Summary of the Module: CIDR, VCN, and Subnets in Oracle Cloud Infrastructure
1. CIDR Blocks and IP Addressing
• CIDR (Classless Inter-Domain Routing) is a method used to represent a range of IP
addresses.
o Format: A.B.C.D/x
▪ A.B.C.D → Network address
▪ /x → Prefix length (number of bits reserved for the network portion).
• Example:
o [Link]/16 represents all IPs from [Link] to [Link].
• Total IP addresses in a CIDR block are calculated using the formula:
o 2^(32 - prefix_length)
▪ e.g., /16 → 2^(32 - 16) = 65,536 addresses.
• Network vs Host Bits:
o The prefix (/x) defines the network bits; the remaining bits define hosts.
o Example: /16 → first 16 bits are for the network; /24 → first 24 bits for the
network.
• Relationship between Prefix and Network Size:
o Smaller prefix (like /16) → Larger network
o Larger prefix (like /24) → Smaller network.
• Binary Representation:
o Each octet (e.g., 192, 168) can be represented in binary (8 bits).
o Example:
▪ 192 → 11000000
▪ 168 → 10101000
▪ Thus, [Link] → 11000000.10101000.00000000.00000010
• Logical AND Operation:
o Used to derive network addresses from an IP and subnet mask.
o Example:
▪ IP: [Link]
▪ Mask /24 = [Link]
▪ Result = [Link] (Network address).
2. Virtual Cloud Network (VCN)
• A VCN (Virtual Cloud Network) is a software-defined private network inside an OCI
region.
o It acts like a private data center network within Oracle Cloud.
• Key Features:
o Must be associated with at least one CIDR block.
o Supports up to five IPv4 CIDR blocks and five IPv6 CIDR blocks.
o CIDR blocks must be non-overlapping.
o Can be resized after creation (for example, /16 → /24).
• Allowed CIDR range: /16 to /30.
• Reserved IP addresses within a subnet:
o 1st IP → Network address
o 2nd IP → Default gateway address
o Last IP → Broadcast address
o These cannot be assigned to hosts.
• Regional Concept:
o A VCN is a regional resource, not tied to a single Availability Domain (AD).
o It can span multiple ADs within one region but cannot span multiple regions.
• IPv6 Support:
o Oracle can allocate a /56 prefix, or users can bring their own IPv6 prefix.
3. VCN Components (Overview)
A VCN consists of multiple sub-components that define its structure and function:
(a) Subnets
• Logical subdivisions of a VCN — smaller networks within a larger CIDR.
• Represented in CIDR format (e.g., [Link]/24).
• Used to group and organize resources like compute instances.
• Two main types:
o Public Subnet: Instances have both public and private IPs.
o Private Subnet: Instances have only private IPs.
(b) Route Tables
• Define traffic routing rules for instances in a subnet.
• Determine how packets are directed (e.g., to Internet Gateway, NAT Gateway, or
another subnet).
• Each subnet must have one associated route table.
(c) DHCP Options
• Dynamic Host Configuration Protocol provides automatic IP and DNS settings to
instances when they boot up.
(d) Security Controls
• Security Lists:
o Define inbound/outbound traffic rules for the entire subnet.
• Network Security Groups (NSGs):
o Apply security rules at the vNIC (virtual network interface card) level.
• Both define which traffic is allowed or denied, but at different scopes.
(e) Gateways
Gateways connect the VCN to external or internal networks:
• Internet Gateway (IGW): Enables instances in a public subnet to connect to the
Internet.
• NAT Gateway: Allows private instances to access the Internet outbound only.
• Service Gateway: Provides access to Oracle Cloud services (like Object Storage)
without using the Internet.
4. Subnets in Detail
• Definition: A subnet (subnetwork) is a contiguous range of IPs within a VCN’s CIDR
block.
• Non-Overlapping: Subnet ranges cannot overlap.
• CIDR Modifications:
o You can edit a subnet’s CIDR even after creation.
• Subnet Scope:
o AD-Specific Subnet: Exists within one Availability Domain.
o Regional Subnet: Spans all Availability Domains in a region (recommended).
• Configuration Inheritance:
o Subnets are a unit of configuration — all resources in a subnet share its route
tables, DHCP options, and security lists.
• Subnet Types:
o Public Subnet: For web-facing instances (e.g., web servers).
o Private Subnet: For internal instances (e.g., databases).
o Decision: Must be made at creation; cannot change later.
5. Key Takeaways
• CIDR notations define network size and range.
