I85PREP
⌘ K
OCI Architect Associate study materials
OCI Architect Associate study resources

Oracle Cloud Infrastructure Architect Associate practice questions

One question at a time. Build your OCI Architect Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity and Access Management (IAM), compartments, and tenancy governance

In OCI Identity and Access Management, which statement correctly describes the relationship between a user and a group?

  1. A group is a container for compartment resources and is managed by the tenancy administrator only.
  2. A user inherits permissions directly from the tenancy, and groups are only used for billing.
  3. A user can belong to multiple groups, and policies grant permissions to groups rather than to individual users. Correct answer.
  4. A user can belong to exactly one group, and that group determines the user's compartment.

Explanation

OCI users are independent identities that can be members of many groups, and the recommended practice is to attach policies to groups so permissions scale with team membership. Groups are identity collections, not resource containers, and they do not determine compartment placement.

Question 2Identity and Access Management (IAM), compartments, and tenancy governance

An administrator wants a policy statement to apply only to a specific compartment named Finance. Which policy syntax element achieves this?

  1. The compartment keyword in the policy's subject line
  2. The compartment path in the policy statement's location scope Correct answer.
  3. The tenancy OCID in the policy's condition block
  4. The group name prefix in the policy's verb clause

Explanation

OCI policies are written in a compartment context, and a statement scoped to a compartment applies to resources in that compartment. The location scope appears in the statement's resource clause, for example 'in compartment Finance'.

Question 3Identity and Access Management (IAM), compartments, and tenancy governance

Which OCI IAM construct is used to organize and isolate resources and to control access at a coarse level?

  1. Compartment Correct answer.
  2. Dynamic group
  3. Auth token
  4. Identity provider

Explanation

Compartments are the primary logical containers for OCI resources and form the boundary for policy-based access. Dynamic groups, identity providers, and auth tokens relate to identity and authentication rather than resource organization.

Question 4Identity and Access Management (IAM), compartments, and tenancy governance

A policy statement reads: allow group Developers to manage instances in compartment Dev. Which action does the verb 'manage' permit?

  1. All actions on the resource type, including create, update, and delete Correct answer.
  2. Only listing and reading instance details
  3. Only actions explicitly listed after the verb
  4. Only creating instances but not deleting them

Explanation

In OCI policy syntax, 'manage' is the broadest verb and grants the full set of permissions for the resource type, including create, read, update, and delete. Narrower verbs such as 'read', 'use', and 'inspect' cover subsets of those permissions.

Question 5Identity and Access Management (IAM), compartments, and tenancy governance

Which statement about the root compartment of a tenancy is accurate?

  1. It must be created manually by the first administrator before any resources exist.
  2. It can be deleted once at least one child compartment is created.
  3. It is created automatically with the tenancy and policies written there can apply tenancy-wide. Correct answer.
  4. It is a regional construct that exists separately in each availability domain.

Explanation

The root compartment is created with the tenancy and is the top of the compartment hierarchy. Policies placed in the root compartment can grant access across the entire tenancy, which is why they should be used sparingly.

Question 6Identity and Access Management (IAM), compartments, and tenancy governance

What is the purpose of a dynamic group in OCI IAM?

  1. To grant console access to federated users based on their department attribute
  2. To organize compartments into a hierarchy for billing purposes
  3. To store API signing keys for service-to-service authentication
  4. To group compute instances and other resources so policies can grant them access without stored credentials Correct answer.

Explanation

Dynamic groups use matching rules to include resources such as instances, and policies can then authorize those resources to call OCI APIs without embedding credentials. They are distinct from user groups, which contain human or federated identities.

Question 7Identity and Access Management (IAM), compartments, and tenancy governance

Which OCI IAM feature lets an administrator require multi-factor authentication for a group of users?

  1. A dynamic group matching rule
  2. A service-level agreement on the tenancy
  3. A compartment quota policy
  4. A sign-on policy in an identity domain Correct answer.

