1z0-1124-25 Exam Dumps : Oracle Cloud Infrastructure 2025 Networking Professional

Requirements: Outbound internet access, no inbound exposure, and private OCIR access.

Option A: Internet Gateway allows inbound traffic, violating the no-exposure rule—incorrect.

Option B: NAT Gateway enables outbound-only internet access, but Internet Gateway adds inbound exposure—incorrect.

Option C: NAT Gateway provides outbound internet access without inbound exposure; Service Gateway enables private OCIR access—correct.

Option D: DRG is for external networks, not internet/OCIR access; Internet Gateway exposes servers—incorrect.

Conclusion: Option C satisfies all requirements.

Oracle states:

"Use a NAT Gateway for outbound internet access from private subnets without inbound connectivity. Use a Service Gateway for private access to OCI services like OCIR."This supports Option C. Reference:NAT and Service Gateway Overview - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Network/Tasks/NATgateway.htm & docs.oracle.com/en-us/iaas/Content/Network/Tasks/servicegateway.htm).

Goal: Balance global load balancing with regional WAF protection near users.

Option A: Single WAF in one region creates a bottleneck and increases latency—insufficient.

Option B: GLB distributes globally to regional Load Balancers, each with a WAF, ensuringprotection close to users—correct.

Option C: WAF before GLB centralizes protection, adding latency and a single failure point—incorrect.

Option D: Source IP routing with regional WAFs is less optimal than GLB’s health-based routing—less effective.

Conclusion: Option B optimizes both goals.

Oracle states:

"OCI GLB distributes traffic across regions. Pair with regional Load Balancers and WAFs for localized protection and optimal performance."This supports Option B. Reference:Global Load Balancer Overview - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Balance/Concepts/globalbalance.htm).

Problem: OKE pods can’t resolve private DB IP despite VCN DNS working.

Option A: CoreDNS in OKE must forward to VCN’s resolver for private IPs; misconfiguration is a common issue—correct.

Option B: Security lists block traffic, not resolution; VCN DNS isn’t hosted on the DB—incorrect.

Option C: Public endpoint affects API access, not internal DNS—incorrect.

Option D: Route tables don’t control DNS resolution—incorrect.

Conclusion: Option A is the most probable cause.

Oracle notes:

"CoreDNS in OKE must be configured to forward queries to the VCN’s DNS resolver (.169 address) for private IP resolution."This supports Option A. Reference:OKE DNS Configuration - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengdns.htm).