Your company has a FastConnect circuit established between your on-premises data center and OCI. However, you have a specific regulatory requirement to encrypt all traffic, even over dedicated connections like FastConnect. You need to implement IPSec encryption without significantly impacting the available bandwidth of your FastConnect circuit. Which is the most effective approach to implement IPSec encryption over your existing FastConnect circuit, while maintaining high bandwidth?
You are designing a highly available application that requires low latency communication between OCI regions. You have two VCNs, VCN-A in Region 1 and VCN-B in Region 2. These VCNs have non-overlapping CIDR blocks and you want to establish a private, direct connection between them for optimal performance. Which of the following steps are necessary to establish this cross-region connectivity using the native OCI networking capabilities?
As a network security engineer, you are tasked with designing a highly secure architecture for a financial application running on OCI. You have deployed a Network Firewall to protect the application’s VCN. Due to regulatory compliance requirements, you need to ensure that no direct internet access is allowed to any compute instance within the application’s private subnet, even if it is misconfigured. You need to block all outbound traffic to the internet. Which Network Firewall rule action best accomplishes this goal?
You are designing an OCI networking architecture for a multi-tier application using Infrastructure as Code (IaC). The architecture includes an OKE cluster for the front-end, a set of Compute instances for the back-end, and an Autonomous Database. You want to ensure that all traffic between these components is encrypted. You are using Transport Layer Security (TLS) for end-to-end encryption but are concerned about the overhead of encrypting all traffic within the VCN. Which approach provides the MOST balanced approach to security and performance, minimizing the overhead of encryption while still protecting sensitive data?
Which of the following is a disadvantage of using a public internet-based VPN connection for migrating large datasets from another cloud provider to OCI?
You are working as an OCI Network Specialist. Your company is migrating its on-premises IPv6 network to OCI. As part of the migration, you need to enable communication between the on-premises network and a VCN in OCI using FastConnect. Your company utilizes global unicast IPv6 addresses on-premises and wants to continue utilizing those addresses in OCI. However, you have a restriction that compute instance traffic must be limited to IPv6 only. After assigning IPv6 addresses from the prefix to the instance, they cannot ping external IPv6 addresses. What configuration most likely addresses this issue?
In a multi-tier architecture with multiple application instances across different private subnets, which Bastion service approach minimizes the need for continuous maintenance of individual session configurations?
Your company has established a hybrid cloud environment using FastConnect to connect your on-premises network to your OCI VCN. You are advertising on-premises network prefixes to OCI via BGP. You want to ensure that OCI only learns routes from your on-premises network that are within a specific range, and that any other prefixes advertised are rejected to prevent routing conflicts. Which BGP attribute and configuration on the OCI side should you use to achieve this?
A company wants to leverage a best-of-breed approach for their application stack. They plan to use OCI for its Autonomous Database, Azure for its container orchestration (AKS), and AWS for its object storage (S3). Considering cost optimization and minimizing data egress charges, which strategy is the MOST efficient for transferring large datasets between these services?
Your company utilizes a hybrid cloud architecture, connecting its on-premises network to an OCIVCN using a FastConnect private peering connection. You need to ensure that instances within a specific subnet in the VCN can only communicate with resources in a designated IP address range within the on-premises network. What is the MOST effective way to achieve this specific network isolation?
In a multi-tier application architecture with separate public and private subnets, where should an OCI Bastion host be placed to provide secure access to resources in the private subnets without exposing them to the internet?
You are designing a highly available and scalable e-commerce application on OCI. The application requires load balancing for both HTTP/HTTPS traffic and TCP-based microservices communication. You need a solution that provides advanced traffic management capabilities, including content-based routing and path-based routing, and can also protect against common web exploits. Which OCI load balancing offering is the most suitable for this scenario, considering the need for web application firewall (WAF) integration?
Your organization uses a combination of OCI and AWS. Applications in OCI frequently access services hosted in AWS. You are experiencing slow and inconsistent data transfer speeds when transferring large files between the two clouds. You have a Site-to-Site VPN, but are considering other options. Which option is NOT a valid design consideration for improving the data transfer performance between OCI and AWS?
A financial services company is implementing a multicloud strategy, storing sensitive customer data in OCI due to its enhanced security features, running analytics workloads in AWS, and utilizing a SaaS application hosted in Google Cloud Platform (GCP). To comply with stringent data sovereignty regulations, the company requires that all traffic between OCI and AWS must transit exclusively within the United States. Which is the MOST critical consideration when choosing a connectivity solution to ensure compliance?
Your company is migrating its on-premises data center to OCI. A critical security requirement is to maintain centralized logging and auditing of all network traffic traversing the OCI Network Firewall. You need to ensure that every session that passes through the firewall is logged and can be analyzed for security events. Which OCI service should you configure in conjunction with the Network Firewall to achieve this centralized logging?
