What Is the Oracle 1Z0-1124-25 Certification?
Oracle 1Z0-1124-25 is the Oracle Cloud Infrastructure 2025 Networking Professional certification. It validates your ability to design, deploy, secure, and troubleshoot networking on OCI — including virtual cloud networks, hybrid connectivity, transitive routing, and workload migration. It is a professional-level credential aimed at practitioners rather than newcomers.
The word doing the work is professional. This is not an introductory cloud exam. It assumes you already understand networking fundamentals and are being tested on applying them within OCI’s specific model — its gateways, its routing behaviour, and its connectivity products.
| Attribute | Detail |
|---|---|
| Exam code | 1Z0-1124-25 |
| Exam name | Oracle Cloud Infrastructure 2025 Networking Professional |
| Number of questions | 50 |
| Duration | 90 minutes |
| Passing score | 68% |
| Price | $245 USD |
Fifty questions across 90 minutes gives nearly two minutes each, which is comfortable pacing for scenario-based questions. The 68% threshold is a slightly unusual figure — it means 34 correct answers out of 50, leaving 16 you can miss. That is more headroom than the number first suggests, but the scenario format means individual questions carry real reasoning weight.
What Does the 1Z0-1124-25 Exam Cover?
The exam spans eight domains covering VCN design, network planning and application services, hybrid architectures, transitive routing, secure networking, workload migration, troubleshooting, and best practices. Three domains carry 20% each, and together they decide 60% of your result.
| Domain | Weight | Approx. questions |
|---|---|---|
| Plan and Design OCI Networking Solutions and App Services | 20% | ~10 |
| Design for Hybrid Networking Architectures | 20% | ~10 |
| Implement and Operate Secure OCI Networking and Connectivity | 20% | ~10 |
| Design and Deploy OCI Virtual Cloud Networks (VCN) | 10% | ~5 |
| Transitive Routing | 10% | ~5 |
| Migrate Workloads to OCI | 10% | ~5 |
| Troubleshoot OCI Networking and Connectivity Issues | 10% | ~5 |
| OCI Networking Best Practices | 0% | — |
The shape here is unusually clear. Three heavyweight domains at 20% carry 60% of the marks, four supporting domains at 10% carry the remaining 40%, and one domain carries nothing at all.
Notice what the three heavyweights have in common: planning, connecting, and securing. None of them is about the mechanics of creating a VCN — that is the 10% domain. The exam is weighted toward architectural judgement rather than resource provisioning, which is exactly what separates a professional-level credential from an associate one.
Why Does One Domain Carry 0%?
The OCI Networking Best Practices domain appears in the 1Z0-1124-25 syllabus with a 0% weighting, covering architecture design, security, connectivity, logging, and monitoring. It contributes no questions of its own — but ignoring it would be a mistake, because its content is the reasoning the other seven domains are graded on.
Think of it as the marking scheme rather than a topic. When a scenario question asks which of four technically workable designs is correct, the differentiator is almost always a best practice: the design that logs properly, segments appropriately, avoids a single point of failure, or follows least privilege. Those principles live in the 0% domain.
This is a genuinely useful signal about how to prepare. A candidate who learns OCI’s networking products but never learns Oracle’s recommended patterns will be able to eliminate obviously wrong answers and then guess between the two plausible ones. The best-practices content is what resolves that final choice.
Practically, read it as a lens rather than a chapter. Whenever you study a product — a gateway, a firewall, a connectivity option — ask what the recommended way to deploy it is and why. That question is where the 0% domain quietly becomes the most valuable content in the syllabus.
Why Is Hybrid Networking Worth 20%?
Design for Hybrid Networking Architectures is 20% of the exam, covering dynamic routing gateways and their attachments, BGP, VPN services, FastConnect products, and multi-cloud connectivity. It carries this weight because almost no enterprise runs OCI in isolation — the interesting problems are at the boundary.
The dynamic routing gateway is the concept to anchor everything else to. It is the hub through which a VCN reaches outside itself, and understanding what can attach to it — VCNs, IPSec tunnels, FastConnect virtual circuits, remote peering connections — gives you a mental model that most of this domain hangs from.
BGP appears explicitly and rewards genuine understanding rather than recognition. Route advertisement, path selection, and how routes propagate across a hybrid boundary all matter, particularly when a question describes traffic taking an unexpected path and asks why.
