Article 19 – OCI Networking Comprehensive Knowledge Assessment and Exam Guide

Instructions

This standalone knowledge assessment tests your architectural mastery of Oracle Cloud Infrastructure (OCI) Networking across all 18 topics in this series.

Work through the 20 scenario-based questions in Section 1 first without scrolling down. Once completed, validate your answers against the comprehensive Answer Key and Detailed Rationale in Section 2.

Section 1: Scenario Questions

Topic 1: VCN Architecture & Subnets

Question 1

An enterprise architect is designing an OCI Virtual Cloud Network (VCN) for a multi-tier web application across Ashburn (us-ashburn-1), which has 3 Availability Domains (AD-1, AD-2, AD-3). The architect needs to ensure compute instances in AD-1 and AD-3 can communicate on the same private network without managing separate subnet route tables per AD. Which subnet design should be used?

  • A) Create 3 AD-Specific Private Subnets (one per AD) and link them using a Local Peering Gateway.
  • B) Create a single Regional Private Subnet spanning all 3 Availability Domains.
  • C) Create a Global Subnet spanning Ashburn and Frankfurt regions.
  • D) Create an AD-Specific Public Subnet in AD-1 and attach Secondary VNICs in AD-3.

Question 2

You create a VCN with an IPv4 CIDR block of 10.0.0.0/16. You then create a Regional Private Subnet defined as 10.0.1.0/24. How many usable IPv4 host addresses are available for compute instances within this subnet?

  • A) 256
  • B) 255
  • C) 251
  • D) 248
Topic 2: IPAM & Reserved Addresses

Question 3

A database team needs a persistent Public IP address for a virtual firewall appliance in a public subnet. If the firewall instance is stopped or recreated during maintenance, the public IP must remain in the tenancy and be re-attachable immediately. Which public IP type should be provisioned?

  • A) Ephemeral Public IP
  • B) Reserved Public IP
  • C) Secondary Private IP
  • D) Dynamic BGP Public IP

Question 4

An architect attempts to run a high-availability Keepalived cluster using standard VRRP (Virtual Router Redundancy Protocol) multicast packets between two Linux VMs in an OCI subnet. The failover IP shifts fail to reach the backup node. Why is VRRP failing?

  • A) OCI subnets strictly forbid secondary IP address assignments.
  • B) OCI SmartNIC network virtualization drops multicast and broadcast traffic.
  • C) VRRP requires a FastConnect circuit to function.
  • D) Keepalived is incompatible with 64-bit Linux OS kernels.
Topic 3: Route Tables & Routing Mechanics

Question 5

A subnet’s custom route table contains 3 route rules:
1. 0.0.0.0/0 ➔ NAT Gateway
2. 10.200.0.0/16 ➔ Dynamic Routing Gateway (DRG v2)
3. 10.200.50.0/24 ➔ Local Peering Gateway (LPG)

If a compute instance in this subnet sends a packet to IP address 10.200.50.12, which route target will the OCI routing engine select?

  • A) NAT Gateway (Rule 1)
  • B) Dynamic Routing Gateway (Rule 2)
  • C) Local Peering Gateway (Rule 3)
  • D) The packet is dropped due to conflicting route entries.
Topic 4: Security Lists vs. Network Security Groups

Question 6

You define a Stateful Ingress Rule in a Security List allowing incoming TCP traffic on port 443 from 0.0.0.0/0. What egress rule is required in the same Security List to permit outbound HTTPS response traffic back to external web clients?

  • A) An egress rule allowing TCP traffic to destination ports 1024-65535.
  • B) An egress rule allowing TCP traffic to destination port 443.
  • C) No egress rule is required because stateful rules automatically permit response traffic.
  • D) A stateless egress rule matching the client’s public IP address.
Topic 5: Internet Egress Gateways

Question 7

A security auditor demands that backend Autonomous Database nodes in a private subnet be completely unaddressable from the public internet, but must be able to initiate outbound connections to external vendor APIs for software updates. Which edge gateway architecture satisfies this requirement?

