CCNA Core Oci Services Questions

A DRG accepts Site-to-Site VPN attachments, supporting both static and dynamic (BGP) routing, connecting on-premises networks to OCI. This satisfies the hybrid connectivity requirement, as the DRG acts as the regional routing hub between your premises and VCNs.

An OCI Internet Gateway is a highly available, horizontally scaled VCN component that provides bidirectional connectivity between the VCN and the public internet. It satisfies the requirement to route inbound and outbound public traffic for resources with public IP addresses.

Bare Metal shapes give the instance a whole physical server, so no hypervisor layer sits between the operating system and hardware. That removes virtualisation overhead and prevents noisy-neighbour contention, satisfying the stem's demands for dedicated hardware, maximum performance and strong isolation.

TLS/SSL encrypts application and load balancer traffic in transit, protecting data moving between clients and OCI endpoints. This directly satisfies the stem's requirement for securing data in transit within OCI networking, distinct from at-rest encryption or network segmentation controls.

Container Instances integrate with OCI File Storage, letting you mount file systems as volumes directly into containers. This satisfies the persistent shared storage requirement, unlike ephemeral local container storage, and avoids managing block volumes or custom drivers.

Object storage replicates objects across multiple devices or availability domains, delivering very high durability with negligible annual data loss probability. This satisfies the stem's requirement for a primary benefit, exceeding typical single-volume block storage resilience.

The CPE object represents the on-premises VPN device, recording its public IP address so OCI can build the IPsec tunnels. Without it, the DRG cannot identify the remote endpoint, so the site-to-site VPN connection cannot be established.

Customer-managed keys in OCI Vault give the organisation sole control over key creation, rotation and deletion, rather than Oracle-managed keys. Assigning that CMK to the Object Storage bucket ensures all stored data is encrypted under a key the customer manages, meeting the compliance mandate.

Object Lifecycle Management rules define policies that automatically transition or delete objects based on age, such as deleting after 90 days. This directly satisfies the retention compliance requirement without manual intervention, unlike retention locks or versioning.

Container Instances provides serverless container execution, letting you run individual containers without provisioning or managing underlying compute hosts. It satisfies the stem's requirement to manage containerized workloads by offering a lightweight, fully managed runtime for single containers, complementing OCI Container Engine for Kubernetes for orchestration-heavy scenarios.

A service gateway provides private access to Oracle services such as Autonomous Database, keeping traffic off the public internet. It satisfies the no-public-internet constraint by routing VCN traffic to the Oracle Services Network via the region's service CIDR label, unlike NAT or internet gateways.

A NAT gateway lets instances in private subnets initiate outbound internet connections without exposing them to inbound traffic. OCI permits attaching it to a VCN, satisfying the stem's requirement for a valid attachable gateway type.

The Dynamic Routing Gateway is the mandatory virtual router that attaches to VCNs and connects them to FastConnect private virtual circuits. It enables private IP reachability across multiple VCNs in different regions without public internet traversal.

Cross-Region Replication asynchronously copies Block Volume backups to a chosen destination region, satisfying the disaster recovery requirement. Copying backups manually between regions is not the supported automated mechanism, and Object Storage replication applies to buckets, not block volume backups.

Infrequent Access Storage suits data accessed rarely yet required instantly, matching the stem's availability constraint. Unlike Archive tiers, which need rehydration hours before retrieval, this tier keeps objects immediately readable while charging lower storage rates than Hot, cutting cost for millions of small, seldom-touched files.

A regional OCI Load Balancer spans multiple availability domains, so it can distribute HTTP/HTTPS traffic across backend compute instances in different ADs, satisfying the resilience constraint. A flexible or private load balancer confined to one AD would not achieve cross-AD distribution.

Security lists filter traffic at the VCN's virtual network interface, not inside the guest OS. A host firewall such as firewalld or iptables independently drops inbound TCP 3000, so it is the additional OS-level control blocking access despite the permissive security list.

A user-defined Volume Backup Policy supports multiple independent schedules, each with its own frequency and retention period, so daily-30-day and weekly-1-year backups coexist in one policy. Predefined policies offer fixed schedules and cannot express distinct retention periods, failing the stated requirement.

OCI's default IPsec parameters may not match the on-premises firewall's required Phase 1 and Phase 2 settings, so defining a custom IPsec connection with those exact algorithms and lifetimes restores tunnel negotiation. Default connections offer no parameter override, causing the mismatched-proposal packet drops described.

OCI Container Instances runs Docker containers directly without managing servers or Kubernetes worker nodes, satisfying the serverless container requirement. It differs from OKE, which requires managing node pools, and from Functions, which is event-driven rather than long-running.

A Managed OKE cluster runs the Kubernetes control plane entirely within Oracle's tenancy, with worker nodes deployed as node pools in the customer's VCN. This matches the stem's requirement that OCI manages master nodes while workers run in the team's VCN.

