Cloud Native Architecture practice questions

OCI API Gateway configured with a mock backend routing to OCI Functions.

Why it fails: API Gateway mock backends return canned responses and never consume Object Storage events, so no delivery, prefix filtering or dead-letter queue exists. It is tempting because API Gateway does front Functions, but for synchronous HTTP invocation, not event-driven bucket triggers.

OCI Notifications Service publishing directly to an OCI Object Storage bucket.

Why it fails: Notifications Service publishes messages to topics and subscriptions, not into Object Storage buckets, and cannot invoke Functions with at-least-once delivery or a dead-letter queue. It is tempting because it is a genuine OCI pub/sub service used for fan-out alerting.

OCI Events Service rule triggering OCI Functions directly without any intermediate queue.

Why it fails: Direct Events-to-Functions rules provide at-least-once delivery but no dead-letter queue for failed invocations, and prefix filtering is limited. It is tempting because it is the simplest native event-driven pattern and works when failures need no retry capture.

Kubernetes Persistent Volume Claims with Block Storage

Why it fails: Incorrect. PVCs handle storage provisioning, not authentication.

OCI Vault Master Encryption Key rotation

Why it fails: Incorrect. Vault is for managing encryption keys and secrets, not for authenticating pods to IAM.

OCI Bastion Service port forwarding

Why it fails: Incorrect. Bastion provides secure access to private hosts via SSH, not workload authentication.

OCI Notifications service broadcast rules

Why it fails: OCI Notifications publishes messages to subscribers over topics; it carries no request traffic and cannot split HTTP requests between pod versions. It tempts because it is an OCI-native service for broadcasting events, and it would be correct for alerting teams about a deployment, not for routing production traffic.

Kubernetes standard Service resource with multiple selectors pointing to the same pod

Why it fails: A Service selects pods by label; a pod matching multiple selectors is still one endpoint set, so traffic splits by endpoint count, not a controllable 10/90 ratio. It tempts because Services do front pods, and weighted routing seems achievable — but Services offer no percentage-based traffic weighting.

OCI Load Balancer listener port re-mapping

Why it fails: Listener port re-mapping forwards a listener port to a backend port set; it cannot express a 10/90 percentage split across two versions. It tempts because load balancer listeners do control traffic entry, and port-based routing is valid for protocol separation — not weighted canary distribution.

OCI Object Storage standard bucket

Why it fails: Incorrect. While object storage holds files, it is not an OCI-integrated container registry with Docker v2 API support.

OCI Artifact Registry

Why it fails: Incorrect. Artifact Registry is for generic software packages (Maven, npm, NuGet), not OCI container images.

OCI DevOps Code Repository

Why it fails: Incorrect. Code Repository is a Git-based source code management service.

OCI Load Balancer backend set weighting rules

Why it fails: Load balancer backend weighting distributes client traffic across registered backends; it never influences the kube-scheduler's pod placement decisions. It is tempting because OCI load balancers do front OKE services, but scheduling pods onto GPU nodes requires nodeSelector, affinity or taints and tolerations, not traffic weighting.

Kubernetes Horizontal Pod Autoscaler resource targets

Why it fails: The Horizontal Pod Autoscaler adjusts replica counts based on CPU or custom metrics; it cannot constrain which node pool a pod lands on. It is tempting because ML microservices are resource-intensive and autoscaling addresses load, but placement on dedicated GPU nodes needs nodeSelector, affinity or taints and tolerations.

OCI Identity and Access Management dynamic group policies

Why it fails: IAM dynamic group policies govern OCI API authorisation for instances and principals; they have no role in Kubernetes pod scheduling. It is tempting because dynamic groups commonly grant OKE nodes access to OCI services, but restricting pods to GPU node pools requires nodeSelector, affinity or taints and tolerations.

Increase the OCI VCN bandwidth limit to maximum.

Why it fails: Incorrect. VCN bandwidth does not control serverless function concurrency limits.

Enable public access on the OCI Functions application endpoint.

Why it fails: Incorrect. Public access changes authentication requirements, not concurrency throttling.

Configure OCI Object Storage lifecycle rules to delete excess messages.

Why it fails: Incorrect. Deleting messages causes data loss and does not solve ingestion throttling.

OCI Object Storage bucket managed by Helm

Why it fails: Helm v3 stores release state as Kubernetes Secrets in the cluster's own etcd, not in an external OCI bucket. Object Storage suits chart repositories via the oci:// registry protocol, so it is tempting when charts are already pushed there, but it never holds release metadata.

OCI Registry chart annotations

Why it fails: OCI Registry chart annotations are metadata attached to published charts, not Helm's release-state store; Helm v3 keeps release state in Kubernetes Secrets by default. It is tempting because OCI registries do host Helm charts, and would be relevant when packaging or distributing charts rather than tracking releases.

