Networking practice questions

Worked examples for Networking

1. Question 1

   An audit finds that a subnet's security list permits ingress SSH (TCP 22) from 0.0.0.0/0, and the team must stop internet SSH access to that subnet while keeping SSH from an on-premises range. What is the correct action in the OCI security-rule model?

   1. A. Edit or remove the existing rule so the only remaining TCP 22 allow rule has the on-premises range as its source, since unmatched traffic is denied implicitlyCorrect answer

      Correct: with allow-only rules and an implicit deny for everything unmatched, blocking traffic means eliminating or narrowing the allow rule that permits it.

   2. B. Add a deny rule for TCP 22 from 0.0.0.0/0 and place it above the existing allow rule

      Assumes deny rules and rule ordering exist. OCI security rules are allow-only and unordered, so there is no deny rule to add and no position that would take effect.

   3. C. Add an NSG to the instances with a rule allowing TCP 22 only from the on-premises range, which will restrict what the security list permits

      Relies on a narrower NSG rule overriding a broader security list rule; because the layers are additive, the 0.0.0.0/0 allow would still stand.

   4. D. Change the existing rule from stateful to stateless, which stops unsolicited inbound connections from the internet

      Confuses statefulness with scope. Stateless only turns off connection tracking; the rule still allows inbound TCP 22 from the same source range.

   Explanation

   OCI security rules — in both security lists and network security groups — express only what is allowed; anything not matched by a rule is denied implicitly, and there are no deny rules and no rule priorities. Restricting access therefore means editing or deleting the overly broad allow rule so that only the intended source remains. Adding a narrower rule elsewhere cannot help because a VNIC's effective permissions are the union of all its rules, and switching a rule to stateless changes only connection tracking, not which sources are permitted.

2. Question 2

   A VNIC resides in a subnet whose security list allows ingress TCP 22, and the same VNIC is also a member of an NSG that allows ingress TCP 443. Which statement correctly describes the traffic the VNIC accepts?

   1. A. Only TCP 443 is accepted, because NSG membership overrides the subnet's security list for that VNIC

      Assumes NSGs replace security lists. Adding a VNIC to an NSG does not detach or suppress the subnet's security lists; both continue to apply.

   2. B. Only TCP 22 is accepted, because subnet-level controls are evaluated first and terminate matching

      Invents an evaluation order in which the first matching layer wins. Security rules have no ordering or priority — they are all allow rules considered together.

   3. C. Neither is accepted, because a VNIC governed by both a security list and an NSG only permits traffic allowed by both

      Applies intersection (AND) semantics. OCI takes the union, not the intersection, so a rule in either construct is sufficient to allow the traffic.

   4. D. Both TCP 22 and TCP 443 are accepted, because the VNIC's effective rules are the union of its security list rules and its NSG rulesCorrect answer

      Correct: when a VNIC is covered by both constructs the rule sets are additive, so traffic matching any rule from either source is permitted.

   Explanation

   Security lists and NSGs are complementary layers, not competing ones: if a VNIC is in a subnet with security lists and also belongs to one or more NSGs, its effective rule set is the union of all those rules, and traffic allowed by any single rule is allowed. This is why NSGs can only widen what is permitted and why tightening a design also requires removing or narrowing the broader security list rules. Interpretations in which NSGs override security lists, subnet rules are evaluated first, or both layers must agree all impose ordering or intersection semantics that OCI security rules do not have.

3. Question 3

   A stateless web tier currently runs on a single compute instance in one availability domain. The architect adds an OCI Load Balancer to improve availability within the region. What is the correct way for the load balancer to deliver that improvement?

   1. A. The load balancer replicates the instance's boot and block volumes to other availability domains so a copy can take over

      Attributes data replication to the load balancer. It distributes network requests only; storage durability and replication are handled by the storage services, not by load balancing.

   2. B. Run instances in multiple availability domains or fault domains, register them all in one backend set, and let health checks divert traffic away from any that failCorrect answer

      Correct. The load balancer is a regional service, so spreading backends across availability or fault domains and relying on health checks removes any single instance or domain as a single point of failure.

   3. C. The load balancer automatically launches replacement compute instances whenever a backend fails its health check

      Confuses load balancing with autoscaling. A failed health check only stops traffic to that backend; creating replacement instances requires an instance pool with an autoscaling configuration.

   4. D. Keep the single instance and set a very low DNS TTL so clients can be redirected quickly if it fails

      Assumes a short TTL is a substitute for redundancy. With only one instance there is no healthy endpoint to point clients at, no matter how quickly records can change.

