CCNA Core Oci Services Questions

Container Engine for Kubernetes provisions and manages OCI-hosted Kubernetes clusters, handling control plane lifecycle, node pools and upgrades. It is the platform service for running containerised workloads, directly matching the stem's requirement to host containers and manage clusters.

Object Storage Lifecycle Rules define policy-based actions on objects matching age or name-prefix filters, so a rule specifying 90 days triggers automatic transition to Archive tier without manual intervention or external scheduling. This directly satisfies the stem's automation constraint, unlike replication, retention locks, or pre-authenticated requests, which address different requirements.

HTTPS encrypts traffic between clients and the load balancer using TLS, protecting credentials and data in transit. The scenario asks for the recommended securing protocol, and HTTPS terminates TLS on the listener, unlike plain HTTP which transmits unencrypted.

Peering alone does not route traffic; each VCN's route table must contain a rule directing the peer CIDR to the LPG. Without this rule, packets have no path to the gateway, so private communication between the two VCNs fails despite the peering link existing.

PARs grant time-limited access to a specific object or bucket via a unique URL, letting external users read or write without OCI credentials or IAM policies. This is an Object Storage-native sharing mechanism, satisfying the question's requirement for features tied directly to the service.

OCI Object Storage delivers 99.999999999% durability across availability domains and redundancy tiers, meeting the high-durability requirement. Its infrequent-access and archive tiers provide the lowest cost per gigabyte for backup data, and objects are accessed via API rather than mounted as a file system, satisfying the no-immediate-mounting constraint.

OCI Object Storage imposes no bucket-level capacity ceiling; a bucket can hold practically boundless data. Limits apply per object (about 10 TiB) and per tenancy, not to the bucket's total size, so the default maximum is effectively unlimited.

Flexible Virtual Machine shapes decouple OCPU and memory allocation, letting you select each independently within defined ratios rather than accepting a fixed bundle. This directly satisfies the stem's requirement for flexible sizing, unlike standard shapes where the two are locked together.

OCI Load Balancer integrates with the Kubernetes Ingress controller to expose multiple HTTP services behind one public IP, satisfying the single-IP and URL path routing constraint. Its layer 7 listeners and routing policies evaluate request paths, unlike layer 4 network load balancers, which cannot route by URL.

OCI enforces distinct resource quotas and limits for Security Lists versus NSGs within a VCN.

Private DNS Resolver forwarding rules direct queries for specific on-premises domains to the corporate directory server's IP addresses over the FastConnect link, while all other names resolve normally within the VCN. This satisfies the stem's custom resolution requirement.

Autoscaling configurations attach to an Instance Pool, defining scaling policies that monitor metrics and adjust instance count. Applying it there satisfies the CPU-based scale-out and scale-in requirement, unlike configuring it on individual instances or load balancers.

OCI Block Volume supports attaching volumes either paravirtualized, where the hypervisor presents the device to the instance, or via iSCSI, where the instance connects to the volume over the network. Both are valid attachment methods for compute instances.

Public subnets in each Availability Domain host the application servers, while private subnets in each Availability Domain hold the databases, giving both high availability and isolation from internet traffic. Intra-VCN traffic stays on the low-latency network, meeting the stem's constraints.

File systems grow and shrink online without provisioning fixed capacity upfront, and you pay only for consumed storage. This satisfies the requirement for elastic capacity, distinguishing FSS from block volumes that must be sized in advance.

NSG rules reference NSGs as source or destination rather than CIDR blocks, so naming the web server NSG as source permits exactly those instances and updates automatically as membership changes. This satisfies the requirement for NSG-to-NSG communication.

NFS mounts require TCP and UDP traffic on ports 111, 2048, 2049 and 2050 to reach the mount target. Security Lists or NSGs in the target subnet must permit this traffic, otherwise the mount hangs waiting for a response.

Dedicated Virtual Machine Hosts allocate an entire physical server to a single tenancy, so no other customer's instances share the hardware. This satisfies the exclusive-allocation constraint, unlike standard multi-tenant shapes or bare metal instances, which do not provide host-level tenancy isolation.

Memory Utilization is a compute instance metric available through the OCI Monitoring service when the Compute Instance Monitoring plugin is enabled on the instance. It satisfies the question's requirement for a monitorable compute metric, reporting the percentage of physical memory consumed by the instance.

