Oracle Cloud Infrastructure 1z0-1124-25 Reddit Questions

Goal: Balance global load balancing with regional WAF protection near users.

Option A: Single WAF in one region creates a bottleneck and increases latency—insufficient.

Option B: GLB distributes globally to regional Load Balancers, each with a WAF, ensuringprotection close to users—correct.

Option C: WAF before GLB centralizes protection, adding latency and a single failure point—incorrect.

Option D: Source IP routing with regional WAFs is less optimal than GLB’s health-based routing—less effective.

Conclusion: Option B optimizes both goals.

Oracle states:

"OCI GLB distributes traffic across regions. Pair with regional Load Balancers and WAFs for localized protection and optimal performance."This supports Option B. Reference:Global Load Balancer Overview - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Balance/Concepts/globalbalance.htm).

Goal:Stable endpoint for MySQL DB with HA failover support.

Endpoint Options:

Public IP:Exposed, changes on failover; unsuitable.

DNS with Floating IP:Persistent across failovers; ideal.

Private IP:Tied to primary, fails on switch; incorrect.

Service Gateway:For OCI services, not MySQL DB; incorrect.

Evaluate Options:

A:Public exposure, no HA; incorrect.

B:Floating private IP with DNS ensures continuity; correct.

C:Static IP breaks on failover; incorrect.

D:Misaligned purpose; incorrect.

Conclusion:DNS with floating IP is most suitable.

MySQL DB in OCI uses floating IPs for HA. The Oracle Networking Professional study guide explains, "A DNS hostname resolving to the floating private IP of the active MySQL Database Service instance ensures seamless connectivity during failover events" (OCI Networking Documentation, Section: MySQL Database Service HA). This provides predictability and stability.

Problem:DNSSEC validation fails post-setup.

DNSSEC Chain:Requires DS record in parent zone for trust.

Evaluate Causes:

A:Low TTL affects caching, not validation; unlikely.

B:Missing DS in parent zone breaks chain; most likely.

C:Resolver config is client-side, not affecting external tools; incorrect.

D:OCI uses standard algorithms; highly unlikely.

Conclusion:Registrar delay in publishing DS is the primary cause.

DNSSEC relies on the parent zone. The Oracle Networking Professional study guide explains, "DNSSEC validation fails if the registrar hasn’t published the DS record in the parent zone, as this breaks the chain of trust" (OCI Networking Documentation, Section: DNSSEC Troubleshooting). This is a common post-enablement issue.

Context: Zero Trust assumes no trust, requiring strict isolation (micro-segmentation).

Option A: Bandwidth isn’t increased by segmentation—incorrect.

Option B: Segmentation may increase route tables for granularity, not reduce them—incorrect.

Option C: Micro-segmentation isolates workloads, limiting breach impact (blast radius)—core Zero Trust goal and correct.

Option D: Inter-region connectivity isn’t simplified by micro-segmentation—incorrect.

Conclusion: Option C aligns with Zero Trust principles.

Oracle notes:

"Micro-segmentation in OCI VCNs, using NSGs and security lists, limits the blast radius of breaches by isolating resources, a key Zero Trust principle."This supports Option C. Reference:Zero Trust in OCI - Oracle Help Center(docs.oracle.com/en-us/iaas/Content/Network/Concepts/zerotrust.htm).