Then there is the recurring commercial-technical trade-off between VPN and FastConnect. Site-to-site VPN runs over the public internet — quick to establish, variable in performance. FastConnect is dedicated private connectivity — consistent and higher bandwidth, but slower to provision and more expensive. Scenario questions almost always turn on which of those properties the described business actually needs. Oracle’s OCI networking overview is the authoritative reference for the products involved, and the FastConnect documentation covers the dedicated-connectivity options in detail.
How Is Secure Networking Tested?
Implement and Operate Secure OCI Networking and Connectivity is 20% of the exam and covers IAM concepts, the Bastion service, CloudShell, Network Firewall, Web Application Firewall, and Zero Trust Packet Routing. It is applied security — configuring and operating protections rather than discussing them abstractly.
IAM underpins the domain, and OCI’s model has its own vocabulary. Compartments, policies, dynamic groups, and principals behave differently from other clouds’ equivalents, and policy syntax questions are common. Understanding how a policy grants access to a compartment is foundational, and the OCI IAM documentation covers the model precisely.
The access services are the practical heart. The Bastion service provides controlled, time-bound access to private resources without exposing them publicly — the answer whenever a scenario needs administrative reach into a private subnet without a public IP. CloudShell sits alongside it as a browser-based access path.
What VCN and Transitive Routing Knowledge Is Needed?
VCN design is 10% of the exam and transitive routing another 10%. Together they cover subnet characteristics, IPv4 and IPv6 addressing, gateway roles, endpoints, local peering gateways, network appliances, and transitive routing configurations. Smaller domains, but foundational to everything above them.
On VCNs, know the gateways by purpose rather than by name. An internet gateway provides two-way public connectivity; a NAT gateway allows outbound-only access for private resources; a service gateway reaches Oracle services without traversing the internet; a dynamic routing gateway handles hybrid and cross-VCN traffic. Most VCN questions reduce to choosing the right gateway for a stated requirement.
Transitive routing is the more conceptually demanding of the two. The core issue is that peered networks do not forward traffic on behalf of each other by default — if VCN A peers with B and B peers with C, A cannot reach C automatically. Knowing how to architect around that, using a DRG or a network appliance as a transit point, is precisely what the domain examines.
IPv6 also appears explicitly in the VCN domain, which is worth flagging because many candidates have far less hands-on IPv6 experience than IPv4. Do not assume your IPv4 knowledge covers it — addressing and gateway behaviour differ enough to generate questions.
Who Should Take the 1Z0-1124-25 Exam?
This certification suits cloud network engineers, architects, and infrastructure professionals working with Oracle Cloud Infrastructure. It is a professional-level credential, so real networking knowledge and hands-on OCI exposure are practical prerequisites even though none are formally required.
Network engineers moving into OCI are the strongest fit. Your BGP, routing, and VPN knowledge transfers directly into the hybrid domain, which is 20% of the exam. The work is learning OCI’s specific model — gateway types, DRG attachments, compartment-based IAM — on top of fundamentals you already hold.
Cloud engineers with OCI experience but a thinner networking background face the inverse challenge. The OCI service knowledge comes easily, and the networking depth — particularly BGP and transitive routing — is where preparation time belongs.
The third audience is architects and security-focused practitioners, for whom the 20% security domain and the best-practices lens make this more relevant than a purely operational certification.
How Should You Prepare for 1Z0-1124-25?
Effective preparation concentrates on the three 20% domains — planning, hybrid connectivity, and security — because together they decide 60% of your result. Most candidates need six to ten weeks. Hands-on time in an OCI tenancy matters more than reading, because the exam is scenario-driven.
| Phase | Focus | Goal |
|---|---|---|
| 1 | VCN fundamentals — subnets, gateways, IPv4 and IPv6, endpoints | Choose the right gateway for any stated requirement |
| 2 | Planning and app services — IP management, load balancing, DNS, traffic steering | Design a topology from a business requirement |
| 3 | Hybrid — DRG attachments, BGP, VPN, FastConnect, multi-cloud | Justify VPN vs FastConnect for a described scenario |
| 4 | Security — IAM, Bastion, CloudShell, Network Firewall, WAF, ZPR | Secure private access without public exposure |
| 5 | Transitive routing, migration, and troubleshooting | Diagnose why traffic is not reaching its destination |
| 6 | Best practices review and timed practice | Pick the recommended design, not merely a working one |
Build topologies rather than reading about them. Create two VCNs, peer them, discover for yourself that transit does not work, then solve it with a DRG. That sequence teaches transitive routing in an afternoon in a way no diagram manages, and the scenarios on the exam are described in exactly those practical terms.
