CCNA Networking Questions

Backend security lists must explicitly permit traffic from the load balancer's subnet CIDR on the application port, since OCI security lists are stateful and evaluate traffic against the source address. Adding this ingress rule satisfies the constraint that the backend subnet currently blocks the load balancer's health checks and forwarded client connections, resolving the timeout.

An Oracle Cloud Infrastructure Virtual Cloud Network (VCN) acts as a software-defined abstraction layer that directly addresses the requirement for isolated resource deployment by establishing a dedicated, private network perimeter within the public cloud. By allowing administrators to define custom CIDR blocks, configure route tables, and manage security lists, a VCN satisfies the fundamental architectural constraint for tenant-level network isolation. This enables workloads to communicate securely while remaining logically segregated from other tenants and external networks.

Failover steering continuously health-checks the primary Ashburn endpoint; when probes fail, the policy marks it unhealthy and answers DNS queries with the Phoenix secondary's address instead. This satisfies the stem's requirement that traffic redirect automatically on primary failure, with no manual intervention or TTL-based client retry logic involved.

DRG route tables control route import and attachment association independently, so placing VCN-1 and VCN-2 attachments in separate tables lets only VCN-1's table import the on-premises attachment's routes. VCN-2's table then lacks that route, blocking its on-premises communication.

Failover steering is natively supported by Oracle Cloud Infrastructure DNS Traffic Management Steering Policies, satisfying the core architectural requirement for high availability and disaster recovery defined in the question stem. This feature continuously monitors the health of designated primary and secondary endpoints through configurable health checks. When a primary endpoint failure is detected, the traffic management policy automatically reroutes incoming DNS queries to the secondary failover resource without requiring manual intervention, thereby ensuring seamless service continuity and minimising downtime for critical cloud workloads.

Network Security Groups achieve this by explicitly associating with individual VNICs through dedicated VNIC-to-NSG membership assignments, allowing administrators to group targets regardless of their subnet placement. Conversely, Security Lists function strictly at the subnet level, automatically applying their ingress and egress rules to every VNIC residing within that specific subnet. This satisfies the architectural constraint regarding targeting flexibility, enabling granular control over specific instances without necessitating subnet redesigns or additional subnets.

Utilising a Local Peering Gateway (or Dynamic Routing Gateway) combined with specific route table entries enables seamless east-west traffic towards the peered Virtual Cloud Network (VCN) via its CIDR block, successfully satisfying the communication requirement. Simultaneously, omitting both an Internet Gateway and a NAT Gateway enforces the negative constraint of the scenario, preventing any outbound north-south traffic from the private subnet to the internet.

A Private Virtual Circuit leverages private IP addresses to establish a secure, dedicated connection between your on-premises data centre and your Oracle Cloud Infrastructure Virtual Cloud Network (VCN). This mechanism directly satisfies the requirement for internal routing by bypassing the public internet entirely, allowing your workloads to communicate using private IPv4 or IPv6 address spaces without requiring public IP allocation or network address translation.

The VCN's implicit local route, covering 10.0.0.0/16 with target 'local', lets worker nodes in different private subnets exchange pod and service traffic. Without it, cross-subnet communication within the VCN fails, breaking standard OKE cluster networking.

DRG route tables with import and export distribution maps let you control route propagation between attachments, enabling Spoke1 traffic to transit the Hub VCN before reaching Spoke2. This satisfies the service inspection requirement, which plain VCN attachments cannot achieve.

Oracle Cloud Infrastructure Virtual Cloud Networks operate on standard IP routing principles and fundamentally do not support Internet Protocol multicast traffic. Because the legacy application relies on multicast for backend state synchronisation—satisfying the specific constraint in the stem—this network-layer limitation means the architecture cannot be lifted and shifted directly. Consequently, developers must re-architect the application communication model to utilise unicast or publish-subscribe messaging patterns before migrating workloads into OCI.

Virtual Network Interface Cards in Oracle Cloud Infrastructure operate on a fundamental architectural constraint requiring every active VNIC to possess a primary private IPv4 address at creation. This mandatory allocation binds the virtual interface directly to a subnet within a Virtual Cloud Network, enabling essential internal routing and communication across the cloud topology. Therefore, stating that every VNIC is assigned at least one primary private IP address directly satisfies the core requirement specified in the stem regarding foundational IP and VNIC mechanics.

