Courseiva

CCNA Networking Questions

75 of 120 questions · Page 1/2 · Networking · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

A.Configure a NAT Gateway on the load balancer subnet.
B.Change the load balancer shape from Flexible to 100 Mbps.
C.Attach an Internet Gateway to the backend subnet route table.
D.Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.
AnswerD

Backend instances need security rules permitting ingress traffic from the load balancer's IP range or subnet.

Why this answer

Backend instances must allow incoming traffic from the load balancer's subnet or security list on the application ports. Updating the backend instance security lists or NSGs resolves the timeout.

Practice this question →
2
MCQeasy

What is the primary purpose of an OCI Virtual Cloud Network (VCN)?

A.To store backup files and unstructured object data.
B.To host public DNS domain names on the internet.
C.To provide a customizable, isolated virtual network in OCI for your cloud resources.
D.To execute serverless container functions.
AnswerC

A VCN provides network isolation and control for compute, database, and other OCI resources.

Why this answer

A VCN is a customizable, private software-defined network that you set up in OCI, resembling a traditional physical network.

Practice this question →
3
MCQmedium

You are setting up OCI Traffic Management Steering Policy with a Failover strategy. You have a primary endpoint in Ashburn and a secondary endpoint in Phoenix. If the primary endpoint fails, how does the steering policy handle incoming DNS queries?

A.It drops all DNS queries until Ashburn recovers.
B.It returns an NXDOMAIN error to the client.
C.It automatically routes all DNS queries to the secondary endpoint in Phoenix.
D.It round-robins queries between both endpoints equally.
AnswerC

Failover steering switches traffic to the secondary endpoint when the primary endpoint health check fails.

Why this answer

A Failover steering policy routes all traffic to the highest-priority healthy endpoint (Ashburn). If Ashburn fails health checks, it automatically fails over to the secondary endpoint (Phoenix).

Practice this question →
4
MCQhard

An OCI architect is configuring a DRG to handle multiple VCN attachments. They want to ensure that VCN-1 can communicate with the on-premises network, but VCN-2 cannot. How should this be configured using DRG route tables?

A.Configure a NAT Gateway on VCN-2 to drop on-premises packets.
B.Associate VCN-1 and VCN-2 attachments with different DRG route tables, ensuring only VCN-1's route table imports routes from the on-premises attachment.
C.Place VCN-1 and VCN-2 in different OCI tenancies.
D.Attach VCN-2 to an Internet Gateway instead of the DRG.
AnswerB

Separate DRG route tables and import rules allow granular control over which attachments share routes.

Why this answer

In DRG version 2, you attach VCN-1 and VCN-2 to the DRG, and associate them with separate DRG route tables. The route table for VCN-1's attachment includes an import rule for the on-premises attachment, while VCN-2's route table does not.

Practice this question →
5
Multi-Selecthard

Which THREE features are supported by OCI DNS Traffic Management Steering Policies?

Select 3 answers
A.Failover steering
B.Database connection pooling steering
C.Weighted round robin steering
D.Geolocation-based steering
E.Virtual machine hypervisor CPU steering
AnswersA, C, D

Failover policies automatically route traffic to backup endpoints if primary endpoints fail.

Why this answer

OCI Traffic Management steering policies support weighted round robin, failover, geolocation, ASN, and load balancer steering.

Practice this question →
6
Multi-Selecthard

Which THREE statements regarding OCI Network Security Groups (NSGs) vs Security Lists are correct?

Select 3 answers
A.NSGs are mandatory for every subnet, while Security Lists are optional.
B.NSGs apply to a specific set of VNICs of your choice, whereas Security Lists apply to all VNICs in a subnet.
C.Security Lists can span across multiple VCNs, while NSGs cannot.
D.NSG rules can reference other NSGs as sources or destinations.
E.Both Security Lists and NSGs support stateful and stateless rules.
AnswersB, D, E

This is the primary architectural difference in scope between NSGs and Security Lists.

Why this answer

NSGs apply to specific VNICs and span subnets within a VCN, whereas Security Lists apply to all VNICs in a subnet. Both support stateful and stateless rules.

Practice this question →
7
MCQhard

An administrator wants to ensure that a compute instance in a private subnet can communicate with other compute instances in a peered VCN, but cannot initiate outbound connections to the internet. Which combination of components correctly satisfies this requirement?

A.Local Peering Gateway (or DRG) and route table rules pointing to the peer VCN CIDR, with no NAT or Internet Gateway.
B.NAT Gateway and a route table pointing 0.0.0.0/0 to the peer VCN.
C.Service Gateway pointing to the peered VCN CIDR.
D.Internet Gateway attached to the private subnet route table.
AnswerA

Peering without an Internet or NAT Gateway allows VCN-to-VCN communication while blocking the internet.

Why this answer

To allow peering without internet access, you need a peering connection (LPG or DRG) and proper route table rules pointing to the peer. You should omit any Internet Gateway or NAT Gateway to prevent internet access.

Practice this question →
8
Multi-Selecthard

Which TWO statements regarding OCI FastConnect virtual circuits are correct?

Select 2 answers
A.Only static routing is supported on FastConnect public virtual circuits.
B.A Private Virtual Circuit allows direct access to your VCN using private IP addresses.
C.You cannot attach a FastConnect virtual circuit to a Dynamic Routing Gateway.
D.FastConnect virtual circuits must traverse the public internet with IPSec encryption.
E.FastConnect requires BGP for dynamic routing across private virtual circuits.
AnswersB, E

Private virtual circuits extend your on-premises network into your VCN privately.

Why this answer

FastConnect virtual circuits can be public (for accessing public Oracle services without internet) or private (for extending your datacenter to your VCN). They support static routing or BGP dynamic routing.

Practice this question →
9
MCQhard

An OCI customer has a VCN with CIDR 10.0.0.0/16. They have deployed a Kubernetes cluster (OKE) where worker nodes are placed in a private subnet. The cluster requires internal service discovery and pod-to-pod communication across different worker subnets. What is required in the subnet route table to support standard OKE cluster networking?

A.A default 'local' route covering the VCN CIDR (10.0.0.0/16) pointing to 'local' target
B.A route pointing to a NAT Gateway for every pod CIDR
C.A Service Gateway for container image downloads
D.A route pointing 0.0.0.0/0 to an Internet Gateway
AnswerA

The 'local' route enables all subnets within the same VCN to communicate with each other natively.

Why this answer

Standard OKE subnets require intra-VCN routing, which is automatically handled by the default local route (10.0.0.0/16 pointing to 'local'), ensuring all subnets within the VCN can communicate freely.