Each OCI Site-to-Site VPN connection provisions two redundant IPSec tunnels per DRG attachment, each terminating on a distinct Oracle VPN endpoint. This satisfies the stem's high-availability requirement, allowing separate CPE public IPs to communicate with distinct tunnel endpoints.

Block volume backups are stored in OCI Object Storage, not in the block volume service itself. Object Storage provides durable, replicated retention independent of the source volume, so the backup survives even if the original block volume is deleted.

Standard Storage serves frequently accessed data with the lowest latency and highest throughput of the Object Storage tiers. Archive and Infrequent Access tiers trade retrieval speed and per-request latency for lower storage cost, so they fail the fast, frequent access requirement.

Infrequent Access Storage targets data accessed rarely but needing immediate availability, with lower storage cost than Standard and lower retrieval cost than Archive. This satisfies the stated requirement for rapid access with reduced retrieval charges compared with Archive tier.

Autoscaling dynamically adjusts compute instance count in response to metrics such as CPU utilisation, adding instances when the 80% threshold is breached and removing them when demand falls. This directly satisfies the stem's requirement for automatic horizontal capacity adjustment.

The OCI DNS Service is the managed Domain Name System offering, hosting public zones and records with global anycast resolution. It directly fulfils the requirement to manage domain records without operating DNS infrastructure, unlike compute or load-balancing services.

Without a subnet route rule whose destination is the on-premises CIDR and whose target is the DRG, instances have no path back to the datacentre; the DRG alone does not populate route tables. This satisfies the missing-routing requirement.

FastConnect provides a dedicated private physical link between on-premises infrastructure and OCI, bypassing the public internet and delivering predictable, consistent bandwidth. Site-to-site VPN traverses the internet with variable throughput, so it cannot satisfy the consistent-bandwidth constraint.

OCI Events emits an object-create event when a new object lands in the bucket, and an event rule invokes an OCI Functions function, which runs the script serverlessly and immediately without provisioning or managing compute instances.

Autoscaling policies act only when metric thresholds are breached and the cooldown interval has elapsed; a misconfigured threshold or active cooldown suppresses scale-out despite high CPU. This directly explains why no scaling action triggers, whereas instance health or image issues would not selectively block scale-out events.

OKE with virtual nodes provides a serverless Kubernetes experience where you do not manage worker nodes. Pods run on virtual nodes that scale automatically, and you pay only for the resources your pods request. This matches the need for no node management, automatic scaling, and consumption-based billing.

Network Security Groups apply stateful rules at the VNIC level, so instances within one subnet can belong to different NSGs with distinct rule sets. Security Lists, by contrast, apply uniformly to every instance in a subnet.

Flexible shapes decouple OCPU and memory allocation, letting you specify each independently within the shape's permitted ratio range at launch. This directly satisfies the stem's requirement that OCPUs and RAM be configured separately rather than in fixed bundles.

A Service Gateway provides private connectivity from a VCN to OCI services such as Object Storage, so traffic never leaves the Oracle network. Adding a route rule targeting the Object Storage service CIDR directs that traffic through the gateway, satisfying the requirement to avoid the public internet while staying within the same region.

Network Load Balancer operates at Layer 4, passing TCP/UDP packets through without proxy termination, which delivers millions of packets per second at ultra-low latency and preserves the client source IP. Layer 7 alternatives terminate connections and rewrite addresses, breaking the source-IP constraint.

A Pre-authenticated Request generates a unique URL granting time-bound access to the specific backup object, requiring no OCI account or IAM console permissions. This satisfies the requirement to share a multi-gigabyte file securely with an external auditor.

An LPG requires matching route rules in both VCNs pointing to the gateway for the peer's CIDR. If either VCN's route table lacks that entry, return or forward traffic is dropped, producing the intermittent packet loss described.

Internet Gateway allows bidirectional public internet traffic.

Placing the database in a private subnet removes it from public internet routing, so only resources inside the VCN, such as the OKE cluster, can reach it. This satisfies the best-security-practice constraint by keeping the database unreachable externally.

