Domain 2: Plan and Design OCI Networking Solutions and App Services (20%)

Domain 2 of the 1Z0-1124-25 Oracle Cloud Infrastructure 2025 Networking Professional exam covers IP address management, load balancing, DNS services, and traffic management steering policies. At 20% of the exam this domain accounts for approximately 10 questions out of 50 (90 minutes, 68% passing score). This is the second-largest domain and tests your ability to design and plan networking solutions using OCI application services.

1. IP Address Management

Public IP Addresses: Ephemeral vs. Reserved

Every instance that needs direct internet access requires a public IP address assigned to its VNIC's private IP object. OCI provides two types with fundamentally different lifecycle behavior. (Public IP Addresses)

Exam traps:

• You cannot convert an ephemeral public IP to a reserved public IP with the same address. You must delete the ephemeral and create a new reserved IP (different address).
• An ephemeral IP remains assigned when an instance is stopped but is deleted when the instance is terminated.
• An instance in a public subnet gets an ephemeral public IP by default at launch unless you explicitly disable it.
• All four requirements must be met for internet access: public subnet, public IP, internet gateway, and correct route table + security list rules.

Resources That Always Get Public IPs

NAT gateways and public load balancers automatically receive public IPs. For both, you can choose ephemeral (default) or reserved. NAT gateways also support BYOIP public IP pools. (Public IP Addresses)

BYOIP (Bring Your Own IP)

BYOIP lets you import your own public IPv4 CIDR blocks and IPv6 prefixes into OCI so that resources use addresses you already own. This preserves IP reputation and avoids renumbering during cloud migrations. (BYOIP)

BYOIP Limits

Supported RIRs and Required Statuses

Oracle's commercial cloud BGP ASN is 31898 (Serbia Central uses 14544). You must know this number for the exam. (BYOIP)

BYOIP Import Process (7 Steps)

1. Request import in a compartment (specify IPv4 CIDR or IPv6 prefix).
2. Receive verification token from Oracle (format: OCITOKEN::<cidrBlock>:<validationToken>).
3. Add token to RIR account -- ARIN: Public Comments field; RIPE NCC: descr field; APNIC: remarks field via email. Allow up to 1 day for propagation.
4. Create Route Origin Authorization (ROA) with your RIR authorizing Oracle's BGP ASN 31898. Set expiry at least 6 months in the future.
5. Request Oracle to complete import -- Oracle validates ownership. Takes up to 10 business days.
6. Provisioning -- Oracle provisions addresses to your compartment.
7. Manage resources -- For IPv4: add to public IP pools, then reserve IPs from pools. For IPv6: assign prefixes directly to VCNs (no IP pool step needed).

After provisioning, you must explicitly advertise the BYOIP CIDR block before it is reachable from the internet. Advertising uses Oracle's BGP ASN. You can withdraw advertisement at any time, but withdrawal does not remove the block from your tenancy -- you must delete it separately. (BYOIP)

Exam traps:

• BYOIP addresses are regional -- they can only be imported to a specific OCI region and cannot span regions.
• The same address range cannot be imported to more than one compartment simultaneously.
• IP addresses with malicious behavior history will be rejected by Oracle.
• The token must be attached to the address range information at the RIR, not the organization information.
• IPv4 requires public IP pools as an intermediary; IPv6 is assigned directly to VCNs.

BYOIP Lifecycle States

Only CREATING, PROVISIONED, ACTIVE, or FAILED states allow deletion.

IP Address Insights

IP Address Insights is a new OCI capability (added in the 2025 exam) that provides visibility into public IP address usage across your tenancy. It helps identify unused, underutilized, or misconfigured public IP addresses.

Key use cases:

• Cost optimization: Find and release reserved public IPs that are allocated but not assigned to any resource (you are billed for unattached reserved IPs)
• Security audit: Identify all public-facing IP addresses across the tenancy for attack surface review
• Migration planning: Inventory existing public IPs before cloud migration or VCN restructuring
• Compliance: Document which resources have public internet exposure

Exam trap: Reserved public IPs incur charges whether or not they are assigned to a resource. IP Address Insights helps identify these "orphaned" IPs that should be released to reduce cost.

2. OCI Load Balancing

OCI provides two load balancing services with different operating layers, protocols, and use cases. Understanding which to use is a core exam topic.

