Networking

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

Two VCNs (VCN-A and Vcn-B) reside in the same OCI region but in different compartments. You need to establish a low-latency, high-bandwidth connection between them using local VCN peering. Which component is NOT required for this setup?

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

Which TWO types of traffic can be routed through an OCI Service Gateway?

Which OCI networking component is automatically created when you provision a Virtual Cloud Network using the VCN Wizard with 'Internet Connectivity'?

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?

Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?

Which THREE characteristics of OCI Security Lists are correct?

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

You are managing an OCI VCN with CIDR block 10.0.0.0/16. You want to create a subnet that can hold up to 500 usable IP addresses. Which subnet CIDR block should you choose?

Which THREE features are supported by OCI Load Balancer?

An OCI architect needs to configure route tables for a VCN where traffic destined for 10.0.1.50/32 must be sent to a specific firewall virtual appliance VNIC (`ip-10-0-1-10`), while all other traffic goes to an Internet Gateway. How should the route table be configured?

You have deployed an OCI VCN with a CIDR of 192.168.0.0/16. You want to peer this VCN with another VCN that has a CIDR of 192.168.64.0/18. Will this local peering succeed?

What is the primary function of an OCI NAT Gateway?

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Which TWO statements are true regarding OCI VCN subnets?

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

An OCI Load Balancer has been configured with SSL termination. The backend servers require incoming traffic to also be encrypted using HTTPS. Which backend set protocol should you choose?

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

What is the primary function of an OCI Internet Gateway?

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

Which TWO statements regarding OCI VCN Local Peering are correct?

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

You are configuring a Site-to-Site VPN connection and need to test connectivity between an on-premises host and an OCI compute instance. The ping fails. You check the security lists and notice that ICMP traffic is blocked. Which rule type must you add to the security list to allow incoming ping requests?

What is the smallest IPv4 CIDR block size supported for an OCI Virtual Cloud Network (VCN)?

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?

An enterprise has multiple VCNs peered to a central hub VCN using a DRG. A security auditor notes that Vcn-A can communicate with Vcn-C because transit routing is enabled on the DRG. The security policy dictates that Vcn-A must never communicate with Vcn-C. How can you block this specific inter-VCN traffic while keeping other routes intact?

Which TWO statements are true regarding OCI VCN Flow Logs?

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

Which THREE components are required when configuring an OCI FastConnect direct peering connection?

You are migrating workloads to OCI and need to route traffic between two VCNs that reside in the same tenancy but in different regions (Ashburn and Phoenix). Which OCI component is required to establish this cross-region connection?

Which TWO protocols are supported for health checks by OCI Load Balancer backend sets?

An OCI administrator creates a subnet and associates a security list with it. An instance in this subnet cannot connect to an external API on HTTPS (port 443). The security list has an ingress rule for port 443, but no egress rules defined. Why is the connection failing?

Which OCI networking component acts as a virtual firewall at the subnet level?

You are configuring a Public Load Balancer in OCI. You want to ensure that incoming traffic is encrypted using TLS 1.3. Where do you configure the SSL certificate and TLS protocol version?

Which THREE features are supported by OCI DNS Traffic Management Steering Policies?

What is the maximum number of Route Tables allowed per Virtual Cloud Network (VCN) in OCI?

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Which TWO actions can you perform on an OCI Virtual Cloud Network (VCN) after it has been created?

An OCI customer has a VCN with CIDR 10.0.0.0/16. They have deployed a Kubernetes cluster (OKE) where worker nodes are placed in a private subnet. The cluster requires internal service discovery and pod-to-pod communication across different worker subnets. What is required in the subnet route table to support standard OKE cluster networking?

You are setting up OCI DNS and want to configure a zone transfer (AXFR) from your on-premises DNS server to OCI Private DNS. Which feature enables secondary DNS functionality in OCI?

Which THREE statements regarding OCI Network Security Groups (NSGs) vs Security Lists are correct?

Which TWO components are involved when routing traffic from an OCI private subnet to an on-premises datacenter via FastConnect?

You are configuring a site-to-site VPN connection in OCI. During the tunnel setup, your on-premises firewall administrator asks for the pre-shared key (PSK). Where is the PSK defined or generated in OCI?

An OCI architect configures a Hub-and-Spoke architecture using DRG version 2. Hub VCN contains security appliances. Spoke VCN-A needs to inspect all outbound internet traffic through the security appliances in the Hub VCN before it hits the Internet Gateway. How should the Spoke VCN route table be configured?

What is the primary purpose of an OCI Service Gateway?

You have a web application behind an OCI Public Load Balancer. You want to restrict access so that only clients coming from a specific corporate external IP address range can access your application. Where should you configure this restriction?

Which THREE components are required when configuring OCI VCN Remote Peering between two regions?

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

Which TWO statements are true regarding OCI IP addresses and VNICs?

You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?

Which THREE statements regarding OCI IPv6 implementation in VCNs are correct?

What is the maximum number of VCNs allowed per region in an OCI tenancy by default (subject to service limits)?

You are troubleshooting a connection to a database instance in a private subnet. You need to verify if security list rules are blocking incoming traffic to port 1521. Which tool in OCI can you use to test reachability between an application instance and the database instance?

Which TWO metrics are available for monitoring OCI Public Load Balancers in OCI Monitoring service?

