CCNA Core Oci Services Questions

NLB operates at Layer 4 of the OSI model, distributing TCP, UDP and ICMP traffic based on connection tuples rather than HTTP content. This connection-oriented mechanism satisfies the stem's requirement for a layer 4 load balancing feature.

A Block Volume Backup captures a point-in-time, read-only copy of a block volume, stored independently and restorable for disaster recovery. It satisfies the stem's requirement for a point-in-time read-only copy of a data disk for backup and DR purposes.

DNS support is a configurable VCN property, toggled via the VCN's DNS settings, enabling Oracle-provided DNS resolution for instances within the VCN. This satisfies the stem's requirement for a genuine VCN property, since DNS support is configured at the VCN level rather than on individual subnets or instances.

Archive Storage is OCI's lowest-cost tier, designed for long-term retention where retrieval takes hours. This satisfies both the seven-year compliance retention and minimal-cost constraints, unlike Standard or Infrequent Access tiers, which cost more and retrieve faster.

OKE provisions and manages Kubernetes clusters, giving you the managed control plane used to orchestrate and run containerised applications on OCI. It satisfies the build-and-manage requirement by handling cluster lifecycle, node pools and upgrades rather than just running a single container.

OCI Load Balancer operates at layer 7, distributing HTTP/HTTPS traffic across backend instances in multiple availability domains, satisfying the fault-tolerance and high-throughput constraints. It performs health checks and removes unhealthy backends, unlike a single-instance or layer-4-only approach, ensuring regional resilience within the specified region.

Block Volume is an OCI storage service, providing network-attached block storage for compute instances. It satisfies the stem's requirement by being a native OCI offering, unlike non-OCI alternatives. Block volumes persist independently of instance lifecycle and can be attached or detached as needed, confirming it as one of the two correct storage services.

A Dynamic Routing Gateway is a virtual router that provides a path for private traffic between a VCN and on-premises networks, remote VCNs, or other regions. It satisfies the stem by enabling private connectivity without exposing traffic to the public internet.

A Service Gateway provides private access from a VCN to supported Oracle services such as Object Storage, satisfying the no-public-internet constraint. Traffic routes over the Oracle network without exposing the instance to the internet, unlike a NAT gateway, which handles general outbound internet traffic.

Archive Storage is the only OCI tier designed for long-term retention of rarely accessed data, with retrieval times measured in hours. It satisfies the seven-year compliance retention and petabyte-scale requirements at the lowest cost per gigabyte, matching the stem's tolerance for slow retrieval.

Object Versioning retains multiple variants of an object within a bucket, letting you recover overwritten or deleted data. It satisfies the bucket-feature requirement by preserving prior object states rather than replacing them, and can be enabled or suspended per bucket.

Flexible shapes decouple OCPU count from memory, letting you set each independently within defined minimum and maximum limits per shape, unlike fixed shapes with preset ratios. This satisfies the requirement regarding what flexible shapes actually permit.

Security lists and NSGs act as virtual firewalls for instances in a VCN. To allow database access only from the web tier, you must configure a rule that permits inbound TCP port 1521 traffic from the web tier's subnet CIDR or from the web tier's NSG. This enforces the principle of least privilege and restricts access to the database tier. Without this rule, the database would be inaccessible or overly permissive.

Object Versioning keeps multiple variants of an object in the same bucket to prevent data loss.

File Storage Service provides NFSv3 shared file systems mountable concurrently by many compute instances, satisfying the POSIX-compliant, multi-AZ requirement. Unlike Block Volume, which attaches to a single instance, FSS scales to hundreds of clients across availability domains within a region, meeting the simultaneous multi-mount constraint in the stem.

Network Security Groups apply security rules to individual VNICs, letting policy be scoped to a workload's role rather than its subnet CIDR. This satisfies the requirement to restrict inter-subnet traffic based on workload identity in a zero-trust design.

The Dynamic Routing Gateway is the VCN-side endpoint terminating the IPSec VPN, providing the attachment point for on-premises traffic. It satisfies the stem's requirement for a component inside the VCN acting as the endpoint, which a customer-premises equipment device or internet gateway cannot provide.

A regional subnet spans all availability domains within its region, so resources in any AD can use it. This is one of the two OCI VCN subnet types, contrasted with availability domain-specific subnets confined to a single AD.

