CCNA Core Oci Services Questions — Page 1 of 4

Multi-Selecthard

Which THREE of the following features are supported by OCI Network Load Balancer (NLB)? (Choose three.)

Select 3 answers

A.Layer 4 (TCP, UDP, ICMP) traffic distribution

B.Handling millions of requests per second with scaling and static VIPs

C.SSL/TLS termination and certificate management

D.Source IP address preservation for backend servers

E.URL path-based routing for HTTP/HTTPS requests

AnswersA, B, D

NLB operates at Layer 4 and handles TCP, UDP, and ICMP protocols.

Why this answer

Network Load Balancer operates at Layer 4 (OSI), supports TCP, UDP, and ICMP, preserves source IP addresses, and provides ultra-high scalability with static public IPs.

Practice this question →

MCQeasy

An administrator needs to create a point-in-time, read-only copy of a Block Volume data disk for backup and disaster recovery purposes. What OCI feature should be created?

A.File Storage clone

B.Compute instance custom image

C.Object Storage archive snapshot

D.Block Volume Backup

AnswerD

Block Volume backups create point-in-time snapshots of block storage data.

Why this answer

Block Volume backups are point-in-time snapshots of a block volume that can be used to restore data or create new volumes.

Practice this question →

Multi-Selectmedium

Which THREE of the following are properties of a VCN?

Select 3 answers

A.DNS support

B.Compute shapes

C.CIDR block

D.Subnets

E.Object Storage buckets

AnswersA, C, D

Internal name resolution.

Why this answer

CIDR block, DNS support, and Subnets are fundamental VCN properties.

Practice this question →

MCQeasy

Your organization wants to store compliance audit logs for 7 years at the absolute lowest storage cost, acknowledging that data retrieval may take several hours. Which OCI Object Storage tier should you use?

A.Archive Storage

B.Infrequent Access Storage

C.Cold Storage

D.Standard Storage

AnswerA

Archive Storage offers the lowest storage cost for long-term retention data that is rarely accessed and can tolerate multi-hour restoration times.

Why this answer

OCI Archive Storage is designed for data that is rarely accessed and must be retained for long periods, providing the lowest cost storage with a multi-hour retrieval time.

Practice this question →

Multi-Selecteasy

Which TWO OCI services are used to build and manage containerized applications? (Choose two.)

Select 2 answers

A.OCI Internet Gateway

B.Oracle Container Engine for Kubernetes (OKE)

C.OCI File Storage Service

D.OCI Block Volume

E.OCI Container Instances

AnswersB, E

OKE manages Kubernetes container clusters.

Why this answer

Oracle Container Engine for Kubernetes (OKE) and OCI Container Instances are core container services in OCI.

Practice this question →

MCQmedium

You are designing a high-throughput, fault-tolerant web application tier. You need to distribute incoming HTTP/HTTPS traffic across multiple compute instances across different availability domains within a region. Which service should you deploy?

A.Dynamic Routing Gateway (DRG)

B.OCI Load Balancer

C.OCI Traffic Director

D.OCI Network Load Balancer

AnswerB

The OCI Load Balancer provides automated traffic distribution across multiple backend servers and supports layer 7 HTTP/HTTPS routing features.

Why this answer

OCI Load Balancer is a regional service that distributes incoming traffic across backend servers across multiple availability domains, ensuring high availability.

Practice this question →

Multi-Selectmedium

Which TWO of the following are OCI storage services?

Select 2 answers

A.DNS Service

B.Block Volume

C.Load Balancer

D.Object Storage

E.Functions

AnswersB, D

Core block store.

Why this answer

Object Storage and Block Volume are primary OCI storage services.

Practice this question →

MCQeasy

What is the primary function of a Dynamic Routing Gateway (DRG) in OCI?

A.To provide a path for private traffic between a VCN and on-premises networks or remote VCNs

B.To route public internet traffic to virtual machines

C.To balance HTTP traffic across backend web servers

D.To provide private access to regional Oracle Cloud services

AnswerA

DRG connects VCNs to on-premises networks or other VCNs.

Why this answer

A DRG acts as a virtual router that provides a path for private traffic between your VCN and locations outside your VCN, such as on-premises networks or other VCNs.

Practice this question →

MCQeasy

What is the primary purpose of an OCI Service Gateway?

A.To peer two VCNs in the same region

B.To connect to on-premises data centers

C.To provide private access to regional Oracle services without traversing the public internet

D.To route public internet traffic for virtual machines

AnswerC

Service Gateway routes traffic privately to Oracle services.

Why this answer

A Service Gateway allows your VCN to access regional Oracle services (like Object Storage) privately without using public internet or NAT.

Practice this question →

MCQeasy

A company needs to store petabytes of data that is rarely accessed but must be retained for compliance for 7 years. Retrievals can take up to several hours. Which storage tier should they use?

A.Standard Storage

B.Infrequent Access Storage

C.Archive Storage

D.Block Volume Backups

AnswerC

Archive Storage is ideal for long-term compliance retention with multi-hour retrieval times.

Why this answer

Archive Storage is the lowest-cost OCI Object Storage tier designed for long-term retention of infrequently accessed data with a multi-hour retrieval time.