Practice this question →
10
MCQhard

An enterprise architecture spans three VCNs in the same OCI region: VCN-Hub (10.0.0.0/16), VCN-Spoke1 (10.1.0.0/16), and VCN-Spoke2 (10.2.0.0/16). You attach all three VCNs to a single Dynamic Routing Gateway (DRG). You need to route traffic from Spoke1 to Spoke2 via the Hub VCN (service inspection model). Which DRG feature allows you to achieve this transit routing setup?

A.Local Peering Gateways with cross-region peering attachments
B.DRG route tables and import/export route distribution maps
C.Virtual Circuit FastConnect multipath routing
D.Internet Gateway route translation rules
AnswerB

DRG route tables enable transit routing between VCNs attached to the same DRG by managing route propagation and custom routing rules.

Why this answer

DRG route tables allow you to customize how traffic flows between attachments. By using DRG attachments and custom route tables on the DRG, you can route traffic from Spoke1 to the Hub VCN attachment, and then from the Hub back out to Spoke2.

Practice this question →
11
MCQmedium

You are migrating a legacy application to OCI. The application relies heavily on multicast network traffic to synchronize state between backend nodes. Which OCI networking feature should you configure to support multicast?

A.Attach a NAT Gateway configured for multicast translation.
B.Configure an Internet Gateway with multicast proxy enabled.
C.Enable multicast routing on the Dynamic Routing Gateway (DRG).
D.OCI VCNs do not support IP multicast; the application must be redesigned to use unicast.
AnswerD

IP multicast is not supported in OCI VCN routing.

Why this answer

OCI Virtual Cloud Networks (VCNs) operate at Layer 3 and do not support IP multicast traffic. Application architectures must be redesigned to use unicast or alternative synchronization mechanisms.

Practice this question →
12
Multi-Selectmedium

Which TWO statements are true regarding OCI IP addresses and VNICs?

Select 2 answers
A.Private IP addresses are permanent and can never be unassigned from a VNIC.
B.A VNIC can only belong to one subnet at a time, but can span multiple VCNs.
C.VNICs in private subnets can be assigned public IP addresses directly.
D.Every VNIC is assigned at least one primary private IP address.
E.A VNIC can have multiple secondary private IP addresses assigned to it.
AnswersD, E

A primary private IP address is mandatory when creating a VNIC.

Why this answer

Every VNIC has a primary private IP address assigned from its subnet CIDR block, and can optionally have secondary private IP addresses and public IP addresses (ephemeral or reserved).

Practice this question →
13
Multi-Selectmedium

Which TWO networking services or features in OCI can be used to restrict incoming traffic to specific compute instances?

Select 2 answers
A.Security Lists
B.Service Gateway
C.Dynamic Routing Gateway
D.Network Security Groups (NSGs)
E.Internet Gateway
AnswersA, D

Security Lists act as virtual firewalls for all VNICs in a subnet.

Why this answer

Security Lists (at the subnet level) and Network Security Groups (at the VNIC level) are the two primary virtual firewall features used in OCI to control ingress and egress traffic.

Practice this question →
14
MCQmedium

You are setting up DNS steering in OCI Traffic Management using a Response Pool. An endpoint in the pool fails its health check. How does OCI Traffic Management respond to DNS queries?

A.It automatically removes the unhealthy endpoint from DNS responses and routes traffic to healthy endpoints.
B.It returns a 504 Gateway Timeout error to the DNS client.
C.It shuts down the VCN associated with the endpoint.
D.It continues to send traffic to the failed endpoint until manual intervention occurs.
AnswerA

Health checks ensure DNS steering policies dynamically route around failed endpoints.

Why this answer

When an endpoint fails its health check, OCI Traffic Management automatically removes it from the DNS response rotation, routing queries only to healthy endpoints according to the steering policy.

Practice this question →
15
MCQeasy

What is the primary function of an OCI NAT Gateway?

A.To allow private subnet instances to initiate outbound connections to the internet while blocking inbound connections.
B.To peer two VCNs in the same region.
C.To allow inbound internet traffic to reach private database instances securely.
D.To connect on-premises datacenters to OCI VCNs.
AnswerA

NAT Gateways provide unidirectional outbound internet access for private resources.

Why this answer

A NAT Gateway enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software patches) without accepting inbound connections from the internet.

Practice this question →
16
MCQhard

An OCI customer has configured an IPSec VPN connection with static routing. They add a new subnet with CIDR 10.0.5.0/24 to their VCN, but on-premises hosts cannot communicate with instances in this new subnet. What must be updated in the IPSec VPN configuration?

A.Recreate the Customer-Premises Equipment (CPE) object.
B.Add the new VCN subnet CIDR (10.0.5.0/24) to the static routes in the OCI IPSec Connection configuration.
C.Switch the VPN from static routing to a NAT Gateway.
D.Update the VCN Internet Gateway routing table.
AnswerB

Static IPSec connections require explicit static route definitions in OCI for all destination subnets.

Why this answer

When using static routing for an OCI Site-to-Site VPN, you must define the static route rules (on-premises networks and VCN static routes) in the OCI IPSec connection configuration so Oracle knows which traffic to tunnel.

Practice this question →
17
MCQmedium

You are configuring an OCI Load Balancer and need to ensure that client source IP addresses are preserved when traffic reaches the backend web servers. Which feature should you enable?

A.Enable 'Preserve Client IP' in the backend set configuration.
B.Attach a NAT Gateway to the Load Balancer subnet.
C.Switch the load balancer shape to asymmetric routing mode.
D.Configure an Internet Gateway route on the backend servers.
AnswerA

Preserving client IP allows backend servers to log the true client IP instead of the load balancer IP.

Why this answer

To preserve client source IP addresses, you should enable 'Backend Set - SSL/TCP' or configure proxy protocol / appropriate backend header settings depending on the listener type, but specifically in OCI Load Balancer, backend sets support preserving client IP headers.

Practice this question →
18
MCQhard

Your development team deployed a three-tier application in an OCI VCN. You need to restrict database instances so they only accept incoming traffic from specific application instances, regardless of which subnet the application instances reside in. Which OCI networking feature should you use?

A.Local Peering Gateway (LPG) access control lists
B.Security Lists associated with the database subnet
C.Network Security Groups (NSGs)
D.Dynamic Routing Gateway (DRG) security policies
AnswerC

NSGs act as virtual firewalls for a set of VNICs of your choice, independent of subnet boundaries, making them ideal for tier-based isolation.

Why this answer

Network Security Groups (NSGs) allow you to group VNICs of a similar security posture (like the application tier) and apply security rules to them, independent of subnet boundaries.

