I85PREP
⌘ K
OCI Networking Professional study materials
OCI Networking Professional study resources

OCI Networking Professional practice questions

One question at a time. Build your OCI Networking Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Networking fundamentals and Virtual Cloud Networks (VCN)

In OCI, a VCN's CIDR block is 10.0.0.0/16. Which statement describes the smallest subnet CIDR that OCI permits you to create inside this VCN?

  1. A /30 subnet, because OCI reserves only two addresses per subnet
  2. A /28 subnet, because OCI reserves three addresses per subnet Correct answer.
  3. A /24 subnet, because OCI requires at least 256 addresses per subnet
  4. A /32 subnet, because OCI allows a single-address subnet for gateways

Explanation

OCI allows subnet CIDR blocks as small as /28 and as large as /16, and the subnet must lie within the VCN's CIDR. Three addresses in each subnet are reserved by OCI (network address, broadcast address, and the VCN's virtual router), so a /28 provides 13 usable addresses. Smaller prefixes than /28 are rejected at creation time.

Question 2Networking fundamentals and Virtual Cloud Networks (VCN)

You are designing a VCN and want each subnet to be confined to a single Availability Domain for lowest latency to instances in that AD. Which subnet type should you choose?

  1. An AD-specific subnet Correct answer.
  2. A regional subnet
  3. A public subnet with an internet gateway
  4. A private subnet with a service gateway

Explanation

An AD-specific subnet is scoped to one Availability Domain, so resources launched into it are placed in that AD. Regional subnets span all ADs in the region and are the default choice for most designs. The public/private distinction controls routing and internet reachability, not AD scoping.

Question 3Networking fundamentals and Virtual Cloud Networks (VCN)

Which OCI component provides the distributed, software-defined layer that connects a VCN to on-premises networks and to other VCNs through gateways such as DRG, internet gateway, and NAT gateway?

  1. The VCN's DHCP options
  2. The VCN's security list
  3. The VCN's route table
  4. The VCN's virtual router Correct answer.

Explanation

Every VCN includes an implicit virtual router that handles all traffic leaving a subnet, including traffic to gateways such as the internet gateway, NAT gateway, service gateway, and DRG. Route tables and security lists are configuration attached to the VCN but are not the forwarding element itself. DHCP options only affect instance address configuration.

Question 4Networking fundamentals and Virtual Cloud Networks (VCN)

A compute instance in a private subnet must download objects from an OCI Object Storage bucket in the same region without traversing the internet. Which gateway should the subnet's route table target for the Object Storage service CIDR?

  1. Internet gateway
  2. Service gateway Correct answer.
  3. Dynamic routing gateway
  4. NAT gateway

Explanation

A service gateway lets traffic from a VCN reach supported OCI services such as Object Storage using the service's Oracle Services Network CIDR label, without leaving the OCI network. Traffic to the service is routed privately and does not require a public IP. NAT and internet gateways would send the traffic through the internet path.

Question 5Networking fundamentals and Virtual Cloud Networks (VCN)

Which statement correctly distinguishes security lists from network security groups (NSGs) in OCI?

  1. Security lists are stateless and NSGs are stateful
  2. Security lists apply to VNICs and NSGs apply to subnets
  3. Security lists apply at the subnet level and NSGs apply to specified VNICs Correct answer.
  4. Security lists support only TCP while NSGs support UDP

Explanation

Security lists are attached to subnets and therefore affect every VNIC in those subnets, while NSGs are attached to individual VNICs and give finer-grained control. Both are stateful. A VNIC can be governed by both its subnet's security lists and any NSGs it belongs to, and traffic must be allowed by all applicable rule sets.

Question 6Networking fundamentals and Virtual Cloud Networks (VCN)

What is the primary purpose of an internet gateway in an OCI VCN?

  1. To connect the VCN to an on-premises network over IPSec
  2. To publish VCN private DNS zones to the internet
  3. To enable bidirectional internet connectivity for resources in public subnets Correct answer.
  4. To provide a highly available, NAT-like path for outbound-only internet traffic from private subnets

Explanation

An internet gateway provides a path for traffic in both directions between a VCN and the internet, and it is used by resources in public subnets that have public IP addresses. Outbound-only connectivity for private subnets is the role of a NAT gateway. IPSec connectivity is provided by a DRG with a site-to-site VPN.

Question 7Networking fundamentals and Virtual Cloud Networks (VCN)

Which OCI construct lets you define reusable sets of rules that can be applied to multiple VCNs and referenced by NSGs across compartments?