Flexible shapes decouple OCPU count from memory allocation, so RAM can be tuned independently within the shape's permitted ratio range. This satisfies the stem's requirement for independently adjustable parameters, unlike fixed shapes where the OCPU-to-memory ratio is locked. Memory is therefore one of the two valid answers.

OKE provides a managed Kubernetes control plane plus node pools with automated worker scaling and managed upgrades, satisfying the orchestration, scaling and upgrade requirements. Container Instances lacks Kubernetes orchestration, and OCI Functions is event-driven rather than cluster-based.

Ephemeral IPs do not persist.

Standard Storage is the default hot tier for frequently accessed data, offering low latency and high durability, and satisfies the requirement of naming a tier available in OCI Object Storage alongside Infrequent Access and Archive.

Availability Domains are isolated, fault-tolerant datacentre groupings within a region, each with independent power, cooling and network. Distributing resources across them satisfies the high-availability requirement, since a single AD failure does not affect instances running in the others.

OCI File Storage Service exposes NFS file systems that many Linux instances can mount and share concurrently, which suits shared configuration files. Object Storage and Block Volume cannot be mounted simultaneously by multiple instances as a POSIX file system, so they fail this requirement.

Archive Storage is the lowest-cost tier, designed for long-term retention of rarely accessed data with retrieval times measured in hours, matching the stated tolerance. Standard and Infrequent Access tiers cost more and offer faster retrieval than the scenario requires.

SSL termination lets the load balancer decrypt incoming HTTPS traffic at the listener, then forward plain HTTP to backend servers, offloading certificate handling and CPU cost from those servers. OCI Load Balancer supports configuring certificates on listeners for exactly this purpose.

FastConnect provides a dedicated, private physical circuit that bypasses the public internet, satisfying the bypass and SLA-backed throughput constraints. The Dynamic Routing Gateway terminates that private virtual circuit and routes traffic between the on-premises network and the OCI VCN, delivering the required high-throughput, reliable hybrid connectivity.

Archive Storage is a genuine Object Storage tier designed for rarely accessed data retained for long periods, offering the lowest storage cost with higher retrieval latency. It sits alongside Standard and Infrequent Access as a valid tier.

NSG ingress rules reference other NSGs as source, letting the database NSG accept traffic from any VNIC in the web server NSG regardless of IP changes. CIDR-based sources would require manual updates whenever web server addresses shift, so NSG-as-source satisfies the dynamic grouping constraint.

Instance Pools group identical Compute instances, and Compute Autoscaling policies scale pool size automatically based on metrics such as CPU utilisation. Together they satisfy the stem's requirement to add or remove instances dynamically as traffic fluctuates.

A NAT Gateway provides outbound-only internet access for instances in a private subnet, translating their private IPs to a public address. It satisfies the constraint of allowing update downloads while blocking unsolicited inbound traffic, since no inbound path is created.

OCI Autoscaling automatically adjusts the number of compute instances in an instance pool based on performance metrics like CPU utilization. It supports scale-out and scale-in policies with thresholds, and integrates with load balancers. This directly meets the requirement for automatic scaling with minimal operational overhead.

Local Peering Gateway connects two VCNs within the same region over Oracle's private backbone, satisfying the private communication requirement without traversing the internet. It is the only OCI construct designed for intra-region VCN-to-VCN peering, unlike Dynamic Routing Gateway, which serves remote or on-premises connectivity.

A default route (0.0.0.0/0) in the private subnet's route table directs all internet-bound traffic to the NAT Gateway, satisfying the requirement to route outbound traffic from private compute instances. The NAT Gateway then translates source addresses, enabling outbound connectivity while preventing inbound internet access.

A reserved public IP is allocated to your tenancy and persists independently of any instance, so it can be detached and reattached to satisfy the compliance requirement that the same address is retained across migrations or instance rebuilds.

Listeners define the IP address, port and protocol on which the load balancer accepts incoming traffic, and reference the backend set that handles it. Without a listener the load balancer cannot receive client connections, satisfying the requirement that listeners are a core component.

Network Load Balancers operate as pass-through Layer 4 devices, forwarding packets without terminating or rewriting the connection, so the original client source IP reaches backends unchanged. This satisfies the stem's requirement of source IP preservation, unlike proxy-based load balancers.

