Networking

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

Which THREE features are supported by OCI DNS Traffic Management Steering Policies?

Which THREE statements regarding OCI Network Security Groups (NSGs) vs Security Lists are correct?

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

An OCI customer has a VCN with CIDR 10.0.0.0/16. They have deployed a Kubernetes cluster (OKE) where worker nodes are placed in a private subnet. The cluster requires internal service discovery and pod-to-pod communication across different worker subnets. What is required in the subnet route table to support standard OKE cluster networking?

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?

Which TWO statements are true regarding OCI IP addresses and VNICs?

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

What is the primary function of an OCI NAT Gateway?

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

You are managing an OCI VCN and want to monitor all dropped packets due to security list violations across all subnets. Which OCI feature should you enable?

Which THREE statements regarding OCI NAT Gateway behavior are correct?

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

An Oracle Cloud Infrastructure (OCI) architect needs to provision a web application that must be accessible directly from the public internet. Which component must be attached to the Virtual Cloud Network (VCN) to allow inbound traffic from the internet?

An administrator configured a Network Security Group (NSG) and a Security List for a compute instance in a subnet. The Security List denies port 443 inbound, but the NSG associated with the instance's primary VNIC explicitly allows port 443 inbound from any source. What will happen when external traffic attempts to access the instance on port 443?

Which TWO networking components are required when establishing an OCI Site-to-Site VPN connection using dynamic routing (BGP)?

You have deployed an OCI VCN with a CIDR of 192.168.0.0/16. You want to peer this VCN with another VCN that has a CIDR of 192.168.64.0/18. Will this local peering succeed?

Which THREE gateways can be attached to a Dynamic Routing Gateway (DRG) in OCI?

You are troubleshooting a web application where users are reporting intermittent connection failures when accessing your OCI Public Load Balancer. You check the load balancer metrics and notice that the `DroppedConnections` metric is spiking. What is the most likely cause?

Your OCI environment requires secure hybrid connectivity using an IPsec VPN over a Dynamic Routing Gateway (DRG). Which THREE parameters or components must be correctly configured to ensure successful IPsec VPN tunnel establishment?

An OCI architect configures a Hub-and-Spoke architecture using DRG version 2. Hub VCN contains security appliances. Spoke VCN-A needs to inspect all outbound internet traffic through the security appliances in the Hub VCN before it hits the Internet Gateway. How should the Spoke VCN route table be configured?

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

An enterprise has multiple VCNs peered to a central hub VCN using a DRG. A security auditor notes that Vcn-A can communicate with Vcn-C because transit routing is enabled on the DRG. The security policy dictates that Vcn-A must never communicate with Vcn-C. How can you block this specific inter-VCN traffic while keeping other routes intact?

Which TWO statements are true regarding OCI VCN subnets?

An OCI administrator creates a subnet route table with a route rule pointing 0.0.0.0/0 to an Internet Gateway. However, compute instances in this subnet cannot reach the internet. Upon checking the instance details, you notice the instances have private IP addresses only and no public IP assigned. What is missing?

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

What is the primary function of an OCI Internet Gateway?

You are configuring a Site-to-Site VPN connection and need to test connectivity between an on-premises host and an OCI compute instance. The ping fails. You check the security lists and notice that ICMP traffic is blocked. Which rule type must you add to the security list to allow incoming ping requests?

What is the maximum number of Availability Domains (ADs) in a typical multi-AD OCI region?

Which TWO types of targets can be specified in an OCI VCN route table rule?

Which THREE statements regarding OCI VCN Route Tables are correct?

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Which TWO protocols are supported for OCI Site-to-Site VPN IPSec tunnels?

What is the maximum number of Route Tables allowed per Virtual Cloud Network (VCN) in OCI?

You are configuring an OCI Public Load Balancer and notice that backend instances are marked as unhealthy. Upon inspecting the health check URL on the backend server via curl, it returns HTTP 200. What is the most likely reason the load balancer still reports them as unhealthy?

An OCI administrator creates a subnet and associates a security list with it. An instance in this subnet cannot connect to an external API on HTTPS (port 443). The security list has an ingress rule for port 443, but no egress rules defined. Why is the connection failing?

Which THREE statements regarding OCI IPv6 implementation in VCNs are correct?

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

An OCI customer has an architecture where VCN-A, VCN-B, and VCN-C are connected to a central DRG in a Hub-and-Spoke topology. VCN-A needs to communicate with VCN-B, but VCN-C must be completely isolated from VCN-A. How should the DRG route tables and attachments be configured?

Your development team needs instances residing in a private subnet to download software patches and updates from the Oracle Cloud Infrastructure (OCI) Object Storage service without exposing those instances to the public internet. Which gateway should you configure?

An OCI customer has a VCN with CIDR 10.0.0.0/16 and wants to peer it with another VCN having CIDR 10.1.0.0/16. However, they also have an on-premises network connected via FastConnect using the CIDR 10.0.0.0/14. What routing challenge does this create?