Security Lists function as virtual firewalls at the subnet level, enforcing ingress and egress rules that filter packets based on source IP, destination port, and protocol. By applying these stateful rules to the subnet associated with your compute instances, you directly satisfy the requirement to restrict incoming traffic. This mechanism provides granular control over network traffic flow, ensuring that only authorised connections reach the specific instances while blocking all other unauthorised attempts at the network boundary.

An Oracle Cloud Infrastructure Network Address Translation (NAT) Gateway satisfies the constraint of allowing private subnet instances to initiate outbound connections to the internet while blocking unsolicited inbound connections. It achieves this by performing source network address translation on traffic originating from resources lacking public IP addresses, rewriting their private IP addresses to the gateway's public IP address for egress routing. Crucially, stateful firewall tracking ensures that only return traffic associated with established outbound sessions is permitted back through, effectively shielding internal workloads from external threats.

NSGs apply security rules to a set of VNICs you choose, independent of subnet CIDR, so database instances accept traffic only from the named application instances wherever they reside. Security lists cannot express this, as they act at subnet level.

OCI VCN Flow Logs directly satisfy the requirement to monitor dropped packets caused by security list violations because you can specifically configure them to capture rejected traffic. By capturing metadata about IP traffic traversing your VCN subnets and filtering for `REJECT` action states, this feature provides the precise visibility needed to audit security posture and troubleshoot blocked connections across all subnets without capturing the actual payload data.

Oracle Cloud Infrastructure NAT Gateway architecture is specifically designed to allow private subnet instances to initiate outbound connections to the public internet for software updates and patches. This satisfies the fundamental routing constraint that private instances require internet access without exposing their private IP addresses to inbound unsolicited traffic from external sources. The gateway performs Source Network Address Translation by mapping private source IP addresses to the public IP address of the NAT Gateway itself, enabling seamless egress while strictly maintaining ingress security.

Virtual Cloud Networks (VCNs) attach directly to an OCI Dynamic Routing Gateway (DRG version 2) via VCN attachments, satisfying the core architectural requirement for routing traffic between your cloud networks and on-premises environments or other VCNs. This attachment mechanism utilises DRG route tables to forward packets dynamically across the transit routing framework, enabling seamless network connectivity without relying on legacy local peering gateways.

An Internet Gateway provides the bidirectional path for traffic between the VCN and the public internet, satisfying the requirement for direct inbound public access. Without it, instances in the VCN cannot receive connections from external clients, regardless of subnet route tables or security rules.

Traffic is allowed if permitted by either a Security List or an associated Network Security Group.

Establishing an OCI Site-to-Site VPN utilising dynamic routing via the Border Gateway Protocol specifically requires a Dynamic Routing Gateway configured with a BGP Autonomous System Number. This satisfies the dynamic routing constraint in the stem, as the DRG acts as the virtual router endpoint on the Oracle side, terminating the IPSec tunnels while running BGP sessions to dynamically exchange route advertisements and maintain path redundancy between your on-premises data centre and the virtual cloud network.

Local VCN peering in Oracle Cloud Infrastructure requires non-overlapping CIDR blocks to ensure proper routing of network traffic. In this scenario, the first VCN uses the CIDR block 192.168.0.0/16, which fully encompasses the second VCN's CIDR block of 192.168.64.0/18. Because the IP address ranges overlap, the OCI networking control plane cannot establish unambiguous routing paths between the virtual cloud networks, thereby causing the peering attempt to fail.

FastConnect virtual circuits attach to a DRG, providing private dedicated connectivity between on-premises networks and the VCN. The DRG also accepts IPSec VPN connections and remote peering connections to other regions, forming the three supported attachment types.

The `DroppedConnections` metric spikes when the OCI Public Load Balancer hits its provisioned bandwidth or maximum connection rate limits, or when backend application servers cannot process incoming requests fast enough. When demand exceeds these operational thresholds, the load balancer actively drops new connections to maintain stability, directly accounting for the intermittent connection failures reported by users.