Explanation

Sign-on policies in an identity domain define authentication requirements, including whether MFA is enforced, for the users the policy applies to. Compartment quotas, SLAs, and dynamic group rules do not govern authentication.

Question 8Identity and Access Management (IAM), compartments, and tenancy governance

Which credential type should a user create to authenticate to the OCI CLI with a key pair rather than a password?

  1. An API signing key Correct answer.
  2. An auth token
  3. A console password
  4. A customer secret key

Explanation

The OCI CLI and SDKs authenticate using an API signing key associated with the user's profile. Auth tokens are used for some token-based services, customer secret keys are for S3-compatible access, and console passwords are for browser sign-in.

Question 9Identity and Access Management (IAM), compartments, and tenancy governance

A company wants all new resources in compartment App to be visible to the security team but modifiable only by the platform team. Which policy design best achieves this?

  1. Grant the security team 'manage all-resources' in the tenancy and rely on tags to limit changes.
  2. Grant both teams 'use all-resources' in the root compartment so permissions are inherited.
  3. Grant the security team 'read all-resources' in compartment App and the platform team 'manage all-resources' in compartment App. Correct answer.
  4. Grant the security team 'manage' on instances and the platform team 'read' on all resources.

Explanation

Policies are additive, so granting read-only access to one group and full management to another in the same compartment produces the intended split of visibility and control. Granting broad permissions at the root or reversing the verbs would not restrict modification to the platform team.

Question 10Identity and Access Management (IAM), compartments, and tenancy governance

A policy statement must allow a group to read object storage buckets in a compartment. Which resource clause is valid for this statement?

  1. in compartment Storage where target.bucket.name = 'data'
  2. objects in compartment Storage Correct answer.
  3. in compartment Storage
  4. bucket in compartment Storage

Explanation

The resource clause names the resource type being authorized, such as 'objects' or 'buckets', followed by the compartment scope. Omitting the resource type or substituting a condition makes the statement invalid or incorrectly scoped.

Question 11Identity and Access Management (IAM), compartments, and tenancy governance

An administrator deletes a compartment that still contains running compute instances. What is the expected result?

  1. The compartment is deleted and the instances are moved to the root compartment automatically.
  2. The compartment is deleted and the instances are terminated automatically.
  3. The compartment is deleted and the instances continue running in an orphaned state.
  4. The deletion fails until all resources in the compartment are moved or terminated. Correct answer.

Explanation

OCI prevents deletion of a compartment that still contains resources, so the administrator must move or terminate those resources first. This safeguard avoids orphaning resources whose policies would become ambiguous.

Question 12Identity and Access Management (IAM), compartments, and tenancy governance

Which statement about the OCI policy verb 'inspect' is correct?

  1. It grants read access to list resources but not to read their detailed contents. Correct answer.
  2. It grants access only to metadata of compartments, not to resources.
  3. It grants full management of all resource types in a compartment.
  4. It is equivalent to 'manage' when applied to instances.

Explanation

'Inspect' is a narrow verb that allows listing resources without exposing their detailed configuration, useful for auditors who need inventory visibility. It is more limited than 'read' and far more limited than 'manage'.

Question 13Identity and Access Management (IAM), compartments, and tenancy governance

A tenancy administrator wants federated users to sign in with their corporate identity provider. Which OCI IAM configuration is required?

  1. Enable MFA on the tenancy root user only and share the credentials with the team.
  2. Issue API signing keys to every corporate user and distribute them centrally.
  3. Configure an identity provider in the identity domain and map external groups to OCI groups. Correct answer.
  4. Create a dynamic group for each corporate department and map it to a compartment.

Explanation

Federation requires configuring an identity provider and mapping the external groups to OCI groups so policies can apply to federated identities. Dynamic groups match resources, and API keys or shared root credentials are not federation mechanisms.

