The interconnect will automatically renumber the Azure subnet to avoid conflict

Explanation

Cross-cloud routing requires non-overlapping CIDR ranges; overlapping or nested ranges create ambiguous next hops and unpredictable forwarding. Address planning must happen before circuits and gateways are provisioned.

Question 10Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which routing mechanism allows an OCI DRG to learn Azure virtual network prefixes across the interconnect?

  1. BGP route exchange between the DRG and the partner or Azure edge over the virtual circuit Correct answer.
  2. OCI DNS private views resolving Azure hostnames
  3. DHCP option sets distributed to the subnets
  4. Static routes manually entered on each OCI compute instance

Explanation

The DRG peers with the remote edge using BGP, and prefixes from Azure are advertised across the circuit so OCI route tables can reference them. Static host routes and DHCP do not scale or propagate cloud-side changes.

Question 11Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A team wants traffic between OCI and Azure to be encrypted in transit even though it uses the dedicated interconnect. Which approach is most appropriate?

  1. Rely on the partner fabric being private and therefore inherently encrypted
  2. Use MACsec on the FastConnect link where supported, or run IPsec tunnels over the interconnect between gateways Correct answer.
  3. Attach a network security group to the DRG
  4. Enable OCI Vault on the compute instances and assume traffic is encrypted

Explanation

A dedicated circuit is private but not automatically encrypted, so architects layer MACsec at layer 2 where available or IPsec at layer 3 for defense in depth. Vault protects keys and secrets, and security groups filter traffic rather than encrypt it.

Question 12Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which OCI route rule type should a VCN subnet use to send traffic destined for an Azure CIDR to the DRG?

  1. A route rule with destination type CIDR_BLOCK and target type dynamic routing gateway Correct answer.
  2. A route rule with destination type CIDR_BLOCK and target type local peering gateway
  3. A route rule with destination type SERVICE_CIDR_BLOCK and target type NAT gateway
  4. A route rule with destination type SERVICE_CIDR_BLOCK and target type internet gateway

Explanation

Remote cloud prefixes are reached through the DRG, so the VCN route table needs a CIDR_BLOCK rule whose target is the DRG. Service CIDR blocks refer to OCI service endpoints, and local peering or NAT targets cannot reach Azure.

Question 13Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect is comparing a single FastConnect virtual circuit with two circuits in different interconnect locations. Which design goal primarily motivates the second circuit?

  1. Reduced cost of OCI egress
  2. Automatic IP address translation between the clouds
  3. Redundancy against a partner or facility failure along the cross-cloud path Correct answer.
  4. Higher layer 7 throughput per TCP connection

Explanation

Diverse circuits in separate locations remove single points of failure in the partner fabric and facility, which is the standard high-availability pattern. Additional circuits do not change per-connection throughput, addressing, or egress pricing.

Question 14Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which Azure routing feature is required when a virtual network must learn on-premises and OCI routes through an ExpressRoute gateway and also exchange them with a network virtual appliance?

  1. Azure DNS Private Resolver
  2. Azure Bastion
  3. Azure Front Door
  4. Azure Route Server Correct answer.

Explanation

Azure Route Server enables BGP peering between a virtual network gateway and network virtual appliances so routes can be exchanged dynamically. Bastion, Front Door, and Private Resolver serve access, delivery, and name resolution respectively.

Question 15Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A workload in OCI calls an Azure PaaS endpoint that is restricted to private access. Which combination correctly keeps the traffic on the interconnect?

  1. An Azure public endpoint plus a service endpoint on the OCI subnet
  2. An Azure public endpoint with an NSG allowing the OCI CIDR
  3. A NAT gateway on the Azure subnet with a user-defined route to the internet
  4. An Azure private endpoint in the target virtual network plus DNS resolution that returns the private IP to OCI clients Correct answer.

Explanation

Private endpoints place a private IP for the PaaS service inside the virtual network, and DNS must resolve the service name to that private address from OCI. Public endpoints, even when filtered, leave the private path.

Question 16Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which statement about DNS resolution across an OCI and Azure multicloud deployment is accurate?