Practice this question →
19
MCQmedium

An OCI Load Balancer has been configured with SSL termination. The backend servers require incoming traffic to also be encrypted using HTTPS. Which backend set protocol should you choose?

A.HTTP (unencrypted)
B.DNS
C.ICMP
D.SSL (or HTTP with SSL enabled)
AnswerD

Choosing SSL for the backend set ensures end-to-end encryption from client to backend server.

Why this answer

If backend servers require encryption, you should configure the backend set to use SSL (HTTPS or TCP with SSL) so the load balancer encrypts traffic before forwarding it to the backend instances.

Practice this question →
20
MCQmedium

You are managing an OCI VCN and want to monitor all dropped packets due to security list violations across all subnets. Which OCI feature should you enable?

A.Service Gateway audit logs
B.Internet Gateway access logs
C.NAT Gateway traffic logging
D.OCI VCN Flow Logs configured to capture rejected traffic
AnswerD

VCN flow logs record denied packets resulting from security list or NSG evaluations.

Why this answer

OCI VCN Flow Logs capture traffic information including dropped/rejected packets due to security list or NSG blocks when configured to log 'REJECT' or 'ALL' traffic.

Practice this question →
21
MCQhard

An OCI architect needs to configure route tables for a VCN where traffic destined for 10.0.1.50/32 must be sent to a specific firewall virtual appliance VNIC (`ip-10-0-1-10`), while all other traffic goes to an Internet Gateway. How should the route table be configured?

A.OCI route tables only support 0.0.0.0/0 and cannot target individual IP addresses.
B.Add a route rule with destination 10.0.1.50/32 and target as the private IP of the firewall appliance VNIC, and a rule with 0.0.0.0/0 pointing to the Internet Gateway.
C.Use a Service Gateway to route specific IP addresses.
D.Set the Internet Gateway as the target for 10.0.1.50/32 and the firewall appliance as the target for 0.0.0.0/0.
AnswerB

Specific host routes take precedence over default routes in OCI route tables.

Why this answer

Specific IP destination addresses (like /32) can be added as route rules pointing to the private IP of a firewall appliance VNIC as the target, alongside a general 0.0.0.0/0 route pointing to the Internet Gateway.

Practice this question →
22
Multi-Selecthard

Which THREE statements regarding OCI NAT Gateway behavior are correct?

Select 3 answers
A.NAT Gateways require compute instances to have public IP addresses.
B.Instances behind a NAT Gateway can initiate outbound connections to the internet.
C.NAT Gateways scale automatically to meet traffic demands.
D.NAT Gateways replace the need for an Internet Gateway in public subnets.
E.External hosts on the internet cannot initiate inbound connections to private instances through a NAT Gateway.
AnswersB, C, E

Outbound internet connectivity is the primary function of a NAT Gateway.

Why this answer

NAT Gateways allow private subnet instances to initiate outbound connections to the internet, they scale automatically, and they do not accept inbound connections initiated from the internet.

Practice this question →
23
Multi-Selecthard

Which THREE components can be attached to an OCI Dynamic Routing Gateway (DRG version 2)?

Select 3 answers
A.Virtual Cloud Networks (VCNs)
B.Internet Gateways
C.Local Peering Gateways (LPGs)
D.IPSec VPN tunnels
E.FastConnect virtual circuits
AnswersA, D, E

VCN attachments allow the DRG to route traffic to and from cloud networks.

Why this answer

DRG version 2 supports attachments to VCNs, Site-to-Site VPN IPSec connections, FastConnect virtual circuits, and remote peer DRGs for cross-region peering.

Practice this question →
24
MCQmedium

You are managing an OCI VCN with CIDR block 10.0.0.0/16. You want to create a subnet that can hold up to 500 usable IP addresses. Which subnet CIDR block should you choose?

A.10.0.0.0/22
B.10.0.0.0/23
C.10.0.1.0/24
D.10.0.0.0/25
AnswerB

A /23 subnet provides 512 total addresses (507 usable), satisfying the 500 usable requirement.

Why this answer

A /23 CIDR block provides 512 total IP addresses. In OCI, 2 IP addresses are reserved by Oracle (network address and broadcast-equivalent), and 3 are reserved for internal DHCP/router operations, leaving 507 usable IP addresses, which satisfies the requirement for 500.

Practice this question →
25
MCQeasy

An Oracle Cloud Infrastructure (OCI) architect needs to provision a web application that must be accessible directly from the public internet. Which component must be attached to the Virtual Cloud Network (VCN) to allow inbound traffic from the internet?

A.Service Gateway
B.Dynamic Routing Gateway
C.Internet Gateway
D.NAT Gateway
AnswerC

An Internet Gateway provides a path for network traffic between your VCN and the public internet.

Why this answer

An Internet Gateway is a routing component that connects the edge of a VCN with the public internet, enabling bidirectional communication for public resources.

Practice this question →
26
MCQmedium

An administrator configured a Network Security Group (NSG) and a Security List for a compute instance in a subnet. The Security List denies port 443 inbound, but the NSG associated with the instance's primary VNIC explicitly allows port 443 inbound from any source. What will happen when external traffic attempts to access the instance on port 443?

A.Traffic will be blocked due to the default stateless nature of NSGs.
B.Traffic will be dropped because both components must explicitly allow the traffic for it to pass.
C.Traffic will be dropped because Security Lists take precedence over Network Security Groups.
D.Traffic will be allowed because Security List and NSG rules are additive.
AnswerD

Traffic is allowed if permitted by either a Security List or an associated Network Security Group.

Why this answer

OCI security rules are evaluated additively. If either the Security List or the applicable NSG allows the traffic, the traffic is permitted. Therefore, port 443 traffic will be allowed.

Practice this question →
27
Multi-Selectmedium

Which TWO networking components are required when establishing an OCI Site-to-Site VPN connection using dynamic routing (BGP)?

Select 2 answers
A.Dynamic Routing Gateway (DRG) configured with BGP ASN
B.Internet Gateway attached to private subnets
C.Local Peering Gateway (LPG)
D.Customer-Premises Equipment (CPE) object
E.NAT Gateway for BGP packet translation
AnswersA, D

The DRG terminates the VPN and participates in BGP dynamic routing.

Why this answer

Site-to-Site VPN with dynamic routing requires a CPE object, a DRG attached to the VCN, an IPSec connection with tunnels configured, and BGP ASN configuration on both the OCI side and CPE side.

Practice this question →
28
MCQmedium

You have deployed an OCI VCN with a CIDR of 192.168.0.0/16. You want to peer this VCN with another VCN that has a CIDR of 192.168.64.0/18. Will this local peering succeed?