Successful IPsec VPN tunnel establishment over a Dynamic Routing Gateway requires matching pre-shared keys and precise cryptographic parameters, including Internet Key Exchange (IKE) version, encryption algorithms, and integrity algorithms on both the Oracle Cloud Infrastructure side and the customer-premises equipment. Without these cryptographic parameters aligning exactly, Phase 1 and Phase 2 security associations cannot be negotiated, directly satisfying the secure hybrid connectivity constraint specified in the stem.

Pointing the spoke's default route at the DRG sends all internet-bound traffic into the hub. The DRG route table then forwards it to the hub VCN attachment, where the security appliances inspect it before it reaches the internet gateway.

A service gateway provides private access to Oracle services such as Object Storage without leaving the OCI network, satisfying the no-public-internet constraint. It is regional, so resources in the private subnet reach Object Storage in the same region over the Oracle backbone, with route table and security rules permitting the traffic.

Listener rule sets apply actions at the listener level. An HTTP-to-HTTPS redirect rule returns a 301 response directing clients from port 80 to port 443, achieving the redirect without a separate backend or additional listener configuration.

DRG route tables control which routes each attachment imports and exports. By restricting import/export distribution between the Vcn-A and Vcn-C attachments, their prefixes are never exchanged, so no route exists between them while other attachments keep their routes.

Oracle Cloud Infrastructure Virtual Cloud Networks require every subnet to be explicitly designated as either public or private during its creation, directly satisfying the requirement to identify the specific architectural states available for subnets. Public subnets are associated with an Internet Gateway to allow inbound and outbound internet traffic, whereas private subnets prohibit direct internet access. This binary classification is immutable regarding its scope type post-creation, enforcing strict network security boundaries from the outset of resource provisioning.

A route to an Internet Gateway only enables egress for instances that already hold a public IP on their VNIC. With private IPs alone, traffic cannot be NAT-translated, so assigning an ephemeral or reserved public IP satisfies the internet-reachability constraint.

The load balancer needs a health check policy on the backend set to probe each instance; it defines the protocol, port and optional URL path used to determine whether a backend is healthy and eligible to receive traffic.

An Oracle Cloud Infrastructure Internet Gateway directly satisfies the requirement for bi-directional communication by acting as a scalable router between a Virtual Cloud Network and the public internet. It enables instances within public subnets to initiate outbound connections while simultaneously allowing inbound traffic originating from the internet to reach those instances, provided the associated route tables and security lists are configured correctly. Without this specific component, resources assigned to public subnets would remain entirely isolated from external public networks despite having public IP addresses.

Allowing incoming ping requests requires an Ingress rule because security lists are stateful firewalls operating at the subnet level in Oracle Cloud Infrastructure. The stem states that ICMP traffic is blocked and ping fails, which directly addresses the ingress direction constraint for incoming Internet Control Message Protocol packets originating from the on-premises host. Specifically permitting ICMP Type 8 (Echo Request) and Code 0 (or all types/codes) enables the destination OCI compute instance to receive and respond to the diagnostic probes across the established Site-to-Site VPN tunnel.

Oracle Cloud Infrastructure regions featuring multiple fault-isolated zones are engineered with a strict architecture comprising exactly three Availability Domains. This specific numerical constraint directly satisfies the multi-AD region design requirement specified in the stem, ensuring balanced infrastructure distribution, high availability, and independent power and cooling across distinct hardware groupings.

A NAT Gateway serves as a valid routing target within an Oracle Cloud Infrastructure Virtual Cloud Network route table rule, satisfying the requirement to direct outbound-only internet traffic for resources residing in private subnets. When instances without public IP addresses initiate connections to the wider internet, the route table matches the destination CIDR block (typically 0.0.0.0/0) and forwards the traffic to the Network Address Translation gateway, which translates private IP addresses to a public IP address for external communication while blocking unsolicited inbound connections.

Every subnet within an Oracle Cloud Infrastructure Virtual Cloud Network must be explicitly associated with a single route table to determine how traffic is directed away from that subnet. This strict association requirement satisfies the mandatory architectural rule that no subnet can exist in a routing vacuum; if a subnet is not explicitly linked to a custom route table during or after creation, it automatically falls back to the VCN's default route table, ensuring continuous network reachability.