Practice this question →

Multi-Selectmedium

Which THREE features are provided by OCI Object Storage buckets? (Choose three.)

Select 3 answers

A.Direct NFSv3 file system mounting

B.Object Versioning

C.Lifecycle Management Rules

D.Block-level iSCSI disk formatting

E.Pre-authenticated Requests (PARs)

AnswersB, C, E

Versioning protects against accidental overwrites and deletions.

Why this answer

OCI Object Storage supports versioning, pre-authenticated requests, and lifecycle management rules.

Practice this question →

Multi-Selectmedium

Which TWO statements are true regarding Oracle Cloud Infrastructure (OCI) Compute Flexible Shapes?

Select 2 answers

A.When you use a flexible shape, you must scale OCPUs and memory in a fixed, predefined ratio.

B.Flexible shapes are only supported with Intel Xeon processor families.

C.Flexible shapes cannot be resized once the compute instance has been provisioned.

D.Flexible shapes allow you to independently customize the amount of memory and the number of OCPUs for a virtual machine instance.

E.Flexible shapes are available for both AMD and Ampere-based virtual machine instances.

AnswersD, E

Flexible shapes give customers granular control to size OCPUs and memory independently to fit their exact workload needs.

Why this answer

Flexible shapes allow you to customize the number of OCPUs and amount of memory independently, and they are available for both AMD and Ampere Arm-based processors.

Practice this question →

Multi-Selecthard

Which THREE statements are accurate regarding OCI Object Storage capabilities and architecture? (Choose three.)

Select 3 answers

A.Object Versioning can be enabled to protect against accidental overwrites and deletions.

B.Object Storage buckets can be directly mounted to Linux file systems via NFSv3 protocol natively.

C.Archive Storage data can be retrieved instantly upon API call without prior restoration requests.

D.Object Storage buckets are regional resources spanning all availability domains in a region.

E.Standard Storage tier data can be accessed instantly without retrieval delays.

AnswersA, D, E

Object Versioning keeps multiple variants of an object in the same bucket to prevent data loss.

Why this answer

OCI Object Storage is regional, highly durable, provides standard and archive tiers, and allows data immutability via Object Versioning and Object Locking.

Practice this question →

Multi-Selecthard

Which TWO statements are correct regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs)? (Choose two.)

Select 2 answers

A.Security Lists can reference another Security List as a rule source.

B.Security Lists apply to all VNICs contained within a specific subnet.

C.Network Security Groups can only be used in public subnets.

D.Network Security Groups apply to a specific set of VNICs chosen across multiple subnets.

E.Security Lists do not support stateful firewall rules.

AnswersB, D

Security lists are subnet-level security constructs.

Why this answer

Security lists apply to entire subnets, while NSGs apply to specific sets of VNICs chosen by the administrator. Both support stateful and stateless rules.

Practice this question →

MCQmedium

Your application running on OCI compute instances requires a shared POSIX-compliant file system that can be mounted simultaneously by hundreds of compute instances across multiple availability domains. Which OCI storage service should you select?

A.Block Volume

B.Object Storage

C.File Storage Service (FSS)

D.Archive Storage

AnswerC

File Storage Service provides a shared POSIX-compliant file system using the NFS protocol, mountable across multiple availability domains.

Why this answer

OCI File Storage Service (FSS) provides a durable, scalable, enterprise-grade network file system that supports the standard NFS v3.0 protocol and can be mounted concurrently from multiple instances across availability domains.

Practice this question →

MCQhard

A security engineer is designing a zero-trust architecture for a microservices environment in OCI. Traffic between compute instances in different subnets must be restricted based on individual workload roles rather than entire subnet CIDR blocks. Which OCI networking feature should be implemented?

A.Security Lists

B.Local Peering Gateways

C.Stateful Route Tables

D.Network Security Groups (NSGs)

AnswerD

NSGs allow defining security rules that apply to a specific set of VNICs, regardless of which subnets they reside in.

Why this answer

Network Security Groups (NSGs) provide virtual firewall rules for a set of VNICs of your choice, allowing fine-grained security rules independent of subnet architecture.

Practice this question →

MCQhard

You need to allow traffic from an on-premises site to a VCN using a VPN. What component is required in the VCN to act as the endpoint?

A.Dynamic Routing Gateway

B.Service Gateway

C.NAT Gateway

D.Internet Gateway

AnswerA

DRG is the virtual router for private connections.

Why this answer

A Dynamic Routing Gateway (DRG) is the required gateway for VPN connections.

Practice this question →

Multi-Selectmedium

Which THREE OCI networking components are regional constructs rather than availability domain-specific? (Choose three.)

Select 3 answers

A.Service Gateway

B.Virtual Cloud Network (VCN)

C.Subnets (can be regional or AD-specific)

D.Compute Instances

E.Internet Gateway

AnswersA, B, E

Service Gateways operate at the regional level.

Why this answer

Virtual Cloud Networks, Internet Gateways, and Service Gateways are regional OCI resources.

Practice this question →

Multi-Selectmedium

Which TWO of the following are types of OCI VCN subnets?

Select 2 answers

A.Global

B.Regional

C.Public-only

D.Reserved

E.Availability domain-specific

AnswersB, E

Spans all ADs.