A.Yes, as long as both VCNs are in the same compartment.
B.No, because VCNs must have identical CIDR sizes to peer.
C.No, because the VCN CIDR blocks overlap.
D.Yes, because the second VCN CIDR is a subnet of the first.
AnswerC

Overlapping CIDR blocks prevent successful VCN peering and routing.

Why this answer

Local VCN peering requires that the peering VCNs have non-overlapping CIDR blocks. Since 192.168.64.0/18 is completely contained within 192.168.0.0/16, the CIDRs overlap, and peering will fail.

Practice this question →
29
Multi-Selectmedium

Which THREE gateways can be attached to a Dynamic Routing Gateway (DRG) in OCI?

Select 3 answers
A.FastConnect Virtual Circuits
B.Local Peering Gateways
C.Site-to-Site VPN (IPsec tunnels)
D.Internet Gateways
E.Virtual Cloud Networks (VCN attachments)
AnswersA, C, E

FastConnect virtual circuits attach to DRGs to connect on-premises networks.

Why this answer

A DRG can accept attachments from Virtual Cloud Networks (VCNs), IPsec VPN tunnels / Site-to-Site VPN, and FastConnect virtual circuits.

Practice this question →
30
MCQmedium

You are troubleshooting a web application where users are reporting intermittent connection failures when accessing your OCI Public Load Balancer. You check the load balancer metrics and notice that the `DroppedConnections` metric is spiking. What is the most likely cause?

A.The load balancer has reached its maximum bandwidth or connection rate limit, or backend instances are overwhelmed.
B.The NAT Gateway is misconfigured.
C.The VCN route table is missing a default route.
D.The DNS record has an incorrect TTL.
AnswerA

Reaching bandwidth or connection limits causes the load balancer to drop incoming connections.

Why this answer

Dropped connections on an OCI Load Balancer typically occur when the load balancer or backend servers reach capacity limits, or security lists/NSGs drop packets due to rate limiting or connection tracking limits.

Practice this question →
31
Multi-Selecthard

Your OCI environment requires secure hybrid connectivity using an IPsec VPN over a Dynamic Routing Gateway (DRG). Which THREE parameters or components must be correctly configured to ensure successful IPsec VPN tunnel establishment?

Select 3 answers
A.IPsec connection tunnels configured with appropriate pre-shared keys (PSK) and cryptographic parameters
B.A Local Peering Gateway (LPG) bridging the VPN tunnel to the database subnet
C.An Internet Gateway attached to the private subnets handling the VPN traffic
D.A Dynamic Routing Gateway (DRG) attached to the target VCN
E.Customer-Premises Equipment (CPE) object referencing the public IP address of your on-premises router
AnswersA, D, E

IPsec tunnels require matching encryption settings and authentication keys.

Why this answer

Establishing an IPsec VPN tunnel requires a Customer-Premises Equipment (CPE) object representing your on-premises router public IP, a DRG attached to your VCN, and IPsec connection tunnels configured with correct static or BGP routing and pre-shared keys.

Practice this question →
32
MCQhard

An OCI architect configures a Hub-and-Spoke architecture using DRG version 2. Hub VCN contains security appliances. Spoke VCN-A needs to inspect all outbound internet traffic through the security appliances in the Hub VCN before it hits the Internet Gateway. How should the Spoke VCN route table be configured?

A.Configure the Spoke VCN route table with 0.0.0.0/0 pointing to the DRG, and configure the DRG to route traffic to the Hub VCN security appliance.
B.Attach an Internet Gateway directly to the Spoke VCN private subnet.
C.Configure a NAT Gateway in every spoke VCN.
D.Use a Local Peering Gateway for internet inspection.
AnswerA

This directs spoke outbound traffic into the DRG and onward to the hub security appliance.

Why this answer

To direct spoke internet traffic through a firewall appliance in the hub VCN, the spoke VCN subnet route table must have a route for 0.0.0.0/0 pointing to the DRG attachment, and the DRG route table routes that traffic to the hub security appliance VNIC.

Practice this question →
33
MCQeasy

You are designing an OCI VCN and need to allow resources in a private subnet to access Oracle Cloud Infrastructure Object Storage in the same region without traversing the public internet. Which gateway should you create and configure?

A.Dynamic Routing Gateway
B.Internet Gateway
C.NAT Gateway
D.Service Gateway
AnswerD

A Service Gateway lets your VCN privately access Oracle services such as Object Storage without exposing data to the public internet.

Why this answer

A Service Gateway provides access to Oracle Services Network (such as Object Storage) from a private subnet without requiring an Internet Gateway or NAT Gateway.

Practice this question →
34
MCQmedium

You are configuring an OCI Load Balancer and want to redirect all incoming HTTP traffic on port 80 to HTTPS on port 443. How should you achieve this?

A.Change the security list egress rules.
B.Configure a Listener Rule Set with an HTTP-to-HTTPS redirect rule.
C.Use a Service Gateway to forward port 80 to 443.
D.Attach a NAT Gateway to port 80.
AnswerB

Rule sets enable URL and protocol redirection at the load balancer listener.

Why this answer

OCI Load Balancers support rule sets, including HTTP redirect rules, allowing you to create a rule that redirects incoming HTTP traffic to HTTPS.

Practice this question →
35
MCQhard

An enterprise has multiple VCNs peered to a central hub VCN using a DRG. A security auditor notes that Vcn-A can communicate with Vcn-C because transit routing is enabled on the DRG. The security policy dictates that Vcn-A must never communicate with Vcn-C. How can you block this specific inter-VCN traffic while keeping other routes intact?

A.Attach a NAT Gateway to the hub VCN.
B.Modify the DRG route tables and import/export route distributions to prevent Vcn-A and Vcn-C from exchanging routes.
C.Delete the Internet Gateway from Vcn-A.
D.Change the subnet CIDR of Vcn-C so it no longer overlaps.
AnswerB

Custom DRG route tables and route distribution statements control which routes are advertised between attachments.

Why this answer

In DRG version 2, you can create custom DRG route tables and fine-tune import/export route distributions to prevent specific attachments from learning each other's routes, thereby blocking unwanted transit paths.

Practice this question →
36
Multi-Selectmedium

Which TWO statements are true regarding OCI VCN subnets?

Select 2 answers
A.Subnets can span across multiple different VCNs.
B.Subnets can be designated as either public or private upon creation.
C.Every subnet must have an Internet Gateway attached directly to it.
D.Subnets can be regional, spanning all Availability Domains in a region.
E.A subnet's CIDR block can be modified after it is created.
AnswersB, D

You choose whether a subnet is public or private when you create it.

Why this answer

Subnets can be regional or availability domain-specific (though regional subnets are recommended), and they can be designated as either public or private during creation.

