I85PREP
⌘ K
OCI Architect Associate study materials
OCI Architect Associate study resources

OCI Architect Associate practice questions

One question at a time. Build your OCI Architect Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity and Access Management

Which statement describes the role of an OCI compartment?

  1. A network segment that isolates traffic between subnets.
  2. A physical data center within a region where resources are deployed.
  3. A logical container used to organize and isolate resources for access control. Correct answer.
  4. A billing construct that aggregates usage from multiple tenancies.

Explanation

Compartments are logical groupings of related resources that form a hierarchy under the tenancy's root compartment, and IAM policies are attached to compartments to govern the resources inside them. They have no relationship to physical location or network topology.

Question 2Identity and Access Management

OCI policies use four verbs with cumulative permissions. Which verb grants the widest set of permissions?

  1. inspect
  2. use
  3. manage Correct answer.
  4. read

Explanation

Verb permissions increase in the order inspect, read, use, manage. The manage verb includes everything the lower verbs allow plus the ability to create, update, and delete the resource.

Question 3Identity and Access Management

How does an individual user obtain permission to work with resources in OCI IAM?

  1. The user is assigned an administrator role inside the tenancy.
  2. The user is placed in a group, and a policy grants that group the required access. Correct answer.
  3. Policies are attached directly to the individual user account.
  4. The user creates the resources in the tenancy's home region.

Explanation

Policies name a subject, and the supported subjects are groups, dynamic groups, and a few special principals; individual users cannot be policy subjects, so access is always obtained through group membership. A user receives every permission granted to any group they belong to.

Question 4Identity and Access Management

A tenancy administrator writes a policy in the root compartment. What does that policy cover?

  1. Only the resources that live directly in the root compartment.
  2. Every compartment in the tenancy, including compartments created later. Correct answer.
  3. Only resources located in the tenancy's home region.
  4. Only resources created by members of the Administrators group.

Explanation

A policy applies to the compartment in which it is created and to every compartment beneath it. Because the root compartment sits at the top of the hierarchy, a policy placed there reaches the whole tenancy, including compartments added later.

Question 5Identity and Access Management

What is a dynamic group used for in OCI IAM?

  1. To group compartments that share a common budget allocation.
  2. To group federated users who sign in through an external identity provider.
  3. To group resources so they can be authorized through instance principals. Correct answer.
  4. To group the API signing keys owned by a single user.

Explanation

A dynamic group holds OCI resources that satisfy a matching rule you write, rather than human users. Matching resources can then authenticate as instance principals and receive the permissions granted to the dynamic group by policies.

Question 6Identity and Access Management

Consider the statement: Allow group Auditors to read buckets in compartment Finance. Which element names the type of resource being protected?

  1. in compartment Finance
  2. Allow
  3. buckets Correct answer.
  4. read

Explanation

An OCI policy statement follows the form Allow <subject> to <verb> <resource-type> in <location> where <conditions>. The token following the verb identifies the resource type, which here is buckets.

Question 7Identity and Access Management

A developer wants to run OCI CLI commands on behalf of their own IAM user account. Which credential must be configured?

  1. An auth token
  2. A customer secret key
  3. The console password
  4. An API signing key pair Correct answer.

Explanation

Calls to the native OCI REST APIs are signed with a private key whose public counterpart is uploaded to the user as an API signing key. The CLI reads the key fingerprint and private key path from its configuration file.

Question 8Identity and Access Management

A policy in compartment Sales allows a group to manage instances. Compartment Sales has a child compartment named Marketing. What access does the group have on instances in Marketing?

  1. None, unless an identical policy is also created in Marketing.
  2. Access only if the group is also defined inside Marketing.
  3. None, because policies do not cross compartment boundaries.
  4. The same access, because a policy applies to its compartment and all child compartments. Correct answer.

Explanation

Policies are inherited down the compartment tree, so a grant made in Sales automatically applies in every child compartment, including Marketing. No duplicate policy is needed in the child compartment.