Network Security Groups decouple security rule enforcement from subnet topology by grouping virtual network interface cards (VNICs) across multiple subnets within the same Virtual Cloud Network. Unlike security lists, which apply strictly at the subnet level, an NSG evaluates traffic for any designated VNIC regardless of its specific subnet assignment. This architectural flexibility satisfies the core requirement that a single security policy can span diverse subnets inside a shared VCN boundary, allowing administrators to efficiently manage fine-grained access control for tiered application components without needing redundant rule configurations.

Internet Key Exchange version 1 (IKEv1) is natively supported by Oracle Cloud Infrastructure Site-to-Site VPN, fulfilling the stem's requirement for standard IPSec tunnel establishment protocols. This protocol operates in aggressive or main mode to establish a secure Security Association (SA) and negotiate cryptographic parameters between the customer premise equipment and the Oracle dynamic routing gateway. By supporting IKEv1 alongside version 2, Oracle ensures broad compatibility with legacy on-premises firewalls and routers that lack IKEv2 capabilities, thereby satisfying the dual-protocol support constraint mandated for establishing reliable hybrid cloud connectivity.

OCI permits multiple route tables per VCN, bounded only by service limits rather than a fixed cap. Each subnet associates with one route table, so multiple tables let you apply distinct routing rules to different subnets within the same VCN, satisfying the scenario's requirement for flexible per-subnet routing.

Security lists and Network Security Groups (NSGs) act as virtual firewalls at the subnet and VNIC levels. Even though the backend application is fully operational and returns an HTTP 200 via a direct local curl command, misconfigured ingress rules on the backend instances will drop incoming health check probes originating from the load balancer subnet. Because the traffic cannot reach the application, the health check fails, directly explaining why the load balancer marks the instances as unhealthy despite their internal availability.

Security lists are stateful, but egress rules are still required for outbound traffic. With no egress rule permitting port 443 or all ports, the instance's outbound HTTPS connection is dropped before reaching the external API, regardless of the ingress rule.

Security lists and network security groups (NSGs) natively support IPv6 CIDR blocks, allowing administrators to define granular ingress and egress filtering rules for dual-stack VCNs. By specifying IPv6 addresses within these stateful or stateless rule sets, you satisfy the requirement for comprehensive traffic control across the OCI network fabric. This capability ensures that IPv6 traffic is subject to the same rigorous security posture as traditional IPv4 traffic, maintaining consistent policy enforcement across all virtualised cloud resources.

Configuring an OCI DNS Traffic Management steering policy with a Load Balancer strategy directly satisfies the requirement to distribute incoming traffic proportionally across multiple endpoints based on user-defined weights, while simultaneously integrating health checks to route requests exclusively to healthy targets. This specific mechanism ensures fault tolerance and optimal resource utilisation by dynamically shifting traffic away from degraded endpoints while maintaining the configured weight-based distribution ratio for operational resources.

Configuring custom Dynamic Routing Gateway (DRG) route tables for each attachment enables precise control over traffic flow in a hub-and-spoke architecture. By tailoring the import and export routes for VCN-A, VCN-B, and VCN-C independently, you can ensure that VCN-A's route table does not import routes associated with VCN-C's attachment. This mechanism directly satisfies the strict isolation requirement stated in the stem, preventing any unwanted network communication between VCN-A and VCN-C while still permitting authorised connectivity.

A service gateway provides private access to Oracle services such as Object Storage over the OCI network, so private-subnet instances reach it without internet exposure. It satisfies the no-public-internet constraint, unlike NAT gateway, which routes traffic to the public internet.

The on-premises /14 covers 10.0.0.0 through 10.3.255.255, which includes both VCN ranges. Because the DRG and FastConnect advertise this broader prefix, OCI cannot distinguish on-premises destinations from peered VCN destinations, so longest-prefix matching fails and traffic is misrouted or dropped.

Configuring custom DNS forwarders in the VCN Resolver, pointing to the on-premises DNS servers reachable through the DRG, lets instances resolve on-premises hostnames. The VCN Resolver forwards queries it cannot answer internally to those specified servers.

Establishing a Remote Peering Connection (RPC) between Dynamic Routing Gateways (DRGs) attached to the Virtual Cloud Networks (VCNs) in Ashburn and Phoenix enables secure, private inter-region traffic replication without traversing the public internet. This architecture directly satisfies the requirement for a dedicated and highly secure private connection across different Oracle Cloud Infrastructure regions, ensuring that database traffic between the primary and standby instances remains isolated and encrypted within OCI's backbone network.