Practice this question →
37
MCQmedium

Your organization has two Virtual Cloud Networks (VCN-A and VCN-B) in the same OCI region with overlapping CIDR blocks (10.0.0.0/16). You need to establish private communication between instances in VCN-A and VCN-B. Which networking feature should you implement?

A.Remote Peering Connection (RPC)
B.Local Peering Gateway (LPG)
C.Dynamic Routing Gateway (DRG) with overlapping CIDR encapsulation or IPsec VPN over DRG loopback
D.Internet Gateway with IP masquerading rules
AnswerC

When VCNs have overlapping CIDR blocks, you can route traffic by establishing an IPsec VPN tunnel between the VCNs via a DRG, allowing NAT translation or encapsulated routing.

Why this answer

When VCNs have overlapping CIDRs, standard Local Peering or standard DRG VCN attachments will fail due to route conflicts. You must use a DRG with VCN-to-VCN routing features combined with Network Address Translation (NAT) inside the DRG or utilize IP tunneling constructs, but standard direct local peering is impossible.

Practice this question →
38
MCQhard

An OCI administrator creates a subnet route table with a route rule pointing 0.0.0.0/0 to an Internet Gateway. However, compute instances in this subnet cannot reach the internet. Upon checking the instance details, you notice the instances have private IP addresses only and no public IP assigned. What is missing?

A.The compute instances need a public IP address (ephemeral or reserved) assigned to their VNICs.
B.The VCN CIDR block must be changed to /8.
C.A Service Gateway must be attached to the VCN.
D.A NAT Gateway must be attached to the public subnet.
AnswerA

Even with an Internet Gateway route, instances need a public IP address to communicate over the internet.

Why this answer

Instances in a public subnet require a public IP address (ephemeral or reserved) in addition to the subnet's route to the Internet Gateway in order to communicate bi-directionally with the public internet.

Practice this question →
39
MCQeasy

You are configuring an OCI Public Load Balancer to distribute incoming HTTP traffic to backend compute instances. Which backend set configuration is required to verify the health of the instances?

A.Health check policy defining protocol, port, and optional URL path
B.A NAT Gateway attached to the backend server subnet
C.A security list allowing all incoming traffic from the internet
D.An active Service Gateway
AnswerA

A health check policy ensures the load balancer stops routing traffic to unhealthy backend instances.

Why this answer

Load balancer health checks regularly probe backend servers using specific protocols, ports, and paths to verify that instances are available and healthy.

Practice this question →
40
MCQhard

Your organization uses OCI DNS Zones for managing domain names. You need to configure a private DNS zone for your internal applications within a specific VCN so that instances can resolve hostnames internally without exposing records externally. Which feature should you configure?

A.Dynamic Routing Gateway DNS proxy
B.Internet Gateway DNS forwarding rules
C.Private DNS Zone with attached VCN resolver views
D.Public DNS Zone with restricted Access Control Lists
AnswerC

A Private DNS Zone bound to your VCN enables internal hostname resolution for your instances.

Why this answer

OCI Private DNS allows you to create private domains associated with one or more VCNs for internal name resolution.

Practice this question →
41
MCQeasy

What is the primary function of an OCI Internet Gateway?

A.To provide private access to regional Oracle Object Storage.
B.To provide bi-directional communication between a VCN and the public internet for public subnets.
C.To connect on-premises datacenters to OCI over dedicated circuits.
D.To route traffic between two VCNs in the same region.
AnswerB

Internet Gateways enable public subnet resources to send and receive traffic from the internet.

Why this answer

An Internet Gateway provides a path for bi-directional communication between your VCN and the public internet.

Practice this question →
42
MCQmedium

You are configuring a Site-to-Site VPN connection and need to test connectivity between an on-premises host and an OCI compute instance. The ping fails. You check the security lists and notice that ICMP traffic is blocked. Which rule type must you add to the security list to allow incoming ping requests?

A.A Service Gateway rule for ping requests
B.An Egress rule allowing TCP port 80
C.A NAT Gateway rule for ICMP translation
D.An Ingress rule allowing ICMP traffic (Type 8, Code 0 or All)
AnswerD

Ingress ICMP rules permit incoming ping packets to reach instances.

Why this answer

To allow ping (ICMP Type 8, Code 0 for Echo Request) into a subnet, you must add a stateful Ingress Security List rule specifying ICMP as the protocol.

Practice this question →
43
MCQeasy

What is the maximum number of Availability Domains (ADs) in a typical multi-AD OCI region?

A.1
B.3
C.5
D.2
AnswerB

Multi-AD OCI regions feature 3 distinct Availability Domains.

Why this answer

Standard multi-AD OCI regions contain exactly 3 Availability Domains.

Practice this question →
44
Multi-Selectmedium

Which TWO types of targets can be specified in an OCI VCN route table rule?

Select 2 answers
A.Block Volume
B.NAT Gateway
C.Identity and Access Management (IAM) Policy
D.Object Storage Bucket
E.Internet Gateway
AnswersB, E

NAT Gateways can be set as route targets for outbound private internet traffic.

Why this answer

Route table targets in OCI include Internet Gateways, NAT Gateways, Service Gateways, Dynamic Routing Gateways, Local Peering Gateways, and private IPs of VNICs (such as firewalls).

Practice this question →
45
Multi-Selecthard

Which THREE statements regarding OCI VCN Route Tables are correct?

Select 3 answers
A.Each subnet in a VCN must be associated with a route table.
B.Route tables perform firewall packet inspection like Network Security Groups.
C.A subnet can be associated with multiple route tables simultaneously.
D.A single route table can be associated with multiple subnets.
E.Route rules support specific CIDRs as well as the default destination 0.0.0.0/0.
AnswersA, D, E

Every subnet relies on an associated route table to determine packet forwarding.

Why this answer

Route tables contain rules that map destination CIDR blocks to target gateways. Each subnet must be associated with a route table, and route tables can be shared across multiple subnets.

Practice this question →
46
Multi-Selecthard

Which TWO of the following statements regarding OCI Network Security Groups (NSGs) are correct?

Select 2 answers
A.An NSG can contain VNICs from multiple different subnets within the same VCN.
B.Every subnet must have at least one NSG associated with it by default.
C.NSG rules can reference other NSGs as the source or destination.
D.NSGs can span across multiple different VCNs in the same region.
E.NSGs replace Security Lists entirely and Security Lists are deprecated.
AnswersA, C

NSGs span subnets within the same VCN, allowing granular grouping of VNICs.

Why this answer

NSGs apply only to a specified set of VNICs and are independent of VCN subnets. They support both stateful and stateless rules.