Question 14Identity and Access Management (IAM), compartments, and tenancy governance

Which statement correctly describes how policies are evaluated when a user belongs to two groups with different permissions?

  1. Policies are additive, so the user receives the union of permissions granted to all their groups. Correct answer.
  2. The most restrictive policy across all groups takes precedence.
  3. The user must choose one group at sign-in to determine effective permissions.
  4. Only the policy attached to the group with the most members is evaluated.

Explanation

OCI policies are allow-only and additive, so a user's effective permissions are the union of everything granted through all groups they belong to. There is no deny rule to override and no most-restrictive resolution.

Question 15Identity and Access Management (IAM), compartments, and tenancy governance

What is the effect of writing a policy in the root compartment that grants a group 'manage all-resources'?

  1. It applies only to resources created directly in the root compartment.
  2. It applies to resources across the entire tenancy, including all child compartments. Correct answer.
  3. It applies only to identity resources such as users and groups.
  4. It applies only to resources tagged with the tenancy name.

Explanation

Policies in the root compartment can grant access tenancy-wide, covering resources in every child compartment. This broad reach is why such statements should be limited to trusted administrative groups.

Question 16Identity and Access Management (IAM), compartments, and tenancy governance

An administrator wants to limit how many compute cores a team can consume in a compartment. Which OCI feature should be used?

  1. An IAM policy with the 'manage' verb
  2. A compartment quota policy Correct answer.
  3. A dynamic group rule matching instances
  4. A budget alert on the compartment

Explanation

Compartment quotas set hard limits on resource consumption, such as the number of cores, within a compartment. IAM policies control who can act, dynamic groups identify resources, and budgets only alert on spending.

Question 17Identity and Access Management (IAM), compartments, and tenancy governance

Which statement about identity domains in OCI IAM is correct?

  1. Each compartment must have its own identity domain.
  2. Identity domains replace compartments as the resource isolation boundary.
  3. Only one identity domain can exist per tenancy region.
  4. An identity domain provides a container for users, groups, and authentication policies. Correct answer.

Explanation

Identity domains host users, groups, and authentication settings, and a tenancy can have multiple domains, such as a default domain and additional ones. They complement compartments rather than replace them.

Question 18Identity and Access Management (IAM), compartments, and tenancy governance

A dynamic group rule must match all instances in compartment Compute that carry the tag Environment=Prod. Which matching rule syntax is appropriate?

  1. ALL {instance.compartment.id = 'ocid1.compartment.oc1..xxx', tag.Environment.value = 'Prod'} Correct answer.
  2. ALL {instance.id = 'ocid1.instance.oc1..xxx'}
  3. ANY {tag.Environment.value = 'Prod'}
  4. ANY {instance.compartment.id = 'ocid1.compartment.oc1..xxx'}

Explanation

A dynamic group matching rule uses ALL or ANY with one or more conditions, and combining the compartment OCID with a tag condition restricts membership to tagged instances in that compartment. Using ANY or matching only an instance OCID would broaden or narrow membership incorrectly.

Question 19Identity and Access Management (IAM), compartments, and tenancy governance

Which statement about the tenancy administrator account is accurate?

  1. It is the initial administrator identity created with the tenancy and should be protected with MFA and limited use. Correct answer.
  2. It is a group that automatically includes all federated users.
  3. It is a normal user that can be deleted after the first identity domain is created.
  4. It is a service account used only by OCI support.

Explanation

The tenancy administrator is the first identity in a new tenancy and holds broad privileges, so best practice is to secure it with MFA and reserve it for break-glass administration. It is not a group, a support account, or a deletable ordinary user.

Question 20Identity and Access Management (IAM), compartments, and tenancy governance

A user reports they can view instances in a compartment but cannot start or stop them. Which policy change grants the missing capability with least privilege?

  1. Grant the user's group 'manage instances' in the compartment. Correct answer.
  2. Grant the user's group 'manage all-resources' in the tenancy.
  3. Grant the user's group 'inspect instances' in the compartment.
  4. Grant the user's group 'read instances' in the compartment.

