Troubleshooting practice questions

You are troubleshooting a cross-cloud connectivity issue between an OCI VCN and an Azure VNet via the OCI-Azure Interconnect. Traffic is dropping intermittently between the environments. Which THREE diagnostic steps or configuration checks should you perform?

Trap 1: Attach an Internet Gateway to the Azure VNet to route private…

Interconnect traffic is private and does not traverse an Internet Gateway.

Trap 2: Configure an OCI Local Peering Gateway to bridge the Azure and OCI…

Local Peering Gateways cannot connect to Azure VNets.

A
Inspect OCI VCN route tables and Azure route tables to ensure return paths are correctly specified.
Missing or incorrect route table rules will cause asymmetric routing or packet drops.
B
Attach an Internet Gateway to the Azure VNet to route private interconnect packets.
Why wrong: Interconnect traffic is private and does not traverse an Internet Gateway.
C
Configure an OCI Local Peering Gateway to bridge the Azure and OCI subnets.
Why wrong: Local Peering Gateways cannot connect to Azure VNets.
D
Verify that BGP status on both the OCI DRG and Azure Virtual Network Gateway is in the Established state.
A stable BGP session is mandatory for route exchange across the interconnect.
E
Check Network Security Groups (NSGs) in OCI and Network Security Groups in Azure for overly restrictive security rules.
Firewall rules or security lists/NSGs frequently block cross-network traffic if not explicitly permitted.

Question 2hardmulti select

An administrator is troubleshooting intermittent packet loss and latency spikes over an OCI FastConnect circuit connected to an on-premises datacenter. Which THREE diagnostic steps or tools are applicable within OCI? (Choose THREE)

Trap 1: Modifying the OCI tenancy tenancy home region to reroute physical…

Tenancy home regions cannot be changed, and region changes do not reroute physical fiber.

Trap 2: Rebooting the OCI IAM service to reset global routing tables.

OCI IAM manages authentication and has no impact on data-plane network routing.

A
Checking OCI Monitoring metrics for the FastConnect virtual circuit to review bandwidth utilization and error drops.
OCI Monitoring provides metrics on traffic volume, drops, and interface health.
B
Using OCI Network Path Analyzer to simulate packet paths and verify reachability between VCN instances and on-premises IPs.
Network Path Analyzer helps trace and diagnose routing and security rule issues.
C
Modifying the OCI tenancy tenancy home region to reroute physical fiber cables.
Why wrong: Tenancy home regions cannot be changed, and region changes do not reroute physical fiber.
D
Verifying BGP session status and logs on the DRG and on-premises routers to check for route flapping.
BGP route flapping causes intermittent connectivity and latency spikes.
E
Rebooting the OCI IAM service to reset global routing tables.
Why wrong: OCI IAM manages authentication and has no impact on data-plane network routing.

Read the full VPN explanation →

Question 3mediummultiple choice

You are troubleshooting an issue where an on-premises server cannot reach an OCI compute instance over an IPSec VPN tunnel. The VPN status in the OCI console shows 'Tunnel Up', but ping tests fail. What is the most likely cause?

Trap 1: The FastConnect virtual circuit is disabled.

FastConnect is a separate service from Site-to-Site VPN.

Trap 2: The OCI VCN does not have an Internet Gateway attached.

Hybrid traffic over VPN does not require an Internet Gateway; it uses the DRG.

Trap 3: The BGP ASN number is misconfigured on the OCI Dynamic Routing…

If BGP was misconfigured, the VPN tunnel status would not show as 'Up'.

A
Security Lists in the OCI VCN or Network Security Groups (NSGs) are blocking ICMP or traffic, or OS firewalls on the compute instance are dropping packets.
Even with a working VPN tunnel, OCI security rules and OS firewalls must permit the traffic.
B
The FastConnect virtual circuit is disabled.
Why wrong: FastConnect is a separate service from Site-to-Site VPN.
C
The OCI VCN does not have an Internet Gateway attached.
Why wrong: Hybrid traffic over VPN does not require an Internet Gateway; it uses the DRG.
D
The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.
Why wrong: If BGP was misconfigured, the VPN tunnel status would not show as 'Up'.

Question 4hardmulti select

You are troubleshooting performance bottlenecks in an event-driven architecture using OCI Streaming. Which THREE metrics or indicators should you monitor to detect consumer lag and partitioning issues?

Trap 1: OCI VCN Internet Gateway packet drop count due to BGP routing…

Incorrect. BGP routing failures affect site-to-site VPNs, not internal streaming consumer lag metrics.

Trap 2: OCI Object Storage bucket public download bandwidth

Incorrect. Object storage metrics are unrelated to streaming consumer lag.

