Networking Fundamentals and Virtual Cloud Networks (VCN)
What this domain tests
This domain covers VCN design: CIDR planning, regional versus AD-specific subnets, VNIC and IP assignment, and the two security rule models. Expect scenario questions that ask which construct enforces a rule or why traffic is blocked.
Core rules
- A VCN is regional and can have up to five IPv4 CIDR blocks (for example 10.0.0.0/16) plus an Oracle-assigned IPv6 /56. Subnets use IPv4 /16–/30.
- A subnet is regional (spans ADs) or AD-specific. "Public" means its route table sends 0.0.0.0/0 to an internet gateway and its security rules allow the traffic; the label alone does not make it public.
- Security lists attach to subnets; network security groups (NSGs) attach to VNICs. Both are stateful, and both are evaluated. A packet must be allowed by the applicable security list and by every NSG on the VNIC.
- VCN peering requires non-overlapping CIDRs: local peering uses LPGs in one region; remote peering uses DRGs across regions.
Worked example
Design 10.0.0.0/16 with web 10.0.1.0/24 (public), app 10.0.2.0/24, and db 10.0.3.0/24. Web routes 0.0.0.0/0 to the IGW; app and db route 0.0.0.0/0 to a NAT gateway for patching, and all three use a service gateway for Object Storage. The security list on web allows TCP 443 from 0.0.0.0/0; the app NSG allows TCP 8080 only from the web NSG; the db NSG allows TCP 1521 only from the app NSG. Reasoning: use NSG references rather than CIDRs so rules follow VNIC membership, and keep databases without inbound internet exposure.
Traps
- The default security list allows SSH TCP 22 from 0.0.0.0/0 - replace it.
- Overlapping CIDRs block peering even when routes look correct.
- An ephemeral public IP can change after stop/start; reserve it for stable DNS.
- A VCN cannot be deleted until its subnets, gateways, and other resources are removed.