Explanation

Starting and stopping instances are instance lifecycle actions covered by 'manage instances' scoped to the compartment, which adds the needed permissions without granting unrelated resources. Read and inspect verbs are view-only, and tenancy-wide manage is broader than necessary.

Question 21Identity and Access Management (IAM), compartments, and tenancy governance

Which condition variable would an administrator use in a policy to restrict access based on the requesting user's group membership?

  1. request.principal.type
  2. target.compartment.id
  3. request.user.id
  4. request.groups Correct answer.

Explanation

Policy conditions can reference request attributes, and request.groups exposes the groups associated with the requesting principal for conditional checks. The other variables identify the user, the target compartment, or the principal type rather than group membership.

Question 22Identity and Access Management (IAM), compartments, and tenancy governance

An architect needs instances in compartment A to read secrets in compartment B without storing credentials on the instances. Which combination achieves this?

  1. A dynamic group matching the instances plus a policy allowing that dynamic group to read secrets in compartment B Correct answer.
  2. An API signing key embedded in each instance's user data plus a policy granting manage secrets
  3. A user group containing the instance OCIDs plus a policy allowing that group to manage secrets in compartment B
  4. A compartment quota on secrets in compartment B plus a budget alert

Explanation

Dynamic groups let policies authorize OCI resources such as instances as principals, enabling credential-free access to services like the secrets service. Embedding keys is insecure, user groups cannot contain instance OCIDs, and quotas or budgets do not grant access.

Question 23Identity and Access Management (IAM), compartments, and tenancy governance

A policy statement grants 'manage all-resources in compartment Team' to group Engineers. A resource in a child compartment Team-Child is accessed. What is the result?

  1. Access is granted because policies in a compartment also apply to its child compartments. Correct answer.
  2. Access is denied unless a matching policy exists in the root compartment.
  3. Access is denied because the policy names only the parent compartment.
  4. Access is granted only if the resource is tagged with the parent compartment name.

Explanation

Compartment policies cascade downward, so a policy written in a parent compartment applies to resources in its child compartments as well. This inheritance is why compartment hierarchy design matters for access control.

Question 24Identity and Access Management (IAM), compartments, and tenancy governance

An administrator writes: allow group Auditors to read buckets in tenancy. What does this statement actually authorize?

  1. Read access to all buckets in every compartment of the tenancy Correct answer.
  2. Read access only to buckets the Auditors group created
  3. Read access only to buckets tagged as auditable
  4. Read access only to buckets in the root compartment

Explanation

Using 'in tenancy' as the scope applies the statement across the entire tenancy rather than a single compartment. This is a common source of over-permissioning when a narrower compartment scope was intended.

Question 25Identity and Access Management (IAM), compartments, and tenancy governance

Which statement best explains why OCI policies cannot explicitly deny access?

  1. OCI policies rely on network security groups to deny access.
  2. OCI policies evaluate deny first and then allow within the same compartment.
  3. OCI policies are allow-only, so access is the union of all allow statements and is removed only by deleting or narrowing grants. Correct answer.
  4. OCI policies use deny statements that take precedence over allow statements.

Explanation

The OCI policy model is allow-only, meaning effective permissions are the union of all matching allow statements. To reduce access, an administrator must remove or narrow the granting statements rather than add a deny rule.

Question 26Identity and Access Management (IAM), compartments, and tenancy governance

An administrator writes the policy statement: allow group Devs to use instances in compartment App. Which set of instance permissions does this statement grant to members of Devs?

  1. Full unrestricted access to every resource type inside compartment App
  2. The ability to read, update, start, stop, and reboot existing instances, without permission to create or delete them Correct answer.
  3. Only the ability to list and read the instances, without any action on them
  4. The ability to create, update, move, and delete the instances

Explanation

In OCI IAM, 'use instances' includes read access, updates, and supported operations on existing instances, such as starting, stopping, and rebooting. It excludes INSTANCE_CREATE and INSTANCE_DELETE, which require 'manage instances'. Thus, this policy grants operational access to existing instances in compartment App without permission to launch or delete them.