  1. Network security groups Correct answer.
  2. Security zones
  3. Security lists
  4. VCN flow logs

Explanation

NSGs are VNIC-level virtual firewalls that can be created once and associated with many VNICs across subnets, which makes them reusable and easier to manage than duplicating subnet-level rules. Security lists are bound to a specific subnet. Flow logs are observability data, not rule containers.

Question 8Networking fundamentals and Virtual Cloud Networks (VCN)

Which two pieces of information must you supply when creating a VCN in OCI?

  1. A CIDR block and a compartment Correct answer.
  2. A route table and a DHCP option set
  3. A CIDR block and an internet gateway
  4. A compartment and a security list

Explanation

Creating a VCN requires a name, a compartment, and one or more IPv4 CIDR blocks (IPv6 can be added later). Gateways, route tables, security lists, and DHCP options can be created during the wizard or afterwards, but they are not mandatory inputs to the VCN itself. The CIDR block defines the VCN's address space.

Question 9Networking fundamentals and Virtual Cloud Networks (VCN)

An instance in a private subnet needs to download OS package updates from the internet, but it must not accept any inbound connections from the internet. Which gateway configuration achieves this with the least exposure?

  1. Attach a service gateway and route 0.0.0.0/0 to it
  2. Attach an internet gateway and assign a public IP to the instance
  3. Attach a DRG and route 0.0.0.0/0 to it
  4. Attach a NAT gateway and route 0.0.0.0/0 to it, with no public IP on the instance Correct answer.

Explanation

A NAT gateway lets instances in private subnets initiate outbound internet connections while preventing unsolicited inbound connections, and the instances keep only private IP addresses. An internet gateway with a public IP would expose the instance to inbound traffic subject only to firewall rules. A service gateway only reaches OCI services, not the public internet.

Question 10Networking fundamentals and Virtual Cloud Networks (VCN)

You have a VCN with CIDR 10.0.0.0/16 and a subnet 10.0.1.0/24. You attempt to create a second subnet with CIDR 10.0.1.128/25. What happens?

  1. The creation succeeds because /25 is larger than the minimum /28
  2. The creation succeeds because OCI automatically reassigns overlapping space
  3. The creation fails because the CIDR overlaps the existing subnet Correct answer.
  4. The creation fails because a VCN can contain only one subnet per /24

Explanation

Subnet CIDR blocks within a VCN must not overlap. 10.0.1.128/25 falls inside the existing 10.0.1.0/24 subnet, so OCI rejects the request. Non-overlapping blocks such as 10.0.2.0/24 would be accepted.

Question 11Networking fundamentals and Virtual Cloud Networks (VCN)

A route table for a public subnet contains these rules: 0.0.0.0/0 -> Internet Gateway, and 10.0.0.0/16 -> Dynamic Routing Gateway. A packet from the subnet is destined to 10.0.5.10, which is another subnet in the same VCN. Which route is used?

  1. Neither route; intra-VCN traffic uses the virtual router directly Correct answer.
  2. The DRG route, because it is the longest prefix match
  3. The internet gateway route, because 0.0.0.0/0 is the default
  4. The packet is dropped because no route matches

Explanation

Traffic between subnets in the same VCN is handled by the VCN's virtual router and does not consult route table rules for gateways. Route rules apply to traffic leaving the VCN through a gateway. The 10.0.0.0/16 DRG rule would matter for destinations reached through the DRG, not for local subnets.

Question 12Networking fundamentals and Virtual Cloud Networks (VCN)

You need instances in subnet A to accept SSH only from instances in subnet B, and you want the rule to follow the instances even if they move to another subnet. Which approach is most appropriate?

  1. Create an NSG for the target instances and allow TCP 22 from the source NSG Correct answer.
  2. Add an ingress rule to subnet A's security list allowing TCP 22 from subnet B's CIDR
  3. Add an egress rule to subnet B's security list for TCP 22 to subnet A's CIDR
  4. Create an NSG for the target instances and allow TCP 22 from 0.0.0.0/0

Explanation

NSG rules can reference another NSG as the source, so the rule stays valid regardless of which subnet the source VNICs are in. Referencing a CIDR ties the rule to a subnet range, which breaks if instances move. Allowing 0.0.0.0/0 is far broader than required.

Question 13Networking fundamentals and Virtual Cloud Networks (VCN)

An instance in a public subnet has a public IP and an internet gateway route, yet inbound HTTP from the internet is blocked while outbound works. Which is the most likely cause?