• Smaller prefix = Larger network.
• A VCN is the foundation of OCI networking — a regional, software-defined private
network.
• Subnets logically divide a VCN for resource organization and control.
• Security lists and NSGs safeguard inbound/outbound traffic.
• Route tables and gateways control traffic flow.
• Understanding the hierarchical structure:
• Region
• └── VCN (/16)
• ├── Subnet A (/24)
• ├── Subnet B (/24)
• ├── Route Table
• ├── DHCP Options
• ├── Security Lists / NSGs
• └── Gateways (Internet, NAT, Service)
In Summary:
• CIDR → Defines IP range and subnet size
• VCN → Private virtual network in OCI region
• Subnets → Subdivisions of VCN
• Route Table → Traffic direction control
• DHCP Options → Automatic IP configuration
• Security List & NSG → Control inbound/outbound traffic
• Gateways → Provide external connectivity
• Best Practices:
o Use regional subnets
o Keep CIDR blocks non-overlapping
o Decide public/private subnet type during creation
o Maintain proper security isolation for workloads
Here’s a comprehensive summary of the lesson highlighting all the key points and technical
details covered across the transcript you provided.
Lesson Summary: OCI Networking — Route Tables, Gateways, and Subnets
1. Route Tables Overview
• A Route Table determines how traffic flows within a Virtual Cloud Network (VCN) and
how outbound traffic leaves it.
• It defines the path to a destination (via destination CIDR blocks and next-hop targets).
• Two types of route tables exist:
o Default Route Table – Automatically created with every new VCN and includes an
implicit local route that allows communication between subnets within the same
VCN. This local route is invisible in the console but always active.
o Custom Route Table – Created manually to control routing for specific subnets,
e.g., distinguishing between public and private subnet routing needs.
2. Route Table Associations and Rules
• Each subnet must be associated with one and only one route table.
• However, a single route table can be associated with multiple subnets.
• Local Route Rule: Enables intra-VCN communication automatically.
• Route Rules consist of:
o Destination CIDR Block – Defines where traffic is headed (e.g., [Link]/0 for the
Internet).
o Target/Next Hop – Defines where to send the traffic (e.g., Internet Gateway, NAT
Gateway, etc.).
• Most Specific Route Rule Wins: When multiple rules overlap, the route with the most
specific CIDR (smallest range) takes precedence.
Example: [Link]/24 overrides [Link]/0.
3. Valid Route Targets
A route rule can point to several target types, including:
• Internet Gateway (IGW) – Enables public Internet access.
• NAT Gateway – Allows private subnet instances to access the Internet (outbound only).
• Service Gateway (SGW) – Enables private access to Oracle Cloud services (no Internet
exposure).
• Dynamic Routing Gateway (DRG) – Used for hybrid connections (VCN ↔ on-premises
network).
• Local Peering Gateway (LPG) – Connects VCNs within the same region.
• Private IP – Routes traffic directly to a specific instance’s private IP.
If no matching route exists, the traffic is dropped.
4. Internet Gateway (IGW)
• Supports bidirectional communication — both egress (VCN → Internet) and ingress
(Internet → VCN).
• Only one Internet Gateway is allowed per VCN.
• To enable Internet access:
1. Instance must reside in a public subnet.
2. Instance must have a public IP address.
3. The subnet’s route table must include a rule with destination [Link]/0 pointing
to the Internet Gateway.
4. Proper security rules must allow relevant traffic (via security lists or NSGs).
• IGW is managed by OCI—highly available and auto-scaled.
5. NAT Gateway (Network Address Translation Gateway)
• Provides outbound Internet access to instances without public IPs in private subnets.
• Unidirectional traffic:
o Allows outbound connections from private instances and their return responses.
o Blocks inbound traffic initiated from the Internet.
• Each NAT Gateway is assigned a public IP address:
o Ephemeral IP (temporary, assigned automatically by OCI).
o Reserved IP (static, user-controlled).
• Supports TCP, UDP, and ICMP traffic.
• You can block traffic entirely through the NAT Gateway regardless of route/security
rules.
• Can only serve instances within its own VCN, not across peered VCNs or connected on-
prem networks.
• Common use case: Allowing private database servers to download updates or patches
securely.
6. Service Gateway (SGW)
• Enables private access from VCNs to Oracle Services Network (OSN) — a collection of
Oracle-managed services (e.g., Object Storage).
• Communication happens over the Oracle backbone network, not the Internet, ensuring
data privacy.
• Hosts with only private IPs can still access Oracle services.