  • A) Attach an Internet Gateway (IGW) to the private subnet route table.
  • B) Provision a NAT Gateway (NGW) and route 0.0.0.0/0 from the private subnet to the NGW.
  • C) Assign Ephemeral Public IPs to the database nodes.
  • D) Configure a Local Peering Gateway pointing to an external ISP.
Topic 6: Service Gateway & OSN

Question 8

A financial compliance team requires that database backup files uploaded from private compute instances to OCI Object Storage must never traverse the public internet or pass through a NAT Gateway. How should the subnet route table be configured?

  • A) Add a route rule: 0.0.0.0/0 ➔ Internet Gateway.
  • B) Add a route rule: All <REGION> Services in Oracle Services Network ➔ Service Gateway.
  • C) Add a route rule: 10.0.0.0/16 ➔ Dynamic Routing Gateway.
  • D) Provision a Public Load Balancer fronting Object Storage endpoints.
Topic 7: Local VCN Peering

Question 9

VCN-Spoke-A (10.1.0.0/16) is connected to VCN-Hub (10.0.0.0/16) via a Local Peering Gateway (LPG). VCN-Spoke-B (10.2.0.0/16) is also connected to VCN-Hub via a separate LPG. Can instances in VCN-Spoke-A communicate directly with instances in VCN-Spoke-B through VCN-Hub using these LPGs?

  • A) Yes, LPG peering is fully transitive by default.
  • B) No, LPG peering is non-transitive; traffic cannot hop across multiple LPGs.
  • C) Yes, but only if both spokes share the same compartment.
  • D) Yes, provided an Internet Gateway is attached to VCN-Hub.
Topic 8: DRG v2 & Enterprise Topologies

Question 10

An enterprise wants to connect 15 VCNs in the Ashburn region to a central shared-services VCN and enable transitive spoke-to-spoke routing with centralized route table management. Which OCI networking service should be deployed?

  • A) Full mesh of 105 Local Peering Gateways (LPGs).
  • B) Dynamic Routing Gateway (DRG v2) with VCN Attachments.
  • C) OCI Web Application Firewall (WAF).
  • D) Network Load Balancer in each spoke VCN.
Topic 9: Cross-Region Peering (RPC)

Question 11

You need to establish private database replication between a primary VCN in Ashburn (us-ashburn-1) and a DR VCN in Frankfurt (eu-frankfurt-1). What two components are required to inter-connect the DRGs across regions over Oracle’s private backbone?

  • A) Two Internet Gateways and an IPSec VPN tunnel.
  • B) A Remote Peering Connection (RPC) in each regional DRG v2, established using the remote RPC OCID.
  • C) Two Local Peering Gateways connected via FastConnect.
  • D) A Public Virtual Circuit paired with an OCI WAF Policy.
Topic 10: Site-to-Site VPN & BGP

Question 12

When configuring an OCI Site-to-Site VPN connection, OCI automatically provisions 2 IPSec tunnels. What is the recommended BGP routing configuration for achieving active-active high-availability failover?

  • A) Configure Static Routing with different metric priorities.
  • B) Configure Dynamic BGP routing on both tunnels with Equal-Cost Multi-Pathing (ECMP).
  • C) Disable Tunnel 2 and use Tunnel 1 exclusively.
  • D) Assign identical static public IP addresses to both tunnel endpoints.
Topic 11: OCI FastConnect

Question 13

An enterprise requires a dedicated 10 Gbps private connection from their on-premises data center to OCI to access private VCN databases with guaranteed low latency and zero public internet routing. Which FastConnect construct must be provisioned?

  • A) Public Virtual Circuit attached to an Internet Gateway.
  • B) Private Virtual Circuit attached to a Dynamic Routing Gateway (DRG v2).
  • C) Service Gateway attached to a Public Load Balancer.
  • D) IPSec VPN Tunnel attached to a CPE object.
Topic 12: Layer 7 Flexible Load Balancers

Question 14

A web application receives unpredictable traffic spikes ranging from 50 Mbps up to 3,000 Mbps. The architect needs an HTTP/HTTPS load balancer that scales throughput dynamically without dropping active SSL connections or requiring manual shape resizing. Which load balancer configuration should be selected?