   Explanation

   A load balancer improves availability by fronting redundant backends: because it is a regional service, backends can be placed in different availability domains or fault domains, registered in a single backend set, and continuously health checked so traffic bypasses any that fail. It provides no data replication and no instance lifecycle management — volumes are protected by the storage services and replacement capacity comes from instance pools with autoscaling. Shortening a DNS TTL likewise changes only how fast a record can be updated and does nothing when the single instance behind the name is the thing that failed.

4. Question 4

   Which TWO statements accurately contrast the roles of a Dynamic Routing Gateway (DRG) and a Local Peering Gateway (LPG) in OCI network design? (Choose two.)

   1. A. A DRG is the VCN gateway used for on-premises connectivity via Site-to-Site VPN or FastConnect, while an LPG has no on-premises role.Correct answer

      The DRG is the virtual router that terminates hybrid attachments (VPN and FastConnect); an LPG exists solely to peer two VCNs within a region.

   2. B. An LPG connects two VCNs within the same region, whereas a DRG is used with a remote peering connection to connect VCNs in different regions.Correct answer

      This is the core distinction: local peering uses a pair of LPGs in one region, remote peering uses DRGs plus a remote peering connection across regions.

   3. C. An LPG can peer VCNs in different regions as long as both VCNs are in the same tenancy.

      Uses an LPG across regions. Tenancy is irrelevant to the limitation — local peering is bounded by region, and cross-region peering requires DRGs.

   4. D. A DRG can only ever have one attachment, so a separate DRG is required for every VCN and every hybrid connection.

      Understates the DRG. A DRG supports multiple attachments — several VCNs plus VPN and FastConnect attachments — which is what enables hub-and-spoke topologies.

   5. E. Traffic through an LPG traverses the public internet unless a Service Gateway is also attached to the VCN.

      Claims peered traffic needs the internet. Local peering traffic uses private IPs and stays on the Oracle network; a Service Gateway is for reaching Oracle services privately and is unrelated to peering.

   Explanation

   The Dynamic Routing Gateway is the VCN's virtual router for traffic outside the VCN's own address space: it terminates Site-to-Site VPN and FastConnect attachments for on-premises connectivity and participates in remote peering to reach VCNs in other regions, and it supports multiple attachments so it can serve as a hub. The Local Peering Gateway has a single, narrower job — peering two VCNs within the same region using private addressing on the Oracle network — so it never spans regions, never reaches an office or data center, and does not depend on the public internet or a Service Gateway to carry peered traffic.

5. Question 5

   An architect is sizing the address space for a new VCN that will later be peered with other VCNs. Which TWO statements about VCN CIDR blocks are correct?

   1. A. A VCN's IPv4 CIDR block can be sized anywhere from /16 down to /30.Correct answer

      Correct. The supported IPv4 CIDR block size range for a VCN runs from /16 at the largest to /30 at the smallest.

   2. B. A VCN is limited to exactly one CIDR block, so under-sizing it at creation can only be corrected by recreating the VCN.

      Misconception that VCN address space is fixed and singular. A VCN supports multiple CIDR blocks, and blocks can be added after creation.

   3. C. Two VCNs may safely use identical CIDR blocks as long as they are peered through a local peering gateway rather than a DRG.

      Restates the overlap misconception. Any form of peering requires non-overlapping address space; the gateway type does not change that.

   4. D. A CIDR block can be added to an existing VCN, provided it does not overlap the VCN's other blocks or the address space of any network the VCN is connected to.Correct answer

      Correct. Address space can be extended after creation, but the non-overlap rule still applies to the VCN's own blocks and to every peered or on-premises network.

   5. E. The VCN CIDR must be at least a /24, because subnets cannot be created smaller than a /24.

      Invents a /24 floor for subnets. Subnets may be far smaller than a /24, and the VCN minimum is a /30.

   Explanation

   A VCN's IPv4 address space is sized within a supported range whose largest block is a /16 and whose smallest is a /30, and a VCN is not restricted to a single block — additional CIDR blocks can be added later so long as they overlap neither the VCN's existing blocks nor any peered or on-premises network. That non-overlap requirement holds for every connection type, so identical CIDRs are never safe just because a particular peering gateway is used. Claims that the address space is permanently fixed at one block, or that subnets have a /24 minimum, both misstate the documented sizing rules.

6. Question 6

   Instances in a private subnet must back up data to OCI Object Storage in the same region. Security policy forbids any route to the internet from this subnet, including through a NAT gateway. Which addition to the subnet's route table satisfies the requirement?

   1. A. A rule whose destination is 0.0.0.0/0 and whose target is a NAT gateway, because Object Storage endpoints are public.

      Would work technically but violates the stated policy, since a NAT gateway is an internet path. It also reflects the misconception that public service endpoints can only be reached over the internet.

   2. B. A rule whose destination is 0.0.0.0/0 and whose target is an internet gateway, after converting the subnet to public.

      Both breaks the no-internet policy and assumes a subnet's public or private designation can be changed after creation, which it cannot.