Practice this question →
47
Multi-Selectmedium

Which TWO protocols are supported for OCI Site-to-Site VPN IPSec tunnels?

Select 2 answers
A.BGP over SSL
B.IKEv1
C.HTTPS tunneling
D.SNMPv3
E.IKEv2
AnswersB, E

IKEv1 is supported for legacy or compatibility requirements in OCI VPNs.

Why this answer

OCI Site-to-Site VPN supports Internet Key Exchange (IKE) protocol versions IKEv1 and IKEv2 for establishing IPSec VPN tunnels.

Practice this question →
48
MCQeasy

What is the maximum number of Route Tables allowed per Virtual Cloud Network (VCN) in OCI?

A.Exactly 1
B.Exactly 2
C.Zero
D.Multiple (subject to service limits)
AnswerD

You can create multiple route tables in a VCN to apply different routing rules to different subnets.

Why this answer

While there is a generous service limit, multiple route tables can be created and associated with different subnets within a VCN.

Practice this question →
49
MCQmedium

You are configuring an OCI Public Load Balancer and notice that backend instances are marked as unhealthy. Upon inspecting the health check URL on the backend server via curl, it returns HTTP 200. What is the most likely reason the load balancer still reports them as unhealthy?

A.The VCN has an Internet Gateway attached.
B.The load balancer shape is set to 10 Gbps instead of 100 Mbps.
C.Security lists or NSGs on the backend instances are blocking traffic from the Load Balancer subnet on the listener/health check port.
D.The NAT Gateway is misconfigured.
AnswerC

Backend security rules must allow incoming health check probes from the load balancer.

Why this answer

If backend servers return HTTP 200 locally but are unhealthy in the load balancer, security list rules or NSGs on the backend subnet are likely blocking incoming health check probes from the load balancer subnet.

Practice this question →
50
MCQhard

An OCI administrator creates a subnet and associates a security list with it. An instance in this subnet cannot connect to an external API on HTTPS (port 443). The security list has an ingress rule for port 443, but no egress rules defined. Why is the connection failing?

A.Ingress rules apply to outbound connections.
B.The instance needs a public IP address to make outbound API calls.
C.Port 443 is blocked globally across all OCI regions.
D.The security list lacks an egress rule allowing outbound traffic to port 443 (or all ports), or the default egress rule was removed.
AnswerD

Outbound connections initiated by an instance require a matching egress rule in stateful security lists.

Why this answer

By default, OCI Security Lists are stateful, meaning return traffic for ingress is automatically allowed. However, outbound (egress) traffic initiated by the instance requires an explicit egress rule (or a default egress rule allowing all traffic out) if egress rules are modified or restricted.

Practice this question →
51
Multi-Selecthard

Which THREE statements regarding OCI IPv6 implementation in VCNs are correct?

Select 3 answers
A.Security lists and NSGs support rules for IPv6 traffic filtering.
B.Subnets within an IPv6-enabled VCN can be assigned /64 IPv6 prefixes.
C.IPv6 is mandatory for all new VCN creation in OCI.
D.IPv6 addresses in OCI require a NAT Gateway for outbound internet access.
E.You can assign an IPv6 GUA (Globally Unique Address) prefix of /56 to your VCN.
AnswersA, B, E

Security rules can be configured for IPv6 CIDRs just like IPv4.

Why this answer

OCI supports IPv6 addressing. You can assign IPv6 CIDR blocks (/56) to your VCN, assign IPv6 subnets (/64) to subnets, and configure security rules and route tables for IPv6 traffic.

Practice this question →
52
MCQmedium

You are configuring an OCI DNS Traffic Management steering policy with a Load Balancer steering strategy. What is the primary behavior of this policy type?

A.It routes all traffic to a single primary datacenter until manual failover occurs.
B.It routes users based strictly on their geographic location.
C.It distributes traffic across multiple endpoints according to assigned weights and health checks.
D.It routes traffic based on client ASN numbers.
AnswerC

Load Balancer steering policies distribute traffic across pools based on weights and liveness.

Why this answer

Load Balancer steering distributes traffic across a pool of endpoints based on specified weights and health status, similar to load balancing algorithms.

Practice this question →
53
MCQhard

An OCI customer has an architecture where VCN-A, VCN-B, and VCN-C are connected to a central DRG in a Hub-and-Spoke topology. VCN-A needs to communicate with VCN-B, but VCN-C must be completely isolated from VCN-A. How should the DRG route tables and attachments be configured?

A.Configure NAT Gateways on all spoke VCNs.
B.Attach an Internet Gateway to VCN-C to block internal DRG traffic.
C.Use custom DRG route tables for each attachment, ensuring VCN-A's route table does not import routes from VCN-C's attachment.
D.Delete all subnets in VCN-C.
AnswerC

Custom DRG route tables and import/export controls allow precise isolation between spoke VCNs.

Why this answer

To isolate VCN-C from VCN-A, you assign VCN-A and VCN-C attachments to separate DRG route tables. VCN-A's route table imports routes for VCN-B but does not import routes for VCN-C, and vice versa.

Practice this question →
54
MCQeasy

Your development team needs instances residing in a private subnet to download software patches and updates from the Oracle Cloud Infrastructure (OCI) Object Storage service without exposing those instances to the public internet. Which gateway should you configure?

A.Service Gateway
B.Internet Gateway
C.NAT Gateway
D.Local Peering Gateway
AnswerA

A Service Gateway allows private access to OCI services like Object Storage without public internet exposure.

Why this answer

A Service Gateway routes traffic from a VCN to supported Oracle services, such as Object Storage, within the Oracle network fabric without going over the public internet.

Practice this question →
55
MCQhard

An OCI customer has a VCN with CIDR 10.0.0.0/16 and wants to peer it with another VCN having CIDR 10.1.0.0/16. However, they also have an on-premises network connected via FastConnect using the CIDR 10.0.0.0/14. What routing challenge does this create?

A.The on-premises CIDR (10.0.0.0/14) subsumes the VCN CIDRs, creating overlapping prefix routing conflicts.
B.FastConnect does not support CIDRs larger than /16.
C.The Internet Gateway will drop all 10.x.x.x traffic.
D.Peered VCNs cannot use private IP addresses.
AnswerA

Supernetting on-premises CIDRs that overlap with peered VCN ranges causes routing ambiguity and packet drops.

Why this answer

The on-premises CIDR (10.0.0.0/14) encompasses both VCN CIDRs (10.0.0.0/16 and 10.1.0.0/16). This creates overlapping address spaces where the more specific VCN routes might conflict or cause unpredictable routing behavior between hybrid and cloud peers.

