43 of 118 questions · Page 2/2 · Networking topic · Answers revealed
What is the maximum number of VCNs allowed per region in an OCI tenancy by default (subject to service limits)?
The default VCN service limit per region is 50.
Why this answer
The default service limit for VCNs per region in an OCI tenancy is typically 50, but can be increased upon request.
Which OCI service provides authoritative Domain Name System (DNS) management and allows you to host public and private DNS zones?
OCI DNS provides resilient, scalable public and private domain name resolution.
Why this answer
OCI DNS is the managed Domain Name System service that enables customers to create and manage public and private DNS zones.
An OCI customer has configured an IPSec VPN tunnel between their on-premises datacenter and an OCI DRG. The tunnel status in the OCI Console shows as 'DOWN'. The customer verifies that the public IP of the CPE is correct and internet connectivity works. What is the most likely cause of the tunnel being down?
IPSec negotiation fails if Phase 1 or Phase 2 settings (encryption, hashing, DH groups) do not match on both ends, or if ISAKMP/IPSec ports are blocked.
What is the primary function of an OCI Dynamic Routing Gateway (DRG)?
DRGs serve as the gateway for hybrid cloud and VCN transit routing.
Why this answer
A DRG is a virtual router that provides a path for private traffic between your VCN and on-premises networks (via FastConnect or Site-to-Site VPN) or other VCNs.
An OCI architect configures a DRG with transit routing, connecting VCN-A and Vcn-B to the DRG. Both VCNs need to communicate with the on-premises datacenter connected via FastConnect. However, VCN-A instances can reach on-premises, but Vcn-B cannot. What is the most likely misconfiguration in the DRG?
DRG route tables and import/export distributions govern transit routing between attachments.
Why this answer
In DRG version 2, route distribution and DRG route tables control traffic between attachments. If Vcn-B cannot reach on-premises, its DRG attachment is likely associated with a DRG route table that lacks import routes for the on-premises attachment, or vice versa.
Which THREE characteristics of OCI Security Lists are correct?
Stateful rules automatically allow return traffic for established connections.
Why this answer
Security lists are virtual firewalls applied at the subnet level, they are stateful by default (though stateless can be configured), and their rules apply to all VNICs in the subnet.
Security rules govern traffic flow; outbound packets must be allowed by security list egress rules or NSGs.
You are configuring an OCI Load Balancer and need to distribute incoming requests across backend servers based on the client's source IP address so that requests from the same client always go to the same backend server. Which load balancing policy should you choose?
IP Hash policy ensures sticky sessions based on client source IP.
Why this answer
The IP Hash load balancing policy hashes the client's source IP address to route requests from the same client to the same backend server, ensuring session persistence.
You are planning IP address allocation for a multi-tier application in OCI. You create a VCN with CIDR 172.16.0.0/16. You need three subnets: web (100 hosts), app (200 hosts), and database (50 hosts). Which combination of subnet CIDRs is valid and non-overlapping?
These CIDRs are non-overlapping, fit within 172.16.0.0/16, and provide enough hosts for each tier.
Why this answer
Subnet CIDRs must be non-overlapping and sized appropriately. For example, 172.16.1.0/24 (256 addresses), 172.16.2.0/24 (256 addresses), and 172.16.3.0/26 (64 addresses) fit within 172.16.0.0/16 without overlapping.
What is the smallest IPv4 CIDR block size supported for an OCI Virtual Cloud Network (VCN)?
OCI supports VCN sizes ranging from /16 to /30.
Why this answer
The smallest VCN CIDR block supported by OCI is /30, and the largest is /16.
You are deploying a Public Load Balancer in OCI to distribute incoming web traffic across multiple backend compute instances in different availability domains. You notice that backend health checks are failing. Which component's configuration should you check first to ensure health check probes can reach the backend instances?
Backend instance firewall rules (Security Lists/NSGs) must permit ingress traffic coming from the Load Balancer.
Why this answer
Load Balancer backend health checks originate from the Load Balancer's subnet. Security Lists or NSGs attached to the backend instances must allow inbound traffic from the Load Balancer subnet on the backend application ports and health check ports.
You have a web application behind an OCI Public Load Balancer. You want to restrict access so that only clients coming from a specific corporate external IP address range can access your application. Where should you configure this restriction?
Access control rules in load balancer rule sets or security lists can restrict traffic by source IP CIDR.
Why this answer
To restrict incoming traffic based on client IP addresses at the load balancer level, you can configure Load Balancer Rule Sets (such as access control rules / IP filtering) or use Security Lists/NSGs on the load balancer subnet.
