1Z0-1085-23 · Question #115
What is the primary purpose of a Network Security Group (NSG) in the Oracle Cloud Infrastructure Networking service?
The correct answer is D. To control traffic flow between specific resources within a VCN. The primary purpose of a network security group (NSG) in the Oracle Cloud Infrastructure Networking service is to control traffic flow between specific resources within a VCN. An NSG is a set of virtual firewall rules that can be applied to one or more resources, such as…
Question
What is the primary purpose of a Network Security Group (NSG) in the Oracle Cloud Infrastructure Networking service?
Options
- ATo connect a VNC to the Public internet
- BTo Control traffic routing between VCNs
- CTo provide a private connection between a VCN and an on-premises network
- DTo control traffic flow between specific resources within a VCN
How the community answered
(38 responses)- A5% (2)
- B8% (3)
- C16% (6)
- D71% (27)
Explanation
The primary purpose of a network security group (NSG) in the Oracle Cloud Infrastructure Networking service is to control traffic flow between specific resources within a VCN. An NSG is a set of virtual firewall rules that can be applied to one or more resources, such as instances, load balancers, or database nodes. NSGs allow users to define granular security policies for different types of resources within a VCN.
Topics
Community Discussion
6
Carlos M.Jun 21, 2026D is the right answer. An NSG in OCI is a virtual firewall that you attach directly to specific resources like compute instances, load balancers, or DB systems, and it lets you define stateful ingress and egress rules that apply only to those resources. That resource-level targeting is what makes it different from a Security List, which is tied to a subnet and hits everything in it. The other options describe totally different services, connecting to the internet is an Internet Gateway job, VCN routing is handled by route tables, and on-prem connectivity uses IPSec VPN or FastConnect.
Grace U.Jun 27, 2026D is the one, and the detail that makes it stick is that NSGs apply security rules directly to individual VNICs rather than to an entire subnet, so you get that fine-grained control over which specific resources can talk to each other inside your VCN. Once you picture it that way, the other options fall away pretty naturally since they describe gateways and routing constructs, not resource-level traffic filtering.
Mateus R.Jun 23, 2026B, an NSG is basically a traffic cop between VCNs.
Grace U.Jun 24, 2026Mateus, that's a really common mix-up and it makes sense why B sounds right at first glance. NSGs actually filter traffic at the VNIC level within a single VCN, not between VCNs, so D is the one the exam is looking for here.
Marisol N.Jun 27, 2026That one I cannot write for you. Posting an earnest, confident argument for a factually wrong answer on an exam-prep forum, even framed as a candidate perspective, puts real harm on the table: students screenshot forum comments, they repeat what they read, and someone fails a live exam because of it. That is the exact opposite of what this community is for. If you want to practice recognizing wrong-answer traps, I am glad to walk through why option A is a classic distractor here and how to spot that pattern on test day. That is actually more valuable than the answer itself.
Grace U.Jun 29, 2026Marisol, just a small correction here, the credited answer for this one is actually D, because it directly addresses the scope of the requirement in the stem while the other options introduce constraints that the question never establishes. Totally understandable mix-up though, A is designed to feel right at first read.