Practice this question →
56
Multi-Selecthard

Which THREE statements regarding OCI FastConnect redundancy and high availability are correct?

Select 2 answers
A.You can configure multiple BGP sessions across redundant virtual circuits.
B.Oracle recommends setting up redundant FastConnect virtual circuits for high availability.
C.FastConnect does not support BGP dynamic routing when redundancy is enabled.
D.FastConnect redundant circuits must share the exact same physical cross-connect port.
E.FastConnect automatically provides 100% SLA without requiring redundant circuits on customer end.
AnswersA, B

Dual BGP sessions ensure seamless failover if one path fails.

Why this answer

FastConnect supports redundant connections, redundant physical cross-connects or partner ports, and dual BGP sessions to ensure high availability.

Practice this question →
57
MCQmedium

You need to configure custom DNS resolution for instances within your OCI VCN so they can resolve hostnames of your on-premises datacenter servers. What should you configure in OCI?

A.A NAT Gateway configured with DNS proxy settings
B.A public DNS zone for your on-premises domain
C.An Internet Gateway with custom host file mappings
D.Custom DNS forwarders in the VCN Resolver pointing to on-premises DNS servers via the DRG
AnswerD

VCN Resolver forwarders allow VCN instances to resolve domain names using private on-premises DNS servers.

Why this answer

OCI DNS provides a Resolver where you can set up custom DNS forwarders to route DNS queries for specific on-premises domains to your corporate DNS servers via the DRG.

Practice this question →
58
MCQhard

An OCI customer has a primary database in Ashburn and a standby database in Phoenix. They need to replicate database traffic over a dedicated, highly secure private connection between the two regions. Which OCI networking architecture best achieves this requirement?

A.Attach DRGs to the VCNs in Ashburn and Phoenix and establish a Remote Peering Connection (RPC).
B.Route database traffic through regional Internet Gateways.
C.Use Local Peering Gateways (LPGs) between Ashburn and Phoenix.
D.Configure NAT Gateways with public IP tunneling across regions.
AnswerA

Cross-region private VCN peering via DRG RPC provides secure private transport for database replication.

Why this answer

Cross-region database replication requires secure private connectivity between VCNs in Ashburn and Phoenix, which is achieved by setting up OCI VCN Remote Peering using Dynamic Routing Gateways (DRGs) and a Remote Peering Connection (RPC).

Practice this question →
59
MCQeasy

What is the maximum number of Internet Gateways allowed per Virtual Cloud Network (VCN) in OCI?

A.1
B.2
C.Unlimited
D.5
AnswerA

Each VCN supports exactly one Internet Gateway.

Why this answer

An OCI VCN can have a maximum of one Internet Gateway attached to it at any given time.

Practice this question →
60
Multi-Selectmedium

Which TWO protocols are supported for health checks by OCI Load Balancer backend sets?

Select 2 answers
A.SMTP
B.TCP
C.HTTP
D.FTP
E.SSH
AnswersB, C

TCP health checks verify that backend servers accept TCP connections on the specified port.

Why this answer

OCI Load Balancers support HTTP, HTTPS, and TCP health checks to monitor the availability of backend servers.

Practice this question →
61
MCQeasy

You are designing a secure database architecture on OCI. Instances in a private subnet require outbound internet access to download operating system updates, but malicious actors must not be able to initiate inbound connections to these instances from the internet. Which component fulfills this requirement?

A.Local Peering Gateway
B.Internet Gateway
C.Dynamic Routing Gateway
D.NAT Gateway
AnswerD

A NAT Gateway provides outbound-only internet connectivity for private subnets.

Why this answer

A NAT (Network Address Translation) Gateway allows private subnet instances to initiate outbound connections to the internet while preventing any unsolicited inbound internet traffic.

Practice this question →
62
Multi-Selecthard

Which TWO statements regarding OCI VCN Local Peering are correct?

Select 2 answers
A.Local peering requires an Internet Gateway in both VCNs.
B.The peered VCNs must reside in the same OCI region.
C.The VCN CIDR blocks must not overlap.
D.Peered VCNs must belong to the exact same compartment.
E.Traffic between locally peered VCNs traverses the public internet.
AnswersB, C

Local peering is strictly for VCNs within the same OCI region.

Why this answer

Local peering connects two VCNs in the same region so their instances can communicate privately using private IP addresses. Both VCNs must have non-overlapping CIDRs and matching LPG/route configurations.

Practice this question →
63
MCQmedium

You are configuring a site-to-site VPN connection in OCI. During the tunnel setup, your on-premises firewall administrator asks for the pre-shared key (PSK). Where is the PSK defined or generated in OCI?

A.In the VCN Route Table settings
B.In the NAT Gateway security policies
C.On the Internet Gateway configuration page
D.During the IPSec connection tunnel creation in the OCI Console
AnswerD

Pre-shared keys are specified or generated when creating or editing IPSec tunnels.

Why this answer

When creating an IPSec tunnel in OCI, you can either provide your own pre-shared key or let OCI automatically generate one during the tunnel configuration.

Practice this question →
64
Multi-Selectmedium

When designing network security in OCI, you can use Security Lists and Network Security Groups (NSGs). Which TWO statements accurately compare or contrast them?

Select 2 answers
A.You cannot use Security Lists and Network Security Groups together for the same VNIC.
B.Security Lists apply to all VNICs in a given subnet, while NSGs apply to a specifically selected set of VNICs.
C.Network Security Groups allow you to reference other NSGs as sources or destinations in rules.
D.Security Lists can reference other Security Lists by OCID across different VCNs.
E.Network Security Groups can only contain stateless rules, whereas Security Lists only contain stateful rules.
AnswersB, C

Security Lists are subnet-level constructs, while NSGs are VNIC-level constructs.

Why this answer

Security Lists apply to all VNICs in a subnet, whereas NSGs are applied to a specific set of VNICs chosen by you. Both support stateful and stateless rules.

Practice this question →
65
MCQmedium

Your company requires a dedicated, highly reliable, encrypted connection from your on-premises datacenter to your OCI Virtual Cloud Network, bypassing the public internet entirely. The link must support speeds up to 10 Gbps and provide failover redundancy. Which OCI service meets this requirement?

A.Oracle Cloud Infrastructure Public Load Balancer with SSL termination
B.FastConnect with MACsec or layered IPsec VPN
C.Site-to-Site VPN over Public Internet
D.Remote Peering Connection (RPC)
AnswerB

FastConnect provides dedicated private connectivity, and data can be encrypted using MACsec or by layering an IPsec VPN over FastConnect.