OCIR is OCI's native, fully managed registry for storing and sharing OCI-compliant container images, integrating directly with OKE and identity policies. It satisfies the stem's requirement for a natively provided container image registry rather than a third-party or self-hosted alternative.

OCI Functions executes event-driven code without provisioning servers, billing only for invocation duration, which suits a short-lived periodic job. However, it caps execution at five minutes, so a genuinely long-running batch would breach that limit. For a stateless task terminating on completion, this serverless model satisfies the no-server-management constraint precisely.

A Service Gateway provides private access to Oracle services such as Object Storage without internet traversal, and the VCN route table needs a rule targeting the service's CIDR via that gateway. Both components together satisfy the private-routing constraint.

Changing the volume's performance tier directly raises the provisioned IOPS and throughput limits of the block volume, satisfying the requirement to improve performance without detaching it from the compute instance. Oracle Cloud Infrastructure offers Lower Cost, Balanced, Higher Performance and Ultra High Performance tiers, each setting distinct IOPS and throughput ceilings.

OCI Container Instances run containers without provisioning or managing underlying compute, so no worker nodes or cluster control plane are needed. This satisfies the stem's demand for the primary benefit: serverless execution. Unlike Container Engine for Kubernetes, which requires node pools, it bills only for resources consumed during execution.

Block Volume provides NVMe-backed, low-latency storage that can be attached as a boot volume to compute instances, meeting the high-performance requirement. Unlike Object or File Storage, it offers the persistent, block-level access a VM's operating system needs, and its performance tiers let you match IOPS to workload demand.

Flexible shapes let you specify an exact OCPU and memory ratio, scaling independently rather than choosing fixed bundles. This satisfies the question's requirement for a valid OCI compute shape type alongside bare metal and fixed shapes.

FastConnect offers two distinct connectivity models: via a service provider, where the provider handles the physical cross-connect, and via colocation, where your equipment connects directly at the exchange. This directly satisfies the stem's requirement for multiple supported models, confirming the statement as accurate.

A public load balancer distributes inbound traffic across backend instances, while instance pools supply identical compute members and autoscaling configurations adjust pool size on demand. Together they deliver the scaling and load balancing the web application architecture requires.

A regional subnet spans every availability domain within its region, satisfying the requirement for a subnet not confined to a single AD. Unlike AD-specific subnets, which are locked to one availability domain, regional subnets extend across all ADs in the region, giving the architect maximum placement flexibility.

File Storage Service provides a shared, POSIX-compliant NFS file system mountable concurrently by many Compute instances across subnets. This satisfies the requirement for simultaneous shared access across hundreds of instances, unlike Block Volume, which attaches to a single instance.

Flexible shapes decouple OCPU and memory allocation, letting you select each independently within supported ratios. This satisfies the requirement to scale CPU and memory separately, unlike fixed shapes where both are bundled in preset combinations.

Route table rules determine whether traffic from the public subnet has a path to an internet gateway. Without a 0.0.0.0/0 route targeting the IGW, the instance cannot reach the internet regardless of other configuration. This is the first check because routing is the fundamental prerequisite for outbound connectivity.

OCI Load Balancer distributes incoming client traffic across backend Compute instances and terminates SSL/TLS at the listener, satisfying both the even-distribution and SSL-offload requirements. Flexible shapes and policies such as weighted round robin let the architect balance load without decrypting on each web server.

Paravirtualized attachment is a supported OCI Block Volume attachment method, using the hypervisor's virtio driver rather than emulating a device. It satisfies the question's requirement for a valid attachment method, delivering higher performance than emulated options while requiring no iSCSI configuration inside the instance.

Ultra High Performance is the only OCI Block Volume tier delivering the highest IOPS per volume, with up to 225,000 IOPS, designed for unpredictable bursty I/O. Lower tiers cap IOPS well below this, so they cannot meet the stated requirement.

OCI Load Balancers terminate incoming SSL/TLS connections at the listener and forward decrypted traffic to backend servers, offloading cryptographic processing. This reduces CPU overhead on backends and centralises certificate management, satisfying the SSL offloading statement.

Network Security Groups apply rules at the VNIC level, so only the chosen database instances receive the restriction while the subnet's own security lists stay untouched. This satisfies the fine-grained, subnet-independent constraint that security lists cannot meet.