Question 9Identity and Access Management

An application running on a compute instance must read objects from an Object Storage bucket without any credentials stored on the instance. What should the administrator configure?

  1. Enable MFA on the instance and grant it manage all-resources in the tenancy.
  2. Place the instance in a dynamic group and grant that group read access to the bucket. Correct answer.
  3. Add the instance's OCID as a user in an IAM group.
  4. Upload an API signing key to the instance metadata service.

Explanation

Instances that match a dynamic group rule can call OCI services as an instance principal, presenting a short-lived certificate instead of a stored secret. Access is then granted by a policy whose subject is the dynamic group.

Question 10Identity and Access Management

An enterprise wants employees to sign in to OCI using its existing SAML 2.0 identity provider. Which statement is correct?

  1. Each federated employee must also be created as a local IAM user with a separate password.
  2. The identity provider authenticates the user, and OCI authorizes through IAM group membership. Correct answer.
  3. Federation cannot coexist with local IAM users in the same identity domain.
  4. Federation moves all authorization decisions to the identity provider, so OCI policies are no longer used.

Explanation

With federation, authentication is delegated to the external identity provider while OCI IAM continues to perform authorization. Groups asserted by the identity provider are mapped to OCI groups, and policies grant access to those groups.

Question 11Identity and Access Management

Which policy condition restricts a statement to resources that reside in a particular compartment?

  1. request.user.name
  2. request.region
  3. request.principal.group
  4. target.compartment.id Correct answer.

Explanation

Condition variables beginning with target describe the resource being acted upon, and target.compartment.id holds the OCID of the compartment containing that resource. Variables beginning with request describe the caller or the call itself.

Question 12Identity and Access Management

An application must use the Amazon S3 Compatibility API to access Object Storage. Which credential does it use?

  1. An API signing key pair
  2. A customer secret key Correct answer.
  3. An auth token
  4. The user's console password

Explanation

The S3 Compatibility API is authenticated with a customer secret key, which OCI presents as an access key and secret key pair. API signing keys serve native OCI REST calls and auth tokens serve Swift-compatible access.

Question 13Identity and Access Management

A group has the statement Allow group Ops to use instances in compartment App. Which action does that statement permit?

  1. Launching additional instances in compartment App.
  2. Terminating existing instances in compartment App.
  3. Changing the shape of an existing instance in compartment App.
  4. Starting and stopping existing instances in compartment App. Correct answer.

Explanation

The use verb permits working with existing resources of the named type, which covers actions such as starting and stopping. Creating, reconfiguring, and deleting the resource all require the manage verb.

Question 14Identity and Access Management

Which matching rule correctly places compute instances from compartment App into a dynamic group?

  1. ALL {resource.type = 'instance', resource.compartment.id = 'ocid1.compartment.oc1..aaaa'} Correct answer.
  2. ALL {group.name = 'App', compartment.id = 'ocid1.compartment.oc1..aaaa', resource.type = 'instance'}
  3. ANY {instance.id = 'ocid1.compartment.oc1..aaaa'}
  4. ANY {user.compartment.id = 'ocid1.compartment.oc1..aaaa'}

Explanation

Dynamic group rules match attributes of resources, and with ALL every condition inside the braces must hold. Combining resource.type = 'instance' with resource.compartment.id limits the group to compute instances in the named compartment.

Question 15Identity and Access Management

Which statement about multi-factor authentication in OCI IAM is correct?

  1. MFA removes the need for a password when signing in to the console.
  2. MFA requires a second factor, such as a time-based one-time passcode, in addition to the password. Correct answer.
  3. MFA must be configured on the compute instances that host the applications.
  4. MFA can be enabled only for the tenancy administrator account.

Explanation

MFA strengthens sign-in by requiring something beyond the password, commonly a time-based one-time passcode from an authenticator application. It can be required of users through identity domain sign-on policies or enabled by each user.