Question 27Identity and Access Management (IAM), compartments, and tenancy governance

A tenancy has compartments Finance and Audit as siblings under the root compartment. A policy in the root compartment grants group Auditors 'read all-resources in compartment Finance'. Members of Auditors can list and read resources in Finance but report that they cannot read anything in Audit. Which explanation is correct?

  1. Cross-compartment access is blocked whenever the two compartments are siblings rather than parent and child
  2. The group Auditors must be granted the same statement in each identity domain before it takes effect
  3. Policies written in the root compartment apply only to the root compartment itself, never to child compartments
  4. The statement applies only to the compartment named in its resource clause, so Audit is outside its scope Correct answer.

Explanation

A policy statement's resource clause is evaluated against the compartment named in it, and the grant does not spill over to sibling compartments. To cover Audit, a separate statement or an additional resource clause naming that compartment is required. Policies placed in the root compartment can reference any compartment in the tenancy, but each statement still targets the compartment it names.

Question 28Identity and Access Management (IAM), compartments, and tenancy governance

A security team wants every member of group Builders to be forced to use multi-factor authentication when signing in to the OCI Console. Which IAM construct enforces this requirement at the group level?

  1. A sign-on policy attached to the identity domain that applies to the group Correct answer.
  2. A policy statement with the verb 'manage' on the tenancy resource type
  3. An identity provider assertion mapping that rejects password logins
  4. A tag default applied to the compartment where the users reside

Explanation

In an OCI identity domain, sign-on policies define the authentication rules users must satisfy, and a rule can be scoped to specific groups so that members must complete an additional factor. The policy is evaluated during sign-in, before any IAM authorization of resource access occurs. IAM policies govern resource permissions and cannot themselves require a second factor.

Question 29Identity and Access Management (IAM), compartments, and tenancy governance

An organization federates users through an external identity provider and wants OCI to recognize them for policy grants without creating local OCI credentials for each person. Which statement describes the correct approach?

  1. Federation grants access automatically to all resources in the tenancy without any policy statements
  2. Users are mapped into an identity domain through federation, and IAM policies grant access to groups in that domain Correct answer.
  3. Each federated user must also be created as a local OCI user with an API key before policies apply
  4. Federated users inherit permissions only from the tenancy administrator account

Explanation

Federated users are provisioned into an OCI identity domain, where group membership is derived from identity provider attributes or assigned locally. IAM policies then reference those groups exactly as they would reference groups of local users, so authorization works the same way. No separate local OCI user or API key is required for console access.

Question 30Identity and Access Management (IAM), compartments, and tenancy governance

A platform team owns compartment Platform, and an application team owns compartment App. The application team must be able to attach and detach a specific network security group that lives in Platform, but must not be able to change anything else there. Which policy design satisfies this requirement?

  1. Grant 'manage network-security-groups in compartment Platform' to the application team with a condition restricting the request to that resource Correct answer.
  2. Grant the application team 'manage all-resources in compartment Platform' so the security group operations always succeed
  3. Grant 'manage all-resources in tenancy' to the application team and rely on audit logs to detect misuse
  4. Grant 'use virtual-network-family in compartment Platform' to the application team and rely on compartment isolation

Explanation

Least privilege in OCI is achieved by naming the narrowest resource type that supports the required operations and scoping the statement to the compartment that contains it. A condition can further restrict the grant so it applies only to the intended resource rather than every network security group in the compartment. Broad verbs or tenancy-wide grants exceed the stated requirement.

Question 31Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

In an OCI VCN, which CIDR block size is the smallest subnet prefix that OCI permits when creating a subnet?