  1. OCI Internet Resolver automatically forwards queries to Azure DNS
  2. A single global DNS namespace is automatically created by the interconnect
  3. Each cloud has its own resolver, so conditional forwarding or a shared private zone must be designed for cross-cloud name resolution Correct answer.
  4. Azure Private DNS zones are automatically visible inside OCI VCNs

Explanation

The interconnect only carries packets; name resolution across clouds must be designed using conditional forwarders, private zones, or a shared resolver architecture. No automatic namespace or zone sharing occurs.

Question 17Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must let OCI workloads reach Azure Blob Storage privately over the interconnect while keeping traffic off the public internet. Which Azure control is central to that requirement?

  1. An Azure CDN profile in front of the storage account
  2. A public endpoint with CORS rules allowing the OCI region
  3. A shared access signature scoped to the OCI tenancy
  4. A storage account firewall configured to allow access only from the selected virtual network and private endpoint Correct answer.

Explanation

Restricting the storage account firewall to the virtual network and using a private endpoint keeps access on private addressing. Shared access signatures and CORS control authorization and browser behavior, not network path.

Question 18Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which OCI capability allows an architect to connect multiple VCNs and on-premises networks to the same DRG so that Azure routes are shared consistently?

  1. Attaching each VCN to the DRG and relying on DRG route tables and route distributions Correct answer.
  2. Creating a full mesh of local peering gateways between every VCN
  3. Configuring each VCN with its own internet gateway and static routes
  4. Assigning a public IP to every instance in each VCN

Explanation

A DRG supports multiple VCN attachments and uses DRG route tables and distributions to control which prefixes are shared with which attachment. Local peering meshes do not scale and do not carry the Azure prefixes.

Question 19Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

What is the role of a connectivity provider such as Equinix Fabric or Megaport in the Oracle Interconnect for Microsoft Azure offering?

  1. It performs data replication between OCI Object Storage and Azure Blob Storage
  2. It hosts the cross-connect between the OCI FastConnect circuit and the Azure ExpressRoute circuit at a shared colocation facility Correct answer.
  3. It supplies the public IP addresses used by the OCI DRG
  4. It provides the identity broker that federates OCI IAM with Microsoft Entra ID

Explanation

The partner operates the physical fabric where both clouds' circuits meet, which is why the OCI and Azure regions must be served by the same provider location. Identity, storage replication, and public addressing are separate concerns.

Question 20Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An application requires that OCI and Azure workloads resolve each other by hostname and that traffic never traverse the public internet. Which combination best satisfies both requirements?

  1. An internet-based VPN plus Azure Private DNS zones
  2. The private interconnect for transport plus public DNS records pointing to public IPs
  3. The private interconnect for transport plus conditional DNS forwarding between OCI and Azure resolvers over that interconnect Correct answer.
  4. Azure Private Link alone without any OCI-side connectivity

Explanation

Private transport and private name resolution are two distinct designs that must both be implemented; forwarding DNS queries over the interconnect keeps resolution private. Public records or internet VPNs reintroduce public exposure, and Private Link alone does not connect OCI.

Question 21Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which consideration most affects the choice of OCI and Azure region pair for the interconnect?

  1. Whether both regions offer the same number of availability domains
  2. Whether the Azure region supports availability zones and the OCI region does not
  3. Whether both regions are served by a supported partner in the same metropolitan area Correct answer.
  4. Whether the OCI region has a matching realm name in Azure

Explanation

The interconnect is only available for specific region pairs that share a supported colocation provider, so the supported region matrix drives placement. Availability domain counts and realm naming do not determine interconnect availability.

Question 22Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A regulated workload requires that cross-cloud traffic be encrypted with customer-managed keys and that the path be dedicated. Which design meets both constraints?

  1. An Azure ExpressRoute circuit with Microsoft-managed encryption only
  2. A FastConnect interconnect relying on the partner fabric for confidentiality
  3. A FastConnect and ExpressRoute interconnect carrying IPsec tunnels whose keys are held in a customer-managed vault Correct answer.
  4. An internet IPsec VPN with provider-managed keys

Explanation

Dedicated circuits supply the private path, and IPsec over that path with customer-managed keys satisfies the encryption and key-ownership requirement. Relying on the fabric or provider-managed keys fails the customer-managed key constraint, and an internet VPN fails the dedicated path constraint.