You are designing a Disaster Recovery architecture where VCN-1 in the Ashburn region needs to peer with VCN-2 in the Phoenix region. Which OCI networking construct is required to achieve this cross-region peering?
DRG version 2 supports cross-region VCN peering and transit routing.
Why this answer
Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, and a remote peering connection established between the two DRGs.
You are setting up OCI DNS and want to configure a zone transfer (AXFR) from your on-premises DNS server to OCI Private DNS. Which feature enables secondary DNS functionality in OCI?
Secondary DNS configuration allows zone transfers between on-premises and OCI DNS.
Why this answer
OCI DNS supports secondary DNS configurations where OCI acts as a primary or secondary DNS server for zones, supporting zone transfers.
Which OCI networking component is automatically created when you provision a Virtual Cloud Network using the VCN Wizard with 'Internet Connectivity'?
The VCN Wizard automatically provisions an Internet Gateway for public subnet traffic.
Which THREE components are required when configuring an OCI FastConnect direct peering connection?
Physical connectivity is required either via colocation cross-connect or a FastConnect partner.
Why this answer
A FastConnect direct peering connection requires a Dynamic Routing Gateway (DRG) attached to your VCN, a FastConnect virtual circuit, and a physical cross-connect or partner connection setup.
What is the primary purpose of an OCI Service Gateway?
Service Gateways keep traffic within the Oracle network backbone when accessing regional Oracle services.
Why this answer
A Service Gateway enables private connectivity from a VCN to Oracle services in the Oracle Services Network without traversing the public internet.
What is the maximum MTU (Maximum Transmission Unit) supported on standard OCI VCN virtual network interfaces (VNICs)?
OCI supports jumbo frames with up to 9000 bytes MTU for high-throughput workloads.
Why this answer
Standard OCI VNICs support an MTU of 9000 bytes (Jumbo Frames), as well as the standard 1500 bytes.
You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?
Slow backend responses exceeding the timeout cause the load balancer to return a 504 error.
Why this answer
A 504 Gateway Timeout occurs when the load balancer does not receive a timely response from the backend servers within the configured idle timeout period.
What is the primary difference between a public subnet and a private subnet in an OCI Virtual Cloud Network?
This is the fundamental distinction defining public versus private subnets in OCI.
Why this answer
Public subnets have a route to an Internet Gateway, allowing instances within them to have public IP addresses and communicate with the public internet. Private subnets do not have routes to an Internet Gateway.
Which TWO methods can be used to connect your on-premises datacenter to an OCI Virtual Cloud Network?
FastConnect provides dedicated, high-bandwidth private connectivity to OCI.
Your organization requires that all database traffic originating from OCI subnets to Oracle Autonomous Database bypass the public internet and use private IP paths. You have configured a Service Gateway. What additional configuration is mandatory in the subnet route table?
Route rules pointing to the Service Gateway are required to route Oracle Services traffic correctly.
Why this answer
To direct traffic to the Service Gateway, the subnet route table must have a route rule where the destination is the Oracle Services Network (or a specific service region prefix) and the target is the Service Gateway.
This is the correct configuration to route outbound traffic from the private subnet to the NAT Gateway.
You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?
Subnet route tables dictate how outbound and return traffic within the VCN is directed to gateways like the DRG.
Why this answer
The VCN route table associated with the compute instance's subnet must contain a route entry pointing the on-premises CIDR block to the DRG as the target.
You are designing an architecture where instances in a private subnet need to send log data to an OCI Logging analytics endpoint, but must not have access to the general public internet. Which service should you leverage?
Service Gateways provide secure, private connectivity to regional OCI services.
Why this answer
A Service Gateway enables private access to regional OCI services (such as Object Storage, Logging, and Database) without requiring internet access.
Which THREE components are required when configuring OCI VCN Remote Peering between two regions?
An RPC establishes the peer connection between the two cross-region DRGs.
Why this answer
Remote VCN peering across regions requires a Dynamic Routing Gateway (DRG) attached to each VCN, a Remote Peering Connection (RPC) established between the two DRGs, and matching route table/security rules.
Which TWO of the following are valid characteristics of OCI Virtual Cloud Networks (VCNs)?
VCNs are regional constructs in OCI.
Why this answer
VCNs span all availability domains within a region and reside within a single OCI region.
Which TWO components are involved when routing traffic from an OCI private subnet to an on-premises datacenter via FastConnect?
The DRG acts as the router connecting the VCN to the FastConnect circuit.
Why this answer
Traffic from a private subnet to on-premises via FastConnect requires a route table rule pointing to the Dynamic Routing Gateway (DRG), and the FastConnect virtual circuit terminating on that DRG.