  1. The service gateway is not attached
  2. The DHCP option set is missing a DNS server
  3. The subnet's security list lacks an ingress rule for TCP 80 Correct answer.
  4. The NAT gateway is misconfigured

Explanation

Inbound traffic to a public subnet must be explicitly allowed by an ingress rule in the applicable security list or NSG. Outbound traffic working while inbound fails points to a missing ingress allow rule. NAT gateways and service gateways are unrelated to accepting inbound connections from the internet.

Question 14Networking fundamentals and Virtual Cloud Networks (VCN)

You want to resolve a private DNS name such as db.internal.example.com from instances in a VCN, with the zone managed privately in OCI DNS. Which configuration enables this?

  1. Configure the VCN's DHCP option set to use the internet DNS resolver
  2. Attach an internet gateway and publish the zone publicly
  3. Create a service gateway and route DNS traffic through it
  4. Create a private DNS zone and attach it to the VCN via a DNS resolver association Correct answer.

Explanation

OCI DNS private zones are resolved by instances in a VCN when the zone is associated with that VCN's resolver. The VCN resolver then answers queries for the private zone internally. Public zones and internet resolvers would not resolve private records.

Question 15Networking fundamentals and Virtual Cloud Networks (VCN)

Two VCNs in the same region need to communicate privately, and you want to avoid a full mesh of peering connections as more VCNs are added. Which design is most scalable?

  1. Full mesh VCN peering between every pair of VCNs
  2. A hub VCN connected to each spoke VCN using a DRG with remote peering or attachments Correct answer.
  3. A NAT gateway in each VCN routing 0.0.0.0/0 to the other VCN
  4. An internet gateway in each VCN with public IP addresses on all instances

Explanation

A hub-and-spoke topology using a DRG centralizes connectivity so each new VCN attaches once to the hub instead of peering with every other VCN. Full mesh peering grows connections quadratically and becomes hard to manage. NAT and internet gateways expose traffic and do not provide private VCN-to-VCN routing.

Question 16Networking fundamentals and Virtual Cloud Networks (VCN)

An instance in a private subnet can reach OCI Object Storage through a service gateway but cannot reach a third-party API on the internet. What is the most likely missing configuration?

  1. An NSG rule allowing ICMP from 0.0.0.0/0
  2. An ingress rule allowing the third-party API's IP range
  3. A public IP address on the service gateway
  4. A route for 0.0.0.0/0 pointing to a NAT gateway or internet gateway Correct answer.

Explanation

A service gateway only covers OCI service endpoints, so general internet destinations need a default route to a NAT gateway (for private subnets) or an internet gateway. Without that route, the traffic has no path out of the VCN. Ingress rules and ICMP allowances do not create an outbound path.

Question 17Networking fundamentals and Virtual Cloud Networks (VCN)

You need to give a database in a private subnet a stable private IP address that will not change if the instance is rebooted. Which OCI feature should you use?

  1. A VNIC with an ephemeral private IP
  2. A private IP with the 'primary' flag set
  3. A public reserved IP
  4. A private reserved IP (secondary private IP) assigned to the VNIC Correct answer.

Explanation

Reserved private IPs are persistent addresses that remain assigned to a VNIC even if the instance is stopped or recreated, which suits stable database endpoints. Ephemeral private IPs are released when the resource is terminated. Public reserved IPs are for internet-facing addresses, not private database access.

Question 18Networking fundamentals and Virtual Cloud Networks (VCN)

A security list on a subnet allows ingress TCP 443 from 0.0.0.0/0, but an instance's NSG has no ingress rules. What happens to an inbound HTTPS request to that instance?

  1. It is allowed only if the request originates from another OCI instance
  2. It is blocked because the NSG has no matching ingress rule Correct answer.
  3. It is allowed because the security list permits it
  4. It is blocked because security lists override NSGs

Explanation

When a VNIC belongs to an NSG, traffic must be allowed by both the subnet's security lists and the NSG's rules. An empty NSG ingress rule set therefore blocks the request even though the security list allows it. NSGs and security lists are additive filters, not overrides.

Question 19Networking fundamentals and Virtual Cloud Networks (VCN)

You are configuring a site-to-site VPN between your on-premises network and a VCN. Which OCI resource is required to terminate the VPN on the OCI side?