OCI allows cloning existing volumes.

Flexible shapes decouple OCPU and memory allocation, letting the architect independently select a custom OCPU count and memory ratio. Fixed shapes bundle preset resource pairs, so they cannot satisfy the memory-intensive sizing requirement. This directly meets the stem's demand for a custom number of OCPUs and memory.

The Higher Performance tier delivers lower latency and higher IOPS/throughput per volume than Balanced or Lower Cost, using NVMe SSDs. It satisfies the stem's requirement for guaranteed high performance and low latency during heavy database operations.

A Virtual Cloud Network (VCN) is OCI's software-defined equivalent of a traditional physical network, providing subnets, route tables, and gateways within a single region. It satisfies the stem's requirement for a software-defined network construct, unlike compartments, which organise resources, or availability domains, which represent physical datacentre locations.

A regional load balancer spans multiple availability domains within a region, distributing traffic across backend servers in each and surviving an AD failure. Flexible shapes and public/private addressing are separate attributes; the regional scope is what satisfies the cross-AD availability constraint.

Block Volume Backup Policies attach to volumes and automatically create scheduled backups with defined retention, and can be copied to other regions. This satisfies the stem's daily backup, 30-day retention, and multi-region requirements without manual intervention.

A Pre-authenticated Request grants time-limited access to a specific object via a unique URL, requiring no IAM credentials or account membership. This satisfies the stem's constraint of temporary read access to one file without managing IAM user credentials.

Lifecycle Rules apply time-based, bucket-level policies that automatically transition objects between Standard and Infrequent Access tiers, then delete them. This directly satisfies the 30-day transition and 365-day deletion constraints without manual intervention or custom code.

FSS provides a shared, elastic NFSv3 file system that multiple compute instances in the same VCN can mount concurrently. It scales automatically up to 8 EB and is designed for POSIX workloads such as HPC simulations. This matches the requirement for a shared, POSIX-compliant file system with no capacity provisioning.

The Infrequent Access tier is designed for data that is accessed less frequently but requires rapid retrieval when needed. It offers lower storage costs than the Standard tier while maintaining millisecond latency. This matches the requirement to minimize costs without sacrificing retrieval speed.

Object Storage provides durable, low-cost, internet-accessible buckets suited to long-term retention, so on-premises datasets can be copied there via CLI, API or transfer appliances. Its unlimited capacity and lifecycle tiering satisfy the long-term storage constraint without provisioning block volumes or databases.

VPUs decouple IOPS and throughput from volume size, letting you tune performance without over-provisioning capacity. This satisfies the stem's requirement that performance scales independently of storage capacity, unlike fixed-performance tiers where the two are locked together.

An ingress rule with source 0.0.0.0/0, protocol TCP, and destination port 80 permits HTTP traffic from any internet address into the subnet. This satisfies the stated requirement precisely, unlike egress rules or narrower CIDR sources.

FastConnect provides a dedicated private physical connection between your on-premises data centre and OCI, bypassing the public internet entirely. This satisfies the stem's requirements for dedicated bandwidth and predictable performance, unlike IPSec VPN, which traverses the internet and offers variable latency.

OCI Vault includes a secret management capability that allows you to store and manage secrets such as passwords, API keys, and configuration files. Secrets are versioned, and access is audited through OCI Audit. The application can retrieve secrets at runtime using the OCI SDK or CLI, with proper IAM policies. This meets the need for secure, auditable secret storage without hardcoding in container images.

Flexible shapes decouple OCPU and memory sizing, so the administrator must specify both values within the shape's permitted ratio range. Fixed shapes instead bundle a preset OCPU-to-memory pairing, which is why selecting OCPU count and RAM amount is the required input here.

Backups of block volumes are automatically stored in Object Storage and can be used to create new volumes at any time.

An Internet Gateway is a highly available, horizontally scaled VCN component providing bidirectional routing between the VCN's subnets and the public internet, for resources with public IPs. It directly fulfils the requirement for a communication path to the public internet.

File Storage Service encrypts all file system data at rest automatically using AES-256, with no customer action required. This satisfies the stem's default-encryption claim, since encryption is applied by the service regardless of whether the customer supplies their own keys.

The DRG terminates the IPsec VPN and must be the route target for on-premises CIDR traffic. Without a route table rule pointing that CIDR to the DRG, instances cannot return traffic through the tunnel, even when security lists and NSGs are correct.