Local SQLite database on the master control plane node

Why it fails: Helm v3 abandoned Tiller and its local SQLite store; it writes release records as Secrets in the cluster's etcd, so no SQLite file exists on the control plane. SQLite was the Helm v2 default, making it tempting for anyone recalling pre-v3 architecture.

SSH Public Key fingerprint authorization

Why it fails: Incorrect. API Gateway is an HTTP/REST gateway, not an SSH server.

Direct integration with Active Directory domain controller LDAP sockets over the public internet

Why it fails: Incorrect. API Gateway does not connect directly to raw LDAP sockets over the internet for auth.

OCI VCN Internet Gateway packet drop count due to BGP routing failures

Why it fails: Incorrect. BGP routing failures affect site-to-site VPNs, not internal streaming consumer lag metrics.

OCI Object Storage bucket public download bandwidth

Why it fails: Incorrect. Object storage metrics are unrelated to streaming consumer lag.

Direct SMS text messages to mobile phone numbers globally

Why it fails: OCI Notifications publishes to HTTPS endpoints, email, and PagerDuty, not global SMS; SMS requires a third-party gateway or OCI Streaming consumer. It is tempting because SMS is a standard alerting channel, and it would be correct where an external messaging service bridges Notifications to mobile subscribers.

Physical fax machine transmission over analog telephone lines

Why it fails: OCI Notifications supports HTTPS, email, and PagerDuty subscriptions; fax over analog lines has no delivery protocol in the service. It is tempting because fax remains common in regulated industries, and it would be correct only via a third-party fax gateway subscribed to an HTTPS or email endpoint.

OCI Streaming Service

Why it fails: OCI Streaming is a high-throughput data ingestion platform, not a networking solution for microservices.

Oracle Cloud Guard

Why it fails: Oracle Cloud Guard is a security posture management service, not a traffic routing or service mesh mechanism.

OCI API Gateway

Why it fails: OCI API Gateway is used primarily for managing ingress traffic and publishing APIs, not internal pod-to-pod mesh routing.

Configure OCI API Gateway with request throttling in front of the OCI Function.

Why it fails: API Gateway throttling drops or rejects excess traffic with 429 status codes, which does not guarantee event durability or at-least-once processing for asynchronous events.

Increase the maximum memory and execution timeout limits on the OCI Function configuration.

Why it fails: While memory scales CPU proportionally, it does not prevent connection drops caused by downstream database saturation during traffic spikes.

Deploy the OCI Function inside a public subnet with an internet gateway for faster database roundtrips.

Why it fails: Functions should reside in private subnets with service gateways or NAT gateways for secure DB connectivity, and public subnets do not solve concurrency overload.

OCI Streaming

Why it fails: OCI Streaming is a publish-subscribe messaging service, not a workflow orchestrator.

OCI Resource Manager

Why it fails: OCI Resource Manager is a Terraform-managed infrastructure orchestration service, not a serverless application workflow engine.

OCI Vault

Why it fails: OCI Vault is used for secrets management and encryption keys.

Inside an OCI Events rule matching the incoming HTTP request payload.

Why it fails: OCI Events reacts to resource state changes, it does not sit inline to intercept and validate HTTP request tokens.

By attaching an OCI IAM policy to the target VCN subnet route table.

Why it fails: OCI IAM policies control access to OCI control-plane and resource APIs, not HTTP header JWT validation for application traffic.

Inside the Ingress Controller configuration manifest deployed on the OKE cluster.

Why it fails: While Ingress controllers can handle authentication, validating at the API Gateway layer prevents unauthorized traffic from hitting the VCN backend entirely.

Use an OCI Database with PL/SQL triggers to download files from Object Storage.

Why it fails: PL/SQL triggers fire on database events, not Object Storage uploads, and a database is neither ephemeral nor event-driven for this task. It tempts because OCI Database offers scheduling and procedural logic, which suits in-database processing rather than reacting to bucket object-creation events.

Deploy a Kubernetes deployment with 10 replicas on an OKE cluster to monitor bucket logs.

Why it fails: A 10-replica deployment runs continuously and polls logs rather than reacting to object-creation events, so it is neither ephemeral nor event-driven. It tempts because OKE can host event consumers, which suits long-running containerised workloads, not sub-three-minute functions triggered per upload.

Provision an Always Free Compute VM running a cron job that polls Object Storage every minute.

Why it fails: A cron job polls on a fixed interval, adding up to a minute of latency and running a VM continuously, so it is not event-driven. It tempts because Always Free Compute removes compute cost, which suits scheduled batch polling rather than immediate per-object invocation.

OCI Functions can execute indefinitely without any timeout restrictions up to 24 hours.

Why it fails: OCI Functions enforces a maximum execution timeout of 300 seconds per invocation, so indefinite or 24-hour runs are impossible. It is tempting because long-running batch jobs do exist, but those belong on OCI Data Flow, OCI Container Instances, or Compute — not the Functions service.