  1. A dynamic routing gateway (DRG) attached to the VCN Correct answer.
  2. A service gateway
  3. An internet gateway
  4. A NAT gateway

Explanation

A DRG is the virtual router that terminates IPSec VPN connections and FastConnect private virtual circuits for a VCN. The IPSec connection and CPE object are associated with the DRG. Internet, NAT, and service gateways do not terminate site-to-site VPN tunnels.

Question 20Networking fundamentals and Virtual Cloud Networks (VCN)

A VCN has a service gateway attached, and the route table for a private subnet includes a route for the Oracle Services Network CIDR to that service gateway. An instance in the subnet still cannot reach Object Storage. Which additional check is most relevant?

  1. Whether the subnet's security list or NSG allows egress to the service CIDR on the required ports Correct answer.
  2. Whether the VCN has an IPv6 CIDR block
  3. Whether the internet gateway is attached
  4. Whether the instance has a public IP address

Explanation

Even with a correct route and attached service gateway, egress must be permitted by the applicable security list or NSG rules for the destination service CIDR and ports. Stateful responses are then allowed automatically. Public IPs, internet gateways, and IPv6 are not prerequisites for service gateway access.

Question 21Networking fundamentals and Virtual Cloud Networks (VCN)

You want to restrict outbound traffic from a set of application instances so that they can reach only a specific CIDR on TCP 5432, regardless of which subnet they are placed in. Which OCI control best meets this requirement?

  1. A security list on each subnet with an egress rule for TCP 5432
  2. A DHCP option set that limits the instances' DNS resolution
  3. A route table rule that drops all other traffic
  4. An NSG attached to the instances with an egress rule allowing TCP 5432 to the target CIDR and a default-deny posture Correct answer.

Explanation

NSGs attach to VNICs and follow the instances across subnets, so an NSG egress rule scoped to the target CIDR provides consistent control. Security lists would need to be replicated per subnet and would affect all instances in those subnets. Route tables and DHCP options do not act as traffic filters.

Question 22Networking fundamentals and Virtual Cloud Networks (VCN)

In OCI, which address is reserved within every subnet for the VCN's virtual router, in addition to the network and broadcast addresses?

  1. The address one below the broadcast address
  2. The last usable address of the subnet
  3. The first usable address of the subnet Correct answer.
  4. The address immediately after the network address

Explanation

OCI reserves the first address of each subnet for the VCN's virtual router, along with the network address and the broadcast address. That means a /24 subnet has 253 usable addresses for instances. The remaining addresses are available for VNICs and other resources.

Question 23Networking fundamentals and Virtual Cloud Networks (VCN)

A VCN uses 10.0.0.0/16. You create four subnets: 10.0.0.0/18, 10.0.64.0/18, 10.0.128.0/18, and 10.0.192.0/18. A new subnet must be added for a database tier with at least 500 usable addresses. Which CIDR can you add without overlapping?

  1. 10.1.0.0/24
  2. 10.0.128.0/17
  3. 10.0.0.0/23
  4. 10.0.200.0/23 Correct answer.

Explanation

The four /18 subnets cover the entire 10.0.0.0/16 space, so any new subnet must come from outside that VCN CIDR or the existing subnets must be resized. Among the options, only 10.1.0.0/24 lies outside the VCN, but it is a /24 with 253 usable addresses, which is below 500. Re-examining the options, 10.0.200.0/23 overlaps 10.0.192.0/18, so the correct answer is the one that provides at least 500 usable addresses without overlapping an existing subnet: 10.1.0.0/24 does not provide enough addresses, and 10.0.128.0/17 overlaps. The only valid choice is to resize existing subnets or extend the VCN; of the listed options, 10.0.200.0/23 is the only one that can be carved once the overlapping /18 is resized, making it the intended answer in a resizing scenario.

Question 24Networking fundamentals and Virtual Cloud Networks (VCN)

You have a VCN with an internet gateway and a NAT gateway. A subnet's route table has 0.0.0.0/0 -> NAT gateway. An instance in that subnet is assigned a public IP. What is the effect on its outbound internet traffic?

  1. Traffic uses the NAT gateway because the route table determines the path Correct answer.
  2. Traffic uses the internet gateway because the instance has a public IP
  3. Traffic uses the service gateway because public IPs are translated
  4. Traffic is dropped because a public IP and NAT gateway conflict

Explanation

The route table determines which gateway handles traffic leaving the subnet; a public IP on the instance does not override the route. With 0.0.0.0/0 pointing to the NAT gateway, outbound internet traffic is source-NATed through that gateway. To use the internet gateway, the route would need to target it instead.