  • A) Fixed 100 Mbps Layer 4 Network Load Balancer.
  • B) OCI Flexible Load Balancer (L7) with Min Bandwidth 10 Mbps and Max Bandwidth 4000 Mbps.
  • C) Static 8000 Mbps Legacy Load Balancer.
  • D) Dynamic Routing Gateway with auto-scaling bandwidth.
Topic 13: Layer 4 Network Load Balancers

Question 15

You are deploying a pool of Palo Alto virtual firewalls that require inspecting raw TCP packets while preserving the original client source IP address on backend servers without adding HTTP proxy headers. Which load balancer should front the firewalls?

  • A) Flexible Load Balancer (L7) with SSL Offloading.
  • B) Network Load Balancer (L4) with Preserve Source IP enabled.
  • C) Service Gateway with Object Storage rules.
  • D) Web Application Firewall in Edge Mode.
Topic 14: Transit Hub Routing & Firewalls

Question 16

When configuring a Transit Hub VCN to force all incoming traffic from a DRG v2 into a central virtual firewall NLB, which special route table must be associated with the Hub VCN’s DRG Attachment?

  • A) Subnet Default Route Table.
  • B) VCN Ingress Route Table.
  • C) Service Gateway Route Table.
  • D) LPG Acceptor Route Table.
Topic 15: Private DNS & Hybrid Resolution

Question 17

An on-premises application needs to resolve private OCI hostnames ending in .prod.oci.company.com. Which OCI Private DNS component must be created inside the VCN to receive incoming DNS queries forwarded from on-premises Active Directory DNS servers?

  • A) Private DNS Outbound Endpoint.
  • B) Private DNS Inbound Endpoint.
  • C) Public DNS Zone.
  • D) VCN Internet Gateway.
Topic 16: Web Application Firewall (WAF)

Question 18

A public-facing e-commerce API is experiencing SQL Injection (SQLi) attacks. You want to block these attacks at the regional load balancer perimeter before they reach application VMs. Which OCI service should be deployed?

  • A) Network Security Group (NSG) with stateful rules.
  • B) OCI Web Application Firewall (WAF) with OWASP Protection Rules attached to the Load Balancer.
  • C) VCN Flow Logs with Service Connector Hub.
  • D) Service Gateway with Private Views.
Topic 17: Network Observability & Flow Logs

Question 19

An administrator needs to trace a hypothetical packet path between a Compute VM in Ashburn and an On-Premises database IP to determine which specific security rule or route table is dropping packets, without generating real network traffic. Which tool should be used?

  • A) VCN Flow Logs JSON viewer.
  • B) VCN Route Analyzer in Network Command Center.
  • C) Service Connector Hub stream.
  • D) FastConnect BGP monitor.
Topic 18: Troubleshooting & Diagnostics

Question 20

A Linux VM in a private subnet cannot connect to external web servers via a newly provisioned NAT Gateway. The route table contains 0.0.0.0/0 ➔ NGW. Route Analyzer shows routing is valid. VCN Flow Logs show outbound TCP SYN packets marked as ACCEPT, but no return SYN-ACK packets arrive. What is the most likely cause?

  • A) The compute VM is missing a Public IP address.
  • B) The NAT Gateway reached its stateful connection limit or Security List drops outbound HTTP traffic.
  • C) The NAT Gateway was assigned to a Public Subnet instead of Private Subnet.
  • D) VCN Flow Logs disabled IP forwarding on the host.