A
OCI VCN Internet Gateway packet drop count due to BGP routing failures
Why wrong: Incorrect. BGP routing failures affect site-to-site VPNs, not internal streaming consumer lag metrics.
B
Consumer Lag (difference between latest message offset and consumer committed offset)
Correct. Consumer lag indicates how far behind consumers are processing messages.
C
Partition-level throughput (bytes/messages per second against stream limits)
Correct. Monitoring partition throughput prevents throttling when limits are exceeded.
D
GetMessages Latency
Correct. Monitoring read latency helps identify read performance issues.
E
OCI Object Storage bucket public download bandwidth
Why wrong: Incorrect. Object storage metrics are unrelated to streaming consumer lag.

Read the full DNS explanation →

Question 5hardmultiple choice

You are troubleshooting a microservice on OKE that is experiencing intermittent 502 Bad Gateway errors when communicating with another internal service. The application uses Kubernetes ClusterIP services for discovery. You suspect DNS resolution failure within the cluster. Which diagnostic tool and approach should you use inside the OKE cluster?

Trap 1: Check the OCI VCN internet gateway route table.

Incorrect. Internal pod-to-pod communication within a Kubernetes cluster uses internal cluster networking (CNI/kube-proxy), not the VCN internet gateway.

Trap 2: Review OCI Cloud Guard threat detection policies.

Incorrect. Cloud Guard does not debug in-cluster microservice DNS errors.

Trap 3: Restart the OCI API Gateway service.

Incorrect. Internal pod-to-pod ClusterIP traffic does not traverse API Gateway.

A
Check the OCI VCN internet gateway route table.
Why wrong: Incorrect. Internal pod-to-pod communication within a Kubernetes cluster uses internal cluster networking (CNI/kube-proxy), not the VCN internet gateway.
B
Deploy a temporary diagnostic container pod (such as netshoot) and test DNS resolution using nslookup against CoreDNS.
Correct. Using a diagnostic pod with networking tools allows direct testing of internal Kubernetes DNS and service endpoints.
C
Review OCI Cloud Guard threat detection policies.
Why wrong: Incorrect. Cloud Guard does not debug in-cluster microservice DNS errors.
D
Restart the OCI API Gateway service.
Why wrong: Incorrect. Internal pod-to-pod ClusterIP traffic does not traverse API Gateway.

Question 6mediummultiple choice

You are troubleshooting an OCI Functions application that fails to pull container images from a private Oracle Cloud Infrastructure Registry (OCIR) repository during deployment. The function application is configured correctly, but the build/invoke fails with authentication errors. What is the most likely missing configuration?

Trap 1: The OCI VCN Security List lacks an egress rule for port 22 to…

OCIR uses HTTPS (port 443), not SSH (port 22), and pulls images from OCIR, not GitHub.

Trap 2: The API Gateway deployment lacks a public IP address.

OCI Functions do not require API Gateway to pull images from OCIR during deployment or execution.

Trap 3: The OCI Vault master encryption key is disabled.

Vault encryption keys secure secrets at rest, but do not prevent OCIR image pulls unless custom customer-managed keys for registry encryption are misconfigured (which is rare and produces different errors).

A
The OCI VCN Security List lacks an egress rule for port 22 to connect to GitHub.
Why wrong: OCIR uses HTTPS (port 443), not SSH (port 22), and pulls images from OCIR, not GitHub.
B
Missing IAM policy granting the Functions service or dynamic group read access to the OCIR repository compartment.
OCI Functions require explicit IAM permissions (such as allowing dynamic groups to read repositories) to pull container images from private OCIR registries.
C
The API Gateway deployment lacks a public IP address.
Why wrong: OCI Functions do not require API Gateway to pull images from OCIR during deployment or execution.
D
The OCI Vault master encryption key is disabled.
Why wrong: Vault encryption keys secure secrets at rest, but do not prevent OCIR image pulls unless custom customer-managed keys for registry encryption are misconfigured (which is rare and produces different errors).

Question 7mediummultiple choice

An application architect is troubleshooting intermittent latency spikes in a distributed microservices application deployed across multiple OCI regions. Which OCI capability should be used to trace requests end-to-end across service boundaries?

Trap 1: OCI Network Visualizer

Incorrect. Network Visualizer provides a graphical representation of VCN resources and routing, not application transaction traces.

Trap 2: OCI Logging Analytics with out-of-the-box system parsers

Incorrect. Logging Analytics analyzes log lines, whereas cross-service distributed tracing requires APM trace spans and propagation headers.

Trap 3: OCI Monitoring service anomaly detection

Incorrect. Anomaly detection identifies statistical outliers in time-series metrics, not distributed transaction flows.

A
OCI Application Performance Monitoring (APM) Distributed Tracing
Correct. APM Distributed Tracing tracks transactions across microservices and regions using trace context propagation.
B
OCI Network Visualizer
Why wrong: Incorrect. Network Visualizer provides a graphical representation of VCN resources and routing, not application transaction traces.
C
OCI Logging Analytics with out-of-the-box system parsers
Why wrong: Incorrect. Logging Analytics analyzes log lines, whereas cross-service distributed tracing requires APM trace spans and propagation headers.
D
OCI Monitoring service anomaly detection
Why wrong: Incorrect. Anomaly detection identifies statistical outliers in time-series metrics, not distributed transaction flows.