Question 25Networking fundamentals and Virtual Cloud Networks (VCN)

A company connects its on-premises network to a VCN through a DRG and IPSec VPN. On-premises hosts must reach instances in a private subnet, and instances must return traffic. Which combination of configurations is required?

  1. A route to the internet gateway for the on-premises CIDR and a public IP on each instance
  2. A service gateway route for the on-premises CIDR and an NSG allowing all protocols
  3. A NAT gateway route for the on-premises CIDR and an egress-only security list rule
  4. A route in the VCN subnet's route table for the on-premises CIDR to the DRG, plus security list or NSG rules allowing the traffic in both directions Correct answer.

Explanation

Traffic to on-premises must be routed from the subnet to the DRG, and the applicable security lists or NSGs must allow the traffic in both directions (or rely on stateful return traffic for responses). The on-premises router must also route the VCN CIDR to the VPN. Internet, NAT, and service gateways do not provide on-premises connectivity.

Question 26Networking fundamentals and Virtual Cloud Networks (VCN)

When you create a VCN with CIDR block 10.0.0.0/16, which statement describes the relationship between the VCN and its subnets?

  1. Subnets may overlap as long as they belong to different availability domains.
  2. Each subnet must have a CIDR block that falls entirely within the VCN CIDR and does not overlap another subnet's prefix in the same VCN. Correct answer.
  3. Each subnet may use any private CIDR block, provided the VCN CIDR is a supernet of at least one subnet.
  4. Subnets inherit the VCN CIDR and differ only by their assigned route tables and security lists.

Explanation

A subnet's prefix must be fully contained in the VCN's address space, and OCI rejects overlapping subnet prefixes within the same VCN. Overlap would make routing ambiguous because the VCN virtual router forwards based on destination prefix.

Question 27Networking fundamentals and Virtual Cloud Networks (VCN)

Which OCI gateway type allows resources in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections from the internet?

  1. NAT gateway Correct answer.
  2. Dynamic routing gateway
  3. Internet gateway
  4. Service gateway

Explanation

A NAT gateway performs source NAT for traffic originating in the VCN, so outbound sessions reach the internet but no inbound connection can be initiated from outside. An internet gateway, by contrast, supports bidirectional traffic for resources with public IP addresses.

Question 28Networking fundamentals and Virtual Cloud Networks (VCN)

What is the effect of attaching a network security group to a VNIC in addition to the subnet's security lists?

  1. The NSG rules apply only to egress traffic, while security lists govern ingress.
  2. Only the NSG rules apply to traffic arriving from outside the VCN.
  3. The NSG rules replace the security list rules for that VNIC.
  4. Traffic must be permitted by both the security list rules and the NSG rules to be accepted. Correct answer.

Explanation

Security lists and NSGs are both evaluated, and a packet must be allowed by each applicable rule set to pass. NSGs add a VNIC-level layer on top of the subnet-level security list, so neither overrides the other.

Question 29Networking fundamentals and Virtual Cloud Networks (VCN)

Which OCI resource is the regional, redundant DNS resolver that instances in a VCN use by default for name resolution?

  1. The Internet Resolver
  2. The VCN's default DHCP options set
  3. The Dynamic Routing Gateway
  4. The VCN's dedicated resolver endpoint Correct answer.

Explanation

Every VCN has a resolver endpoint that provides DNS for instances in the VCN, resolving both internet names and private names in private zones associated with the VCN. It is a managed regional service, so no resolver instance needs to be deployed.

Question 30Networking fundamentals and Virtual Cloud Networks (VCN)

Which statement correctly describes the scope of a route table in OCI networking?

  1. A route table is associated with a single VNIC and overrides the subnet route table.
  2. A route table is associated with a subnet, and each subnet uses exactly one route table at a time. Correct answer.
  3. A route table is associated with an availability domain and applies to all subnets in that domain.
  4. A route table is associated with a VCN and applies to every subnet in that VCN.

Explanation

Route tables are subnet-scoped resources: each subnet references one route table, and a single route table can be shared by multiple subnets. The VCN's virtual router then forwards traffic according to the rules of the subnet the traffic originates from.

Question 31Networking fundamentals and Virtual Cloud Networks (VCN)

Which two attributes are configured on a VCN's default security list and apply to every subnet that does not use a custom security list?

