Security, Monitoring, and Troubleshooting
What this domain tests
This domain covers defense in depth and operational diagnosis: NSG and security-list behavior, flow logs, metrics and alarms, and tools such as Network Path Analyzer.
Core rules
- Both security lists (subnet) and NSGs (VNIC) are stateful: return traffic for an allowed connection is automatically permitted. Ingress must be allowed by the relevant security list and every NSG on the VNIC.
- VCN flow logs capture accepted and rejected flows; enable them at the VCN, subnet, or VNIC level and send to Object Storage, Streaming, or Logging.
- Metrics (LB, DRG, VPN, VCN) feed alarms and Notifications. Audit records API changes.
- Network Path Analyzer tests a simulated path between endpoints and identifies the blocking route or security rule. OCI Bastion provides managed SSH without public IPs.
- OCI Network Firewall, WAF, and Security Zones add policy enforcement beyond NSGs.
Worked example
SSH to a compute instance times out. Check: does the instance have a public IP or a bastion path? Does the subnet route 0.0.0.0/0 to an IGW? Does the security list allow TCP 22 from the admin CIDR? Does the VNIC's NSG also allow 22? Is the OS firewall open? Run Network Path Analyzer from the admin source to the VNIC; it reports the failing rule. Reasoning: work outside-in - routing, then security lists, then NSGs, then guest OS - and use flow logs to confirm whether packets arrive.
Traps
- Fixing only the NSG and forgetting the security list, or vice versa.
- Expecting a NAT gateway or private subnet to accept inbound SSH.
- Treating stateful rules as needing an explicit return rule.
- Reading flow logs as real time; they are aggregated.
- Opening 0.0.0.0/0 to management ports instead of scoping to a bastion or admin CIDR.