Why this answer

Subnets can be regional or availability domain-specific.

Practice this question →

MCQmedium

Which of the following is a capability of the OCI Block Volume service?

A.Global replication

B.Direct console access

C.Volume cloning

D.Automatic OS patching

AnswerC

OCI allows cloning existing volumes.

Why this answer

Block volumes support automatic and manual backups to Object Storage.

Practice this question →

Multi-Selectmedium

Which THREE storage options can be attached or mounted to an OCI Compute virtual machine instance? (Choose three.)

Select 3 answers

A.OCI Object Storage bucket (mounted as block device)

B.OCI File Storage Service (via NFS)

C.OCI Container Instance storage

D.OCI Block Volume

E.OCI Boot Volume

AnswersB, D, E

FSS can be mounted via NFS on compute VMs.

Why this answer

Compute instances can use Boot Volumes, Block Volumes, and File Storage Service (via NFS).

Practice this question →

MCQeasy

A cloud architect needs to provision an Oracle Cloud Infrastructure (OCI) Compute instance with a custom number of OCPUs and memory for a memory-intensive application. Which shape type should the architect select?

A.GPU shape

B.Standard shape

C.DenseIO shape

D.Flexible shape

AnswerD

Flexible shapes allow independent configuration of OCPUs and memory.

Why this answer

Flexible shapes allow users to customize the number of OCPUs and the amount of memory independently, making them ideal for workloads that require specific resource ratios.

Practice this question →

MCQhard

An application requires a block volume with guaranteed high performance and low latency for heavy database operations. Which OCI Block Volume performance tier should you select?

A.Archive Tier

B.Higher Performance

C.Balanced

D.Lower Cost

AnswerB

Higher Performance provides maximum IOPS and performance.

Why this answer

Higher Performance provides maximum IOPS and throughput for demanding database workloads.

Practice this question →

MCQmedium

You are designing a secure web application architecture. You want to ensure that incoming database traffic is restricted to only web servers belonging to a specific Network Security Group, without exposing database ports to the rest of the subnet. Which feature enables this?

A.Dynamic Routing Gateway policies

B.Internet Gateway rules

C.Network Security Groups (NSGs)

D.Security Lists

AnswerC

NSGs provide VNIC-level security rules with cross-NSG references.

Why this answer

Network Security Groups (NSGs) allow you to specify security rules referencing other NSGs as sources or destinations for fine-grained filtering.

Practice this question →

MCQeasy

What is the term used in OCI to describe a software-defined version of a traditional physical network, including subnets, route tables, and gateways?

A.Subnet Gateway

B.Virtual Cloud Network (VCN)

C.Local Peering Network

D.Virtual Private Network (VPN)

AnswerB

VCN is the core software-defined networking construct in OCI.

Why this answer

A Virtual Cloud Network (VCN) is a customizable, software-defined private network that you set up in OCI.

Practice this question →

MCQmedium

You are configuring an OCI Load Balancer and want to ensure high availability by distributing traffic across backend servers in different availability domains within a region. Which type of load balancer should you deploy?

A.Availability Domain-specific Load Balancer

B.Dynamic Routing Load Balancer

C.Regional Load Balancer

D.Local Peering Load Balancer

AnswerC

Regional load balancers span multiple availability domains for high availability.

Why this answer

A regional load balancer distributes traffic across backend servers across multiple availability domains within the region.

Practice this question →

MCQhard

You need to ensure that database block volumes are automatically backed up every day with a retention policy of 30 days across multiple regions. What OCI feature should you use?

A.Manual OCI CLI snapshot scripts

B.Object Storage Lifecycle Management rules

C.Compute Instance Autoscaling configurations

D.Block Volume Backup Policies

AnswerD

Backup policies automate scheduled backups, retentions, and cross-region copying natively.

Why this answer

Volume Backup Policies allow you to assign predefined or custom backup schedules (daily, weekly, monthly) with automated cross-region replication and retention rules.

Practice this question →

MCQmedium

To secure a subnet, you need to define rules that restrict traffic based on the source and destination at the packet level. Which OCI resource provides this stateful security?

A.Network Security Groups (NSG)

B.Security Lists

C.Dynamic Routing Gateway

D.Route Tables

AnswerB

Security Lists are subnet-level firewall rules.

Why this answer

Security Lists provide stateful packet filtering for all VNICs in a subnet.

Practice this question →

MCQeasy

An administrator needs to temporarily grant read access to a specific file in an OCI Object Storage bucket to a colleague without managing IAM user credentials. What feature should be used?

A.Bucket public access toggle

B.VCN Security List rule modification

C.IAM Group policy update

D.Pre-authenticated Request (PAR)

AnswerD

PARs provide time-limited URL access to specific objects without IAM credentials.

Why this answer

Pre-authenticated requests (PARs) provide a convenient way to grant secure, time-limited download or upload access to individual objects.

Practice this question →

MCQeasy

An administrator needs to ensure that data in an OCI Object Storage bucket is automatically transitioned from Standard storage to Infrequent Access storage after 30 days, and then deleted after 365 days. Which Object Storage feature should be used?