A VCN supports exactly one Internet Gateway, which provides bidirectional internet access for resources in public subnets via the route table. This hard limit means the gateway is attached once per VCN, satisfying the question's constraint on maximum count.

Oracle Cloud Infrastructure Load Balancer backend sets natively support Transmission Control Protocol (TCP) health checks, directly satisfying the protocol requirement specified in the stem for non-HTTP backend monitoring. When configured, the load balancer attempts a three-way TCP handshake with the designated backend server port at regular intervals. If the target server responds with a SYN-ACK packet, the health check passes, confirming the node is reachable and capable of servicing incoming connections, thereby fulfilling the transport-layer validation criteria.

A NAT Gateway facilitates outbound internet connectivity for instances within a private subnet while strictly preventing unsolicited inbound traffic from the public internet. By performing source network address translation, it allows instances to initiate requests to external update repositories while ensuring they remain unreachable to external malicious actors. This architecture satisfies the constraint of enabling necessary OS updates without exposing the private infrastructure to inbound connection attempts, maintaining a secure perimeter for your OCI database environment.

Local peering gateways facilitate communication between virtual cloud networks exclusively within the same OCI region, satisfying the fundamental geographic constraint defined in the question stem. Because these gateways operate at the regional level, they cannot bridge networks across different geographic areas, which would instead require a remote peering connection. This architectural limitation ensures that traffic remains contained within the regional boundary, providing a secure and performant method for internal routing between peered subnets without needing to integrate external identity providers like Microsoft Entra ID.

The pre-shared key is entered when creating the IPSec connection and its tunnels in the OCI Console, then shared with the on-premises firewall administrator. It is not generated by CPE objects or DRG attachments, which hold no tunnel secrets.

Security Lists operate at the subnet level, meaning their rules automatically apply to all Virtual Network Interface Cards (VNICs) residing within that specific subnet. In contrast, Network Security Groups utilise regional VNIC-only security groupings, allowing you to handpick a specifically selected set of VNICs regardless of their subnet placement. This fundamental architectural difference satisfies the constraint comparing the scope of application between subnet-wide security lists and targeted network security groups in Oracle Cloud Infrastructure.

Terminating TLS connections at the OCI Load Balancer requires an HTTP/HTTPS listener because it is the only listener type that decrypts incoming encrypted traffic, allowing the load balancer to parse application-layer data, inspect HTTP headers for security or routing decisions, and subsequently forward the unencrypted requests to the backend web servers.

Local VCN peering operates entirely within the Oracle Cloud Infrastructure software-defined networking fabric, routing traffic privately between virtual cloud networks without traversing the public internet. Because the communication stays strictly internal to the regional fabric to satisfy the high-bandwidth and low-latency requirements, an Internet Gateway is entirely superfluous. Internet Gateways are designed exclusively for bidirectional communication between a VCN and the public internet, meaning attaching one to VCN-A is neither necessary nor relevant for establishing a private, intra-region peering relationship with Vcn-B.

DRG route tables control which routes are imported from each attachment and which are advertised to it. If the DRG route table for spoke VCN B's attachment lacks an import rule or route distribution that includes the on-premises CIDRs learned from the FastConnect virtual circuit, the DRG will not forward spoke B traffic to on-premises. Spoke A works because its attachment's DRG route table imports those routes.

An OCI Local Peering Gateway (LPG) directly satisfies the requirement for private communication between two Virtual Cloud Networks (VCNs) residing in the same OCI region. By establishing this targeted peering relationship, cloud resources across both VCNs can route traffic securely and privately over internal Oracle infrastructure without traversing the public internet, all while strictly adhering to the regional boundary constraint specified in the stem.

Reserving a public IP address involves allocating a persistent IPv4 address from Oracle's public IP pool and mapping it independently to a VNIC's private IP. This directly satisfies the requirement to assign a public IP address to an OCI compute instance while ensuring that the public identifier remains static and retained across instance lifecycle events, such as termination and relaunch, making it fully independent of the underlying VM state.