• Removes the need for Internet Gateway or NAT Gateway for such access.
• Uses Service CIDR Labels (like oci-phx-objectstorage) — logical strings representing
Oracle service IP ranges — instead of manually entering IP ranges.
• Regional scope: Can only access Oracle services within the same region.
7. Public Subnets
• When creating a subnet, choosing “Public Subnet” allows instances to be assigned
public IPs on their Virtual Network Interface Cards (VNICs).
• Requirements for Internet communication:
1. Instance must have a public IP.
2. Subnet must have a route rule pointing to the Internet Gateway.
3. Security rules (Security Lists or NSGs) must permit the desired traffic.
• Used for publicly accessible workloads like web servers.
8. Private Subnets
• Instances in private subnets have only private IPs (no public IPs).
• They cannot directly communicate with the Internet.
• To enable controlled outbound communication:
o Use a NAT Gateway for Internet-bound traffic.
o Use a Dynamic Routing Gateway (DRG) for connecting to on-premises networks.
• Common use case: Hosting databases or application servers that should not be publicly
reachable.
9. VCN Security Overview
Security in a VCN is multi-layered, achieved through:
1. Subnet Type – Public vs. Private.
2. Security Lists – Operate at the subnet level; define ingress/egress rules for all instances
within the subnet.
3. Network Security Groups (NSGs) – Operate at the instance level; provide fine-grained,
stateful traffic control.
4. Instance Firewalls – OS-level rules for inbound/outbound traffic.
5. IAM Policies – Control who can manage VCN and its components.
6. Security Zones – Enforce Oracle’s best practices automatically (e.g., disallowing public
IPs, enforcing private-only architecture).
Analogy:
• Security List = Main gate guard (controls entry into the housing estate).
• NSG = Personal security guard for each house (controls access to individual instances).
Key Takeaways
• Default Route Table = automatic, implicit local routing within VCN.
• Custom Route Tables = created for specific subnet routing (public/private separation).
• Most Specific Rule Wins = narrowest CIDR range takes priority.
• Internet Gateway = bidirectional Internet access for public subnets.
• NAT Gateway = outbound-only Internet access for private subnets.
• Service Gateway = private access to Oracle services.
• Each subnet ↔ one route table, but one route table ↔ multiple subnets.
• Security is enforced using subnet types, NSGs, security lists, and IAM policies.
Lesson Summary: Network Security Groups (NSGs) and Security Lists in OCI
1. Introduction to Network Security Groups (NSGs)
Definition
• A Network Security Group (NSG) is a virtual firewall that controls inbound (ingress) and
outbound (egress) traffic at the VNIC level (Virtual Network Interface Card).
• It applies to specific OCI resources like:
o Compute instances
o Load balancers
o Mount targets
o API Gateways
o And other supported resources within the same Virtual Cloud Network (VCN).
Core Components
An NSG consists of two main components:
1. Set of Security Rules – Defines ingress and egress rules.
2. Set of VNICs – The NSG must be associated with the VNICs of resources (like compute
instances).
2. NSG Rules Overview
Ingress Rules (Inbound Traffic)
• Controls incoming traffic to the instance.
• You define:
o Source Type: Can be:
1. CIDR Block (e.g., [Link]/16)
2. Service (e.g., Object Storage)
3. Another NSG
o Source: Value depends on source type.
o IP Protocol: (e.g., TCP, UDP, ICMP, RDP, SSH)
o Source Port Range: Optional.
o Destination Port Range: Optional (auto-populated based on protocol).
Egress Rules (Outbound Traffic)
• Controls outgoing traffic from the instance.
• You define:
o Destination Type: Can be CIDR, Service, or NSG.
o Destination: Based on destination type.
o Protocol, Source/Destination Port Ranges: Optional fields.
3. Stateful vs Stateless Rules
Feature Stateful Stateless
Automatically tracks and allows Does not track sessions; requires explicit
Definition
response traffic. rules for both directions.
Feature Stateful Stateless
If ingress allows request, egress Must create a separate egress rule for return
Behavior
response is auto-allowed. traffic.
Connection
Uses connection tracking. No connection tracking.
Tracking
Normal bidirectional traffic (e.g., High-volume Internet-facing apps (e.g.,
Best Use Case
SSH, API, database). HTTP/HTTPS) for performance optimization.
Example:
• Stateful:
o Ingress rule allows TCP port 80 (HTTP) — response traffic automatically allowed.
• Stateless:
o Same rule requires an additional egress rule to allow responses.