A.Object Storage Lifecycle Rules

B.Block Volume Auto-Backup Policies

C.VCN Security Lists

D.IAM Policy Statements

AnswerA

Lifecycle rules automate moving objects between storage tiers and purging them after defined periods.

Why this answer

Object Storage Object Lifecycle Management rules allow automating the transition and deletion of objects based on age.

Practice this question →

Multi-Selecthard

Which TWO OCI compute features help in achieving cost optimization?

Select 2 answers

A.GPU Instances

B.Preemptible Instances

C.Bare Metal

D.Dedicated Hosts

E.Autoscaling

AnswersB, E

Offers lower cost for interruptible tasks.

Why this answer

Preemptible instances and Autoscaling are primary tools for managing compute costs.

Practice this question →

MCQhard

An organization requires a highly available IPsec VPN connection from their on-premises data center to an OCI VCN. To ensure high availability, what is the recommended architecture for the Dynamic Routing Gateway (DRG) and customer premise equipment (CPE)?

A.A single VPN tunnel connecting to a single CPE device.

B.Redundant VPN tunnels utilizing multiple CPE public IP addresses terminating on the DRG.

C.Configuring active-passive peering across two separate VCNs.

D.Using an Internet Gateway instead of a DRG with redundant static routes.

AnswerB

Redundant tunnels across multiple CPEs provide automatic failover and high availability.

Why this answer

OCI supports redundant VPN tunnels across multiple CPE public IPs terminating on a DRG to ensure high availability and failover.

Practice this question →

MCQeasy

Which OCI service allows you to back up your on-premises data to the cloud for long-term storage?

A.Block Volume

B.Object Storage

C.FastConnect

D.Compute Instance

AnswerB

Object storage provides a durable and scalable destination for backups.

Why this answer

Object Storage with lifecycle policies is commonly used for backup storage.

Practice this question →

Multi-Selecthard

Which THREE of the following statements are true regarding OCI Block Volume backups and performance? (Choose three.)

Select 3 answers

A.Block volume performance can be scaled independently of storage capacity by adjusting Volume Performance Units (VPUs).

B.Block volumes can only be attached to a single compute instance across multiple regions simultaneously.

C.Block volume backups are always full backups and incremental backups are not supported.

D.Block volume backups can be copied across different OCI regions.

E.You can resize a block volume online without detaching it from the compute instance.

AnswersA, D, E

Users can select different performance tiers or adjust VPUs to scale IOPS and throughput.

Why this answer

Block Volume performance can be scaled independently using performance units, backups can be automated via policies, and volumes can be resized online.

Practice this question →

MCQmedium

You are configuring security lists for a subnet hosting web servers. You want to allow incoming HTTP traffic on port 80 from any IP address on the internet. How should you configure the ingress rule?

A.Source: 0.0.0.0/0, Protocol: TCP, Destination Port: 80

B.Source: Internet Gateway, Protocol: ICMP

C.Source: 10.0.0.0/16, Protocol: UDP, Destination Port: 443

D.Source: 0.0.0.0/0, Protocol: UDP, Destination Port: 80

AnswerA

Source 0.0.0.0/0 allows traffic from any IP on port 80.

Why this answer

An ingress security rule allowing TCP traffic on destination port 80 with source CIDR 0.0.0.0/0 permits public HTTP access.

Practice this question →

MCQmedium

You need to connect an on-premises data center to an OCI Virtual Cloud Network with dedicated, high-bandwidth, and predictable network performance that bypasses the public internet entirely. Which OCI networking service should you implement?

A.Internet Gateway

B.Local Peering Gateway

C.Site-to-Site VPN

D.FastConnect

AnswerD

FastConnect provides a dedicated private network connection bypassing the public internet.

Why this answer

OCI FastConnect provides a dedicated, private connection between your on-premises data center and OCI with higher bandwidth and better reliability than the public internet.

Practice this question →

MCQmedium

An administrator needs to create a flexible OCI compute virtual machine instance. Which parameters are required when selecting a flexible compute shape?

A.Physical socket count and hypervisor version

B.Number of OCPUs and amount of memory (RAM)

C.Only the fixed instance shape family name

D.Network bandwidth allocation and disk spindle speed

AnswerB

Flexible shapes allow custom configuration of OCPUs and memory.

Why this answer

Flexible compute shapes require specifying the number of OCPUs and the amount of memory (RAM) independently.

Practice this question →

Multi-Selectmedium

Which TWO statements accurately describe OCI Block Volume backups?

Select 2 answers

A.Block volume backups can only be restored within the exact same availability domain where they were created.

B.Creating a block volume backup requires stopping the attached compute instance to ensure data integrity.

C.Block volume backups are stored in OCI Object Storage and can be restored as new volumes.

D.Block volume backups cannot be copied across different OCI regions.

E.You can configure volume backup policies to automate incremental and full backups on a recurring schedule.

AnswersC, E

Backups of block volumes are automatically stored in Object Storage and can be used to create new volumes at any time.

Why this answer

OCI allows both manual and automated scheduled backups, and backups can be copied across different OCI regions for disaster recovery.

Practice this question →

MCQeasy

What is the primary purpose of an OCI Internet Gateway when attached to a Virtual Cloud Network (VCN)?