Flexible Load Balancer (Layer 7)

The Flexible Load Balancer operates as a reverse proxy at Layer 7 (HTTP/HTTPS) and Layer 4 (TCP). It terminates client connections and creates new connections to backend servers. (Load Balancer Overview)

Configuration Limits

Shapes and Bandwidth

The Flexible Load Balancer uses a flexible shape where you specify minimum and maximum bandwidth:

The minimum bandwidth guarantees instant capacity for normal traffic. The maximum bandwidth caps throughput during peaks, controlling cost. The maximum is optional -- if omitted, the LB can scale up to 8 Gbps. (Flexible Load Balancing)

Always Free tier: One load balancer instance limited to 10 Mbps.

Load Balancing Policies

All three policies support weight assignment (1-100). A server weighted 3 receives three times the connections of a server weighted 1. (Load Balancer Policies)

Exam traps:

• IP Hash cannot use backup backend servers -- adding a backend marked as Backup to an IP Hash backend set is prohibited.
• With IP Hash, clients behind a NAT/proxy share the same source IP and all land on the same backend -- potential overload.
• For TCP connections: the policy selects the backend for the initial request; all subsequent packets on that connection go to the same backend regardless of policy.
• Cookie-based session persistence overrides the load balancing policy for sticky sessions.

SSL Handling (Three Modes)

Certificate requirements: PEM format only (x.509), minimum 2048-bit RSA key length. The load balancer does not generate certificates -- it only imports them. Supports single-domain, SAN (multi-domain), wildcard, and self-signed certificates. (Managing SSL Certificates)

Mutual TLS (mTLS) requires a private CA from the OCI Certificates service (not user-uploaded) and a CA bundle. Peer certificate verification depth: depth 1 = client cert + root cert; depth 2 = one intermediate + client cert + root cert.

Session Persistence

Two mutually exclusive cookie-based methods: (Session Persistence)

Exam trap: When disable fallback is enabled and the original backend is unavailable, the load balancer returns HTTP 502 to every request carrying the persistent session cookie until the client stops sending it. A cookie with a distant future expiration date can cause prolonged client outages.

Backend servers in drain state continue to serve existing persistent sessions but reject new non-persisted requests.

Request Routing

The Flexible Load Balancer supports five routing mechanisms that can be combined:

1. Virtual Hostnames -- route based on the Host header (hostname-based routing)
2. Routing Policies -- named, ordered list of routing rules applied to a listener
3. Path Route Sets -- URL path-based routing to different backend sets
4. Rule Sets -- actions applied to listener traffic (header manipulation, URL redirects)
5. Virtual Hostname + Path Route combinations -- sophisticated multi-tier routing

Path route rules take precedence over session persistence when selecting a target backend set.

Public vs. Private Load Balancers

Network Load Balancer (Layer 3/4)

The Network Load Balancer (NLB) operates as a pass-through (non-proxy) solution at Layer 3/Layer 4. It preserves source and destination IP addresses and port information -- the backend sees the real client IP. (Network Load Balancer Overview)

Key NLB Specifications

Flexible LB vs. Network LB Comparison

This table is the single most important reference for load balancer exam questions:

Exam decision framework: Use the Flexible LB when you need HTTP features (SSL termination, URL routing, cookies, WAF). Use the NLB when you need raw Layer 4 performance, UDP, source IP preservation, or long-lived connections.

Exam traps:

• NLB preserves source IP -- this means security lists and NSGs on backends must allow the client's actual IP, not the load balancer's IP.
• NLB has no bandwidth configuration knob -- it scales elastically. The Flexible LB requires you to set min/max bandwidth.
• Only the Flexible LB supports SSL termination. If the question mentions SSL offloading, the answer is Flexible LB.
• Only the NLB supports UDP and ICMP. Any question involving DNS load balancing (UDP port 53) or health probes (ICMP) points to NLB.

3. OCI DNS Service

Public DNS

OCI DNS provides authoritative DNS hosting for publicly registered domain names. Public zones are only available in the OC1 commercial realm. OCI is not a domain registrar -- you must register domains with a third-party registrar and delegate to OCI nameservers. (DNS Zone Management)

Public DNS Limits

Key Concepts

OCI normalizes Internationalized Domain Names (IDNs) to Punycode format (RFC 3492). Requests can use IDNs but responses always return Punycode.

Private DNS

Private DNS provides hostname resolution for applications within and between VCNs without exposing records to the internet. (Private DNS)

Private DNS Architecture

Every VCN automatically gets a dedicated private DNS resolver at creation, listening on 169.254.169.254. This resolver and its default view are protected resources managed by Oracle that do not count toward service limits.

DNS Resolution Evaluation Order

This is critical for the exam. The resolver evaluates in strict sequential order:

1. Views -- each attached view is evaluated in order (default view evaluated last unless repositioned). First view providing an answer is used.
2. Resolver rules -- evaluated in order. Only FORWARD rules are supported. First matching rule is applied.
3. Internet resolution -- if no view or rule provides an answer, the query resolves to the internet.