4. Practical NSG Use Case – Tiered Architecture
• In multi-tier architectures (e.g., web, app, database tiers):
o Each tier can have its own NSG.
o All resources with similar security postures share one NSG.
o Example:
▪ Web tier: NSG-1 (handles Internet traffic)
▪ App tier: NSG-2 (internal only)
o Communication between tiers:
▪ Allowed by referencing NSG-1 as the source in NSG-2 ingress rule.
• Important: Both NSGs must exist in the same VCN.
5. Default Behavior of NSGs
• No default NSG is created automatically when you create a VCN.
→ You must manually create and configure NSGs and their rules.
• In contrast, default route tables and security lists are automatically created with a new
VCN.
6. Example NSG Configuration
Direction State Source/Destination Protocol Port Description
Ingress Stateful [Link]/0 TCP 80 Allow HTTP traffic
Ingress Stateful [Link]/0 TCP 22 Allow SSH traffic
• NSG-A is applied to two compute instances in Subnet A.
• NSG-B is applied to one instance in Subnet B.
• Any instance associated with NSG-A can receive inbound SSH (port 22) traffic from the
Internet.
7. Security Lists Overview
Definition
• A Security List (SL) is also a set of firewall rules controlling ingress and egress traffic.
• Unlike NSGs, Security Lists are associated with subnets, not individual VNICs.
• Thus, all instances within a subnet share the same security rules defined in the subnet’s
Security List.
Key Concepts
• Security Lists are applied to subnets, but enforced at the VNIC level.
• You can associate:
o One or more Security Lists per subnet.
o A single Security List with multiple subnets.
When to Use Security Lists
• When you want to apply uniform security rules to all instances within a subnet.
Example: A subnet for internal databases with the same ingress/egress restrictions.
8. Using NSG and Security List Together
Possible Configurations
1. Use Security List only
2. Use NSG only
3. Use both simultaneously
If both are applied:
• The union of all rules applies.
o If either NSG or SL allows traffic, it is permitted.
o If neither allows, traffic is denied.
• This approach provides fine-grained control (via NSG) plus broad subnet-level rules (via
SL).
Example:
• Subnet has Security List allowing TCP port 1521 (database).
• Instance’s VNIC has NSG allowing TCP port 22 (SSH).
• Result: Instance allows both 1521 and 22.
9. Differences Between NSG and Security List
Feature Network Security Group (NSG) Security List (SL)
Subnet (applies to all
Scope VNIC (instance-level)
instances in subnet)
Association Explicitly to VNICs Automatically to subnet
Granularity Fine-grained Broad and general
Source/Destination Types
CIDR, Service, NSG CIDR, Service
Supported
Created automatically with
Default Creation Not created automatically
VCN
Feature Network Security Group (NSG) Security List (SL)
For workloads needing unique access For applying common
Use Case
control (e.g., web tier vs app tier) security rules across subnets
At VNIC level (even though
Traffic Enforcement Point At VNIC level
defined at subnet)
10. Key Takeaways
• NSG = Instance-Level Firewall, attached to VNICs.
• Security List = Subnet-Level Firewall, attached to subnets.
• Ingress Rules control inbound traffic; Egress Rules control outbound.
• Stateful Rules automatically allow response traffic; Stateless Rules require explicit rules
both ways.
• NSG Source Types: CIDR, Service, or NSG (cross-tier communication).
• Security List Source Types: CIDR or Service only.
• You can use both NSG and Security Lists for layered security — the union of their rules
determines the allowed traffic.
• Best Practices:
o Use NSGs for application-tier separation (e.g., web/app/database).
o Use Security Lists for default subnet-wide protections.
o Always design rules with least privilege principle (only allow what’s needed).
In Summary:
A Network Security Group (NSG) provides fine-grained, instance-level control over traffic, while
a Security List provides subnet-wide control. Both support ingress and egress rules, and when
combined, OCI enforces the union of both rule sets to determine which packets are allowed
through the network.
Excellent — since your last 3 questions were based on Oracle Cloud Infrastructure (OCI)
modules —
Granular Access Control in Object Storage
Network Security Groups (NSG)
Security Lists (SL)
— I’ve crafted 40 Multiple-Choice Questions (MCQs) that combine all three topics.
Each question has four options (A–D), correct answers, and clear explanations for quick study
or quiz preparation.
