Troubleshooting practice questions

Check the OCI VCN internet gateway route table.

Why it fails: An internet gateway route table governs egress to public endpoints, not in-cluster ClusterIP DNS resolution, so it cannot reveal why service names fail to resolve. It is tempting because VCN routing underpins OKE networking, but ClusterIP traffic stays internal and never traverses that gateway.

Review OCI Cloud Guard threat detection policies.

Why it fails: Cloud Guard detects misconfigurations and threats across OCI tenancies; it does not resolve in-cluster DNS queries or surface CoreDNS failures. It is tempting because it is a security diagnostic service, but intermittent 502s from name resolution require querying CoreDNS directly from a pod.

Restart the OCI API Gateway service.

Why it fails: OCI API Gateway fronts external HTTP traffic into the cluster; restarting it cannot fix internal ClusterIP DNS lookups between pods. It is tempting because 502 errors often implicate gateways, but the failing path here is service-name resolution inside the cluster, not the ingress tier.

The FastConnect virtual circuit is disabled.

Why it fails: FastConnect is a separate private dedicated-circuit service; disabling its virtual circuit does not affect an IPSec tunnel that already reports Tunnel Up. It is tempting because FastConnect also links on-premises networks to OCI, and would be the correct focus if connectivity ran over a dedicated private circuit rather than a VPN.

The OCI VCN does not have an Internet Gateway attached.

Why it fails: An Internet Gateway carries traffic between a VCN and the public internet, not traffic arriving over an IPSec tunnel from on-premises. It is tempting because missing gateway routes commonly break connectivity; it would be correct if the instance needed outbound internet access rather than reaching the on-premises server.

The BGP ASN number is misconfigured on the OCI Dynamic Routing Gateway.

Why it fails: A wrong BGP ASN would prevent route exchange and typically leave the tunnel down or without learned routes, contradicting the reported Tunnel Up state. It is tempting because BGP misconfiguration genuinely breaks dynamic routing; it would be the correct answer if the tunnel showed Down or no routes were advertised.

Change the tenant subscription currency from USD to EUR.

Why it fails: Changing tenant subscription currency is a billing operation and has no effect on DNS query resolution or endpoint reachability. It is tempting because tenancy-level settings are sometimes misconfigured during migrations, so administrators may suspect account configuration. The actual fault lies in DNS records, resolvers or network security lists, which must be inspected instead.

Reformat all backend database tables using SQL*Plus.

Why it fails: Reformatting database tables alters data structures and cannot resolve name resolution failures; DNS problems require checking the VCN resolver, DNS zones and security rules. It is tempting because post-migration data corruption is a real concern, and SQL*Plus is a genuine OCI database administration tool, but it addresses a different failure domain entirely.

Delete all OCI compartments and recreate the tenancy root structure.

Why it fails: Deleting compartments and rebuilding the tenancy root destroys resources and cannot restore name resolution; it would worsen the outage. It is tempting because compartment misconfiguration can cause access failures, so rebuilding structure appears to reset state. DNS troubleshooting instead requires verifying resolver settings, zone records and endpoint addresses.

OCI Health Checks ping monitors

Why it fails: Health Checks ping monitors test reachability from external vantage points to a public IP, so they cannot inspect packets at the VNIC or reveal security list or network security group verdicts. They are tempting for confirming endpoint availability, and would be correct when validating whether a public-facing service responds from outside OCI.

OCI Monitoring service VNIC packet counters

Why it fails: VNIC packet counters report aggregate byte and packet totals, not per-packet accept or reject verdicts against security lists or network security groups, so they cannot confirm which rule dropped traffic. They are tempting for spotting traffic volume anomalies, and would be correct when confirming whether traffic reached a VNIC at all.

OCI Network Firewall system logs

Why it fails: Network Firewall system logs record traffic handled by the firewall itself, not verdicts from security lists or network security groups applied at the VNIC, so they cannot confirm those rules dropped packets. They are tempting because they show allow and deny decisions, and would be correct when troubleshooting firewall policy on a subnet.

Format the attached block volumes with ext3 file systems instead of ext4.

Why it fails: Reformatting to ext3 changes only the filesystem metadata journaling mode; it cannot raise the provisioned IOPS or throughput ceiling of a Lower Cost (Balanced) block volume, so the bottleneck persists. Ext3 is tempting when migrating legacy Linux workloads that require its journaling format, but the fix here is moving to a Higher Performance volume.

Recreate the virtual machines using denser AMD compute shapes with local NVMe storage.

Why it fails: Local NVMe on denser AMD shapes gives high IOPS but is ephemeral, so data is lost on instance stop or termination, violating the data-integrity requirement. Local NVMe suits stateless or replicated workloads tolerating instance loss, not persistent migrated volumes.

Attach an OCI File Storage Service (FSS) mount target as the primary root volume.

Why it fails: File Storage Service provides a shared NFS mount, not a bootable block volume, so it cannot serve as a root volume and adds network latency rather than resolving I/O contention. FSS suits shared file access across multiple instances, not replacing a performance-limited block volume.

The OCI VCN Security List lacks an egress rule for port 22 to connect to GitHub.

Why it fails: OCIR pulls authenticate against Oracle Cloud Infrastructure Registry endpoints over HTTPS on port 443, so a port 22 egress rule to GitHub cannot resolve the authentication failure. It is tempting because egress rules do govern outbound connectivity, but this option would be correct only if the function needed SSH access to an external Git host.

The API Gateway deployment lacks a public IP address.

Why it fails: API Gateway public IP addressing governs inbound client access to published APIs, not the outbound authentication OCI Functions performs against OCIR. It is tempting because gateway misconfiguration produces deployment-adjacent errors, but this option would be correct only where external consumers could not reach an API route.

The OCI Vault master encryption key is disabled.

Why it fails: A disabled Vault master encryption key affects decryption of Vault-managed secrets, not the credential used to authenticate to OCIR, so the image pull still fails. It is tempting because Vault keys underpin many OCI security controls, but this option would be correct only where the failure involved reading encrypted secret material.

OCI Network Visualizer

Why it fails: Network Visualizer maps VCN topology, security rules and reachability; it shows no per-request path across microservices. It tempts because it visualises connectivity, and it is correct when diagnosing network-level reachability or misconfigured security lists between subnets.

OCI Logging Analytics with out-of-the-box system parsers

Why it fails: Logging Analytics parses and indexes log records; it cannot stitch a request's spans across service boundaries into one trace. It tempts because it aggregates telemetry centrally, and it is correct when correlating log events for root-cause analysis rather than distributed tracing.

OCI Monitoring service anomaly detection

Why it fails: Monitoring anomaly detection flags deviations in aggregated metrics such as latency, but it cannot follow an individual request across service boundaries. It tempts because it surfaces latency spikes, and it is correct when alerting on abnormal resource or service metrics rather than tracing.