Troubleshooting practice questions

You are troubleshooting a performance issue on an OCI compute instance. You suspect that the instance is experiencing CPU throttling due to credits being exhausted. Which compute shape type are you most likely using?

Trap 1: HPC (High-Performance Computing) Shape

HPC shapes are optimized for tightly coupled MPI workloads with dedicated cores, not burstable CPU credits.

Trap 2: Bare Metal Standard Shape

Bare metal shapes dedicate the entire physical hardware and do not use burstable CPU credits.

Trap 3: GPU Shape

GPU shapes are designed for graphics and parallel compute acceleration without burstable credit limits.

A
HPC (High-Performance Computing) Shape
Why wrong: HPC shapes are optimized for tightly coupled MPI workloads with dedicated cores, not burstable CPU credits.
B
Standard AMD Flexible Shape with baseline OCPU performance enabled
Burstable instances use CPU credits to allow temporary bursting above baseline, which can lead to throttling if credits run out.
C
Bare Metal Standard Shape
Why wrong: Bare metal shapes dedicate the entire physical hardware and do not use burstable CPU credits.
D
GPU Shape
Why wrong: GPU shapes are designed for graphics and parallel compute acceleration without burstable credit limits.

Question 2hardmultiple choice

You are troubleshooting a custom OCI compute image that fails to boot properly after launching an instance. The instance gets stuck in a pre-boot state. Where can you view serial console logs to diagnose the low-level boot sequence and kernel panic messages?

Trap 1: Object Storage boot bucket logs

Boot volumes do not output text logs directly to storage buckets during boot.

Trap 2: OCI Logging service via custom log agents

Logging agents require the operating system to boot successfully and run the agent daemon.

Trap 3: OCI Monitoring service under instance metrics

Monitoring service tracks metrics like CPU and network utilization, not boot console text.

A
Object Storage boot bucket logs
Why wrong: Boot volumes do not output text logs directly to storage buckets during boot.
B
OCI Logging service via custom log agents
Why wrong: Logging agents require the operating system to boot successfully and run the agent daemon.
C
OCI Compute Instance Serial Console connection
Serial console connections provide direct text-based access to the instance's console output during boot.
D
OCI Monitoring service under instance metrics
Why wrong: Monitoring service tracks metrics like CPU and network utilization, not boot console text.

Question 3mediummultiple choice

You are troubleshooting a function timeout in OCI Functions. You notice that the function takes 30 seconds to initialize database connections on every cold start. How can you optimize this initialization overhead?

Trap 1: Enable instance pool autoscaling on the function application.

OCI Functions manage their own scaling automatically and do not use compute instance pools.

Trap 2: Increase the function memory allocation to 32 GB.

While memory increases CPU allocation, connection establishment logic should be placed in global scope rather than inside the handler.

Trap 3: Migrate the function container to an OKE cluster DaemonSet.

Migrating to Kubernetes is an architectural overcomplication compared to optimizing code scope.

A
Enable instance pool autoscaling on the function application.
Why wrong: OCI Functions manage their own scaling automatically and do not use compute instance pools.
B
Place the database connection initialization code outside the main function handler method so it executes during container warm start.
Global scope initialization runs once when the container spins up (cold start) and is reused for subsequent invocations (warm starts).
C
Increase the function memory allocation to 32 GB.
Why wrong: While memory increases CPU allocation, connection establishment logic should be placed in global scope rather than inside the handler.
D
Migrate the function container to an OKE cluster DaemonSet.
Why wrong: Migrating to Kubernetes is an architectural overcomplication compared to optimizing code scope.

Question 4mediummultiple choice

You are troubleshooting a deployment failure in Resource Manager. Where can you see the detailed Terraform output logs?

Trap 1: Events logs

Events do not contain job-specific output.

Trap 2: Audit logs

Audit logs only show API calls, not job output.

Trap 3: Cloud Shell logs

Cloud Shell logs are local to the session.

A
Events logs
Why wrong: Events do not contain job-specific output.
B
Job logs
The Job execution logs contain the complete Terraform output.
C
Audit logs
Why wrong: Audit logs only show API calls, not job output.
D
Cloud Shell logs
Why wrong: Cloud Shell logs are local to the session.

Question 5hardmultiple choice

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Trap 1: The user's password in OCI IAM has expired and must be reset.