Question 23Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect observes asymmetric routing between OCI and Azure after adding a second circuit. Which action most directly addresses the problem?

  1. Add a NAT gateway on each side to normalize the source addresses
  2. Increase the MTU on both circuits to 9000 bytes
  3. Align BGP advertisements and local preference or AS path settings so both directions prefer the same path Correct answer.
  4. Disable BGP and rely on static routes on both sides

Explanation

Asymmetric routing across parallel circuits usually stems from inconsistent route preference, so tuning BGP attributes on both sides restores symmetric forwarding. Static routes reduce adaptability, NAT does not fix path selection, and MTU tuning is unrelated.

Question 24Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which statement correctly distinguishes Oracle Interconnect for Microsoft Azure from Oracle Cloud Infrastructure FastConnect to a customer data center?

  1. The multicloud offering requires no OCI DRG while FastConnect to a data center does
  2. The multicloud offering uses the public internet while FastConnect to a data center is private
  3. The multicloud offering pairs an OCI circuit with an Azure ExpressRoute circuit at a partner, whereas FastConnect to a data center terminates at the customer edge Correct answer.
  4. The multicloud offering supports only layer 2 while FastConnect to a data center supports only layer 3

Explanation

Both offerings are built on FastConnect, but the multicloud variant cross-connects to an Azure ExpressRoute circuit in a partner fabric, while the data center variant reaches customer equipment. Both use a DRG and both are private, so the other statements are false.

Question 25Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must design a multicloud architecture where OCI hosts the database tier and Azure hosts the application tier, with strict isolation between environments. Which design element is most important for meeting the isolation requirement?

  1. Separate VCNs and virtual networks per environment, each with its own DRG attachments and route policies limiting cross-environment reachability Correct answer.
  2. A single shared VCN and virtual network with security lists differentiating environments
  3. A shared DRG route table advertising all prefixes to every attachment
  4. One FastConnect circuit shared by all environments with a single flat route table

Explanation

Environment isolation across clouds requires separate network domains and explicit route policy so one environment cannot reach another. Sharing networks, circuits with flat routing, or advertising all prefixes to every attachment defeats isolation even when security lists exist.

Question 26Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

In Oracle Interconnect for Microsoft Azure, which two cloud regions does a single interconnect location connect by design?

  1. One OCI region and two Azure regions in the same geography
  2. One OCI region and one Azure region that are paired at that interconnect location Correct answer.
  3. Two OCI regions and one Azure region in the same country
  4. Any OCI region and any Azure region selected at provisioning time

Explanation

The interconnect is offered at defined location pairs, each joining a specific OCI region with a specific Azure region. You choose among the available pairs; you cannot arbitrarily bridge any two regions through one interconnect location.

Question 27Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which component on the OCI side terminates the cross-cloud connection provided by Oracle Interconnect for Microsoft Azure?

  1. A NAT gateway in the VCN's public subnet
  2. A service gateway bound to the Object Storage CIDR
  3. A local peering gateway between two VCNs
  4. A dynamic routing gateway attached to the VCN Correct answer.

Explanation

The DRG is the OCI edge that hosts the virtual circuit attachment and exchanges routes with the Azure side. Subnet route rules point Azure-bound traffic at the DRG.

Question 28Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

What is the maximum number of virtual circuits a customer can associate with a single Oracle Interconnect for Microsoft Azure connection?

  1. One
  2. Four
  3. Two Correct answer.
  4. Eight

Explanation

Each interconnect connection supports up to two virtual circuits, which lets you build redundant primary and secondary paths across the paired edge devices. More circuits require additional interconnect connections.

Question 29Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which Azure resource must exist before an Azure virtual network can use an ExpressRoute circuit delivered through Oracle Interconnect for Microsoft Azure?

  1. A NAT gateway on the Azure subnet
  2. An Azure Firewall in a hub virtual network
  3. A private DNS zone linked to the virtual network
  4. An ExpressRoute gateway in the target virtual network Correct answer.

