Networking: VCNs, Subnets, Gateways, Routing, Security Lists, NSGs, and Connectivity
What this domain tests
Networking scenarios ask you to prove that a described traffic path actually works end to end. Marks hinge on route tables plus gateways plus security rules being consistent - a single missing piece breaks the path.
Core rules
- A VCN is regional with one or more CIDR blocks. Subnets are regional or AD-specific, and public vs private is decided by the subnet's route table, not by its name.
- Internet Gateway gives bidirectional internet access to public subnets. NAT Gateway gives outbound-only internet for private subnets and never accepts inbound connections.
- Service Gateway gives private access to the Oracle Services Network (for example Object Storage) without crossing the internet.
- DRG connects VCNs to on-premises through FastConnect or Site-to-Site VPN and enables transit routing between VCNs.
- Local Peering Gateway peers VCNs in the same region; remote peering uses DRGs across regions. Peered CIDRs must not overlap.
- Security lists are subnet-level and stateful. NSGs are VNIC-level and stateful, and apply only to VNICs explicitly added to them.
Worked example
A three-tier app: the web subnet routes 0.0.0.0/0 to the Internet Gateway, with an NSG allowing TCP 443 inbound from the internet. App and database subnets route 0.0.0.0/0 to the NAT Gateway for patching, plus a Service Gateway rule for Object Storage. The database NSG allows TCP 1521 only from the app NSG as source - not the whole VCN CIDR - so the app tier is the only client.
Traps
Expecting NAT to permit inbound sessions; assuming a Service Gateway reaches arbitrary internet destinations; overlapping CIDRs silently blocking peering; adding NSG rules but forgetting to place the VNIC in that NSG; assuming a security list can reference an NSG as a source (it cannot).