A.To peer two VCNs within the same tenancy

B.To provide a communication path between the VCN and the public internet

C.To connect on-premises data centers via private circuits

D.To route traffic privately to Oracle services like Object Storage

AnswerB

Internet Gateway enables bidirectional internet communication.

Why this answer

An Internet Gateway provides a path for bidirectional network traffic between your VCN and the public internet.

Practice this question →

Multi-Selecthard

Which TWO statements are true regarding OCI File Storage Service (FSS)? (Choose two.)

Select 2 answers

A.File storage data is stored entirely within a single compute instance's local NVMe drive.

B.File Storage file systems have a hard maximum capacity limit of 50 Gigabytes.

C.File Storage requires iSCSI protocol configuration on every client instance.

D.All data stored in OCI File Storage is encrypted at rest by default.

E.File Storage file systems can be mounted concurrently by thousands of compute instances using NFSv3.

AnswersD, E

FSS automatically encrypts all file system data at rest.

Why this answer

FSS supports concurrent NFS mounts across instances and encrypts all file system data at rest by default.

Practice this question →

MCQhard

You are troubleshooting a connectivity issue where an on-premises server cannot reach an OCI compute instance over an IPsec VPN tunnel. The security list and NSG rules are verified as correct. What is another common OCI networking configuration that must be checked?

A.Confirm that the subnet has a Service Gateway attached

B.Check that the compute instance has a public IP address assigned

C.Verify that an Internet Gateway is attached to the VCN

D.Ensure the VCN route table has a rule pointing on-premises CIDR to the DRG

AnswerD

Without a route table entry pointing to the DRG, return or outbound packets cannot traverse the VPN.

Why this answer

The VCN route table must have a rule pointing traffic destined for the on-premises subnet to the Dynamic Routing Gateway (DRG).

Practice this question →

MCQmedium

A company is running a batch processing workload on OCI and wants to optimize compute costs by using spare capacity. The workload can tolerate sudden termination if OCI reclaims the capacity. Which compute instance type should be deployed?

A.Preemptible Instances

B.Reserved Capacity Instances

C.Standard Flexible Compute Instances

D.Dedicated Virtual Machine Hosts

AnswerA

Preemptible instances are offered at a discount using spare capacity and can be reclaimed by OCI.

Why this answer

Preemptible instances allow customers to utilize spare OCI compute capacity at a significant discount, with the caveat that OCI can reclaim them when needed.

Practice this question →

MCQeasy

A web application experiencing fluctuating traffic needs a compute solution that automatically scales out the number of virtual machine instances based on CPU utilization. Which combination of OCI services should be configured?

A.Container Instances and OKE

B.Compute Instances and Load Balancer

C.Instance Pools and Autoscaling Configurations

D.Bare Metal Instances and NAT Gateway

AnswerC

Instance pools group instances together, and autoscaling configurations adjust capacity dynamically.

Why this answer

Instance Pools and Autoscaling Configurations work together to automatically provision or terminate compute instances based on defined performance metrics.

Practice this question →

MCQmedium

You need to back up an on-premises database directly to OCI Object Storage using a dedicated, high-speed connection that does not use the public internet. Which networking service should you use?

A.Internet Gateway

B.FastConnect

C.Site-to-Site VPN

D.Local Peering Gateway

AnswerB

FastConnect provides dedicated private connections suitable for large database backups.

Why this answer

FastConnect provides dedicated private connectivity between on-premises data centers and OCI, bypassing the public internet.

Practice this question →

Multi-Selecteasy

Which TWO core OCI services provide compute capabilities? (Choose two.)

Select 2 answers

A.OCI File Storage Service

B.Oracle Container Engine for Kubernetes (OKE)

C.OCI Object Storage

D.OCI Virtual Cloud Network

E.Compute Instances

AnswersB, E

OKE provides managed container compute clusters.

Why this answer

Compute Instances and Oracle Container Engine for Kubernetes (or Container Instances) provide compute power in OCI.

Practice this question →

MCQeasy

An OCI tenant requires a dedicated, high-speed, private network connection from their on-premises data center to OCI that bypasses the public internet entirely. Which OCI service should be provisioned?

A.Service Gateway

B.IPsec VPN

C.Internet Gateway

D.FastConnect

AnswerD

FastConnect provides a dedicated private connection bypassing the public internet.

Why this answer

OCI FastConnect provides dedicated, private, high-bandwidth connections between an on-premises network and OCI.

Practice this question →

Multi-Selectmedium

Which THREE configuration items are specified when creating an OCI Virtual Cloud Network (VCN)? (Choose three.)

Select 3 answers

A.Availability Domain assignment

B.CIDR Block (IPv4)

C.VCN Name

D.DNS Label

E.GPU count specification

AnswersB, C, D

A CIDR block defines the IP address range for the VCN.

Why this answer

Creating a VCN requires specifying a name, a DNS label, and a CIDR block.

Practice this question →

MCQhard

An enterprise has two VCNs in the same OCI region. VCN-A needs to communicate with VCN-B. The VCN CIDR blocks do not overlap. The administrator configures a Local Peering Gateway (LPG) on VCN-A and another on VCN-B, and establishes the peer connection. However, instances in VCN-A still cannot reach instances in VCN-B. What additional step is required?