Rule sets attach to a listener and let it select among multiple backend sets based on conditions such as path or host header, enabling content-based routing on one listener. This satisfies the high-volume requirement by distributing requests across several backend pools without provisioning extra listeners.

A private DNS zone becomes resolvable inside a VCN only when attached through a VCN view, which binds the zone to the VCN's resolver. Creating the zone alone leaves instances unable to query internal.corp records.

The Service Gateway provides private access to Oracle services without traversing the internet, and Object Storage in the same region is a supported service. Traffic stays on the Oracle network, satisfying the requirement for regional OCI service access.

TLS termination happens at the listener, where you attach the SSL certificate bundle and select the minimum TLS protocol version. Configuring TLS 1.3 there encrypts incoming client traffic before it reaches backend servers, satisfying the requirement without touching backend sets or health checks.

A public load balancer's regional high availability comes from placing its primary subnet in one Availability Domain and a second subnet in another. Selecting subnets in two ADs gives the load balancer nodes in each, satisfying the cross-AD availability requirement.

Network Path Analyzer traces the route between a source and destination, evaluating security lists, network security groups and route tables hop by hop. It identifies which rule blocks TCP port 1521, satisfying the reachability test requirement.

*BackendSetHealthyInstanceCount* directly satisfies the requirement to monitor the operational status of backend servers associated with Oracle Cloud Infrastructure Public Load Balancers. This metric tracks the exact quantity of healthy backend servers currently registered within a specific backend set, enabling administrators to configure alarms and effectively gauge application availability. Because the OCI Monitoring service ingests this metric natively from the load balancer service, it serves as a primary indicator for traffic routing health and autoscaling triggers.

Oracle Cloud Infrastructure enforces a default service limit of 50 Virtual Cloud Networks (VCNs) per region within a single tenancy to help manage resource allocation and prevent unintended architectural sprawl. This specific boundary directly satisfies the regional tenancy constraint queried in the stem. While administrators can request a service limit increase through the Oracle Cloud console if larger topologies are required, 50 remains the baseline ceiling established out-of-the-box for standard deployments.

Oracle Cloud Infrastructure DNS is the designated managed service that directly satisfies the requirement for authoritative Domain Name System management by supporting the creation and hosting of both public-facing and internal, private DNS zones. It enables organisations to configure and propagate custom domain records securely across virtual cloud networks and external internet endpoints without deploying custom BIND servers.

An IPSec tunnel stays DOWN when IKE Phase 1 or Phase 2 parameters differ between peers, or when UDP ports 500 and 4500 are blocked. Correct CPE addressing and internet connectivity do not help if negotiation cannot complete or the encrypted packets are filtered.

A Dynamic Routing Gateway (DRG) acts as a virtual router that establishes private pathways to satisfy the requirement for secure, non-public connectivity between a Virtual Cloud Network (VCN) and external environments. By attaching a DRG to your VCN, you can aggregate routing for multiple connection types—such as FastConnect private circuits, IPSec VPN tunnels, and Remote Peering Connections between different VCNs—thereby enabling scalable, enterprise-grade traffic encapsulation without traversing the public internet.

Transit routing through a Dynamic Routing Gateway (DRG) relies on route tables and import distributions to propagate prefixes correctly between attachments. For VCN-B instances to reach the on-premises datacenter via FastConnect, the DRG attachment for VCN-B must be associated with a DRG route table that includes an import route distribution populated with the on-premises routes. Since VCN-A succeeds while VCN-B fails, the absence of this specific import configuration on VCN-B's route table prevents it from learning the required on-premises network paths.

Security lists in OCI are stateful, meaning return traffic for an allowed inbound connection is automatically permitted without a separate egress rule. This satisfies the question's requirement for a correct characteristic, unlike network security groups' stateless behaviour or the misconception that security lists are stateless.

Stateful security lists or NSGs must permit outbound traffic; a missing egress rule blocks OS update downloads even when the NAT Gateway route exists. Checking egress rules first isolates the most common cause of this failure.

To survive a single CPE failure, a second on-premises CPE with its own pair of IPSec tunnels to the DRG is required. OCI supports multiple CPEs per IPSec connection, and each CPE can have its own redundant tunnels. Without a second CPE, a hardware failure at the primary CPE would take down all tunnels.