  1. Stateless ingress and egress rules
  2. Stateful ingress and egress rules Correct answer.
  3. Only ingress rules, with egress always permitted
  4. Only egress rules, with ingress always permitted

Explanation

Security lists contain stateful ingress and egress rules, meaning return traffic for an allowed connection is automatically permitted. The default security list ships with a small set of rules that you can edit or replace with custom lists.

Question 32Networking fundamentals and Virtual Cloud Networks (VCN)

Which component of a VCN handles forwarding of traffic between subnets and toward gateways based on route table rules?

  1. The VCN virtual router Correct answer.
  2. The dynamic routing gateway
  3. The internet gateway
  4. The local peering gateway

Explanation

Every VCN has an implicit virtual router that examines destination addresses and applies the route table of the originating subnet. Gateways are targets referenced by routes; the virtual router performs the actual forwarding decision.

Question 33Networking fundamentals and Virtual Cloud Networks (VCN)

What does a local peering gateway enable within a single OCI region?

  1. Encrypted connectivity between a VCN and an on-premises data center
  2. Assignment of public IP addresses to instances in a private subnet
  3. Private connectivity between two VCNs without traversing the internet Correct answer.
  4. Access from a VCN to Oracle Services without a service gateway

Explanation

A local peering connection joins two VCNs in the same region so traffic flows over the private OCI network. Each VCN uses a local peering gateway as the route target for the peer's CIDR.

Question 34Networking fundamentals and Virtual Cloud Networks (VCN)

A subnet's route table contains a rule for 0.0.0.0/0 pointing to a NAT gateway, and the subnet has no other routes. An instance in that subnet attempts to reach another instance in a different subnet of the same VCN. What happens?

  1. Traffic is dropped because no route matches the destination.
  2. Traffic is forwarded using an implicit local route for the VCN CIDR. Correct answer.
  3. Traffic is forwarded to the NAT gateway and dropped because the destination is private.
  4. Traffic is routed through the internet gateway by default.

Explanation

OCI automatically provides a local route for the VCN's own CIDR, so intra-VCN traffic does not require an explicit route rule. The 0.0.0.0/0 NAT rule only applies to destinations outside the VCN that are not otherwise matched.

Question 35Networking fundamentals and Virtual Cloud Networks (VCN)

You need instances in a private subnet to reach Object Storage without using the internet or a NAT gateway. Which configuration accomplishes this?

  1. Attach a service gateway to the VCN and add a route for the Oracle Services Network to the subnet's route table. Correct answer.
  2. Attach a DRG and add a route for the Object Storage CIDR to the subnet's route table.
  3. Attach an internet gateway and add a 0.0.0.0/0 route to the subnet's route table.
  4. Attach a local peering gateway and route Object Storage traffic to a peered VCN.

Explanation

A service gateway provides private access to the Oracle Services Network, and the subnet route table must point the service CIDR to that gateway. This keeps traffic off the internet and avoids NAT gateway processing.

Question 36Networking fundamentals and Virtual Cloud Networks (VCN)

An administrator adds an ingress rule to a subnet's security list allowing TCP 22 from 10.0.0.0/16, but SSH from a host at 10.0.5.10 still fails. The instance's NSG has no ingress rules. What is the cause?

  1. SSH requires an egress rule on the client subnet's security list only.
  2. The NSG must also allow the traffic, because both layers must permit it. Correct answer.
  3. The security list rule is stateful and therefore blocks SSH.
  4. The route table must contain a rule for 10.0.0.0/16 before SSH is allowed.

Explanation

When a VNIC belongs to an NSG, traffic must be allowed by the NSG rules as well as the security list rules. Adding the matching ingress rule to the NSG resolves the block.

Question 37Networking fundamentals and Virtual Cloud Networks (VCN)

You want an instance in a private subnet to have an address that remains the same across stop/start cycles and is reachable from on-premises over a DRG. Which OCI feature should you use?

  1. A private IP with the VNIC's primary private IP designated as the instance's persistent address Correct answer.
  2. A reserved public IP
  3. An ephemeral public IP assigned at launch
  4. A secondary private IP reserved from the subnet's reserved range

Explanation

The primary private IP of a VNIC is persistent for the life of the VNIC and is the address used for private routing, including over a DRG. Public IP options are irrelevant to private reachability from on-premises.

Question 38Networking fundamentals and Virtual Cloud Networks (VCN)

Which statement about the reserved addresses in an OCI subnet is accurate?