A.Modify the default Security List to allow inbound traffic from the same VCN CIDR.

B.Attach an Internet Gateway to both VCNs to route traffic between them.

C.Create a Dynamic Routing Gateway (DRG) and attach both VCNs to it.

D.Add route rules in the respective subnet route tables pointing the peer VCN's CIDR block to the LPG target.

AnswerD

Route table rules are mandatory for directing traffic into the Local Peering Gateway.

Why this answer

Peering gateways require explicit route rules in the subnet route tables pointing traffic destined for the peer VCN CIDR to the local LPG.

Practice this question →

MCQeasy

A company needs to store unstructured data such as log files, images, and backups in OCI for long-term retention at the lowest possible cost, and data retrieval times of several hours are acceptable. Which OCI Object Storage tier should be chosen?

A.Block Volume Backup Tier

B.Infrequent Access Tier

C.Archive Storage Tier

D.Standard Tier

AnswerC

Archive Storage provides the lowest cost for long-term retention with multi-hour retrieval times.

Why this answer

Archive Storage is designed for data that is rarely accessed and requires long-term retention, offering the lowest storage cost with a retrieval time of up to 4 hours.

Practice this question →

Multi-Selecthard

Which THREE of the following statements regarding OCI Virtual Cloud Network (VCN) Security Lists and Network Security Groups (NSGs) are correct? (Choose three.)

Select 3 answers

A.Security Lists apply to all VNICs in a specific subnet, whereas NSGs apply to a specific set of VNICs chosen by the user.

B.Security Lists are stateless by default and require manual configuration for stateful tracking.

C.Both Security Lists and Network Security Groups support stateful and stateless firewall rules.

D.An instance VNIC can be associated with multiple Network Security Groups.

E.Network Security Groups require rules to reference subnet CIDR blocks rather than other NSGs.

AnswersA, C, D

Security lists are subnet-level, while NSGs are VNIC-level.

Why this answer

Security lists apply to entire subnets and are stateful by default, whereas NSGs apply to specific VNICs and also support stateful or stateless rules.

Practice this question →

MCQeasy

Which OCI service is best suited for running serverless code functions that trigger based on events or HTTP requests?

A.OKE

B.OCI Functions

C.Container Instances

D.Compute Instances

AnswerB

OCI Functions is designed for serverless, event-driven architectures.

Why this answer

OCI Functions is a serverless, event-driven compute service.

Practice this question →

MCQhard

You are configuring an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) and need to ensure that compute instances in a private subnet can initiate outbound internet connections to download software patches without allowing unsolicited inbound traffic from the internet. Which gateway must you attach to the VCN?

A.Service Gateway

B.Internet Gateway

C.NAT Gateway

D.Dynamic Routing Gateway

AnswerC

A NAT Gateway allows outbound traffic to the internet while preventing inbound sessions.

Why this answer

A NAT (Network Address Translation) Gateway enables instances in a private subnet to connect to the internet for updates while blocking inbound connections from the internet.

Practice this question →

Multi-Selecteasy

Which TWO storage services in OCI provide encryption at rest by default? (Choose two.)

Select 2 answers

A.Public Internet Cache

B.Unencrypted On-Premises NAS

C.Local unmanaged scratch disks

D.OCI Block Volume

E.OCI Object Storage

AnswersD, E

Block Volume encrypts all data at rest by default.

Why this answer

All major OCI storage services including Object Storage and Block Volume encrypt data at rest by default.

Practice this question →

Multi-Selecteasy

Which TWO OCI storage services provide file or object storage capabilities rather than block storage? (Choose two.)

Select 2 answers

A.Boot Volume

B.OCI Block Volume

C.OCI File Storage Service

D.OCI Object Storage

E.Local NVMe Storage

AnswersC, D

File Storage Service provides shared network file system storage.

Why this answer

Object Storage and File Storage Service provide object and file storage respectively, whereas Block Volume provides block-level storage.

Practice this question →

MCQhard

An application deployment in a VCN private subnet needs to query external APIs hosted on the public internet, but malicious actors must not be able to initiate inbound connections to the application instances. Which combination of VCN gateways provides this required behavior?

A.Internet Gateway combined with a Service Gateway

B.Dynamic Routing Gateway combined with a NAT Gateway

C.NAT Gateway combined with a Security List blocking all inbound traffic from 0.0.0.0/0

D.Local Peering Gateway combined with an Internet Gateway

AnswerC

A NAT Gateway allows outbound traffic, and Security Lists control packet filtering to block unsolicited inbound traffic.

Why this answer

A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while blocking all unsolicited inbound connections.

Practice this question →

MCQhard

A.Using an Internet Gateway instead of a DRG with redundant static routes.

B.A single VPN tunnel connecting to a single CPE device.

C.Redundant VPN tunnels utilizing multiple CPE public IP addresses terminating on the DRG.

D.Configuring active-passive peering across two separate VCNs.

AnswerC

Redundant tunnels across multiple CPEs provide automatic failover and high availability.

Why this answer

OCI supports redundant VPN tunnels across multiple CPE public IPs terminating on a DRG to ensure high availability and failover.