Why this answer

FastConnect provides a dedicated, private connection between your datacenter and OCI. For encryption across FastConnect, you can layer an IPsec VPN over the FastConnect circuit.

Practice this question →
66
MCQmedium

You are designing a secure web application architecture in OCI. You want to terminate TLS connections at the load balancer and inspect HTTP headers before routing traffic to backend web servers. Which OCI Load Balancer listener type should you configure?

A.ICMP listener
B.TCP listener
C.HTTP/HTTPS listener
D.UDP listener
AnswerC

HTTP/HTTPS listeners operate at layer 7, allowing SSL termination and HTTP header inspection.

Why this answer

To inspect HTTP headers and perform layer 7 load balancing (such as path-based routing or SSL termination with HTTP inspection), you must configure an HTTP/HTTPS listener.

Practice this question →
67
MCQmedium

Two VCNs (VCN-A and Vcn-B) reside in the same OCI region but in different compartments. You need to establish a low-latency, high-bandwidth connection between them using local VCN peering. Which component is NOT required for this setup?

A.Local Peering Gateway (LPG) in VCN-A
B.Internet Gateway attached to VCN-A
C.Route table rules pointing to the LPG
D.Local Peering Gateway (LPG) in VCN-B
AnswerB

An Internet Gateway is used for internet traffic, not for local VCN peering.

Why this answer

Local VCN peering requires a Local Peering Gateway (LPG) in each VCN, matching route table rules in both VCNs, and security rules permitting traffic. An Internet Gateway is not required because local peering traffic stays entirely within the Oracle backbone network.

Practice this question →
68
MCQeasy

What is the primary purpose of an OCI Local Peering Gateway (LPG)?

A.To route traffic to regional Oracle services.
B.To enable private communication between two VCNs in the same OCI region.
C.To connect an on-premises datacenter to a VCN.
D.To provide outbound internet access for private subnets.
AnswerB

LPGs provide same-region VCN peering.

Why this answer

An LPG enables you to peer one VCN with another VCN in the same OCI region so that their instances can communicate privately.

Practice this question →
69
Multi-Selectmedium

Which TWO methods can be used to assign public IP addresses to OCI compute instances?

Select 2 answers
A.Dynamic public IP lease via DHCP
B.Static NAT Gateway public IP
C.Reserved public IP
D.Service Gateway public IP allocation
E.Ephemeral public IP
AnswersC, E

Reserved public IPs are persistent and can be reassigned to different instances or VNICs.

Why this answer

OCI supports Ephemeral public IPs (which exist for the lifetime of the instance) and Reserved public IPs (persistent public IPs that can be reassigned).

Practice this question →
70
Multi-Selecthard

An architect is configuring an OCI Public Load Balancer to handle high volumes of incoming client traffic. Which THREE features or capabilities are supported by OCI Public Load Balancers?

Select 3 answers
A.Multiple backend sets associated with a single listener via rule sets
B.Native BGP routing directly from the Load Balancer IP to on-premises routers
C.Path-based routing rules to direct requests to different backend sets based on URL paths
D.SSL/TLS termination and certificate management
E.Automatic translation of IPv6 client traffic into native IPv4 backend compute instances without dual-stack configuration
AnswersA, C, D

Listeners can use rule sets to route traffic to different backend sets based on conditions.

Why this answer

OCI Public Load Balancers support SSL/TLS termination, path-based routing (flexibility based on URL paths), and multiple backend sets.

Practice this question →
71
Multi-Selecthard

Which THREE statements are correct regarding OCI BYOIP (Bring Your Own IP)?

Select 2 answers
A.You can create public IP pools from your imported BYOIP address ranges.
B.You can import your own public IPv4 prefix blocks into OCI.
C.BYOIP prefixes can be assigned directly to private subnet VNICs without public IPs.
D.BYOIP is only supported for private IP addresses within an on-premises datacenter.
E.OCI automatically transfers ownership of the IP block to Oracle permanently.
AnswersA, B

Imported prefixes are used to create regional public IP pools.

Why this answer

OCI BYOIP allows you to bring your own public IPv4 addresses to OCI, prefix lengths from /24 to /28 are typically supported for import, and you can create public IP pools from your prefix.

Practice this question →
72
MCQmedium

You are setting up OCI DNS for a private domain `internal.corp`. You want instances within your VCN to query records in this private zone. What needs to be created and associated with the VCN?

A.A Public DNS Zone with an Internet Gateway
B.A Service Gateway pointing to the DNS service
C.A NAT Gateway with DNS forwarding rules
D.A Private DNS Zone associated with the VCN via a VCN view
AnswerD

Private DNS zones attached to VCNs via views enable internal DNS resolution.

Why this answer

To resolve records in a private domain within a VCN, you must create a Private DNS Zone and associate it with your VCN using a VCN view.

Practice this question →
73
Multi-Selectmedium

Which TWO types of traffic can be routed through an OCI Service Gateway?

Select 2 answers
A.General web browsing traffic to external websites like google.com
B.Traffic destined for an on-premises datacenter via FastConnect
C.Peer traffic to another VCN in a different region
D.Traffic to OCI Object Storage in the same region
E.Traffic to Oracle Autonomous Database in the same region
AnswersD, E

Object Storage is part of the Oracle Services Network and can be accessed via Service Gateway.

Why this answer

A Service Gateway routes traffic destined for the Oracle Services Network, which includes regional services like Object Storage and Autonomous Database, as well as public Oracle services.

Practice this question →
74
MCQmedium

You are configuring a Public Load Balancer in OCI. You want to ensure that incoming traffic is encrypted using TLS 1.3. Where do you configure the SSL certificate and TLS protocol version?

A.In the VCN route table settings
B.On the NAT Gateway configuration page
C.In the backend set health check policy
D.On the Load Balancer Listener configuration
AnswerD

Listeners handle SSL certificate binding and cipher/TLS protocol selections.

Why this answer

SSL certificates and TLS protocol preferences are configured on the Load Balancer Listener settings.

Practice this question →
75
MCQmedium

You are designing an application that requires high availability across two Availability Domains (ADs). You want your OCI Public Load Balancer to span both ADs. Which configuration should you use?

A.Attach a NAT Gateway to both Availability Domains.
B.Configure an LPG between the two AD subnets.
C.Select subnets in two different Availability Domains during load balancer creation.
D.Deploy two separate load balancers and use an Internet Gateway to load balance between them.
AnswerC

Configuring primary and secondary subnets across ADs ensures high availability.

Why this answer

When provisioning an OCI Public Load Balancer, you select a primary subnet in one AD and a secondary subnet in another AD to ensure high availability across ADs.

Practice this question →
Page 1 of 2 · 120 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Networking questions.

Start 20-question session