Networking practice questions

BYOIP prefixes can be assigned directly to private subnet VNICs without public IPs.

Why wrong: BYOIP addresses are public IPs and follow standard OCI public IP assignment rules.

BYOIP is only supported for private IP addresses within an on-premises datacenter.

Why wrong: BYOIP specifically applies to public IPv4 addresses.

OCI automatically transfers ownership of the IP block to Oracle permanently.

Why wrong: You retain ownership of your IP prefix; Oracle only advertises/uses it on your behalf.

FastConnect does not support BGP dynamic routing when redundancy is enabled.

Why wrong: BGP is fully supported and recommended for redundant FastConnect setups.

FastConnect redundant circuits must share the exact same physical cross-connect port.

Why wrong: Redundant circuits should utilize separate physical ports or diverse provider paths.

FastConnect automatically provides 100% SLA without requiring redundant circuits on customer end.

Why wrong: Customers must implement redundant circuits on their end to achieve high availability SLAs.

Local Peering Gateway (LPG) access control lists

Why wrong: LPGs handle VCN-to-VCN traffic routing in the same region, not security rules for instances.

Security Lists associated with the database subnet

Why wrong: Security lists apply to all VNICs in a subnet, which is too broad if application instances are spread across multiple subnets.

Dynamic Routing Gateway (DRG) security policies

Why wrong: DRG is used for routing between VCNs and on-premises networks, not for intra-VCN instance-level security rules.

The route table on the VCN subnet does not have a route to 0.0.0.0/0.

Why wrong: Missing VCN routes affect packet forwarding, not BGP session state establishment (Idle/Connect).

The Security List on the DRG attachment blocks ICMP traffic.

Why wrong: ICMP traffic blocking does not prevent BGP state progression.

The public subnet has an incorrect Internet Gateway route.

Why wrong: FastConnect uses private virtual circuits and does not rely on Internet Gateways.

NAT Gateway

Why wrong: NAT Gateways provide outbound internet access for private subnets, not on-premises hybrid connectivity.

Local Peering Gateway (LPG)

Why wrong: LPGs only support peering between VCNs in the same region.

Internet Gateway

Why wrong: Internet Gateways handle public internet traffic, not private hybrid connections.

A NAT Gateway configured with DNS proxy settings

Why wrong: NAT Gateways do not handle DNS proxying or name resolution.

A public DNS zone for your on-premises domain

Why wrong: Public DNS zones are meant for internet-facing resolution, not private hybrid name resolution.

An Internet Gateway with custom host file mappings

Why wrong: Host files do not provide scalable DNS resolution, and Internet Gateways do not manage internal DNS.

Dynamic Routing Gateway

Why wrong: A Dynamic Routing Gateway is used to connect to on-premises networks or other VCNs via remote peering.

Internet Gateway

Why wrong: An Internet Gateway provides bi-directional communication with the public internet, not secure private access to regional Oracle services.

NAT Gateway

Why wrong: A NAT Gateway routes outbound traffic to the public internet, whereas a Service Gateway keeps traffic within the Oracle network backbone.

A NAT Gateway attached to the backend server subnet

Why wrong: A NAT gateway is for outbound internet traffic, not load balancer health checking.

A security list allowing all incoming traffic from the internet

Why wrong: Health checks originate from the load balancer subnet, not necessarily the public internet.

An active Service Gateway

Why wrong: Service Gateways are for connecting to Oracle services, not backend health checks.

Attach an Internet Gateway directly to the private subnet and add a security list rule allowing egress to 0.0.0.0/0.

Why wrong: Internet Gateways are attached to VCNs and used by public subnets, not private subnets.

Configure a Service Gateway with a route to 0.0.0.0/0.

Why wrong: Service Gateways are used to access Oracle services in the Oracle Services Network, not the general public internet.

Assign a public IP address to the instances within the private subnet.

Why wrong: Private subnets cannot have public IP addresses assigned to their VNICs by design.