Question 16Identity and Access Management

A user belongs to two groups. One group is granted read buckets and the other manage buckets in the same compartment. What is the user's effective access?

  1. No access, because the two grants conflict.
  2. Read only, because the more restrictive grant wins.
  3. Manage, because permissions from all applicable policies are combined. Correct answer.
  4. Read only, until an administrator removes one of the grants.

Explanation

OCI policies are allow-only and additive, so effective permissions are the union of every statement that applies to the principal. A broader grant held through one group is not narrowed by a narrower grant held through another.

Question 17Identity and Access Management

A company wants a policy statement to apply only to requests that originate from its corporate network. Which condition should be used?

  1. request.networkSource.name = 'corp-network' Correct answer.
  2. request.principal.id = 'corp-network'
  3. request.operation = 'corp-network'
  4. target.resource.kind = 'corp-network'

Explanation

A network source is a named IAM object listing allowed IP ranges or VCNs, and request.networkSource.name tests the name of the network source that matched the request. This ties a grant to where the call originates.

Question 18Identity and Access Management

Which policy condition bases access on a defined tag attached to the target resource?

  1. target.resource.tag.Operations.Department.value = 'Finance' Correct answer.
  2. request.principal.tag.Operations.Department.value = 'Finance'
  3. target.compartment.tag.Operations.Department = 'Finance'
  4. request.user.tag.Operations.Department.value = 'Finance'

Explanation

Tag-based access control tests tags on the resource being acted upon, using the form target.resource.tag with the namespace, tag key, and value. Conditions beginning with request describe the caller rather than the target.

Question 19Identity and Access Management

How are IAM users, groups, and policies scoped in OCI?

  1. They are scoped to a single availability domain.
  2. They are global and apply across all regions in the tenancy. Correct answer.
  3. They are regional, so a separate copy is needed in each region.
  4. They are confined to the compartment in which they were created and cannot be referenced elsewhere.

Explanation

IAM is a global service: users, groups, dynamic groups, identity providers, and policies exist once for the tenancy and are visible from every region. Compartments are likewise global, while most other resources are regional.

Question 20Identity and Access Management

Which statement best describes how OCI IAM evaluates access?

  1. The policy closest to the resource in the compartment hierarchy takes precedence.
  2. An explicit deny statement always takes precedence over an allow statement.
  3. Access is the union of all allow statements that apply to the principal, with no deny statements to override them. Correct answer.
  4. Policies are evaluated in creation order, and the last matching statement wins.

Explanation

OCI policy statements are allow-only. Every statement matching the principal, resource, and conditions contributes permissions, and the result is the union of those grants, so no statement can subtract access granted elsewhere.

Question 21Identity and Access Management

A function running in OCI Functions must write to an Object Storage bucket. Which approach matches OCI's model for authenticating that workload?

  1. Store a user's API signing private key inside the function's container image.
  2. Use a resource principal, with dynamic group rules defining the workload's identity and policies granting access. Correct answer.
  3. Rely on instance principals, because functions run on compute instances managed by the tenancy.
  4. Add the function's OCID to the Administrators group.

Explanation

OCI Functions uses resource principals: the workload is identified by attributes such as its compartment rather than by a stored key, and access is granted to a dynamic group whose rule matches those attributes. This avoids embedding long-lived credentials in code.

Question 22Identity and Access Management

A dynamic group rule matches instances that carry the defined tag Environment=Prod. An administrator removes that tag from one instance. What is the effect?

  1. Access is lost, because dynamic group membership is derived from the rule at request time. Correct answer.
  2. Access continues, because tag values are evaluated only when the instance boots.
  3. Access changes only after the instance is restarted.
  4. Access continues until the dynamic group itself is deleted and recreated.

Explanation

Dynamic groups are dynamic because membership is computed from the matching rule rather than from an explicit list of members. Once the resource's attributes no longer satisfy the rule, the instance stops receiving the permissions granted to that dynamic group.