You are setting up DNS steering in OCI Traffic Management using a Response Pool. An endpoint in the pool fails its health check. How does OCI Traffic Management respond to DNS queries?

You are configuring an OCI Public Load Balancer and notice that backend instances are marked as unhealthy. Upon inspecting the health check URL on the backend server via curl, it returns HTTP 200. What is the most likely reason the load balancer still reports them as unhealthy?

What is the primary function of an OCI Dynamic Routing Gateway (DRG)?

An OCI customer has a VCN with CIDR 10.0.0.0/16 and wants to peer it with another VCN having CIDR 10.1.0.0/16. However, they also have an on-premises network connected via FastConnect using the CIDR 10.0.0.0/14. What routing challenge does this create?

Which TWO types of targets can be specified in an OCI VCN route table rule?

Which THREE statements regarding OCI VCN Route Tables are correct?

You are managing an OCI VCN and want to monitor all dropped packets due to security list violations across all subnets. Which OCI feature should you enable?

What is the maximum MTU (Maximum Transmission Unit) supported on standard OCI VCN virtual network interfaces (VNICs)?

An OCI customer has a primary database in Ashburn and a standby database in Phoenix. They need to replicate database traffic over a dedicated, highly secure private connection between the two regions. Which OCI networking architecture best achieves this requirement?

You are configuring an OCI Load Balancer and need to distribute incoming requests across backend servers based on the client's source IP address so that requests from the same client always go to the same backend server. Which load balancing policy should you choose?

Which TWO methods can be used to assign public IP addresses to OCI compute instances?

An OCI administrator creates a subnet route table with a route rule pointing 0.0.0.0/0 to an Internet Gateway. However, compute instances in this subnet cannot reach the internet. Upon checking the instance details, you notice the instances have private IP addresses only and no public IP assigned. What is missing?

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?

What is the primary purpose of an OCI Local Peering Gateway (LPG)?

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

Which THREE statements regarding OCI NAT Gateway behavior are correct?

What is the maximum number of Availability Domains (ADs) in a typical multi-AD OCI region?

Which TWO protocols are supported for OCI Site-to-Site VPN IPSec tunnels?

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

An OCI customer has an architecture where VCN-A, VCN-B, and VCN-C are connected to a central DRG in a Hub-and-Spoke topology. VCN-A needs to communicate with VCN-B, but VCN-C must be completely isolated from VCN-A. How should the DRG route tables and attachments be configured?

You are troubleshooting a web application where users are reporting intermittent connection failures when accessing your OCI Public Load Balancer. You check the load balancer metrics and notice that the `DroppedConnections` metric is spiking. What is the most likely cause?

Which THREE statements regarding OCI VCN DNS and Hostname resolution are correct?

Which TWO networking components are required when establishing an OCI Site-to-Site VPN connection using dynamic routing (BGP)?

You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?

An Oracle Cloud Infrastructure (OCI) architect needs to provision a web application that must be accessible directly from the public internet. Which component must be attached to the Virtual Cloud Network (VCN) to allow inbound traffic from the internet?

An OCI customer has configured an IPSec VPN connection with static routing. They add a new subnet with CIDR 10.0.5.0/24 to their VCN, but on-premises hosts cannot communicate with instances in this new subnet. What must be updated in the IPSec VPN configuration?

Your development team needs instances residing in a private subnet to download software patches and updates from the Oracle Cloud Infrastructure (OCI) Object Storage service without exposing those instances to the public internet. Which gateway should you configure?

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

Your organization has two Virtual Cloud Networks (VCN-A and VCN-B) in the same OCI region with overlapping CIDR blocks (10.0.0.0/16). You need to establish private communication between instances in VCN-A and VCN-B. Which networking feature should you implement?

An administrator configured a Network Security Group (NSG) and a Security List for a compute instance in a subnet. The Security List denies port 443 inbound, but the NSG associated with the instance's primary VNIC explicitly allows port 443 inbound from any source. What will happen when external traffic attempts to access the instance on port 443?

Your company requires a dedicated, highly reliable, encrypted connection from your on-premises datacenter to your OCI Virtual Cloud Network, bypassing the public internet entirely. The link must support speeds up to 10 Gbps and provide failover redundancy. Which OCI service meets this requirement?

You are deploying a Public Load Balancer in OCI to distribute incoming web traffic across multiple backend compute instances in different availability domains. You notice that backend health checks are failing. Which component's configuration should you check first to ensure health check probes can reach the backend instances?

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Which TWO of the following are valid characteristics of OCI Virtual Cloud Networks (VCNs)?

Your organization uses OCI DNS Zones for managing domain names. You need to configure a private DNS zone for your internal applications within a specific VCN so that instances can resolve hostnames internally without exposing records externally. Which feature should you configure?

When designing network security in OCI, you can use Security Lists and Network Security Groups (NSGs). Which TWO statements accurately compare or contrast them?

Which THREE gateways can be attached to a Dynamic Routing Gateway (DRG) in OCI?

An architect is configuring an OCI Public Load Balancer to handle high volumes of incoming client traffic. Which THREE features or capabilities are supported by OCI Public Load Balancers?

Your OCI environment requires secure hybrid connectivity using an IPsec VPN over a Dynamic Routing Gateway (DRG). Which THREE parameters or components must be correctly configured to ensure successful IPsec VPN tunnel establishment?