Federated users do not have local OCI passwords; authentication is entirely managed by the external IdP.

Trap 2: The API signing key of the IdP metadata XML file needs to be…

Metadata certificates have multi-year validity and do not need daily rotation.

Trap 3: OCI requires manual creation of local user profiles for every…

Just-in-time (JIT) user provisioning or federated mapping handles user creation dynamically upon successful SSO.

A
The user's password in OCI IAM has expired and must be reset.
Why wrong: Federated users do not have local OCI passwords; authentication is entirely managed by the external IdP.
B
The API signing key of the IdP metadata XML file needs to be rotated daily.
Why wrong: Metadata certificates have multi-year validity and do not need daily rotation.
C
OCI requires manual creation of local user profiles for every federated login attempt.
Why wrong: Just-in-time (JIT) user provisioning or federated mapping handles user creation dynamically upon successful SSO.
D
The group mapping rule in the OCI Identity Provider configuration does not match the incoming group claim in the SAML assertion.
OCI requires explicit group mapping rules that match the exact group name or attribute assertion sent by the external IdP.

Review the full subnetting walkthrough →

Question 6mediummultiple choice

You are troubleshooting a connection issue to an OCI Compute instance behind a public Load Balancer. The security list for the load balancer allows traffic on port 443, but clients receive a connection timeout. Upon checking the backend instances, you notice their security lists do not allow incoming traffic from the load balancer subnet. What is the best practice fix?

Trap 1: Configure a NAT Gateway on the load balancer subnet.

NAT Gateways manage outbound traffic, whereas the issue is incoming traffic reaching the backend.

Trap 2: Change the load balancer shape from Flexible to 100 Mbps.

Changing the load balancer shape does not fix missing security rules on backend instances.

Trap 3: Attach an Internet Gateway to the backend subnet route table.

Backend subnets for load balancers should remain private and do not need Internet Gateways.

A
Configure a NAT Gateway on the load balancer subnet.
Why wrong: NAT Gateways manage outbound traffic, whereas the issue is incoming traffic reaching the backend.
B
Change the load balancer shape from Flexible to 100 Mbps.
Why wrong: Changing the load balancer shape does not fix missing security rules on backend instances.
C
Attach an Internet Gateway to the backend subnet route table.
Why wrong: Backend subnets for load balancers should remain private and do not need Internet Gateways.
D
Add a security rule in the backend subnet to allow traffic from the Load Balancer subnet CIDR on the application port.
Backend instances need security rules permitting ingress traffic from the load balancer's IP range or subnet.

Question 7mediummultiple choice

You are troubleshooting a web application where users are reporting intermittent connection failures when accessing your OCI Public Load Balancer. You check the load balancer metrics and notice that the `DroppedConnections` metric is spiking. What is the most likely cause?

Trap 1: The NAT Gateway is misconfigured.

NAT Gateways do not process incoming load balancer connections.

Trap 2: The VCN route table is missing a default route.

A missing route would cause complete connection failure, not spiking dropped connection metrics under load.

Trap 3: The DNS record has an incorrect TTL.

DNS TTL affects caching, not active TCP connection drops on the load balancer.

A
The load balancer has reached its maximum bandwidth or connection rate limit, or backend instances are overwhelmed.
Reaching bandwidth or connection limits causes the load balancer to drop incoming connections.
B
The NAT Gateway is misconfigured.
Why wrong: NAT Gateways do not process incoming load balancer connections.
C
The VCN route table is missing a default route.
Why wrong: A missing route would cause complete connection failure, not spiking dropped connection metrics under load.
D
The DNS record has an incorrect TTL.
Why wrong: DNS TTL affects caching, not active TCP connection drops on the load balancer.

Question 8hardmultiple choice

You are troubleshooting an issue where an application cannot access an OCI Object Storage bucket. The IAM policies are verified as correct, and the object storage endpoint is reachable. However, the client receives HTTP 403 Forbidden errors when attempting to perform a GET request. The bucket is private. What could be causing this?

Trap 1: The VCN lacks an Internet Gateway, and traffic is attempting to go…

Access to Object Storage via a Service Gateway bypasses the internet, but lack of an IGW wouldn't cause 403s if internal routing is correct.