An OCI Function can be configured to invoke an OCI Database directly over a public IP without any VCN security configurations.

Why it fails: Functions run inside a VCN subnet and reach databases through private endpoints, NSGs, security lists and route tables; a public IP bypass with no security configuration is not offered. It tempts because public database endpoints exist, but those still require ingress rules and credentials.

Add an API Gateway authorizer that validates a shared secret header, and configure the backend to reject requests missing that header.

Why it fails: A shared secret header authorizer authenticates callers, not the gateway origin. Any client that learns the secret can send it directly to the backend, bypassing the gateway entirely. This does not enforce that traffic originated from the API Gateway deployment, and it adds credential rotation overhead. The requirement is network-level origin control, which this approach cannot provide.

Create an OCI Web Application Firewall policy in front of the backend and enable only the API Gateway's public IP address in the allow list.

Why it fails: A WAF policy inspects HTTP traffic but is not an origin-enforcement mechanism for private backends, and the API Gateway public endpoint does not present a stable single IP that can be reliably allow-listed. This adds cost and complexity without guaranteeing that only gateway-originated traffic reaches the service instances, so it fails the least-overhead requirement.

Place the backend instances in a public subnet and use a security list that allows ingress from 0.0.0.0/0 on the service port, relying on the API Gateway's TLS termination for protection.

Why it fails: Exposing the backend on a public subnet with 0.0.0.0/0 ingress directly contradicts the goal of accepting only gateway-originated traffic. TLS termination at the gateway does not prevent direct connections to the backend's public address. This configuration increases attack surface and provides no origin enforcement, making it clearly unsuitable for the stated requirement.

Instrument each service with the OCI Application Performance Monitoring Java agent and rely on its automatic trace context propagation across all language runtimes.

Why it fails: OCI APM agents exist for specific runtimes, and a polyglot environment would require a compatible agent per language plus configuration. That is more than minimal code change and may not cover every service. It also does not address log correlation for services that only write stdout, so it does not fully meet the stated requirement.

Enable OCI Flow Logs on the cluster's VCN and parse the five-tuple fields to reconstruct request paths between pods.

Why it fails: VCN flow logs capture network metadata such as source and destination IPs and ports, not HTTP request identifiers or application context. Reconstructing logical request paths from five-tuples is unreliable, especially with reused connections and NAT. This does not provide the per-request correlation across services that the team requires.

Configure OCI Monitoring alarms on each service's CPU and memory metrics, and correlate incidents using the alarm timestamps in OCI Notifications.

Why it fails: Monitoring alarms track resource metrics and notify on thresholds; they do not carry per-request identifiers and cannot correlate a single request across services. This approach addresses availability, not request-level tracing. It would leave the team unable to follow one transaction through the call chain, so it fails the correlation objective.

Use OCI Events to trigger the Function for each message, and configure the rule to retry failed invocations indefinitely until the function succeeds.

Why it fails: OCI Events rules react to service state changes, not individual stream messages, so they cannot deliver per-message triggers from OCI Streaming. Even if a rule existed, indefinite retries would block progress and could duplicate work. This design does not integrate with stream partitions or offsets and cannot meet the requirements.

Create a Function with a Streaming trigger, and rely on the Functions service to checkpoint offsets only after the function returns successfully.

Why it fails: OCI Functions Streaming triggers do not manage consumer group offsets or commit checkpoints on your behalf. Without explicit offset management, a failed invocation can cause messages to be reprocessed or skipped depending on the consumer configuration. This approach does not guarantee no message loss and misstates how the trigger behaves.

Configure the Function to poll the stream using the OCI SDK, and set the function timeout high enough to process an entire partition before returning.

Why it fails: Polling from a Function is possible but Functions have execution time limits, and processing a whole partition in one invocation risks timeout and uncommitted offsets. This design also does not naturally scale with partition count because each function instance would need coordination. It cannot reliably guarantee no message loss under failure.

OCI Identity and Access Management (IAM) dynamic groups

Why it fails: Dynamic groups grant OCI resource principals access to services; they do not validate inbound JWTs at the gateway. They are tempting because they are the standard OCI mechanism for authorising compute instances, and would be correct for letting a function call another OCI service without credentials.

Network Security Group (NSG) ingress rules on the API Gateway subnet

Why it fails: NSG ingress rules filter traffic by IP address and port at the network layer, so they cannot inspect or validate a JWT. They are tempting because NSGs genuinely restrict which clients reach the gateway, and would be correct for limiting access to known source CIDR ranges rather than authenticating token holders.

OCI Web Application Firewall (WAF) rate limiting rule

Why it fails: WAF rate limiting throttles request volume by source, but performs no JWT signature or claim validation, so unauthenticated requests still reach the backend. It is tempting because WAF does inspect HTTP traffic, and rate limiting is the right control when the requirement is blocking volumetric abuse rather than enforcing token-based authentication.