Encrypting In-Transit Communication for OCI Compute Instances and On-Premises Server
Question
You have been asked to ensure that in-transit communication between an Oracle Cloud Infrastructure (OCI) compute instance and an on-premises server (192.168.10.10/32) is encrypted.
The instances communicate using HTTP.
The OCI Virtual Cloud Network (VCN) is connected to the on-premises network by two separate connections: a Dynamic IPsec VPN tunnel and a FastConnect virtual circuit.
No static configuration has been added.
What solution should you recommend? (Choose the best answer.)
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.D.
https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/transitrouting.htmThe best solution for encrypting in-transit communication between an Oracle Cloud Infrastructure (OCI) compute instance and an on-premises server (192.168.10.10/32) that communicate using HTTP would be to advertise a 192.168.10.10/32 route over the Dynamic IPsec VPN tunnel.
Here's why:
A. The first answer states that the instances will communicate by default over IPsec VPN, which ensures data is encrypted in-transit. However, this assumption is incorrect because no static configuration has been added.
B. Advertising a 192.168.10.10/32 route over the VPN is a viable solution because it ensures that all traffic destined for that IP address will be sent over the VPN connection, and IPsec VPN ensures data is encrypted in-transit. Therefore, this option is a possible solution.
C. Advertising a 192.168.10.10/32 route over the FastConnect is not a recommended solution because FastConnect does not provide encryption by default, so the traffic will be sent in plaintext.
D. The fourth option suggests that the instances will communicate by default over the FastConnect private virtual circuit, which ensures data is encrypted in-transit. However, this is not correct since FastConnect does not provide encryption by default.
In summary, the best solution is to advertise a 192.168.10.10/32 route over the Dynamic IPsec VPN tunnel to ensure that all traffic destined for that IP address is sent over the VPN connection, which will encrypt the data in-transit.