Trap 2: The bucket name is not globally unique within the tenancy.

OCI prevents duplicate bucket names within a namespace, so creation would fail rather than yielding a runtime 403 on GET.

Trap 3: The Object Storage bucket is configured in the Infrequent Access…

Tiering affects retrieval pricing and time, not access authorization resulting in 403 errors.

A
The VCN lacks an Internet Gateway, and traffic is attempting to go over the public internet.
Why wrong: Access to Object Storage via a Service Gateway bypasses the internet, but lack of an IGW wouldn't cause 403s if internal routing is correct.
B
The OCI KMS master encryption key associated with the bucket has been disabled or scheduled for deletion.
If the encryption key protecting the bucket's objects is disabled, read and write operations will fail with authorization or forbidden errors.
C
The bucket name is not globally unique within the tenancy.
Why wrong: OCI prevents duplicate bucket names within a namespace, so creation would fail rather than yielding a runtime 403 on GET.
D
The Object Storage bucket is configured in the Infrequent Access tier instead of Standard.
Why wrong: Tiering affects retrieval pricing and time, not access authorization resulting in 403 errors.

Question 9hardmultiple choice

You are troubleshooting a container image pull failure in your OKE cluster. The error message indicates an authentication failure when trying to pull from the Oracle Container Registry (OCIR). What Kubernetes resource must be configured in your cluster namespace to allow pulling images from a private OCIR repository?

Trap 1: An OCI IAM Dynamic Group attached to the VCN security list.

IAM dynamic groups do not authenticate Kubernetes container image pulls.

Trap 2: A Persistent Volume Claim attached to the registry endpoint.

PVCs provide storage volumes, not registry authentication.

Trap 3: An API Gateway route rule with public auth bypass headers.

API Gateway does not authenticate Kubernetes node image pulls.

A
An OCI IAM Dynamic Group attached to the VCN security list.
Why wrong: IAM dynamic groups do not authenticate Kubernetes container image pulls.
B
A Persistent Volume Claim attached to the registry endpoint.
Why wrong: PVCs provide storage volumes, not registry authentication.
C
An API Gateway route rule with public auth bypass headers.
Why wrong: API Gateway does not authenticate Kubernetes node image pulls.
D
A Kubernetes Secret of type `dockerconfigjson` referenced via `imagePullSecrets` in the pod spec.
Docker registry secrets provide Kubernetes pods with credentials to authenticate against private registries like OCIR.

Question 10hardmultiple choice

You are troubleshooting a slow-running query on an Exadata Cloud Service database. You suspect that smart scan is not being utilized by the storage cells. Which Exadata feature enables offloading SQL processing operations like filtering and projections directly to the storage servers?

Trap 1: Oracle Database In-Memory Column Store

In-Memory stores data in compressed columnar format in the database node memory, not on storage cells.

Trap 2: Hybrid Columnar Compression (HCC)

HCC compresses data to save space and reduce I/O bandwidth, whereas Smart Scan performs the actual offloaded processing.

Trap 3: Automatic Storage Management (ASM) Mirroring

ASM mirroring provides data redundancy across disks, not query offloading.

A
Oracle Database In-Memory Column Store
Why wrong: In-Memory stores data in compressed columnar format in the database node memory, not on storage cells.
B
Exadata Smart Scan (Storage Offload)
Smart Scan offloads query filtering and processing to the Exadata storage servers.
C
Hybrid Columnar Compression (HCC)
Why wrong: HCC compresses data to save space and reduce I/O bandwidth, whereas Smart Scan performs the actual offloaded processing.
D
Automatic Storage Management (ASM) Mirroring
Why wrong: ASM mirroring provides data redundancy across disks, not query offloading.

Question 11hardmultiple choice

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

Trap 1: Explicit deny statements always take precedence over allow…

OCI IAM policy grammar does not support 'deny' statements; all policies are 'allow' rules.

Trap 2: Compartment-level policies take strict precedence, overriding and…

Compartment policies do not override tenancy root policies; policies from both levels accumulate additively.

Trap 3: The most recently created policy overrides all older conflicting…

Policy creation order has no impact on evaluation precedence.