Section 2: Answer Key & Detailed Rationale

Question 1: Answer B
  • Rationale: OCI Regional Subnets span all Availability Domains (ADs) within a region. Placing instances in AD-1, AD-2, and AD-3 inside a single Regional Subnet allows them to share the exact same subnet IP space, security rules, and route table without complex inter-AD routing.
Question 2: Answer C
  • Rationale: OCI reserves 5 IP addresses per IPv4 subnet (.0 Network, .1 Default Gateway, .2 DNS Resolver, .3 Platform Reserved, .255 Broadcast). For a /24 subnet ($256$ total IPs), usable host IPs $= 256 – 5 = 251$.
Question 3: Answer B
  • Rationale: A Reserved Public IP is a persistent OCI resource object with its own OCID. It remains allocated to your tenancy and can be reassigned between VNICs or load balancers dynamically. Ephemeral IPs are destroyed when instances terminate.
Question 4: Answer B
  • Rationale: OCI SmartNIC off-box network virtualization drops multicast and broadcast packets at the hardware layer. Standard VRRP multicast heartbeats cannot traverse OCI subnets. High availability must use OCI API IP reassignment or OCI Load Balancers.
Question 5: Answer C
  • Rationale: OCI routing uses Longest Prefix Match (LPM). Destination IP 10.200.50.12 matches Rule 1 (/0), Rule 2 (/16), and Rule 3 (/24). Rule 3 has the longest prefix length (/24), so traffic routes to the Local Peering Gateway (LPG).
Question 6: Answer C
  • Rationale: Stateful Rules track connection state in the SmartNIC connection table. Return response traffic is automatically allowed regardless of egress rules.
Question 7: Answer B
  • Rationale: A NAT Gateway (NGW) permits unidirectional outbound-only egress from private subnets while blocking all unsolicited inbound connections from the public internet.
Question 8: Answer B
  • Rationale: The Service Gateway (SGW) routes traffic directly to the Oracle Services Network (OSN) over private internal OCI backplane infrastructure, ensuring Object Storage traffic never traverses public internet edge gateways.
Question 9: Answer B
  • Rationale: Local Peering Gateway (LPG) connections are strictly non-transitive. Traffic cannot enter one LPG and hop out another LPG to reach a third VCN. Transitive routing requires DRG v2.
Question 10: Answer B
  • Rationale: The Dynamic Routing Gateway (DRG v2) acts as a central virtual router for hub-and-spoke topologies, supporting scalable transitive routing across dozens of VCNs.
Question 11: Answer B
  • Rationale: Cross-Region VCN Peering connects two regional DRG v2 gateways by establishing a Remote Peering Connection (RPC) pair over Oracle’s encrypted global backbone.
Question 12: Answer B
  • Rationale: Dynamic BGP Routing with Equal-Cost Multi-Pathing (ECMP) across both IPSec tunnels delivers sub-second failover and active-active bandwidth aggregation.
Question 13: Answer B
  • Rationale: A Private Virtual Circuit over OCI FastConnect connects directly to a DRG v2, providing dedicated, private, non-internet transport to private VCN subnets.
Question 14: Answer B
  • Rationale: The OCI Flexible Load Balancer (L7) dynamically scales bandwidth between minimum and maximum bounds (e.g., 10 Mbps to 4000 Mbps) to handle unpredictable web traffic spikes seamlessly.
Question 15: Answer B
  • Rationale: The OCI Network Load Balancer (L4) provides zero-copy Layer 4 packet pass-through while natively preserving the client’s original source IP address.
Question 16: Answer B
  • Rationale: A VCN Ingress Route Table attached to a DRG VCN Attachment overrides standard ingress routing, forcing traffic entering the VCN from the DRG to route directly to a firewall NLB.
Question 17: Answer B
  • Rationale: An Inbound DNS Endpoint allocates a private IP inside the VCN to receive DNS resolution queries forwarded from on-premises Active Directory DNS servers.
Question 18: Answer B
  • Rationale: OCI Web Application Firewall (WAF) with OWASP Protection Rules inspects HTTP request payloads at the Layer 7 load balancer perimeter to detect and block SQL Injection (SQLi) attacks.
Question 19: Answer B
  • Rationale: VCN Route Analyzer (in Network Command Center) performs hop-by-hop control plane path simulations to pinpoint missing route rules or security blocks without sending live network traffic.
Question 20: Answer B
  • Rationale: If routing and flow log ingress show ACCEPT but return traffic never arrives, either the NAT Gateway connection tracking table is saturated or an outbound security rule is dropping return packets. (Option A is incorrect because private instances behind a NGW do NOT require public IPs).

Related Posts