Practice this question →

MCQmedium

What is the default behavior of a Security List in OCI?

A.Stateful

B.Always allow all

C.Stateless

D.Always deny all

AnswerA

Stateful rules track connection status.

Why this answer

Security Lists are stateful by default, meaning return traffic for allowed requests is automatically permitted.

Practice this question →

MCQhard

An application deployed on OCI Compute instances requires custom DNS records that resolve only within a specific VCN and are not exposed to the public internet. Which OCI DNS feature should you configure?

A.Internet Resolver Forwarding

B.Traffic Management Steering Policies

C.Public DNS Zone

D.Private DNS Zone

AnswerD

Private DNS zones provide internal domain name resolution within VCNs.

Why this answer

Private DNS zones allow you to manage internal domain names that are resolved exclusively within your VCNs.

Practice this question →

Multi-Selecthard

An administrator is configuring OCI Block Volume backups for production workloads. Which TWO features are natively supported by the OCI Block Volume service? (Choose two.)

Select 2 answers

A.Incremental backups that capture only blocks changed since the last backup

B.Automated backup policies with predefined frequencies (Bronze, Silver, Gold)

C.Real-time synchronous mirroring of block volumes across global cloud regions automatically

D.Direct backup storage to local NVMe drives on the same server

E.Instantaneous read-only block volume cloning

AnswersA, B

Block volume backups are fully incremental, capturing only blocks that have changed since the previous backup.

Why this answer

OCI Block Volume supports both manual backups and automated backup policies (Bronze, Silver, Gold), as well as cross-region volume replication for disaster recovery.

Practice this question →

MCQhard

An application running in an OCI VCN needs to access OCI Object Storage and Oracle Autonomous Database privately. Both services must be accessed without traffic leaving Oracle's network backbone and without using public IPs. Which combination of OCI gateway features accomplishes this?

A.Internet Gateway and NAT Gateway

B.Dynamic Routing Gateway paired with an external DNS resolver

C.Local Peering Gateway attached to the Object Storage tenancy

D.Service Gateway with appropriate VCN route table rules and security policies

AnswerD

Service Gateways provide private connectivity to Oracle services without public internet traversal.

Why this answer

A Service Gateway allows private access to regional Oracle services (like Object Storage), while Oracle Database services are accessed natively within private subnets via the service network.

Practice this question →

Multi-Selectmedium

Which THREE storage performance tiers are available for OCI Block Volumes? (Choose three.)

Select 3 answers

A.Lower Cost

B.Archive Tier

C.Higher Performance

D.Balanced

E.Infrequent Access Tier

AnswersA, C, D

Lower Cost is one of the Block Volume performance tiers.

Why this answer

OCI Block Volume offers Lower Cost, Balanced, and Higher Performance tiers.

Practice this question →

MCQhard

You need to ensure that database block volumes are automatically backed up daily with a retention policy of 30 days and cross-region replication. What OCI feature should you use?

A.Block Volume Backup Policies

B.Object Storage Lifecycle Management rules

C.Compute Instance Autoscaling configurations

D.Manual OCI CLI snapshot scripts

AnswerA

Backup policies automate scheduled backups, retention, and cross-region copying.

Why this answer

Block Volume Backup Policies automate scheduled backups, retentions, and cross-region replication.

Practice this question →

Multi-Selectmedium

Which TWO of the following features are provided by OCI DNS? (Choose two.)

Select 2 answers

A.Public DNS zones for managing globally resolvable internet domains

B.Automatic SSL certificate provisioning for backend web servers

C.Private DNS zones for internal VCN domain name resolution

D.Automated DDoS mitigation for compute instances without DNS zones

E.Direct layer 4 TCP packet load balancing

AnswersA, C

OCI DNS supports public zones for internet-facing domains.

Why this answer

OCI DNS supports both public DNS zones for internet domain resolution and private DNS zones for internal VCN name resolution.

Practice this question →

MCQmedium

To ensure high availability for your web application, you should deploy your instances across:

A.A single VCN

B.The same subnet

C.Different Availability Domains

D.A single Fault Domain

AnswerC

Spanning ADs protects against entire data center failures.

Why this answer

Deploying across different availability domains (ADs) or fault domains (FDs) is best practice for HA.

Practice this question →

MCQhard

An architect is provisioning a high-performance compute cluster that requires direct, unvirtualized access to physical hardware components, including raw local NVMe SSDs and high core counts, without hypervisor overhead. Which compute shape category must be chosen?

A.Bare Metal shapes

B.DenseIO VM shapes

C.Preemptible VM instances

D.Flexible Virtual Machine shapes

AnswerA

Bare Metal shapes provide dedicated physical hardware access without a hypervisor layer.

Why this answer

Bare Metal shapes provide dedicated physical servers with direct hardware access and no virtualization overhead.

Practice this question →

MCQeasy

Which OCI Object Storage feature allows you to grant temporary, time-bound read or write access to a specific bucket or object without sharing user credentials?

A.API Signing Keys

B.Identity and Access Management (IAM) Policies

C.Security Lists

D.Pre-authenticated Requests (PARs)

AnswerD

PARs allow temporary URL-based access without credentials.