40 OCI Security & Access Control MCQs
Object Storage – Granular Access Control (1–14)
1. What does OCI Object Storage primarily store?
A. Structured data
B. Unstructured data such as files, images, or videos
C. Encrypted text files only
D. Only compute logs
Answer: B
Explanation: Object Storage is designed for unstructured data like files, images, and videos
stored as objects within buckets.
2. Which OCI service component acts as the container for objects?
A. Folder
B. Instance
C. Bucket
D. Vault
Answer: C
Explanation: A bucket organizes and stores objects in OCI Object Storage.
3. What is the main advantage of object-level IAM policies?
A. They improve database query speed
B. They allow granular access to specific objects
C. They reduce bucket capacity
D. They disable user access
Answer: B
Explanation: Object-level IAM policies enable fine-grained control over individual files or
datasets.
4. In OCI, IAM policies for Object Storage can be scoped at:
A. File system level
B. Region level only
C. Tenancy or compartment level
D. Data center level
Answer: C
Explanation: Policies can be applied at tenancy or compartment scope for control over multiple
buckets or objects.
5. The variable used for defining object-level access control is:
A. [Link]
B. [Link]
C. [Link]
D. object_scope.level
Answer: B
Explanation: The [Link] variable allows IAM conditions for specific object names or
patterns.
6. What is the benefit of using [Link]?
A. It improves upload speed
B. It allows permissions for specific files or folders
C. It deletes old objects automatically
D. It encrypts objects by default
Answer: B
Explanation: [Link] enables access rules based on exact object names or prefixes
(like “prod/*”).
7. Which of these is NOT a valid Object Storage IAM action?
A. OBJECT_CREATE
B. OBJECT_READ
C. OBJECT_DELETE
D. OBJECT_SYNC
Answer: D
Explanation: OCI defines standard actions like READ, CREATE, DELETE — OBJECT_SYNC is not
among them.
8. When granting full access to all objects in a folder, which wildcard pattern is used?
A. “folder?”
B. “folder*”
C. “folder@”
D. “folder#”
Answer: B
Explanation: The asterisk (*) acts as a wildcard to match all objects within a folder.
9. What does an OBJECT_INSPECT permission allow?
A. Upload objects
B. View object metadata
C. Delete objects
D. Copy buckets
Answer: B
Explanation: OBJECT_INSPECT allows viewing metadata or object details without modifying
them.
10. What kind of workloads benefit most from object-level access control?
A. Gaming servers
B. Big data, IoT, and data lakes
C. Email applications
D. Chat apps
Answer: B
Explanation: These workloads require secure and flexible access to millions of data objects.
11. Which IAM scope provides the broadest level of access?
A. Object level
B. Bucket level
C. Compartment level
D. Tenancy level
Answer: D
Explanation: Tenancy scope covers all compartments, buckets, and objects.
12. Which file type restriction can be implemented using object-level policy?
A. [Link]: *.txt
B. [Link]: *.pdf
C. [Link]: *.zip
D. [Link]: *.csv
Answer: B
Explanation: Using [Link]: *.pdf restricts access to PDF files only.
13. Object-level IAM policies help prevent:
A. Bucket deletion
B. Unauthorized object reads or writes
C. Network overload
D. Database latency
Answer: B
Explanation: They enforce precise access rules to protect sensitive data objects.
14. Object-level IAM enhances:
A. Cost estimation
B. Granular security
C. Encryption management
D. API throttling
Answer: B
Explanation: It gives administrators granular security control at object granularity.
Network Security Groups (15–28)
15. What is a Network Security Group (NSG)?
A. A subnet
B. A virtual firewall
C. A database engine
D. A load balancer
Answer: B
Explanation: NSG functions as a virtual firewall for VNICs.
16. NSGs contain which two primary components?
A. Subnets and route tables
B. VNIC associations and security rules
C. Load balancers and DNS records
D. Gateways and connections
Answer: B
Explanation: NSGs are made up of VNICs and security rules (ingress/egress).
17. NSGs can be associated with which OCI resources?
A. Compute instance, Load balancer, Mount target, API Gateway
B. Only Compute instance
C. Subnet only
D. Database only
Answer: A
Explanation: NSG supports multiple resources, not just compute.
18. What does an ingress rule control?
A. Outgoing traffic
B. Incoming traffic
C. Load balancing
D. VPN connectivity
Answer: B
Explanation: Ingress rules define which incoming traffic is allowed to a resource.
19. Which of the following can be a source type in an ingress rule?
A. Subnet
B. CIDR block, Service, or NSG
C. Route table
D. IPsec connection
Answer: B
Explanation: Ingress source can be any of these three: CIDR, service, or NSG.