FastConnect provides a dedicated, private physical circuit between the on-premises network and OCI, bypassing the public internet. It satisfies the requirement for an on-premises-to-VCN connection while offering predictable latency and higher bandwidth than internet-based alternatives.

An Internet Gateway is the VCN component that provides a routed path to the public internet, enabling bidirectional traffic for resources in public subnets with public IP addresses. It satisfies the requirement for connectivity between the VCN and external networks, unlike NAT or Service Gateways.

The Layer 7 Load Balancer operates at the application layer, enabling HTTP/HTTPS routing, SSL termination, and cookie-based session persistence. Layer 4 balancing handles only TCP/UDP, so it cannot inspect cookies or terminate SSL for this scenario.

Preemptible instances run on spare capacity and can be reclaimed by OCI at short notice, delivering substantial discounts suited to fault-tolerant batch workloads. The stem's tolerance of sudden termination matches this reclaimable model, unlike on-demand or reserved capacity.

A service gateway provides private access from a subnet to Oracle Cloud Infrastructure Object Storage, keeping traffic off the public internet. It satisfies the stem's private-network constraint, since database instances in the private subnet route to Object Storage through the gateway rather than traversing the internet or requiring a NAT gateway.

Preemptible Instances tap spare OCI capacity at steep discounts, satisfying the stem's cost-reduction goal. They can be reclaimed with little notice, so they suit only fault-tolerant workloads that checkpoint or tolerate interruption. That trade-off between price and reliability is precisely why the option pairs lower cost with fault tolerance.

File Storage Service provides a POSIX-compliant, shared, high-performance file system mountable by multiple compute instances concurrently across availability domains. This satisfies both constraints in the stem: POSIX semantics and cross-availability-domain shared access, which object and block storage cannot deliver.

Backend sets group the compute instances or IP addresses that receive traffic, paired with health checks and policies. The listener and load balancer reference a backend set to route incoming requests to the correct servers.

OCI DNS public zones host authoritative records for internet-facing domains, letting you create and manage A, CNAME and TXT entries. This directly satisfies the stem's requirement to register and manage public DNS records for a domain hosted on OCI.

Object Storage public buckets serve objects directly over HTTP without any compute instance, so no VM web server is provisioned. Enabling public visibility on the bucket satisfies the stem's constraint of hosting static HTML, images and JavaScript entirely on OCI.

OCI FastConnect provides a dedicated, private physical or logical connection between on-premises infrastructure and OCI, bypassing the public internet. This satisfies the requirement for predictable, high-speed performance, unlike IPSec VPN, which traverses the internet and offers variable latency.

Oracle Container Engine for Kubernetes provides a managed Kubernetes control plane while leaving worker node compute under customer control, matching the stated split of responsibilities. OCI Container Instances and Functions abstract away nodes entirely, so they cannot satisfy the requirement to manage worker nodes yourself.

Bare Metal instances give the tenant the entire physical server with no hypervisor layer, so no other customer shares CPU, memory or network hardware. This hardware-level separation satisfies workloads demanding strict isolation, licensing on physical cores, or non-virtualised performance.

Container Instances runs containers directly on OCI-managed infrastructure, removing the need to provision or patch Kubernetes clusters, node pools, or servers. This serverless container runtime satisfies the stem's constraint of running Docker containers quickly without orchestration overhead.

A private subnet reaches the internet only when its route table contains a 0.0.0.0/0 rule targeting the NAT Gateway. Without that route, traffic has no path outbound, regardless of the gateway's attachment or permissive security lists. The stem confirms the gateway exists and egress is allowed, isolating the missing route as the cause.

OCI Functions executes code in response to events without any server provisioning, satisfying the stem's serverless constraint. Its maximum execution timeout of five minutes accommodates the stated short duration, whereas container or VM services would require infrastructure management the developer explicitly wants to avoid.

OCI File Storage Service delivers a hierarchical, NFS-accessible shared file system, satisfying the stem's demand for file storage rather than block storage. Unlike block volumes, which present raw fixed-size blocks to a single instance, it supports concurrent multi-client access through standard file protocols, making it a valid selection alongside OCI Object Storage.

Traffic destined for Object Storage must be routed to the Service Gateway, so the subnet's route table needs a rule whose destination is the Oracle Services Network service CIDR and whose target is that gateway. Without it, packets never reach the gateway.

OKE provisions and manages the Kubernetes control plane (API server, scheduler, etcd) across availability domains, while worker nodes run in the customer's tenancy and VCN. This split responsibility matches the stem's requirement that Oracle manages masters and the customer manages workers.

Remote Peering Connection attached to each region's Dynamic Routing Gateway provides the private, cross-region VCN-to-VCN link. A single DRG alone cannot span regions, so the RPC pairing is the required component for this inter-region connectivity.

The IPsec connection is the encrypted tunnel object itself, binding the CPE to the DRG and carrying traffic between the on-premises network and the VCN. Without it, no IPsec VPN path exists, so it is mandatory for this topology.