Explanation

The ExpressRoute gateway is the Azure-side endpoint that terminates the circuit and learns routes. Without it, the virtual network cannot use the circuit even if the circuit is provisioned.

Question 30Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which statement best describes how Oracle Interconnect for Microsoft Azure is ordered and delivered?

  1. It is ordered only through an OCI support ticket
  2. It is ordered only through Azure Resource Manager templates
  3. It is ordered only through a third-party colocation provider's portal
  4. It is ordered through Oracle and Azure marketplaces and provisioned at a shared interconnect location Correct answer.

Explanation

The offering is jointly sold and provisioned through the Oracle and Microsoft marketplaces, with the physical cross-connect handled at the designated interconnect facility. The customer does not need to contract a colocation provider separately.

Question 31Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which OCI construct holds the route rules that direct subnet traffic toward Azure over the interconnect?

  1. A route table associated with the subnet Correct answer.
  2. A security list attached to the VNIC
  3. A network security group attached to the VNIC
  4. A DHCP option set attached to the VCN

Explanation

Route tables contain route rules, including rules whose target is the DRG, and are associated with subnets. Security lists and NSGs filter traffic but do not choose the next hop.

Question 32Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which Azure construct associates a virtual network with an ExpressRoute circuit so that the network can use it?

  1. A private endpoint in the target subnet
  2. An ExpressRoute circuit connection within the circuit's peering Correct answer.
  3. A service endpoint on the target subnet
  4. A route table bound to the gateway subnet

Explanation

Authorization and connection objects on the ExpressRoute circuit link a virtual network's gateway to the circuit. Service endpoints and private endpoints address Azure PaaS, not circuit attachment.

Question 33Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

Which pair of capabilities is provided by Oracle Interconnect for Microsoft Azure?

  1. Content delivery and global anycast distribution
  2. Identity federation between OCI IAM and Microsoft Entra ID
  3. Public internet connectivity with bandwidth throttling
  4. Private dedicated connectivity and predictable low-latency paths between the paired regions Correct answer.

Explanation

The interconnect provides a private, dedicated path between the paired OCI and Azure regions with more predictable latency than internet transit. It does not itself deliver CDN, identity federation, or throttled public access.

Question 34Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect needs OCI and Azure virtual networks to exchange routes automatically as subnets are added on either side. Which combination achieves this with the least manual effort?

  1. Static route rules on both sides updated by a change-management runbook
  2. A single static route covering 0.0.0.0/0 on each side pointing at the interconnect
  3. Host routes installed on every instance by a configuration-management tool
  4. BGP peering between the DRG and the ExpressRoute gateway, with subnet CIDRs advertised from each side Correct answer.

Explanation

BGP between the OCI DRG and the Azure ExpressRoute gateway propagates prefixes dynamically as networks change. Static approaches require manual updates and risk stale or overly broad routes.

Question 35Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A company wants the interconnect to carry only production traffic while development traffic uses a VPN over the internet. Which design element enforces this separation on the OCI side?

  1. A NAT gateway shared by production and development subnets
  2. Security lists that block development CIDRs on the production subnet
  3. Separate DRG attachments with route tables that steer each subnet to the intended attachment Correct answer.
  4. A single DRG attachment with a shared route table for all subnets

Explanation

Route tables associated with each subnet determine which attachment traffic uses, so distinct attachments and route tables keep production on the interconnect and development on the VPN. Filters alone do not select a path.

Question 36Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must estimate the bandwidth needed for a nightly bulk transfer of 4 TB between OCI and Azure within a six-hour window. Which figure is the minimum sustained throughput required?

  1. About 1.5 Gbps Correct answer.
  2. About 15 Mbps
  3. About 150 Mbps
  4. About 15 Gbps

Explanation

Four terabytes is about 32 terabits, and dividing by a 21,600-second window gives roughly 1.5 Gbps sustained. Provisioning below that rate would miss the window even with perfect efficiency.

Question 37Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An OCI VCN uses 10.0.0.0/16 and an Azure virtual network uses 10.1.0.0/16. A subnet in OCI must reach an Azure VM at 10.1.2.4. Which OCI route rule accomplishes this?