Local Peering Gateway (LPG) in VCN-A

Why wrong: An LPG is required in each VCN participating in local peering.

Route table rules pointing to the LPG

Why wrong: Route rules pointing to the LPG are necessary in both VCN route tables to direct traffic across the peer.

Local Peering Gateway (LPG) in VCN-B

Why wrong: An LPG is required in both VCNs for local peering.

Configure a NAT Gateway on the load balancer subnet.

Why wrong: NAT Gateways manage outbound traffic, whereas the issue is incoming traffic reaching the backend.

Change the load balancer shape from Flexible to 100 Mbps.

Why wrong: Changing the load balancer shape does not fix missing security rules on backend instances.

Attach an Internet Gateway to the backend subnet route table.

Why wrong: Backend subnets for load balancers should remain private and do not need Internet Gateways.

Every subnet must have at least one NSG associated with it by default.

Why wrong: NSGs are optional; subnets use security lists by default if no NSGs are applied.

NSGs can span across multiple different VCNs in the same region.

Why wrong: NSGs are scoped to a single VCN and cannot span across multiple VCNs.

NSGs replace Security Lists entirely and Security Lists are deprecated.

Why wrong: Security Lists and NSGs both coexist and serve different architectural scopes.

Internet Gateway attached to the private subnets

Why wrong: Site-to-Site VPN traffic traverses the DRG, not an Internet Gateway.

Local Peering Gateway (LPG)

Why wrong: LPGs are used for VCN-to-VCN peering, not on-premises VPN connections.

General web browsing traffic to external websites like google.com

Why wrong: External internet sites are not part of the Oracle Services Network.

Traffic destined for an on-premises datacenter via FastConnect

Why wrong: On-premises traffic uses the DRG, not the Service Gateway.

Peer traffic to another VCN in a different region

Why wrong: Cross-region VCN peering uses a DRG, not a Service Gateway.

Dynamic Routing Gateway

Why wrong: Dynamic Routing Gateways are not created by default by the basic internet VCN wizard.

Local Peering Gateway

Why wrong: Local Peering Gateways are only created when manually setting up VCN peering.

FastConnect Virtual Circuit

Why wrong: FastConnect requires manual provisioning and telecommunication provider setup.

Local Peering Gateway (LPG)

Why wrong: LPGs only support same-region VCN peering.

NAT Gateway

Why wrong: NAT Gateways provide outbound internet access, not VCN-to-VCN peering.

Internet Gateway

Why wrong: Internet Gateways route traffic to the public internet, not peer VCNs directly and securely.

Check if the instances have public IP addresses assigned.

Why wrong: Private subnets do not need public IP addresses when using a NAT Gateway.

Check if an Internet Gateway is also attached to the VCN.

Why wrong: Private subnets do not use Internet Gateways directly; the NAT Gateway handles outbound traffic.

Check if a Service Gateway is attached to the VCN.

Why wrong: Service Gateways are for Oracle services, whereas OS updates come from external public repositories.

Private subnets require IPv6 addressing.

Why wrong: IPv6 is optional for both public and private subnets.

Private subnets cannot use Security Lists.

Why wrong: Both public and private subnets can use Security Lists.

Public subnets cannot communicate with Oracle Database services.

Why wrong: Public subnets can access Oracle services, provided proper routing and security rules exist.

2

Why wrong: Only one Internet Gateway is permitted per VCN.

Unlimited

Why wrong: There is a strict limit of one Internet Gateway per VCN.

5

Why wrong: The limit is one per VCN.

Attach a NAT Gateway to the Load Balancer subnet.

Why wrong: NAT Gateways manage outbound traffic and do not affect client IP preservation.

Switch the load balancer shape to asymmetric routing mode.

Why wrong: Asymmetric routing mode is not an OCI load balancer setting.

Configure an Internet Gateway route on the backend servers.

Why wrong: Backend servers should not have direct internet gateways for this purpose.