   3. C. A rule whose destination is the VCN's own CIDR and whose target is a dynamic routing gateway, because regional services are reached through the DRG.

      Confuses the DRG's role, which is connectivity to on-premises networks and other VCNs, and routes a destination that is already handled by implicit intra-VCN routing.

   4. D. A rule whose destination is the region's Oracle services CIDR label and whose target is a service gateway.Correct answer

      Correct. A service gateway lets a private subnet reach supported Oracle services in the same region over the Oracle network, without traversing the internet.

   Explanation

   A service gateway is the design element that gives private subnets access to supported Oracle services within the same region without any internet path, and it is used in a route rule by targeting the region's Oracle services CIDR label rather than 0.0.0.0/0. Routing a default route to a NAT gateway or an internet gateway both send traffic over the internet, which the policy forbids, and the internet-gateway variant additionally assumes an immutable subnet attribute can be flipped. A dynamic routing gateway addresses on-premises and cross-VCN connectivity, and a rule for the VCN's own CIDR is redundant with the VCN's implicit local routing.

7. Question 7

   Which TWO statements correctly describe how VCN route tables and route rules behave? (Choose two.)

   1. A. A route rule specifies a destination CIDR (or a service CIDR label) and a target gateway or private IP; traffic destined within the VCN itself is routed automatically and needs no rule.Correct answer

      Route rules exist to send traffic OUT of the VCN via a gateway or a private IP next hop; intra-VCN traffic between subnets is handled implicitly by the VCN's local routing, so no rule is needed for it.

   2. B. When several rules match a packet, the most specific (longest-prefix) matching rule is used.Correct answer

      VCN routing follows longest-prefix match, so a more specific destination CIDR takes precedence over a broader one such as 0.0.0.0/0. This is what lets a targeted rule override a default route.

   3. C. Route rules also filter traffic, so a route table can be used in place of a security list to block unwanted connections.

      Confuses routing with security. Route tables decide where traffic is forwarded; security lists and network security groups decide what is permitted. They are separate controls.

   4. D. Every subnet must have its own dedicated route table that cannot be shared with any other subnet.

      Misconception about route table scope. A route table is a VCN-level resource that multiple subnets can be associated with; sharing one route table across subnets with the same connectivity needs is normal.

   5. E. Rules are evaluated strictly top-to-bottom in the order they were created, and the first rule listed always wins.

      Imports an ordered-ACL model from other systems. VCN route rules are not order-dependent; selection is by longest-prefix match on the destination, not by creation order.

   Explanation

   A route rule pairs a destination (a CIDR or a service CIDR label) with a target such as a gateway or a private IP, and it governs traffic leaving the VCN — traffic between subnets inside the same VCN is routed automatically. When multiple rules could match, the most specific destination prefix wins, which is what makes a narrow rule override a broad default. Routing is not a security control: permitting or denying traffic is the job of security lists and network security groups. Route tables are VCN-level resources shareable across subnets, and rule selection is by prefix specificity rather than creation order.

8. Question 8

   A company connects two separate on-premises data centres to the same DRG, each over its own Site-to-Site VPN (IPSec) tunnel, and expects the DRG to route traffic directly between the two data centres so that OCI acts as a transit hub between them. Even with correct route rules, this data-centre-to-data-centre path fails. Why?

   1. A. A DRG does not transit traffic between two IPSec (or FastConnect) attachments: a packet that enters the DRG through an IPSec tunnel can never leave through another IPSec tunnel or virtual circuit, so the two data centres must be connected to each other directly.Correct answer

      Correct and grounded: the DRG transit restriction blocks on-prem-link-to-on-prem-link routing regardless of route rules; OCI transits VCN-to-VCN and VCN-to-on-prem, not on-prem-to-on-prem.

   2. B. It works as soon as a DRG route rule for each data centre's CIDR is added to the other attachment's DRG route table.

      A route rule cannot override the transit restriction; even with matching routes, packets in via one IPSec tunnel are not forwarded out another.

   3. C. It works only if both tunnels are assigned the same DRG route table so their routes are shared.

      Sharing one route table does not lift the restriction; the limitation is on the attachment type, not on route-table assignment.

   4. D. It works only if BGP dynamic routing is enabled on both tunnels instead of static routing.

      The routing protocol is irrelevant; BGP versus static changes how routes are learned, not whether IPSec-to-IPSec transit is permitted.

   Explanation

   A DRG connects VCNs and on-premises networks, but it will not transit a packet that arrives on an IPSec tunnel or FastConnect virtual circuit back out through another IPSec tunnel or virtual circuit. So two on-premises data centres each attached only by their own VPN cannot use the DRG as a hub to reach each other, no matter how route rules or route tables are arranged. They must be linked directly.