  1. /24
  2. /30
  3. /28 Correct answer.
  4. /16

Explanation

OCI allows subnet CIDR blocks between /16 and /30, but the practical minimum for a usable subnet is /28 because OCI reserves the first two IP addresses and the last address in every subnet, leaving too few usable addresses in a /29 or /30. A /28 is therefore commonly cited as the smallest subnet you should create for real workloads.

Question 32Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which OCI gateway type allows instances in a private subnet to reach the internet for software updates while preventing inbound connections from the internet?

  1. Dynamic Routing Gateway
  2. NAT Gateway Correct answer.
  3. Service Gateway
  4. Internet Gateway

Explanation

A NAT Gateway provides outbound-only internet access for instances in private subnets. Instances can initiate connections to the internet, but the internet cannot initiate connections back to those instances. An Internet Gateway, by contrast, supports bidirectional traffic for instances with public IPs.

Question 33Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

A security list in OCI is best described by which statement?

  1. It is applied at the VNIC level and its rules are stateless.
  2. It is applied at the subnet level and its rules are stateful.
  3. It is applied at the subnet level and its rules are stateless. Correct answer.
  4. It is applied at the VNIC level and supports stateful rules only.

Explanation

Security lists are virtual firewall rules attached to a subnet and apply to all VNICs in that subnet. Their rules are stateless, meaning return traffic must be explicitly allowed by a corresponding rule. Network security groups, in contrast, are VNIC-level and stateful.

Question 34Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which OCI construct is stateful and can be applied to individual VNICs to control traffic?

  1. Network security group Correct answer.
  2. Security list
  3. DHCP options
  4. Route table

Explanation

Network security groups (NSGs) are stateful virtual firewalls applied to specific VNICs. Because they are stateful, return traffic for an allowed connection is automatically permitted. Security lists, by contrast, are subnet-level and stateless.

Question 35Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

When you create a VCN with the VCN Wizard in the OCI Console and choose the option to create public and private subnets, which gateway is automatically created for the private subnet's outbound internet access?

  1. NAT Gateway Correct answer.
  2. Service Gateway
  3. Internet Gateway
  4. Local Peering Gateway

Explanation

The VCN Wizard creates a NAT Gateway so that instances in the private subnet can initiate outbound internet connections without being reachable from the internet. It also typically creates an Internet Gateway for the public subnet and a Service Gateway for OCI services.

Question 36Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which statement correctly describes the relationship between a VCN and its subnets in OCI?

  1. A subnet is tied to a single availability domain and cannot be changed after creation. Correct answer.
  2. A subnet is regional and spans all availability domains in the region.
  3. Subnets can span multiple availability domains by default.
  4. Subnets are always private and cannot have public IP addresses.

Explanation

In OCI, a subnet is scoped to a single availability domain, and this association is set at creation time and cannot be changed later. The VCN itself is regional and can contain subnets in multiple availability domains. This regional VCN, AD-scoped subnet model is fundamental to OCI networking design.

Question 37Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

What is the purpose of a route rule with destination 0.0.0.0/0 in a VCN route table?

  1. It blocks all outbound traffic from the subnet.
  2. It applies only to traffic within the VCN.
  3. It sends all traffic not matching a more specific route to the specified target gateway. Correct answer.
  4. It enables DNS resolution inside the VCN.

Explanation

A default route with destination 0.0.0.0/0 acts as a catch-all for traffic that does not match any more specific route rule. OCI route tables use longest-prefix match, so more specific destinations take precedence over the default route. The target determines whether traffic goes to an Internet Gateway, NAT Gateway, DRG, or other gateway.

Question 38Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which OCI gateway is required to connect a VCN to an on-premises network over a FastConnect or Site-to-Site VPN connection?

  1. Internet Gateway
  2. NAT Gateway
  3. Service Gateway
  4. Dynamic Routing Gateway Correct answer.

Explanation

A Dynamic Routing Gateway (DRG) is the virtual router that attaches to a VCN and provides connectivity to on-premises networks via FastConnect or Site-to-Site VPN, and also to other VCNs through remote peering. Internet, NAT, and Service Gateways serve different purposes and do not provide on-premises connectivity.