Review the full subnetting walkthrough →

Question 8hardmultiple choice

You are troubleshooting a networking issue where virtual machines in a private subnet cannot communicate with an external endpoint over the internet. You suspect security lists or network security groups might be dropping the packets. Which OCI observability feature can help verify whether packets are being accepted or rejected at the VNIC level?

Trap 1: OCI Health Checks ping monitors

Incorrect. Health Checks test external endpoint reachability, not internal VNIC packet disposition.

Trap 2: OCI Monitoring service VNIC packet counters

Incorrect. Monitoring provides aggregate throughput metrics for VNICs, not per-packet accept/reject flow log analysis.

Trap 3: OCI Network Firewall system logs

Incorrect. Network Firewall logs apply when using the managed firewall service, but standard VCN VNIC traffic visibility is captured by VCN Flow Logs.

A
OCI Health Checks ping monitors
Why wrong: Incorrect. Health Checks test external endpoint reachability, not internal VNIC packet disposition.
B
OCI VCN Flow Logs
Correct. VCN Flow Logs capture metadata about traffic flowing to and from VNICs, including whether packets were accepted or rejected.
C
OCI Monitoring service VNIC packet counters
Why wrong: Incorrect. Monitoring provides aggregate throughput metrics for VNICs, not per-packet accept/reject flow log analysis.
D
OCI Network Firewall system logs
Why wrong: Incorrect. Network Firewall logs apply when using the managed firewall service, but standard VCN VNIC traffic visibility is captured by VCN Flow Logs.

Read the full DNS explanation →

Question 9easymulti select

During a migration cutover weekend, your team encounters unexpected DNS resolution failures preventing users from reaching the newly migrated OCI application endpoints. Which TWO immediate troubleshooting steps should you perform? (Choose two.)

Trap 1: Change the tenant subscription currency from USD to EUR.

Billing currency settings do not affect DNS record resolution.

Trap 2: Reformat all backend database tables using SQL*Plus.

Reformatting database tables has no relation to solving DNS resolution failures.

Trap 3: Delete all OCI compartments and recreate the tenancy root structure.

Deleting compartments causes catastrophic data loss and does not troubleshoot DNS.

A
Check OCI VCN DNS resolver settings and custom resolver forwarders if integrating with on-premises DNS.
VCN resolver configuration ensures internal and hybrid DNS queries route correctly to private endpoints.
B
Verify that public DNS records (A and CNAME) have been updated with the correct OCI Load Balancer IP addresses and check TTL settings.
Checking DNS records and TTL ensures clients are querying the updated OCI endpoint rather than cached old IPs.
C
Change the tenant subscription currency from USD to EUR.
Why wrong: Billing currency settings do not affect DNS record resolution.
D
Reformat all backend database tables using SQL*Plus.
Why wrong: Reformatting database tables has no relation to solving DNS resolution failures.
E
Delete all OCI compartments and recreate the tenancy root structure.
Why wrong: Deleting compartments causes catastrophic data loss and does not troubleshoot DNS.

Question 10hardmultiple choice

Your engineering team is troubleshooting an issue where migrated Linux virtual machines in OCI are experiencing severe disk I/O performance bottlenecks. The instances were migrated using raw block-level cloning from on-premises SAN storage. The volumes in OCI are provisioned as Lower Cost (Balanced) block volumes. What action should you take to resolve the performance bottleneck while maintaining data integrity?

Trap 1: Format the attached block volumes with ext3 file systems instead of…

ext3 is an older file system and will not improve block-level I/O throughput provided by the storage layer.

Trap 2: Recreate the virtual machines using denser AMD compute shapes with…

While local NVMe offers high performance, local NVMe is ephemeral and data does not persist across reboots, making it unsuitable for persistent OS/data disks without application-level replication.

Trap 3: Attach an OCI File Storage Service (FSS) mount target as the…

FSS is designed for shared file storage (NFS), not as a high-performance root operating system boot volume for Linux VMs.

A
Format the attached block volumes with ext3 file systems instead of ext4.
Why wrong: ext3 is an older file system and will not improve block-level I/O throughput provided by the storage layer.
B
Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.
Why wrong: While local NVMe offers high performance, local NVMe is ephemeral and data does not persist across reboots, making it unsuitable for persistent OS/data disks without application-level replication.
C
Modify the OCI block volume performance tier or increase the assigned Volume Performance Units (VPUs) per GB.
Increasing VPUs or changing performance tiers dynamically scales IOPS and throughput to match workload requirements.
D
Attach an OCI File Storage Service (FSS) mount target as the primary root volume.
Why wrong: FSS is designed for shared file storage (NFS), not as a high-performance root operating system boot volume for Linux VMs.