The IPSec Connection details provide the Oracle tunnel endpoint public IP addresses.
Which TWO components are required to configure an OCI Site-to-Site VPN with redundant tunnels?
The DRG terminates the VPN connection on the cloud side.
Why this answer
OCI automatically provisions two redundant VPN tunnels for every Site-to-Site VPN connection. To use them, you configure a CPE object, a DRG, and configure both tunnels on your on-premises router.
Which OCI networking component acts as a virtual firewall at the subnet level?
Security Lists provide stateful/stateless ingress and egress packet filtering at the subnet level.
Why this answer
Security Lists act as virtual firewalls that apply to all VNICs within a given subnet.
You have configured a FastConnect dedicated circuit using a Provider model, but your on-premises routers cannot reach OCI VCN instances. BGP status is showing as 'Idle'. What is the most likely cause?
You are migrating workloads to OCI and need to route traffic between two VCNs that reside in the same tenancy but in different regions (Ashburn and Phoenix). Which OCI component is required to establish this cross-region connection?
DRG version 2 supports cross-region VCN peering.
Why this answer
Cross-region VCN peering requires a Dynamic Routing Gateway (DRG) attached to each VCN, configured with a remote peering connection between the two DRGs.
Which TWO actions can you perform on an OCI Virtual Cloud Network (VCN) after it has been created?
You can create additional subnets as long as they fit within the VCN CIDR blocks.
Why this answer
After creating a VCN, you can add new subnet CIDRs, add/remove gateways, modify route tables, and update security lists. However, you cannot change the primary VCN CIDR block once created.
Which TWO statements are true regarding OCI VCN Flow Logs?
Flow logs record network flows such as source/destination IPs, ports, and protocols.
Why this answer
VCN Flow Logs capture accepted and rejected traffic traffic flows across VNICs in your VCN. They can be stored in OCI Object Storage or streamed to Logging Analytics.
You are configuring a FastConnect virtual circuit using the Oracle provider model. You have completed the setup in the OCI Console and received an Oracle Industry Partner token (OCID). What is the next step you must take?
The provider uses the token to establish the virtual circuit link to OCI.
Why this answer
When using the FastConnect Provider model, you must provide the Oracle Industry Partner token (OCID) to your telecommunication or network provider so they can provision the circuit from their end.
Which THREE features are supported by OCI Load Balancer?
Load balancers support TCP stream proxying at layer 4.
Why this answer
OCI Load Balancers support TCP, HTTP, and HTTPS listeners, SSL termination, health checks, and multiple load balancing algorithms like weighted round robin and least connections.
Which THREE criteria can OCI Traffic Management Steering Policies use to route DNS traffic?
Failover policies route traffic to primary endpoints and fail over to secondary endpoints if the primary fails.
Why this answer
OCI Traffic Management steering policies support multiple traffic steering strategies including Failover, Load Balancer, Geolocation, ASN-based, and Compute-based routing.
An enterprise customer has a Hybrid cloud architecture. They need to connect their on-premises datacenter to multiple VCNs in different OCI regions using a single dedicated connection. Which OCI component must be used as the central transit hub?
A DRG is the required router for connecting on-premises networks and enabling cross-region or multi-VCN transit routing.
Which THREE statements regarding OCI VCN DNS and Hostname resolution are correct?
VCN Resolver provides automatic internal DNS name resolution between instances.
Why this answer
OCI assigns internal domain names to instances based on VCN and subnet configuration. Instances can resolve each other using hostname prefixes or fully qualified domain names (FQDNs), and custom DNS zones can be integrated.
You are designing an OCI VCN and need to configure DNS so that instances can resolve custom internal domain names as well as internet domain names. Which OCI VCN Resolver feature should you utilize?
Custom forwarders allow the VCN resolver to route specific private domain queries to internal name servers.
Why this answer
The VCN Resolver handles DNS resolution for instances. You can configure custom DNS forwarders in the VCN Resolver to forward queries for specific private domains to internal DNS servers while resolving internet queries normally.
Which THREE components are required when establishing a Site-to-Site VPN connection between your on-premises datacenter and an OCI VCN?
The IPSec Connection binds the CPE and DRG together and establishes encrypted tunnels.
You are designing an OCI VCN and need to ensure that database instances in a private subnet can communicate with backend storage endpoints over the Oracle network backbone. Which gateway should you ensure is attached and routed to?
Service Gateways connect private subnets to regional Oracle services privately.
Why this answer
Service Gateway provides private access to Oracle services like Object Storage across the Oracle network backbone.
Ready to test yourself?
Try a timed practice session using only Networking questions.