Question 39Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

An instance in a private subnet must reach Object Storage without traversing the internet. Which gateway should be configured, and what route rule is needed?

  1. Service Gateway with a route to the Object Storage service CIDR Correct answer.
  2. NAT Gateway with a route to 0.0.0.0/0
  3. Internet Gateway with a route to 0.0.0.0/0
  4. Dynamic Routing Gateway with a route to 0.0.0.0/0

Explanation

A Service Gateway provides private access from a VCN to supported OCI services such as Object Storage, and the route table must include a route whose destination is the service's CIDR (or the service's regional CIDR) with the Service Gateway as target. Traffic stays on the OCI network and never uses the internet.

Question 40Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

A security list allows inbound TCP port 22 from 0.0.0.0/0 but does not include an outbound rule. What happens to the SSH response packets returning to the client?

  1. They are blocked only if an NSG also denies them.
  2. They are allowed because security lists are stateful.
  3. They are allowed because OCI automatically permits return traffic on ephemeral ports.
  4. They are blocked because security list rules are stateless and no outbound rule allows them. Correct answer.

Explanation

Security list rules are stateless, so return traffic must be explicitly allowed by an outbound rule. Without an outbound rule permitting the response packets, the SSH session cannot complete even though the inbound rule exists. NSGs, which are stateful, would not have this problem.

Question 41Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Two VCNs in the same region need to communicate privately. Which OCI feature should be used?

  1. Internet Gateway with public IPs
  2. Remote Peering Connection
  3. Local Peering Gateway Correct answer.
  4. Dynamic Routing Gateway with FastConnect

Explanation

A Local Peering Gateway (LPG) connects two VCNs in the same region without using the internet. Remote Peering Connections are used for VCNs in different regions. Using public IPs and an Internet Gateway would expose traffic to the internet and is not the private option.

Question 42Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

An architect wants to allow only specific instances in a subnet to accept inbound traffic on port 443, while other instances in the same subnet should not. Which approach meets this requirement with the least operational overhead?

  1. Create a DHCP option set that restricts port 443.
  2. Create an NSG that allows port 443 and attach it only to the intended VNICs. Correct answer.
  3. Create a route rule that sends port 443 traffic to a NAT Gateway.
  4. Create a security list that allows port 443 and attach it to the subnet.

Explanation

NSGs are applied to individual VNICs, so you can allow port 443 only on the intended instances while leaving other VNICs in the same subnet unaffected. A security list applies to every VNIC in the subnet, which would not meet the per-instance requirement. Route tables and DHCP options do not filter traffic by port.

Question 43Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

A route table contains two rules: 0.0.0.0/0 to a NAT Gateway and 10.0.0.0/16 to a DRG. A packet from an instance is destined for 10.0.5.10. Which target does OCI select?

  1. The NAT Gateway, because 0.0.0.0/0 is the default route.
  2. The target is chosen randomly between the two rules.
  3. The DRG, because 10.0.0.0/16 is the longest matching prefix. Correct answer.
  4. The packet is dropped because two rules match.

Explanation

OCI route tables use longest-prefix match, so the more specific 10.0.0.0/16 route to the DRG takes precedence over the 0.0.0.0/0 default route. The default route is used only when no more specific route matches. Multiple matching rules do not cause drops or random selection.

Question 44Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which statement about the reserved IP addresses in an OCI subnet is correct?

  1. Only the network address and broadcast address are reserved.
  2. The first two IP addresses and the last IP address are reserved in each subnet. Correct answer.
  3. Only the first IP address is reserved.
  4. No IP addresses are reserved in OCI subnets.

Explanation

OCI reserves the first two IP addresses (network address and the VCN's virtual router address) and the last IP address (broadcast) in each subnet. These addresses cannot be assigned to instances. This reservation reduces the number of usable addresses in a subnet by three.