Treat phase six as essential rather than optional revision. Because the best-practices domain carries no questions of its own but informs the grading of every scenario, reviewing Oracle’s recommended patterns immediately before the exam is unusually high-value — it is what lets you choose between two designs that both technically work.
Test under timed conditions before booking. Working through a realistic 1Z0-1124-25 practice exam exposes whether you can reason through a connectivity scenario at pace, and which of the eight domains is quietly weaker than it felt while studying. Oracle’s own certification path overview is worth checking for current exam status, since Oracle versions its cloud exams by year.
Is the OCI Networking Professional Worth Earning?
1Z0-1124-25 is worth most to professionals whose organisations run Oracle Cloud Infrastructure, and to consultants delivering OCI implementations. As a vendor-specific professional credential, its value tracks OCI adoption in your market rather than cloud networking skills generally.
Its strongest feature is the specialism it certifies. Cloud generalists are plentiful; engineers who can architect hybrid connectivity, design transitive routing, and secure it properly on a specific platform are considerably scarcer. That combination is where the harder and better-paid cloud networking work sits.
Timing is a genuine consideration too. Oracle versions these exams by year — this is the 2025 iteration — which keeps content current but means the credential has a defined shelf life. Factor recertification into the decision rather than treating it as permanent.
The honest limitation is portability. OCI-specific knowledge does not transfer wholesale to other clouds, though the underlying concepts — BGP, hybrid connectivity, segmentation, zero trust — generalise well. If your work is anchored to Oracle Cloud, the specificity is the point; if you move across providers, weigh it against a vendor-neutral networking credential.
Frequently Asked Questions
How many questions are on the 1Z0-1124-25 exam?
The exam contains 50 questions with a 90-minute limit, giving nearly two minutes per question. That pacing is comfortable, which reflects the scenario-based format — many questions describe a networking requirement or fault that takes genuine reading and reasoning.
What is the passing score for 1Z0-1124-25?
The passing score is 68%, meaning 34 correct answers out of 50. That leaves 16 questions you can miss. Because three domains carry 20% each, weakness in planning, hybrid connectivity, or security consumes that margin quickly.
How much does the exam cost?
The exam costs $245 USD. Third-party practice test products are priced separately and cost considerably less, so do not confuse the two when budgeting for the certification.
Why does one domain have a 0% weighting?
The OCI Networking Best Practices domain contributes no questions of its own, but its content is the reasoning used to grade the other domains. When several designs are technically workable, best practices determine which is correct. Study it as a lens rather than skipping it.
Which domains are most heavily weighted?
Three domains carry 20% each: planning and designing networking solutions, hybrid networking architectures, and secure networking and connectivity. Together they decide 60% of the exam, and all three test architectural judgement rather than resource provisioning.
Do you need BGP knowledge for this exam?
Yes. BGP appears explicitly in the hybrid networking domain, which is 20% of the exam. You should understand route advertisement, path selection, and how routes propagate across hybrid boundaries — particularly for questions where traffic takes an unexpected path.
What is transitive routing in OCI?
Peered networks do not forward traffic on behalf of each other by default, so if VCN A peers with B and B peers with C, A cannot reach C automatically. Transitive routing is architecting around that using a dynamic routing gateway or a network appliance as a transit point.
When should you choose FastConnect over VPN?
FastConnect provides dedicated private connectivity with consistent performance and higher bandwidth, but takes longer to provision and costs more. Site-to-site VPN runs over the public internet and is faster to establish. Scenario questions turn on which property the described business actually requires.
How long should you study for 1Z0-1124-25?
Six to ten weeks suits most candidates, depending on existing networking depth and OCI exposure. Concentrate on the three 20% domains, and build real topologies in a tenancy rather than studying diagrams, since the exam is heavily scenario-based.
Conclusion
1Z0-1124-25 is an architecture exam wearing networking clothes. Three domains at 20% each — planning, hybrid connectivity, and security — carry 60% of the marks, and all three ask for judgement rather than provisioning steps. Creating a VCN is the 10% domain; deciding how it should connect and be protected is where the exam actually lives.
Build topologies rather than reading about them, learn the DRG as the hub that hybrid connectivity hangs from, and give BGP and transitive routing the hands-on time they need. Then review the 0%-weighted best-practices content last, because it is what lets you pick the recommended design over the merely workable one. Fifty questions, 90 minutes, 68% to pass, and a blueprint that tells you plainly where to aim.