Preemptible Instances draw on OCI's spare capacity and cost substantially less than on-demand, but OCI can reclaim them with little notice. The stem's tolerance for sudden termination is the deciding constraint, so this fault-tolerant batch workload fits preemptible capacity exactly, unlike standard or dedicated shapes.

Instance Pools group identical compute instances, and Autoscaling Configurations apply policies that add or remove instances based on metrics such as CPU utilisation. Together they satisfy the automatic scale-out requirement, unlike standalone instances or load balancers alone.

FastConnect provides a dedicated, private physical connection between your on-premises network and OCI, bypassing the public internet entirely. This satisfies the stem's requirement for a high-speed, non-internet link, letting the database back up directly to Object Storage over private peering rather than traversing public routes.

OKE is a managed Kubernetes service that provisions and orchestrates worker node compute instances to run containerised workloads. It satisfies the stem's requirement for a core OCI service providing compute capabilities, since clusters consume Compute instances as their underlying compute substrate.

FastConnect provisions a dedicated private circuit between your on-premises data centre and OCI, physically bypassing the public internet. This directly satisfies the stem's requirement for a high-speed, private connection, unlike IPSec VPN, which traverses the internet. It offers consistent bandwidth and lower latency than internet-based alternatives.

The IPv4 CIDR block defines the VCN's private address space and is mandatory at creation, since every subnet and route rule must fall within it. OCI requires this range up front, so it satisfies the stem's requirement for a specified configuration item.

An LPG peer connection alone does not route traffic; each VCN's subnet route tables must contain a rule directing the peer VCN's CIDR block to the LPG as target. Without these routes, packets have no path, so instances cannot reach the peered VCN.

Archive Storage Tier suits this scenario because it is engineered for long-term retention of infrequently accessed unstructured data at the lowest storage cost in OCI Object Storage. Its retrieval latency of hours aligns exactly with the stated acceptable retrieval window, satisfying both the cost-minimisation and tolerance-for-delay constraints in the stem.

Security Lists are subnet-scoped: every VNIC in the subnet inherits the rules automatically. NSGs are VNIC-scoped, letting you group and apply rules to a chosen set of VNICs across subnets, satisfying the question's requirement to distinguish the two mechanisms.

OCI Functions is Oracle's serverless compute service, executing code on demand without provisioning or managing servers. It natively integrates with OCI Events and API Gateway, so functions can be invoked by event triggers or HTTP requests, matching the serverless, event-driven requirement exactly.

A NAT Gateway provides one-way outbound internet access for instances in private subnets, translating their private IPs and blocking unsolicited inbound connections. This satisfies the requirement to download patches while preventing inbound internet traffic, unlike an Internet Gateway, which requires public IPs.

RoCE v2 provides high-bandwidth, low-latency, and low-CPU-overhead communication between compute instances, ideal for HPC and cluster workloads. It is available on specific bare metal and HPC shapes in OCI. This directly addresses the need for extremely low latency and high bandwidth with minimal network overhead.

Multiple CPE public IPs give the DRG redundant IPSec tunnels across distinct endpoints, so a single tunnel or CPE failure does not sever connectivity. This satisfies the high-availability constraint by removing the single point of failure inherent in one tunnel.

OCI security lists are stateful by default: return traffic for an allowed inbound connection is automatically permitted without a matching egress rule. This differs from network security groups, which are also stateful, and from stateless configurations requiring explicit rules in both directions.

A private DNS zone resolves names only within the VCNs you attach to it, so records stay invisible to the public internet. This directly satisfies the requirement for custom records scoped to a specific VCN, unlike public zones, which publish globally via OCI's internet-facing resolvers.

A service gateway provides private access to OCI services such as Object Storage and Autonomous Database over the Oracle network backbone, requiring no public IPs or internet traversal. Route table rules and security policies direct and permit that traffic from the VCN.

Lower Cost is one of the three OCI Block Volume performance tiers, offering the lowest IOPS and throughput for workloads with modest demands. It satisfies the question's requirement to identify the available performance tiers alongside Balanced and Higher Performance.

Block Volume Backup Policies define scheduled backups with configurable retention, satisfying the 30-day requirement. Cross-region replication is achieved by copying backups to another region, either through policy settings or cross-region copy. This directly meets the daily automatic backup and retention constraints specified in the scenario.