  1. Destination 10.1.0.0/16 with target type local peering gateway
  2. Destination 10.1.2.4/32 with target type internet gateway
  3. Destination 0.0.0.0/0 with target type service gateway
  4. Destination 10.1.0.0/16 with target type dynamic routing gateway Correct answer.

Explanation

A route rule for the Azure CIDR with the DRG as target sends the traffic over the interconnect. The DRG then forwards it to the ExpressRoute circuit.

Question 38Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A workload on Azure must reach an OCI Autonomous Database using its private endpoint over the interconnect. Which OCI-side element must the route target?

  1. The service gateway of the VCN hosting the private endpoint
  2. The NAT gateway of the VCN hosting the private endpoint
  3. The internet gateway of the VCN hosting the private endpoint
  4. The dynamic routing gateway attached to the VCN hosting the private endpoint Correct answer.

Explanation

Traffic entering from Azure arrives through the DRG, so the return path and the Azure-bound path both use the DRG attachment. Private endpoints are reached through normal VCN routing to the DRG.

Question 39Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must give Azure workloads access to OCI Object Storage buckets without traversing the public internet. Which OCI feature supports this?

  1. A service gateway in the VCN, reachable from Azure through the DRG Correct answer.
  2. A NAT gateway in the VCN with a public IP reservation
  3. A local peering gateway between the VCN and the Object Storage network
  4. An internet gateway with a bucket policy restricted by source CIDR

Explanation

A service gateway lets traffic reach OCI services such as Object Storage without leaving the OCI network, and Azure traffic arrives through the DRG. Combining the two keeps the path private.

Question 40Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A customer wants the interconnect to survive the failure of one of the paired edge devices. Which configuration provides that resilience?

  1. One virtual circuit with a longer BGP hold timer
  2. One virtual circuit plus a NAT gateway for failover
  3. One virtual circuit with a higher bandwidth setting
  4. Two virtual circuits on the same interconnect connection, one per edge device Correct answer.

Explanation

The two circuits on a connection terminate on different edge devices, so losing one device leaves the other circuit active. Bandwidth or timer changes do not add a second physical path.

Question 41Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must document which Azure subnet prefixes are advertised to OCI after a new Azure subnet is created. Which mechanism determines this automatically?

  1. The OCI route table is regenerated whenever Azure adds a subnet
  2. Azure DNS forwards subnet records to OCI through a zone transfer
  3. The ExpressRoute gateway advertises the virtual network address space and any configured additional prefixes over BGP Correct answer.
  4. The OCI DRG polls the Azure Resource Manager API for subnet changes

Explanation

The ExpressRoute gateway advertises the virtual network address space, plus any additional prefixes configured on the connection, through BGP. OCI learns those prefixes on the DRG.

Question 42Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A team reports that OCI instances can reach Azure, but Azure instances cannot reach OCI. Which troubleshooting step is most likely to reveal the cause?

  1. Check that the OCI subnet's route table and security rules permit inbound traffic from the Azure CIDR Correct answer.
  2. Check that the Azure virtual network has a NAT gateway configured
  3. Check that the OCI instances have public IP addresses assigned
  4. Check that the OCI VCN has a DHCP option set with a custom DNS server

Explanation

One-way reachability usually points to a missing return route or a filter blocking inbound traffic on the receiving side. Verifying the OCI route table and security rules for the Azure CIDR isolates that quickly.

Question 43Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect is told the interconnect provides a private path but not encryption of the payload. Which statement correctly reflects the shared responsibility?

  1. The interconnect encrypts all traffic automatically with keys managed by Oracle
  2. The customer must apply encryption such as TLS or IPsec if the data requires confidentiality in transit Correct answer.
  3. The interconnect encrypts traffic only when both regions are in the same country
  4. The interconnect relies on Azure ExpressRoute MACsec for all customer traffic

Explanation

The interconnect provides a private dedicated path but does not by itself guarantee payload encryption end to end. Workloads that require confidentiality must use protocols such as TLS or IPsec.

Question 44Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A workload must resolve an Azure private DNS name from an OCI instance over the interconnect. Which approach is appropriate?

