I85PREP
⌘ K
OCI Security Professional study materials
OCI Security Professional study resources

OCI Security Professional: Network security (VCN, security lists, NSGs, gateways)

OCI Security Professional · Work through your exam, one topic at a time.

All guide sections

Network security (VCN, security lists, NSGs, gateways)

This domain tests VCN design as a security boundary: subnet placement, route tables, gateways, security lists, and network security groups (NSGs). Questions often ask which control actually blocks or permits a flow.

Core rules

  • Security lists are subnet-level allow lists; NSGs are VNIC-level allow lists. Both are stateful by default: reply traffic for an allowed connection is automatically permitted.
  • When a VNIC has an NSG, traffic must be allowed by the relevant NSG rules and by the subnet's security list rules. Use NSGs to tighten access between instances in the same subnet; use security lists for broad subnet baselines.
  • Route tables choose the path; they do not grant permission. A packet still needs a matching security rule and a route to a gateway.
  • Internet Gateway: bidirectional internet for public subnets. NAT Gateway: outbound internet for private subnets, no unsolicited inbound. Service Gateway: private access to supported OCI services such as Object Storage, without internet. DRG: on-premises or transit connectivity. Local Peering Gateway: VCN-to-VCN peering in the same region.
  • Private subnets should route 0.0.0.0/0 to a NAT gateway, and the service CIDR to a service gateway.

Worked example

A private subnet instance must fetch OS updates from the internet and read Object Storage privately. Route table: 0.0.0.0/0 -> NAT gateway; OCI service CIDR -> service gateway. Egress security rule: TCP 443 to 0.0.0.0/0 (or the update mirror CIDR) for updates, and TCP 443 to the service CIDR for Object Storage. Ingress: none from the internet. Reasoning: NAT provides outbound-only internet; the service gateway keeps Object Storage traffic off the internet; stateful rules allow return traffic. A common error is adding an Internet Gateway route, which makes the subnet public.

Traps

Opening 0.0.0.0/0 ingress for testing; forgetting egress rules; confusing route tables with firewalls; assuming an NSG replaces the security list; and using a service gateway for arbitrary internet destinations.