Question 23Identity and Access Management

A group has the statement Allow group Ops to manage instances in compartment App. Which action does that statement leave unauthorized?

  1. Launching a new instance in compartment App.
  2. Updating the tags on an instance in compartment App.
  3. Creating a block volume in compartment App. Correct answer.
  4. Terminating an instance in compartment App.

Explanation

Each resource family has its own resource type in a policy statement, so manage instances covers instances only. Working with block volumes requires a separate statement naming volumes, ranging from use volumes to manage volumes depending on the action.

Question 24Identity and Access Management

A federated user signs in to the OCI console successfully but receives an authorization error when listing objects in a bucket that teammates can list. Which cause is most likely?

  1. The user's password in the identity provider has expired.
  2. Multi-factor authentication has been disabled for the user.
  3. The user's identity provider group is not mapped to an OCI group that a policy grants access to. Correct answer.
  4. The user is signing in from a region where Object Storage is unavailable.

Explanation

A successful sign-in proves authentication succeeded, so the failure lies in authorization. OCI authorizes federated users only through OCI groups that the identity provider's group assertions map to, and a policy must grant those groups the required access.

Question 25Networking

Which CIDR block size range is permitted when creating an OCI Virtual Cloud Network?

  1. /24 to /30
  2. /16 to /24
  3. /16 to /30 Correct answer.
  4. /8 to /30

Explanation

OCI accepts VCN IPv4 CIDR blocks between /16 and /30, so the block must be large enough to hold subnets but no larger than a /16. Anything outside that range is rejected at creation time. Subnet CIDRs must fall inside the VCN's CIDR and cannot overlap other subnets.

Question 26Networking

Which gateway provides bidirectional internet connectivity for resources that have a public IP address in a VCN?

  1. Internet gateway Correct answer.
  2. NAT gateway
  3. Local peering gateway
  4. Service gateway

Explanation

An internet gateway is the VCN component that connects a VCN to the public internet in both directions, and it is regional and highly available. Instances still need a public IP plus a route rule pointing 0.0.0.0/0 at the gateway. The other gateways serve private outbound traffic, Oracle services, or VCN-to-VCN links.

Question 27Networking

A compute instance in a private subnet must download patches from the internet but must not accept inbound connections from the internet. Which gateway supports this requirement?

  1. Service gateway
  2. NAT gateway Correct answer.
  3. Dynamic routing gateway
  4. Internet gateway with a public IP on the instance

Explanation

A NAT gateway allows instances in private subnets to initiate outbound internet connections while blocking connections initiated from the internet. The instance needs a route rule toward the NAT gateway but no public IP. This is the standard pattern for private compute that needs outbound access only.

Question 28Networking

Which OCI component lets resources in a private subnet reach Object Storage without traffic leaving the Oracle network?

  1. Service gateway Correct answer.
  2. Internet gateway
  3. NAT gateway
  4. Dynamic routing gateway

Explanation

A service gateway gives private subnets a path to supported Oracle services such as Object Storage using service CIDR labels as the route destination. Traffic stays on the Oracle network and never traverses the internet. Access can additionally be restricted with a service gateway policy.

Question 29Networking

Security lists in OCI are applied at which level?

  1. VNIC
  2. Subnet Correct answer.
  3. VCN
  4. Individual public IP address

Explanation

A security list is associated with a subnet, and its rules apply to every VNIC in that subnet. Because the scope is the subnet, all instances placed there inherit the same rule set. Finer-grained control per VNIC is the job of network security groups.

Question 30Networking

Network security groups in OCI are applied to which scope?

  1. The entire VCN
  2. Individual VNICs Correct answer.
  3. Each subnet in the VCN
  4. Each route table

Explanation

A network security group is a set of rules applied to the VNICs that are members of the group, so the same group can protect selected instances across subnets. Because membership is per VNIC, it supports fine-grained, per-workload rules. Traffic must still also be permitted by the subnet's security list.

Question 31Networking

A VCN is created and its default security list is left unchanged. Which inbound traffic does that list allow?