OCI DNS hosts public zones that resolve globally over the internet, satisfying the requirement for managing internet-facing domains. This is distinct from private zones, which resolve only within a VCN and are not publicly reachable.

Availability Domains are physically separate datacentres within an OCI region, each with independent power and cooling. Distributing instances across them ensures the workload survives a single domain failure, directly satisfying the high-availability requirement in the stem.

Bare Metal shapes give the instance direct access to the physical host, with no hypervisor layer, exposing raw local NVMe SSDs and full core counts. This satisfies the requirement for unvirtualised hardware access without overhead.

Pre-authenticated Requests embed credentials in a unique URL, granting time-limited read or write access to a specific bucket or object. This satisfies the constraint of sharing access without distributing OCI user credentials or requiring IAM identities for recipients.

Object versioning retains prior copies of an object whenever it is overwritten or deleted, allowing recovery after accidental deletion. This is a native Object Storage bucket setting, directly matching the stem's requirement to protect against accidental data loss.

Object Storage supports server-side encryption with customer-managed keys stored in OCI Vault. By selecting the Vault master encryption key as the bucket's encryption key and configuring a rotation schedule on that key, the compliance requirement for customer-managed encryption with automatic 90-day rotation is satisfied. Object Storage uses the key to encrypt data at rest, and key rotation is handled by Vault without re-encrypting existing objects.

The Network Load Balancer forwards packets at Layer 4, so it does not terminate or inspect TCP sessions, preserving the original client source IP. This satisfies the database cluster's need for high throughput and source-IP visibility that a Layer 7 load balancer masks.

Oracle Data Guard can maintain a standby database in a different Availability Domain within the same region. It provides automatic failover and minimal data loss (with synchronous or asynchronous replication). This directly satisfies the requirement for intra-region high availability with failover to another AD.

File Storage Service exposes NFSv3 file systems mountable concurrently by many compute instances, satisfying the shared NFS requirement. Block Volume attaches to one instance at a time, and Object Storage is not a POSIX NFS file system.

File Storage Service integrates with OCI Vault, supporting both Oracle-managed and customer-managed encryption keys for file system data at rest. This satisfies the encryption action, with keys handled through the vault rather than the file system itself.

Multi-attach lets one block volume be attached to several instances at once, satisfying the shared-access requirement. It is a distinct OCI Block Volume capability, unlike standard single-instance attachment, and is used for clustered or shared-storage workloads needing concurrent access.

Instance Pools with Autoscaling Configurations satisfy the elastic compute requirement: the autoscaling configuration attaches to a pool and adjusts its size between minimum and maximum instance counts based on performance metrics such as CPU utilisation. This delivers automatic scale-out during traffic spikes and scale-in when demand subsides, without manual intervention.

Block volume backups can be copied to another OCI region, satisfying the disaster-recovery requirement by placing a restorable copy outside the source region's failure domain. This cross-region copy is distinct from cloning a volume within the same availability domain.

OCI Container Instances run containers directly without provisioning or managing compute hosts or Kubernetes clusters, billing per second for the resources consumed. This serverless-container model satisfies the requirement to deploy rapidly without managing underlying infrastructure.

OKE's managed control plane runs on OCI tenancy infrastructure, so Oracle handles upgrades, patching and availability of the API server and etcd, satisfying the reduced-management-overhead constraint. Worker nodes remain in your compartment, giving you workload control without operating control-plane components yourself.

A Private DNS Resolver with forwarding rules sends queries for custom internal domains to the on-premises DNS server reached over FastConnect, satisfying the hybrid resolution constraint. Forwarding rules direct specific zones to designated external DNS servers, unlike the default VCN resolver, which only handles OCI-managed names.

OCI Container Instances runs containers directly without provisioning Kubernetes clusters or virtual machines, satisfying the serverless-container and rapid-start constraint. It provides a serverless compute environment for single containers, unlike OKE, which requires managing cluster infrastructure and node pools.

A Pre-Authenticated Request embeds credentials in a URL, granting time-limited access to a specific object or bucket without requiring an IAM identity or authentication. This satisfies the need to share a resource temporarily with external parties.

The load balancer terminates client connections and inserts the original client address into the X-Forwarded-For header. Configuring web servers to log that header restores the true public client IP instead of the load balancer's internal private address.