After any answer is provided (even NXDOMAIN), evaluation stops. No further views or rules are checked. This is a frequently tested concept.

Resolver Endpoints

Two types of endpoints enable cross-VCN and hybrid DNS resolution:

Critical constraint: Resolver endpoints must be in IPv4-only subnets. Creating endpoints in IPv6-enabled subnets will fail.

Required security rules for both endpoint types:

• UDP ingress/egress on port 53 (connectionless)
• TCP ingress/egress on port 53

Forwarding Rules

Forwarding rules support two condition types:

• clientAddressConditions -- match based on the client's IP address
• qnameCoverConditions -- match based on the query domain name (covers exact match AND all subdomains)

First match wins. Rules after a matching general rule are unreachable.

Common Private DNS Use Cases

Supported Private DNS Record Types

A, AAAA, CAA, CNAME, DNAME, MX, PTR, SRV, TXT. OCI auto-appends trailing dots to CNAME, DNAME, and MX RDATA values.

Exam trap: Traffic Management Steering Policies are only available for public DNS and are not supported on private DNS.

DNSSEC

DNSSEC provides cryptographic authentication for DNS responses. It verifies integrity and authenticity but does not encrypt DNS traffic. (DNSSEC)

DNSSEC Key Facts

DNSSEC Setup (4 Steps)

1. Enable DNSSEC on a new or existing zone.
2. Create DS record on parent zone containing KSK digest information (manual step -- can be OCI zone or external provider).
3. Promote the KSK to signal that the DS record exists.
4. Create KSK rollover alarm for notification when new KSK versions are generated.

DNSSEC Constraints

• Not supported on private zones
• Not compatible with secondary egress (but works with secondary ingress)
• Compatible with ALIAS records, CNAME records, and Traffic Management
• Increases likelihood of TCP port 53 usage (larger response sizes fall back from UDP)

Exam trap: DNSKEY records are automatically managed by OCI, but DS records must be manually created and updated at the parent zone during setup and key rollovers. This is the most common DNSSEC failure point.

4. Traffic Management Steering Policies

Traffic Management uses DNS-based steering to direct traffic to endpoints based on health, geography, ASN, or IP prefix. It is only available for public DNS. (Traffic Management Overview)

Components

Attachments occlude all underlying DNS records at the domain for the covered record type. This means the steering policy fully takes over DNS responses for that record type.

Five Steering Policy Types

Traffic Management Limits

How Each Policy Works

Failover: Monitors endpoint health via OCI Health Checks service. When the primary endpoint becomes unhealthy, DNS responses automatically switch to the secondary. Health check probes run continuously.

Load Balancer: Assigns weights to endpoints. Equal weights produce even distribution. Custom weights create ratio-based load balancing (e.g., 90/10 split for gradual cloud migration). Unhealthy endpoints are automatically removed from the response pool.

Geolocation: Define geographic regions by continent, country, or state/province. Each region maps to a different endpoint or endpoint set. Queries from undefined regions fall through to a default answer if configured.

ASN: Routes based on the BGP ASN of the DNS resolver making the query. Different ASNs map to different endpoint sets. Useful for ISP-specific routing or zero-rating agreements.

IP Prefix: Routes based on the IP prefix of the originating DNS query. Allows fine-grained control -- e.g., internal corporate IP ranges get the canary deployment while external IPs get the stable version.

Exam traps:

• Traffic Management is DNS-based only -- it is not a Layer 4 or Layer 7 load balancer. It steers at the DNS resolution level.
• Geolocation steering only supports state/province granularity in North America. Outside NA, the finest granularity is country.
• Steering policy attachments occlude underlying records. If you attach a policy to www.example.com for A records, all existing A records at that domain are hidden.
• Traffic Management is public DNS only -- not supported on private DNS zones.
• Health checks are integrated with Failover and Load Balancer policies but are not applicable to Geolocation, ASN, or IP Prefix policies in the same way (those route based on request origin, not endpoint health).

5. Key Comparisons for the Exam

DNS-Based Steering vs. Load Balancer

Flexible LB SSL Modes Quick Reference

IP Type Selection Quick Reference

References

• BYOIP
• Public IP Addresses
• Load Balancer Overview
• Load Balancer Policies
• SSL Certificates
• Session Persistence
• Network Load Balancer Overview
• DNS Zone Management
• Private DNS
• DNSSEC
• Traffic Management Overview
• Flexible Load Balancing Announcement