Oracle Cloud Infrastructure 2025 Networking Professional Practice Exam 2025: Latest Questions

You are designing a new VCN with public and private subnets. The security team requires that all east-west traffic to instances be controlled at the subnet boundary (not per instance). Which OCI feature best meets this requirement?

A team is configuring an OCI Load Balancer to distribute HTTPS traffic to a pool of backend instances. They want the load balancer to detect failed backends and stop sending traffic to them. Which configuration accomplishes this?

A company needs private connectivity from an on-premises network to OCI without traversing the public internet. They also need predictable latency and do not want to manage IPSec tunnels. Which OCI connectivity option should you recommend?

An administrator wants to capture VCN flow logs for monitoring and troubleshooting traffic to and from instances in a subnet. Which OCI capability should they enable?

You have a VCN with a private subnet that must access OCI Object Storage privately (no public IPs, no internet egress). Which design meets this requirement with least exposure?

A customer uses a public OCI Load Balancer with a private backend subnet. Users report intermittent 504 errors. The backend instances are healthy when checked directly from within the VCN. Which is the most likely OCI networking cause?

A company has two VCNs in the same OCI region with overlapping CIDR blocks. They need the workloads to communicate privately. What is the recommended approach?

You are deploying a multi-tier application. The security team wants to allow SSH only from a bastion host to private instances, while allowing the same private instances to receive application traffic from the load balancer. Which approach provides the most granular control and least administrative overhead?

You have an on-premises network connected to OCI using FastConnect via a DRG. You attach two VCNs to the same DRG and want on-prem to reach both VCNs. Connectivity to VCN-A works, but VCN-B is unreachable from on-prem. Both VCN attachments show 'Available'. What is the most likely missing configuration?

A security audit requires that all outbound internet access from private subnets be restricted to a small set of approved FQDNs (for example, specific update repositories). Instances must remain in private subnets without public IPs. Which OCI-native design best satisfies this requirement?

You need to force traffic between two subnets in the same VCN (10.0.1.0/24 and 10.0.2.0/24) to pass through a next-generation firewall (NVA) for inspection. Instances must not be able to communicate directly via the VCN’s implicit local routing. Which OCI feature best enforces this requirement?

A web application uses an OCI Load Balancer with two backend sets: one for /api and one for /static. You want to ensure that requests to /api are routed to a different backend set than /static without deploying separate load balancers. Which load balancer feature should you use?

Your company needs private, resilient connectivity from an on-premises data center to OCI with predictable routing and the ability to use multiple circuits for redundancy. Which solution best meets these requirements?

You are troubleshooting a site-to-site IPSec VPN to OCI. The tunnels show as UP, but on-premises hosts cannot reach instances in the VCN. The VCN subnet route table has a route to the DRG for the on-premises CIDR. What is the most common missing configuration on the OCI side?

A security team wants to centrally inspect and control egress traffic from multiple VCNs before it reaches the internet. Each VCN should remain isolated, but all outbound traffic must traverse a shared inspection VCN that hosts an NVA cluster. Which design is most appropriate?

An application in a private subnet must access Object Storage without traversing the public internet. Which configuration enables this while keeping the subnet private?

A team wants to restrict SSH access to a fleet of instances across multiple subnets using a single reusable policy object, without modifying each subnet’s security list. They also want the ability to reference the same rule set from different instances as they scale. Which OCI feature should they use?

You are configuring an OCI Load Balancer for an HTTPS application. The backend servers already terminate TLS and require the original client IP address for audit logging. Which load balancer setting best preserves the client IP at the backend?

A VCN has two private subnets that must resolve private DNS names for endpoints in another VCN via private peering. Name resolution works from subnet A but not from subnet B. Both subnets can reach the remote VCN by IP. What is the most likely cause?

Security operations needs to detect and investigate anomalous traffic (for example, port scans) within a VCN. They want packet-level visibility without deploying agents on every instance. Which OCI capability best supports this requirement?

An organization uses OCI DNS for a public zone. They want the root record (example.com) to return different answers based on whether the client is in North America or Europe to reduce latency. Which OCI DNS feature best meets this requirement?

You have a hub-and-spoke topology using a DRG. A new spoke VCN is attached to the DRG, but instances in that spoke cannot reach an on-premises network over FastConnect. The on-premises network can reach the spoke subnets. Which configuration issue most likely causes this one-way connectivity?

A security team needs to collect VCN Flow Logs for several subnets, store them centrally, and query them for troubleshooting and incident response. Which approach is recommended to enable this in OCI?

A web application is behind an OCI Load Balancer with two backend sets: one serves HTTP on port 80 and the other serves HTTPS on port 443. After enabling health checks, the HTTPS backend set remains unhealthy even though the service works when accessed directly. What is the most likely cause and fix?

A company must expose a private application running in a private subnet to users on the internet, but the backend instances must not have public IPs. The application must support end-to-end TLS to the backends (no TLS termination at the edge). Which architecture best meets the requirement?