  1. TCP 443 from any source
  2. TCP 22 from any source Correct answer.
  3. ICMP echo request from any source
  4. TCP 1521 from the VCN CIDR

Explanation

The default security list ships with a stateful ingress rule for SSH on TCP 22 from 0.0.0.0/0, an ingress rule for ICMP type 3 code 4, and a broad egress rule. Administrators are expected to tighten these rules for production. HTTPS, database ports, and ping are not open by default.

Question 32Networking

A local peering gateway connects which two things?

  1. Two VCNs in the same region Correct answer.
  2. A VCN and an on-premises network
  3. A VCN and Object Storage
  4. Two VCNs in different regions

Explanation

A local peering gateway links two VCNs that reside in the same OCI region, and each side needs a corresponding route rule. Cross-region VCN connectivity instead uses dynamic routing gateways with a remote peering connection. On-premises connectivity and service access use different components.

Question 33Networking

A subnet is created without specifying a route table. Which routing behaviour applies?

  1. It uses the VCN's default route table until a custom one is associated. Correct answer.
  2. It receives a merged copy of every route table defined in the VCN.
  3. It inherits the route table of the first subnet created in the VCN.
  4. It has no route rules and can reach only other subnets in the same VCN.

Explanation

Every VCN has a default route table, and any subnet that is not explicitly associated with a custom route table uses it. A subnet can be associated with only one route table at a time. Custom route tables must be created and associated deliberately.

Question 34Networking

VCN A is peered with VCN B, and VCN B is peered with VCN C. What connectivity exists between VCN A and VCN C?

  1. They can communicate only through an internet gateway.
  2. They can communicate as long as all three VCNs use the same security list.
  3. They cannot communicate unless they are peered directly or connected through a transit routing design such as a DRG. Correct answer.
  4. They can communicate because VCN peering is transitive.

Explanation

VCN peering is non-transitive: a peering between A and B does not give A any path to a VCN that is only peered with B. Direct peering between A and C, or a transit hub built with a DRG and DRG route tables, is required. Security list similarity does not change routing reachability.

Question 35Networking

In the OCI Load Balancer service, which choice produces a load balancer that has no public IP address?

  1. A private load balancer Correct answer.
  2. A flexible-shape load balancer
  3. A public load balancer with a reserved public IP
  4. A public load balancer placed in a private subnet

Explanation

The Load Balancer service is created as either public or private, and a private load balancer exposes only a private IP reachable from inside the VCN and connected networks. Shape and IP reservation options do not change the public/private characteristic. A public load balancer always has a public-facing address.

Question 36Networking

Which statement about reserved public IPs in OCI is correct?

  1. They persist after resource deletion and can be reassigned. Correct answer.
  2. They are replaced with a new address each time the instance reboots.
  3. They can be attached only to load balancers, not to compute instances.
  4. They are released automatically when the instance is stopped or terminated.

Explanation

A reserved public IP is a tenancy-owned address that stays allocated until you explicitly delete it, so it can be moved between resources and survives termination of the resource that was using it. An ephemeral public IP, by contrast, is tied to the resource's lifetime. Both types can be assigned to compute instances and other resources that support public IPs.

Question 37Networking

The DNS type setting in a VCN's DHCP options can be set to which values?

  1. Regional Resolver or AD-specific Resolver
  2. Internet and VCN Resolver, or Custom Resolver Correct answer.
  3. Authoritative Resolver or Recursive Resolver
  4. Public Resolver or Private Resolver

Explanation

DHCP options let you choose either the Internet and VCN Resolver, which provides OCI's DNS plus internet resolution, or a Custom Resolver where you supply your own DNS server addresses. The setting determines what DNS servers instances receive. It is independent of subnet regionality.

Question 38Networking

A route table contains 0.0.0.0/0 pointing to a NAT gateway and 10.0.0.0/16 pointing to a dynamic routing gateway. Where is traffic destined for 10.0.5.7 sent?