20. In egress rules, the corresponding parameter to source type is:
A. Source name
B. Destination type
C. Target name
D. Object type
Answer: B
Explanation: Egress rules define destination type (CIDR, service, or NSG).
21. What is the main difference between stateful and stateless rules?
A. Stateful tracks connections; stateless doesn’t
B. Stateless is faster
C. Stateful applies only to ingress
D. Stateful allows only ICMP
Answer: A
Explanation: Stateful rules automatically allow response traffic using connection tracking.
22. When would you prefer stateless rules?
A. For high-volume, internet-facing applications
B. For internal backend servers
C. For encrypted storage
D. For cost saving
Answer: A
Explanation: Stateless rules suit high-throughput traffic like HTTP/HTTPS, avoiding connection
tracking overhead.
23. Which default rule is created automatically with a VCN?
A. NSG
B. Route Table
C. Default Security List
D. Default Subnet
Answer: C
Explanation: When a VCN is created, a default Security List (not NSG) is created.
24. Does OCI automatically create a default NSG?
A. Yes
B. No
Answer: B
Explanation: NSGs must be manually created; only default security lists are automatic.
25. NSGs can control traffic between:
A. Regions
B. Different VCNs
C. Two NSGs within the same VCN
D. Tenancies
Answer: C
Explanation: NSGs can reference each other only if both belong to the same VCN.
26. In a multi-tier architecture, you can:
A. Use one NSG for all tiers
B. Use separate NSGs for web and app tiers
C. Apply NSG to subnet
D. Apply NSG globally
Answer: B
Explanation: Best practice is to assign different NSGs for different tiers (e.g., Web Tier, App Tier).
27. What happens if a stateful ingress rule allows port 80 traffic?
A. Response traffic must be defined manually
B. Response traffic is automatically allowed
Answer: B
Explanation: Stateful rules track sessions, so replies are auto-allowed.
28. Which protocol is typically used for web access control in NSG rules?
A. ICMP
B. TCP
C. UDP
D. ARP
Answer: B
Explanation: Web services commonly use TCP ports (80, 443).
Security Lists (29–40)
29. Security Lists are associated with:
A. Individual VNICS
B. Subnets
C. Regions
D. Availability domains
Answer: B
Explanation: Security Lists apply to all VNICs within a subnet.
30. How are Security List rules enforced?
A. At subnet level only
B. At the VNIC level
C. At bucket level
D. At region level
Answer: B
Explanation: Though associated with subnets, rules are enforced at the VNIC level.
31. Security Lists can contain:
A. Only ingress rules
B. Both ingress and egress rules
Answer: B
Explanation: Like NSGs, Security Lists support both ingress and egress rules.
32. If both an NSG and Security List are applied, the result is:
A. The intersection of both
B. The union of both
Answer: B
Explanation: The combined effect is a union — any “Allow” rule in either applies.
33. Traffic is allowed only if:
A. Deny rule exists
B. There’s an Allow rule in either SL or NSG
Answer: B
Explanation: OCI uses “allow-by-rule” logic; explicit allow must exist.
34. Security Lists can use which source types?
A. CIDR and Service
B. CIDR, Service, and Security List
Answer: A
Explanation: Unlike NSGs, SLs don’t support Security List as a source type.
35. NSGs can reference other NSGs, but Security Lists cannot. True or False?
Answer: True
Explanation: NSG supports NSG-as-source type; Security Lists do not.
36. Which of these combinations is valid in OCI security configuration?
A. Only NSG
B. Only Security List
C. Both NSG and Security List
D. All of the above
Answer: D
Explanation: OCI allows either or both — flexibility in configuration.
37. When should you prefer a Security List?
A. When applying uniform rules to all subnet instances
B. When controlling access to a single VNIC
Answer: A
Explanation: SLs are ideal for subnet-wide rule enforcement.
38. Which rule type supports connection tracking?
A. Stateless
B. Stateful
Answer: B
Explanation: Stateful rules automatically track and allow responses.
39. In OCI, which construct must be created manually?
A. Route Table
B. NSG
Answer: B
Explanation: NSGs are not auto-created with VCNs.
40. A subnet can have multiple Security Lists. What happens then?
A. The stricter list applies
B. The union of all rules applies
Answer: B
Explanation: Multiple Security Lists combine; all Allow rules are effective.
TOTAL: 40 Questions
Coverage:
• 14 on Object Storage (Granular Access)
• 14 on Network Security Groups
• 12 on Security Lists