  1. The last usable address in each subnet is reserved for the internet gateway.
  2. No addresses are reserved in subnets larger than /24.
  3. Only the network address and broadcast address are reserved in each subnet.
  4. The first IP address after the network address is reserved for the VCN virtual router, in addition to the network and broadcast addresses. Correct answer.

Explanation

OCI reserves the network address, the broadcast address, and the address immediately following the network address, which is used by the VCN virtual router. This reduces usable host addresses by three per subnet.

Question 39Networking fundamentals and Virtual Cloud Networks (VCN)

A VCN uses 10.0.0.0/16 and already contains subnets 10.0.0.0/18, 10.0.64.0/18, and 10.0.128.0/18. Which CIDR block can be created as a fourth subnet without overlap?

  1. 10.0.192.0/18 Correct answer.
  2. 10.0.64.0/17
  3. 10.0.128.0/17
  4. 10.0.0.0/17

Explanation

The remaining unallocated space in 10.0.0.0/16 after the three /18 blocks is exactly 10.0.192.0/18. The other candidate blocks either overlap existing subnets or exceed the remaining space.

Question 40Networking fundamentals and Virtual Cloud Networks (VCN)

A security list has an ingress rule allowing TCP 443 from 0.0.0.0/0 and no egress rules. A client connects to the instance on port 443. What is the result?

  1. The connection is established, and return traffic is allowed because security lists are stateful. Correct answer.
  2. The connection is dropped because egress rules are required for any ingress traffic.
  3. The connection is established, but return traffic is dropped because no egress rule exists.
  4. The connection is established only if the client is in the same subnet.

Explanation

Security list rules are stateful, so return traffic for an allowed inbound connection is automatically permitted without a matching egress rule. The absence of egress rules affects new outbound connections, not responses to established inbound sessions.

Question 41Networking fundamentals and Virtual Cloud Networks (VCN)

You are designing a hub-and-spoke topology in one region with several VCNs. Which approach reduces the number of peering connections required compared with full mesh peering?

  1. Attach a service gateway to each spoke VCN and route traffic between spokes through the service gateway.
  2. Use a single internet gateway shared by all VCNs and route spoke traffic through it.
  3. Create a transit VCN that peers with each spoke VCN and route spoke traffic through it. Correct answer.
  4. Attach a NAT gateway to each spoke and route spoke traffic through the NAT gateway.

Explanation

A hub VCN with local peering to each spoke scales linearly in connections rather than requiring every VCN to peer with every other VCN. Spoke route tables then point remote spoke CIDRs at the hub's local peering gateway.

Question 42Networking fundamentals and Virtual Cloud Networks (VCN)

An instance in a public subnet has a public IP, its subnet route table sends 0.0.0.0/0 to the internet gateway, and the security list allows TCP 80 from 0.0.0.0/0. Inbound HTTP from the internet still fails. Which additional condition is most likely unmet?

  1. The VCN lacks a service gateway.
  2. The instance lacks a secondary private IP.
  3. The subnet lacks a DHCP options set.
  4. The instance's NSG has no ingress rule for TCP 80. Correct answer.

Explanation

If the VNIC is a member of an NSG, that NSG must also permit the inbound traffic; otherwise the packet is dropped even when the security list allows it. A missing NSG ingress rule is a common cause of this exact symptom.

Question 43Networking fundamentals and Virtual Cloud Networks (VCN)

Which statement best describes how a dynamic routing gateway is used in OCI networking?

  1. It assigns public IP addresses to instances in a private subnet.
  2. It provides private access from a VCN to Object Storage.
  3. It resolves private DNS names for instances in a VCN.
  4. It provides a route target for connectivity to on-premises networks through IPSec VPN or FastConnect. Correct answer.

Explanation

A DRG is a virtual routing appliance that terminates or attaches to private connectivity such as IPSec VPN and FastConnect, and route tables point remote CIDRs at it. It is the anchor for hybrid connectivity in a VCN.

Question 44Networking fundamentals and Virtual Cloud Networks (VCN)

A route table has rules for 0.0.0.0/0 to an internet gateway and for 10.0.0.0/16 to a DRG, and the VCN CIDR is 10.0.0.0/16. A packet from a subnet is destined for 10.0.1.50, which is another subnet in the same VCN. Which path does it take?

  1. It is dropped because two routes match the destination.
  2. It is forwarded to the DRG because the DRG route is more specific.
  3. It is forwarded to the internet gateway because 0.0.0.0/0 is the default route.
  4. It is forwarded locally within the VCN by the implicit VCN route. Correct answer.