  1. To the dynamic routing gateway, because the more specific prefix is preferred. Correct answer.
  2. Nowhere, because overlapping route rules are rejected.
  3. To both targets simultaneously for redundancy.
  4. To the NAT gateway, because 0.0.0.0/0 matches every destination.

Explanation

Route selection uses longest prefix match, so the /16 route wins over the default route for any address inside 10.0.0.0/16. The default route only handles destinations with no more specific match. Overlapping routes of different lengths are valid and expected.

Question 39Networking

What do VCN flow logs record?

  1. Configuration changes made to the VCN by IAM users.
  2. The full contents of packets, including payload data.
  3. Metadata about traffic flows that passed through a VNIC, subnet, or VCN. Correct answer.
  4. Only traffic that is allowed by security rules.

Explanation

Flow logs capture flow-level metadata such as source and destination addresses, ports, protocol, and whether the flow was accepted or rejected. They do not capture packet payloads. Capturing both accepted and rejected flows makes them useful for security analysis and troubleshooting.

Question 40Networking

An A record for db.internal is published in a private DNS zone that is attached to a VCN. What is the effect?

  1. The record resolves only from the public internet.
  2. It must be copied manually into every subnet's DHCP options.
  3. It resolves for resources that use the VCN's resolver. Correct answer.
  4. It resolves only after a public zone with the same name exists.

Explanation

A private DNS zone attached to a VCN is served by the VCN's resolver, so instances configured to use that resolver can resolve its records. The zone is not visible on the public internet. Attachment to the VCN is what scopes the resolution to that network.

Question 41Networking

A dedicated FastConnect connection must reach Object Storage using its public IP addresses without traversing the internet. Which virtual circuit type is required?

  1. Site-to-Site VPN
  2. Private peering
  3. Local peering
  4. Public peering Correct answer.

Explanation

FastConnect public peering provides connectivity to Oracle's public services, including Object Storage public endpoints, over the dedicated connection. Private peering instead reaches private IP addresses inside a VCN through a DRG. Choosing the wrong virtual circuit type leaves the intended destinations unreachable.

Question 42Networking

A network security group allows inbound TCP 443 from 10.0.0.0/16, while the subnet's security list allows inbound TCP 22 only. What happens to a request from 10.0.0.5 to port 443?

  1. It is denied, because traffic must be allowed by both the security list and the NSG. Correct answer.
  2. It is allowed, because NSGs override security lists.
  3. It is allowed, because the NSG rule is more specific.
  4. It is allowed, because security lists apply only to traffic between subnets.

Explanation

Security lists and network security groups are evaluated independently, and traffic must be permitted by every layer that applies to the VNIC. An allow in the NSG cannot compensate for a deny in the subnet's security list. Both rule sets must therefore be updated to permit the flow.

Question 43Networking

Which statement describes a flexible-shape load balancer?

  1. It delivers a fixed bandwidth regardless of traffic volume.
  2. It requires a dedicated FastConnect connection to operate.
  3. It lets you set a minimum and maximum bandwidth within the allowed range. Correct answer.
  4. It can be used only with private load balancers.

Explanation

A flexible shape lets you choose the bandwidth range, and the load balancer scales between the minimum and maximum values as demand changes. This avoids paying for fixed capacity that is rarely used. The shape setting is independent of whether the load balancer is public or private.

Question 44Networking

Which OCI gateway is required to connect a VCN to an on-premises network through IPSec VPN or FastConnect?

  1. Service gateway
  2. Dynamic routing gateway Correct answer.
  3. NAT gateway
  4. Internet gateway

Explanation

A dynamic routing gateway is the VCN attachment point for IPSec VPN tunnels and FastConnect virtual circuits, and it also supports VCN-to-VCN transit routing. Route rules in the VCN point on-premises prefixes at the DRG. The other gateways handle internet or Oracle service traffic only.

Question 45Networking

Two VCNs in different OCI regions must communicate over private addresses. Which combination is required?