When migrating workloads to OCI requiring consistent, high-bandwidth connections with minimal latency, and your on-premises data center has direct fiber connectivity, which OCI service is most suitable?
When analyzing Flow Logs for a subnet, how can you filter logs to isolate traffic that was rejected due to a specific security list rule?
In a hybrid cloud migration, which OCI component is essential for dynamically routing traffic between on-premises networks and OCI Virtual Cloud Networks (VCNs), facilitating seamless communication?
Your application running on OCI Compute instances in a private subnet requires high availability and the ability to distribute incoming traffic across multiple instances. You need to ensure that the load balancer can handle both HTTP and HTTPS traffic and provides health checks to monitor the availability of your backend servers. Which OCI Load Balancer offering is the most suitable for this scenario, considering both functionality and cost-effectiveness for a production environment?
You have deployed an application on OCI that uses a Regional Load Balancer with an HTTPS listener. You want to enforce end-to-end encryption and ensure that the connection between the load balancer and the backend servers is also encrypted. Which load balancer configuration step is MANDATORY to achieve this?
Which OCI resource is used to establish private connectivity between two VCNs within the same region, facilitating direct, low-latency communication?
You are designing a multi-tier application within an OCI Virtual Cloud Network (VCN). The application comprises a public-facing web tier in one subnet, an application tier in another, and a database tier in a third. For security reasons, you want to ensure that only the application tier can initiate connections to the database tier. The web tier needs to be able to communicate with the application tier, but not directly with the database tier. You are using private IP addresses within your VCN. Which procedural step is MOST effective to achieve this network isolation?
A company has deployed a VCN in OCI with multiple subnets. Security requirements dictate that instances in different subnets within the same VCN should not be able to directly communicate with each other unless explicitly permitted. You are tasked with implementing this policy. What is the most appropriate approach to meet this requirement?
You are setting up a FastConnect connection between your on-premises data center and OCI. You need to configure BGP to exchange routing information. You require OCI to always prefer the FastConnect path for traffic destined to your on-premises network, even if OCI learns about the same prefixes via the public internet. Which BGP attribute should you configure on the OCI side of the FastConnect connection to achieve this?
Your company has two FastConnect circuits connecting your on-premises network to OCI. You want to implement a BGP configuration that ensures that traffic from OCI to your on-premises network is load-balanced across both FastConnect circuits. Which BGP configuration would BEST achieve load balancing across the two FastConnect circuits?
Your security policy mandates that all communication between your compute instances in a private subnet and OCI Object Storage must be authenticated and authorized using IAM policies and not rely on public IP addresses. Which OCI networking feature is the most appropriate to satisfy this requirement?
You’re designing a multi-region deployment of your application on OCI. You want to use OCI’s global load balancing capabilities, but also require the WAF to protect against attacks close to the user. Which configuration provides the best balance between global load balancing and regional WAF protection?
Your company is utilizing a multi-cloud architecture with applications running on both OCI and AWS. You have established a Site-to-Site VPN connection between OCI and AWS for secure communication. Over time, you observe that the VPN tunnel becomes unstable and frequently disconnects, particularly during peak hours. You suspect this is due to increased network latency and packet loss. Which action is least likely to improve the stability and reliability of your OCI-AWS Site-to-Site VPN connection in this scenario?
Your company needs to connect an on-premises data center to an OCI Virtual Cloud Network (VCN) to extend their existing infrastructure to the cloud. The connection MUST be secure, reliable, and provide consistent, low-latency access to resources in both environments. Resources in the OCI VCN need access to the on-premises servers, and resources in the on-premises data center need to access the compute instances located in a private subnet within the OCI VCN. Which is the MOST appropriate architectural design for establishing connectivity in this hybrid cloud environment, considering the available endpoints and gateway options in OCI?
When configuring transitive routing through a network appliance in a hub-and-spoke VCN topology, which configuration is necessary to ensure that traffic from a spoke VCN to another spoke VCN passes through the network appliance?
Which OCI service provides detailed logs for network traffic traversing a Network Load Balancer, offering insights into client connections and backend health checks?
In a multi-region OCI environment, which configuration is necessary to allow communication between two VCNs located in different regions through a DRG?
You are responsible for managing access to an Oracle Autonomous Database (ADB) instance inyour OCI environment. You need to configure a secure connection to the ADB from compute instances located in a private subnet. You want to limit access to the ADB to only the designated compute instances. Which type of endpoint, in conjunction with appropriate security rules, provides the MOST granular control over network access to the Autonomous Database?
TESTED 16 Jun 2025