Why this answer

Pre-authenticated requests (PARs) provide a way to securely let external users access or download specific objects or buckets without credentials for a defined duration.

Practice this question →

Multi-Selectmedium

Which THREE actions can be performed using OCI Object Storage features? (Choose three.)

Select 3 answers

A.Attach the bucket as an iSCSI block storage disk to a VM

B.Enable object versioning to protect against accidental data deletion

C.Generate pre-authenticated requests for temporary public data access

D.Configure cross-region replication to automatically copy bucket data to another region

E.Mount the bucket directly as a local NFSv3 file system on compute instances

AnswersB, C, D

Versioning retains previous object states.

Why this answer

Object Storage supports versioning, pre-authenticated requests, and cross-region replication.

Practice this question →

Multi-Selecthard

Which THREE of the following are methods to connect to OCI?

Select 3 answers

A.Local Peering

B.Public Internet

C.Service Gateway

D.Site-to-Site VPN

E.FastConnect

AnswersB, D, E

Standard connection method.

Why this answer

FastConnect, VPN, and Public Internet are standard connection methods.

Practice this question →

MCQmedium

You are configuring an OCI Network Load Balancer (NLB) for a high-performance database cluster. Why would you choose NLB over a regional Layer 7 Load Balancer?

A.NLB operates at Layer 4 and preserves client source IP addresses

B.NLB requires fewer VCN subnets than regional load balancers

C.NLB terminates SSL certificates and inspects HTTP payloads

D.NLB supports URL path-based routing for HTTP applications

AnswerA

NLB is Layer 4 and preserves source IPs.

Why this answer

Network Load Balancer operates at Layer 4, handles high packet rates with ultra-low latency, and preserves client source IP addresses.

Practice this question →

MCQhard

An application running on OCI Compute instances requires shared file storage that can be mounted concurrently across hundreds of Linux instances via the standard NFS protocol. Which OCI storage service is best suited?

A.Object Storage

B.File Storage Service

C.Block Volume

D.Local NVMe Temporary Storage

AnswerB

File Storage Service supports standard NFSv3 protocol and concurrent multi-instance mounting.

Why this answer

File Storage Service (FSS) provides a durable, scalable, enterprise-grade network file system that can be mounted by NFS protocol across multiple compute instances simultaneously.

Practice this question →

Multi-Selecthard

Which THREE of the following actions can be performed using OCI File Storage Service (FSS)? (Choose three.)

Select 3 answers

A.Encrypt file system data using Oracle-managed or customer-managed encryption keys in OCI Vault.

B.Attach the file system to compute instances as a block device using iSCSI commands.

C.Take point-in-time snapshots of the file system for data backup and recovery.

D.Mount the file system concurrently across thousands of compute instances using standard NFS v3 protocol.

E.Resize the file system storage capacity manually or configure it to require fixed 32 TB increments.

AnswersA, C, D

FSS supports encryption at rest using keys managed in OCI Vault.

Why this answer

FSS supports NFSv3, snapshot creation for data protection, and cross-region replication or cloning.

Practice this question →

MCQmedium

Which OCI feature allows you to attach a single block volume to multiple instances simultaneously?

A.Dynamic Routing Gateway

B.Object Storage

C.File Storage

D.Multi-attach

AnswerD

Multi-attach feature enables shared block storage access.

Why this answer

Block Volume 'multi-attach' allows read/write access from multiple instances.

Practice this question →

MCQeasy

An operations team wants to ensure that a critical web application automatically scales compute capacity up during high traffic spikes and scales down when traffic subsides. Which OCI service combination provides this capability?

A.Bare Metal instances with manual resizing

B.Instance Pools with Autoscaling Configurations

C.OCI Functions triggered by Object Storage events

D.Dedicated Virtual Host resource groups

AnswerB

Autoscaling configurations dynamically adjust the size of an instance pool based on performance metrics.

Why this answer

Compute autoscaling configurations work alongside Load Balancers and Instance Pools to automatically adjust the number of compute instances based on metrics like CPU utilization.

Practice this question →

Multi-Selecthard

Which TWO actions are supported when managing OCI Block Volume backups? (Choose two.)

Select 2 answers

A.Copying block volume backups across regions for disaster recovery

B.Attaching a block volume backup directly to multiple running instances

C.Converting a block volume backup directly into an Object Storage bucket

D.Mounting a block volume backup directly as an NFS file system

E.Automating backups using user-defined or predefined backup policies

AnswersA, E

Cross-region replication copies block backups to secondary regions.

Why this answer

Block volume backups can be scheduled using backup policies and replicated across regions.

Practice this question →

MCQeasy

Your development team needs to deploy containerized applications rapidly on OCI without managing underlying compute servers or clusters. Which OCI container service fits this requirement best?

A.Oracle Container Engine for Kubernetes (OKE)

B.Compute Instances with Docker pre-installed

C.OCI Functions

D.OCI Container Instances

AnswerD

Container Instances is a serverless service that enables developers to run containers instantly on OCI without managing underlying compute infrastructure.

Why this answer

OCI Container Instances is a serverless compute service that lets you run containers quickly without having to manage any servers or Kubernetes clusters.

Practice this question →