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

An OCI customer has a primary database in Ashburn and a standby database in Phoenix. They need to replicate database traffic over a dedicated, highly secure private connection between the two regions. Which OCI networking architecture best achieves this requirement?

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

Which TWO protocols are supported for health checks by OCI Load Balancer backend sets?

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

Which TWO statements regarding OCI VCN Local Peering are correct?

You are configuring a site-to-site VPN connection in OCI. During the tunnel setup, your on-premises firewall administrator asks for the pre-shared key (PSK). Where is the PSK defined or generated in OCI?

When designing network security in OCI, you can use Security Lists and Network Security Groups (NSGs). Which TWO statements accurately compare or contrast them?

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

Two VCNs (VCN-A and Vcn-B) reside in the same OCI region but in different compartments. You need to establish a low-latency, high-bandwidth connection between them using local VCN peering. Which component is NOT required for this setup?

A company has an OCI VCN with a hub-and-spoke topology. The hub VCN is connected to on-premises through a FastConnect virtual circuit and a DRG. Two spoke VCNs are attached to the same DRG using local peering. Instances in spoke VCN A can reach on-premises, but instances in spoke VCN B cannot reach on-premises even though the DRG attachment exists. Route tables in both spoke VCNs contain a default route to the DRG, and security rules allow all required traffic. What is the most likely cause?

What is the primary purpose of an OCI Local Peering Gateway (LPG)?

Which TWO methods can be used to assign public IP addresses to OCI compute instances?

An architect is configuring an OCI Public Load Balancer to handle high volumes of incoming client traffic. Which THREE features or capabilities are supported by OCI Public Load Balancers?

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

Which TWO types of traffic can be routed through an OCI Service Gateway?

You are configuring a Public Load Balancer in OCI. You want to ensure that incoming traffic is encrypted using TLS 1.3. Where do you configure the SSL certificate and TLS protocol version?

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

You are troubleshooting a connection to a database instance in a private subnet. You need to verify if security list rules are blocking incoming traffic to port 1521. Which tool in OCI can you use to test reachability between an application instance and the database instance?

Which TWO metrics are available for monitoring OCI Public Load Balancers in OCI Monitoring service?

What is the maximum number of VCNs allowed per region in an OCI tenancy by default (subject to service limits)?

Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?

An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?

What is the primary function of an OCI Dynamic Routing Gateway (DRG)?

An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?

Which THREE characteristics of OCI Security Lists are correct?

An administrator created a private subnet and attached a route table with a rule pointing 0.0.0.0/0 to a NAT Gateway. However, instances in this subnet cannot download OS updates from external public repositories. What should the administrator check first?

A network engineer is configuring a site-to-site IPSec VPN between an on-premises CPE and an OCI DRG. The engineer wants to ensure that the VPN connection is highly available and can survive a single CPE or tunnel failure. Which three components or configurations are required to achieve this? (Choose three.)

You are configuring an OCI Load Balancer and need to distribute incoming requests across backend servers based on the client's source IP address so that requests from the same client always go to the same backend server. Which load balancing policy should you choose?

You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?

You are deploying a Public Load Balancer in OCI to distribute incoming web traffic across multiple backend compute instances in different availability domains. You notice that backend health checks are failing. Which component's configuration should you check first to ensure health check probes can reach the backend instances?

You have a web application behind an OCI Public Load Balancer. You want to restrict access so that only clients coming from a specific corporate external IP address range can access your application. Where should you configure this restriction?

You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?

You are setting up OCI DNS and want to configure a zone transfer (AXFR) from your on-premises DNS server to OCI Private DNS. Which feature enables secondary DNS functionality in OCI?

Which THREE components are required when configuring an OCI FastConnect direct peering connection?

What is the primary purpose of an OCI Service Gateway?

What is the maximum MTU (Maximum Transmission Unit) supported on standard OCI VCN virtual network interfaces (VNICs)?

You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?

What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?

Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?

Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?

An Oracle Cloud Infrastructure (OCI) architect needs to configure a Virtual Cloud Network (VCN) with a public subnet and a private subnet. Which configuration is required for resources in the private subnet to reach the public internet through a NAT Gateway?

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?

Which THREE components are required when configuring OCI VCN Remote Peering between two regions?

Which TWO components are involved when routing traffic from an OCI private subnet to an on-premises datacenter via FastConnect?

You are configuring a Site-to-Site VPN connection in OCI. Your on-premises firewall requires you to specify the Oracle VPN IP address and configure IPSec tunnel parameters. Where do you find the Oracle VPN public IP addresses in the OCI Console?

Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?

Which OCI networking component acts as a virtual firewall at the subnet level?

You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?

You are migrating workloads to OCI and need to route traffic between two VCNs that reside in the same tenancy but in different regions (Ashburn and Phoenix). Which OCI component is required to establish this cross-region connection?

Which TWO actions can you perform on an OCI Virtual Cloud Network (VCN) after it has been created?

Which TWO statements are true regarding OCI VCN Flow Logs?

You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?

Which THREE features are supported by OCI Load Balancer?

An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?

Which THREE statements regarding OCI VCN DNS and Hostname resolution are correct?

You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?

Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?

You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?