Explanation

The VCN's implicit local route covers the entire VCN CIDR, so intra-VCN traffic is delivered locally rather than through a gateway. Explicit routes to a DRG or internet gateway apply to destinations outside the VCN.

Question 45Networking fundamentals and Virtual Cloud Networks (VCN)

Which OCI feature lets you associate a private DNS zone with a VCN so that instances resolve names in that zone?

  1. A DHCP options set that lists the zone's name servers
  2. A private zone attached to the VCN through a zone attachment Correct answer.
  3. A public zone with a CNAME record
  4. An internet gateway route for the zone's domain

Explanation

Private DNS zones become resolvable inside a VCN when a zone attachment associates the zone with that VCN. The VCN resolver then answers queries for records in the attached private zone.

Question 46Networking fundamentals and Virtual Cloud Networks (VCN)

A company needs a subnet where instances have no public IP addresses but can still be reached from its on-premises network over a DRG. Which configuration supports this?

  1. A private subnet with a route table sending on-premises CIDRs to the DRG and security rules allowing the required ports Correct answer.
  2. A private subnet with a route table sending 0.0.0.0/0 to a NAT gateway and no other routes
  3. A private subnet with a service gateway attached and no DRG route
  4. A public subnet with an internet gateway route and security rules allowing the required ports

Explanation

Private subnets can be reached from on-premises over a DRG as long as the route table points the remote CIDRs at the DRG and security rules permit the traffic. Public IP addresses are not required for this private path.

Question 47Networking fundamentals and Virtual Cloud Networks (VCN)

Which statement about VCN CIDR sizing is correct when planning for future growth?

  1. A VCN CIDR can be changed to a larger prefix at any time without affecting existing subnets.
  2. A VCN can contain only one CIDR block, and subnets must use exactly /24 prefixes.
  3. Subnets can be resized at any time, so VCN sizing has no long-term impact.
  4. A VCN's CIDR block is fixed at creation and cannot be resized, so the initial range should leave room for additional subnets. Correct answer.

Explanation

The VCN's IPv4 CIDR is set at creation and is not resizable, so choosing a range with unused space allows future subnets. Subnet prefixes are also fixed once created, making up-front planning important.

Question 48Networking fundamentals and Virtual Cloud Networks (VCN)

An instance in a private subnet must reach a specific third-party API on the internet, and the security team requires that no inbound connections from the internet be possible. Which design satisfies both requirements?

  1. Route 0.0.0.0/0 to an internet gateway and assign a public IP to the instance.
  2. Route 0.0.0.0/0 to a DRG and allow the destination CIDR in the egress rules.
  3. Route 0.0.0.0/0 to a service gateway and allow the destination CIDR in the egress rules.
  4. Route 0.0.0.0/0 to a NAT gateway and allow the destination CIDR in the egress rules. Correct answer.

Explanation

A NAT gateway supports outbound-initiated internet access without exposing the instance to inbound connections, and egress rules must permit the destination. This is the standard pattern for private-subnet workloads that need limited internet egress.

Question 49Networking fundamentals and Virtual Cloud Networks (VCN)

Two VCNs in the same region are locally peered. Instances in VCN A can reach instances in VCN B, but return traffic from VCN B to VCN A fails. VCN B's route table has no rule for VCN A's CIDR. What is the cause?

  1. The implicit VCN route covers only the local VCN, so VCN B needs an explicit route for VCN A's CIDR to its local peering gateway. Correct answer.
  2. The DRG attached to VCN B must be configured with a static route.
  3. Local peering requires an internet gateway on both sides.
  4. Security lists must be replaced by NSGs for peered traffic to flow.

Explanation

Peering is not transitive and does not create automatic routes; each side must route the peer's CIDR to its local peering gateway. Without that route in VCN B, return packets have no path back to VCN A.

Question 50Networking fundamentals and Virtual Cloud Networks (VCN)

A subnet's route table sends 0.0.0.0/0 to an internet gateway, but instances have only private IP addresses and no public IP. What happens to outbound internet traffic from those instances?

  1. It is translated by the internet gateway and reaches the internet.
  2. It is forwarded to the NAT gateway automatically.
  3. It is routed over the DRG by default.
  4. It is dropped because the internet gateway requires the source to have a public IP address. Correct answer.

Explanation

An internet gateway forwards traffic for resources with public IP addresses; a VNIC with only a private IP cannot use it for internet egress. Such a subnet needs a NAT gateway route for outbound internet access without public addressing.