OCI Operations Associate: Compute and Networking Operations

Compute and Networking Operations

This domain tests instance lifecycle and VCN design: shapes, instance pools, autoscaling, subnets, gateways, route tables, and security rules.

Core rules

• Flexible shapes let you set OCPUs and memory independently. Burstable shapes are cheaper but cap baseline CPU with burst credits. Autoscaling uses an instance pool plus a policy (CPU utilization or schedule) and scales between minimum and maximum sizes.
• A VCN has a CIDR block and regional or AD-specific subnets. A subnet is public when its route table points 0.0.0.0/0 to an internet gateway; a private subnet can use a NAT gateway for outbound-only internet.
• Route tables attach to subnets, not to the VCN itself. A service gateway provides private access to Object Storage and other OCI services without internet exposure.
• Security lists apply at the subnet level and are stateful; network security groups (NSGs) apply to VNICs and are also stateful. Both use allow rules only; there is no explicit deny rule.

Worked example

A private subnet instance must download OS patches but must not accept inbound internet traffic. Place it in a private subnet, add a route rule 0.0.0.0/0 -> NAT gateway, and do not add an internet gateway route. Add an egress rule for TCP 443 to 0.0.0.0/0. If the instance also needs Object Storage, add a service gateway route and a rule for the Oracle Services Network CIDR. Adding an internet gateway route would make the subnet public.

Traps

• Thinking a public IP alone makes a subnet public; the route table must point to an internet gateway.
• Applying NSG rules to a subnet; NSGs bind to VNICs.
• Forgetting that security lists and NSGs are stateful, so return traffic is automatic.
• Using a NAT gateway for inbound traffic; it is outbound-only.
• Overlooking that an instance pool uses an instance configuration snapshot, so an image change needs a new configuration.