A NAT Gateway translates private subnet egress traffic to a public source IP, enabling instances to reach the internet while blocking unsolicited inbound connections. This satisfies the outbound-only constraint, unlike an Internet Gateway, which permits bidirectional traffic and requires public IP addresses on instances.

Path-based routing inspects the request URI and forwards traffic to different backend sets according to rules matching prefixes such as /api or /web. This directly satisfies the requirement to distribute traffic by URL path, unlike simple round-robin or host-based listeners.

File Storage Service provides a shared, elastic NFSv3 file system that multiple Linux instances can mount concurrently, including across availability domains within a region. This directly satisfies the stem's requirements: simultaneous multi-instance access, NFSv3 protocol support, and cross-availability-domain reach, which block volume attachments cannot deliver.

Private DNS Zones resolve hostnames to private IP addresses inside a VCN, with the zone attached to the VCN and views controlling resolution. This satisfies the requirement for internal hostname resolution without exposing records publicly.

Placing the node pool across multiple subnets in different Availability Domains or Fault Domains spreads worker nodes physically, so a single rack failure cannot take down the whole pool. This satisfies the requirement to prevent downtime from one hardware rack failing.

A Block Volume Clone creates an instantaneous point-in-time copy using copy-on-write, so no bulk data movement occurs at creation. This satisfies the space-efficient, no-wait constraint, unlike a full backup-and-restore cycle, which copies all blocks before the volume becomes usable.

An Internet Gateway provides bidirectional internet connectivity for subnets with public IP addresses, and it attaches directly to a VCN. This satisfies the stem's requirement for a gateway that can be attached to an OCI Virtual Cloud Network.

A private subnet carries no route rule targeting an Internet Gateway, so instances lack public connectivity in either direction. Placing database servers there satisfies the isolation requirement, while a public subnet would expose them to inbound internet traffic.

Bare metal shapes run directly on dedicated physical hardware with no hypervisor, eliminating virtualisation overhead and giving full CPU, memory and network performance. This matches the scenario's requirement for dedicated servers without a virtualisation layer.

A Dynamic Routing Gateway (DRG) provides the virtual router that connects your VCN to on-premises networks via FastConnect or IPSec VPN. Setting the DRG as the route target forwards on-premises-bound traffic through that gateway, satisfying the requirement to route private subnet traffic correctly to the data centre.

Volume cloning creates a point-in-time copy of a block volume, letting you restore data after accidental deletion or corruption without affecting the source. It satisfies the stem's protection requirement through snapshot-based replication, unlike encryption or access controls, which prevent rather than recover. Cloning therefore delivers the resilience the scenario demands.

A public load balancer provides a regional, fault-tolerant entry point that spreads HTTP/HTTPS traffic across backend instances in multiple availability domains. It satisfies the stem's requirement for a resilient entry point, unlike a private load balancer, which only serves internal clients within a VCN.

OCI Functions is a fully managed, serverless platform that executes code triggered by events, scaling automatically without provisioning or patching virtual servers. This satisfies the constraint of running code on demand with no infrastructure management, unlike Compute instances.

Network Security Groups apply stateful allow or deny rules at the instance's virtual NIC or subnet level, so rules can target a single compute instance without altering other instances sharing the subnet. This satisfies the requirement to restrict access per application instance.

SSL termination happens at the listener, which references a certificate bundle stored in the load balancer's certificate configuration. Associating that certificate with the HTTPS listener satisfies the stem's requirement for secure traffic with SSL termination at the load balancer.

OCI Functions is a fully managed, serverless platform that executes code in response to events or HTTP requests, so no server or runtime provisioning is needed. This directly satisfies the stem's requirement to run event-triggered functions without managing infrastructure.

OCI Functions is a serverless platform that executes code in response to events, with OCI provisioning and scaling the runtime environment. This satisfies the constraint because no operating system or hypervisor management is exposed to the customer.

Security Lists are subnet-level constructs applied to every VNIC in the subnet, whereas NSGs are VNIC-level and apply only to the specific VNICs you add. This axis of difference determines how granularly you can target security rules.

Instance Pool health checks monitor instance state, and auto-healing terminates and recreates instances that fail checks or land on failed hardware. This directly satisfies the stem's requirement for automatic replacement after catastrophic physical hardware failure.

A Service Gateway provides private access to Oracle services such as Autonomous Database over the OCI backbone, keeping traffic off the public internet. It is configured within the VCN and satisfies both the privacy and backbone-network constraints.

Lifecycle Management Policies apply rule-based transitions between Object Storage tiers, automatically demoting objects to Archive Storage once they reach the specified 90-day age threshold. This satisfies the stem's cost-saving requirement without manual intervention or application changes, since the policy runs server-side against object metadata.

OCI Object Storage is designed for massive volumes of unstructured data, storing images and backups as objects in buckets without filesystem or block constraints. Its durability and elastic capacity suit this requirement better than Block Volume or File Storage.