Question 45Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

An instance in a public subnet cannot reach the internet even though it has a public IP and the subnet routes 0.0.0.0/0 to an Internet Gateway. Which security-list configuration is the most likely cause?

  1. The instance has a private IP address.
  2. The security list has no outbound rule allowing traffic to 0.0.0.0/0. Correct answer.
  3. The security list has an inbound rule allowing TCP port 22.
  4. The subnet has a route to a Service Gateway.

Explanation

Because security lists are stateless, outbound traffic must be explicitly permitted. If the security list lacks an outbound rule for 0.0.0.0/0, the instance cannot initiate connections to the internet even with a public IP and a correct route. An inbound SSH rule alone does not enable outbound traffic.

Question 46Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which statement about the Service Gateway is accurate?

  1. It requires an Internet Gateway to function.
  2. It provides private access to supported OCI services and requires a route rule pointing to it. Correct answer.
  3. It is available only in the root compartment.
  4. It can be used from any subnet in the VCN without additional route configuration.

Explanation

A Service Gateway enables private connectivity from a VCN to supported OCI services such as Object Storage, and the subnet's route table must include a route whose destination is the service CIDR with the Service Gateway as target. It does not require an Internet Gateway and is not limited to the root compartment.

Question 47Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

A company wants to connect its on-premises data center to a VCN with a Site-to-Site VPN. Which two components are required on the OCI side?

  1. A Service Gateway and a Local Peering Gateway
  2. A Local Peering Gateway and a NAT Gateway
  3. A Dynamic Routing Gateway and a Customer-Premises Equipment object Correct answer.
  4. An Internet Gateway and a NAT Gateway

Explanation

A Site-to-Site VPN requires a DRG attached to the VCN and a Customer-Premises Equipment (CPE) object that represents the on-premises VPN device. IPSec tunnels are then created between the DRG and the CPE. Internet, NAT, Service, and Local Peering Gateways do not provide on-premises VPN connectivity.

Question 48Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which OCI feature allows you to resolve DNS names for instances in a VCN using the VCN's resolver?

  1. The Internet Gateway's DNS proxy
  2. The Service Gateway's DNS endpoint
  3. The VCN's built-in DNS resolver, configured through DHCP options Correct answer.
  4. DHCP options with a custom DNS server

Explanation

Each VCN has a built-in DNS resolver, and DHCP options tell VNICs which DNS server to use and which search domain to apply. By default, instances use the VCN resolver, which resolves internal hostnames and forwards external queries. Internet, Service, and NAT Gateways do not provide DNS resolution.

Question 49Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

An instance in a private subnet must resolve the private IP of another instance in the same VCN by hostname. Which configuration is required?

  1. Enable the VCN's DNS resolver and set the subnet's DHCP options to use it. Correct answer.
  2. Add a route to 0.0.0.0/0 pointing to a Service Gateway.
  3. Attach an Internet Gateway to the subnet.
  4. Create an NSG rule allowing DNS traffic from 0.0.0.0/0.

Explanation

Internal hostname resolution in a VCN relies on the VCN's DNS resolver, which is enabled through the subnet's DHCP options. The resolver maps instance hostnames to their private IPs within the VCN. Internet Gateway, NSG DNS rules, and Service Gateway routes do not provide internal name resolution.

Question 50Networking: VCNs, subnets, gateways, routing, security lists, NSGs, and connectivity

Which statement about the order in which OCI evaluates security lists and NSGs is correct?

  1. Only the security list is evaluated when an NSG is attached.
  2. Traffic must be allowed by both the security list and any applicable NSG to be permitted. Correct answer.
  3. NSG rules override security list rules.
  4. Security list rules override NSG rules.

Explanation

Security lists and NSGs are evaluated independently, and traffic must be permitted by both for it to flow. Neither overrides the other. This means a permissive NSG rule cannot compensate for a restrictive security list, and vice versa.