  1. Rely on the DRG to translate DNS names into IP addresses
  2. Configure conditional forwarding from the OCI resolver to a DNS forwarder that can reach the Azure private zone Correct answer.
  3. Add the Azure private zone records to the OCI VCN's DHCP option set
  4. Create a public DNS zone in OCI that mirrors the Azure private zone records

Explanation

Cross-cloud private name resolution requires forwarding between resolvers over the private path. OCI's resolver can forward specific domains to a DNS server reachable through the DRG.

Question 45Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must choose between Oracle Interconnect for Microsoft Azure and a self-managed VPN over the internet for a latency-sensitive trading application. Which factor most strongly favors the interconnect?

  1. The interconnect removes the need for any routing configuration in either cloud
  2. The interconnect automatically encrypts all traffic with customer-managed keys
  3. The interconnect provides unlimited bandwidth at no additional cost
  4. The dedicated path avoids unpredictable internet routing and provides more consistent latency Correct answer.

Explanation

A dedicated path avoids the variable paths and congestion of internet transit, giving more predictable latency. Encryption, routing configuration, and cost still require attention.

Question 46Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

After a second interconnect connection is added for capacity, some flows take one path outbound and a different path inbound. Which action most directly addresses this?

  1. Align BGP path selection on both sides so the same connection is preferred in both directions Correct answer.
  2. Disable route propagation on the Azure ExpressRoute gateway
  3. Increase the MTU on both DRG attachments
  4. Add a NAT gateway to the OCI subnet

Explanation

Asymmetric routing across multiple connections usually results from each side preferring a different path. Coordinating BGP attributes such as AS path prepending or local preference makes both directions agree.

Question 47Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A regulated customer requires a dedicated private path and encryption with customer-managed keys for data crossing between OCI and Azure. Which design satisfies both requirements?

  1. A public peering arrangement with IP allowlisting on both sides
  2. A site-to-site VPN over the internet with provider-managed keys only
  3. Oracle Interconnect for Microsoft Azure combined with workload-level TLS or IPsec using customer-managed keys Correct answer.
  4. Oracle Interconnect for Microsoft Azure alone, relying on its private path

Explanation

The interconnect satisfies the dedicated private path, while workload-level encryption with customer-managed keys satisfies the confidentiality requirement. Neither element alone covers both.

Question 48Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect is designing a hub-and-spoke model in OCI where a shared services VCN connects to Azure and several spoke VCNs must reach Azure through it. Which OCI capability supports this without attaching each spoke to the DRG?

  1. A NAT gateway in each spoke VCN
  2. Transit routing through the DRG with VCN attachments and route rules in each spoke Correct answer.
  3. A service gateway in each spoke VCN
  4. A local peering gateway between each spoke and Azure

Explanation

A DRG can act as a transit point among attached VCNs and the interconnect, letting spokes route to Azure through the hub VCN. Each spoke still needs a route rule pointing at its path to the hub.

Question 49Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

A customer wants to minimize cross-cloud latency for a chatty application split between OCI and Azure. Which design choice has the greatest effect?

  1. Selecting an available OCI and Azure region pair at the same interconnect location Correct answer.
  2. Increasing the ExpressRoute gateway SKU to the largest size
  3. Enabling a longer BGP hold timer on both sides
  4. Adding a second NAT gateway in each cloud

Explanation

Physical proximity of the paired regions at the interconnect location dominates latency for chatty workloads. Gateway SKU, NAT, and timers affect capacity or convergence, not the fundamental round-trip distance.

Question 50Multicloud Fundamentals and Oracle Interconnect for Microsoft Azure

An architect must explain why the interconnect alone does not guarantee that an Azure VM can reach an OCI instance even when the circuit is up. Which explanation is most accurate?

  1. The circuit requires a public IP on every OCI instance
  2. The circuit only carries traffic in the OCI-to-Azure direction
  3. The circuit is inactive until a VPN is also configured
  4. Routing and security configuration must exist on both sides, including route tables, gateway associations, and filter rules Correct answer.

Explanation

A working circuit provides the physical path, but reachability also depends on route tables, gateway associations, and security rules on both clouds. Missing any of these breaks the end-to-end flow.