  1. A single service gateway shared by both VCNs plus a matching security list rule.
  2. An internet gateway in each VCN plus a route rule between the two VCNs.
  3. A local peering gateway in each VCN plus a route rule between the two VCNs.
  4. A DRG attached in each region plus a remote peering connection between them. Correct answer.

Explanation

Cross-region VCN peering is built with a dynamic routing gateway in each region connected by a remote peering connection, with route rules on both sides pointing at the DRGs. Local peering gateways only work within a single region. The peerings also require non-overlapping CIDR blocks.

Question 46Networking

Which statement about IPv6 addressing in an OCI VCN is correct?

  1. IPv6 addressing is supported only on AD-specific subnets.
  2. A VCN is assigned a /56 prefix and each subnet takes a /64 from it. Correct answer.
  3. A subnet receives a /48 prefix and the VCN takes a /64 from it.
  4. A VCN receives a single /128 address shared by all of its subnets.

Explanation

When IPv6 is enabled, the VCN is assigned a /56 IPv6 prefix and each subnet in that VCN is assigned a /64 prefix carved from it. The subnet prefix is what addresses VNICs in IPv6. Enabling IPv6 alone does not create internet reachability; the appropriate gateway and route rules are also needed.

Question 47Networking

A network security group contains an ingress rule allowing TCP 22 from 203.0.113.10 and no egress rules at all. What happens to the reply packets of an established SSH session?

  1. They are allowed because OCI security rules are stateful and track the connection. Correct answer.
  2. They are dropped because no egress rule exists.
  3. They are dropped unless an egress rule for TCP 22 is added to the group.
  4. They are allowed only if the subnet's security list also contains an egress rule.

Explanation

Both security lists and network security groups are stateful, so response traffic for an allowed connection is automatically permitted regardless of the egress rules. You do not need a matching outbound rule for the return packets. Stateless behaviour would require explicitly allowing both directions.

Question 48Networking

An architect tries to peer VCN-A with CIDR 10.0.0.0/16 and VCN-B with CIDR 10.0.1.0/24 using a local peering gateway. What is the outcome?

  1. Peering succeeds because both VCNs are in the same region.
  2. Peering succeeds, but only the 10.0.1.0/24 range becomes routable.
  3. Peering succeeds if the overlapping subnet is placed in a different availability domain.
  4. Peering cannot be established while the CIDR blocks overlap. Correct answer.

Explanation

VCN peering, whether local or remote, requires that the address ranges of the two VCNs do not overlap. Here 10.0.1.0/24 is contained inside 10.0.0.0/16, so the peering request fails. Same-region placement or availability domain choice does not resolve the conflict.

Question 49Networking

VCN-A and VCN-B are both attached to the same dynamic routing gateway for transit routing. What must be configured for traffic from VCN-A to reach VCN-B?

  1. Identical security lists on both VCNs and a shared DHCP option set.
  2. A direct local peering gateway between VCN-A and VCN-B.
  3. An internet gateway in each VCN with a default route to the DRG.
  4. A route in VCN-A pointing to the DRG plus a DRG route table entry for VCN-B. Correct answer.

Explanation

For transit routing, the spoke VCN uses a route rule toward the DRG, and the DRG's route table must contain an entry that maps traffic for the other VCN's CIDR to that VCN attachment. Both halves are required, because the VCN route table handles egress from the spoke while the DRG route table handles forwarding inside the hub. Security lists still apply but do not create reachability.

Question 50Networking

Which CIDR block can be used when creating an OCI VCN?

  1. 10.0.0.0/31
  2. 10.0.0.0/8
  3. 10.0.0.0/32
  4. 10.0.0.0/16 Correct answer.

Explanation

A VCN's IPv4 CIDR block must be between /16 and /30, so the mask has to be large enough to hold subnets but no larger than a /16. A /16 is the largest block permitted, and a /30 is the smallest. Anything outside that range is rejected at creation time.