A
OCI policies are additive; if any applicable policy grants access, the user is authorized.
OCI IAM uses an additive evaluation model where permissions from all applicable policies accumulate; there are no explicit denies.
B
Explicit deny statements always take precedence over allow statements.
Why wrong: OCI IAM policy grammar does not support 'deny' statements; all policies are 'allow' rules.
C
Compartment-level policies take strict precedence, overriding and nullifying tenancy root policies.
Why wrong: Compartment policies do not override tenancy root policies; policies from both levels accumulate additively.
D
The most recently created policy overrides all older conflicting policies.
Why wrong: Policy creation order has no impact on evaluation precedence.

Question 12mediummultiple choice

You are troubleshooting a web application where users intermittently experience 504 Gateway Timeout errors when connecting via the OCI Public Load Balancer. What is the most common cause related to the load balancer or backend configuration?

Trap 1: The Internet Gateway has exceeded its bandwidth limit.

Internet Gateways scale automatically and do not generate 504 gateway timeouts.

Trap 2: The NAT Gateway is blocking incoming HTTP traffic.

NAT Gateways do not handle inbound load balancer traffic.

Trap 3: The VCN route table is missing a default route.

A missing default route would result in complete connection failure, not intermittent timeouts.

A
The Internet Gateway has exceeded its bandwidth limit.
Why wrong: Internet Gateways scale automatically and do not generate 504 gateway timeouts.
B
The NAT Gateway is blocking incoming HTTP traffic.
Why wrong: NAT Gateways do not handle inbound load balancer traffic.
C
The VCN route table is missing a default route.
Why wrong: A missing default route would result in complete connection failure, not intermittent timeouts.
D
Backend servers are taking longer to process requests than the load balancer idle timeout threshold.
Slow backend responses exceeding the timeout cause the load balancer to return a 504 error.

Read the full VPN explanation →

Question 13hardmultiple choice

You are troubleshooting a connectivity issue where an on-premises server is trying to reach an OCI compute instance via an IPsec VPN attached to a Dynamic Routing Gateway (DRG). The VPN tunnels are up, but traffic is dropped. Upon checking the VCN route table, you see a route pointing to the DRG, but the on-premises subnet CIDR is missing. What specific OCI construct must be updated to ensure return traffic from the VCN successfully routes back to the on-premises network?

Trap 1: The Security List must have a stateful egress rule allowing all…

OCI security lists are stateful by default for egress, but routing requires explicit route table entries, not security list changes.

Trap 2: The Local Peering Gateway route table must map the on-premises…

LPGs are for VCN-to-VCN peering, not IPsec VPN connections.

Trap 3: The NAT Gateway route table must be updated with the on-premises…

VPN traffic does not traverse a NAT Gateway; it goes through the DRG.

A
The Security List must have a stateful egress rule allowing all protocols to the internet.
Why wrong: OCI security lists are stateful by default for egress, but routing requires explicit route table entries, not security list changes.
B
The Local Peering Gateway route table must map the on-premises subnet.
Why wrong: LPGs are for VCN-to-VCN peering, not IPsec VPN connections.
C
The NAT Gateway route table must be updated with the on-premises CIDR.
Why wrong: VPN traffic does not traverse a NAT Gateway; it goes through the DRG.
D
The VCN Route Table associated with the subnet must include a route rule with the destination as the on-premises CIDR and the target as the DRG.
Subnet route tables dictate how outbound and return traffic within the VCN is directed to gateways like the DRG.

Review the full subnetting walkthrough →

Question 14mediummultiple choice

You are troubleshooting a connection to a database instance in a private subnet. You need to verify if security list rules are blocking incoming traffic to port 1521. Which tool in OCI can you use to test reachability between an application instance and the database instance?

Trap 1: NAT Gateway packet tracer

NAT Gateways do not have a packet tracer utility.

Trap 2: OCI Load Balancer health check

Load balancer health checks only probe backend sets attached to the load balancer.

Trap 3: Service Gateway connectivity tester

Service Gateways route to Oracle services and do not provide a path analyzer tool.

A
NAT Gateway packet tracer
Why wrong: NAT Gateways do not have a packet tracer utility.
B
OCI Network Path Analyzer
Network Path Analyzer simulates packet traversal and checks security lists and route tables for reachability issues.
C
OCI Load Balancer health check
Why wrong: Load balancer health checks only probe backend sets attached to the load balancer.
D
Service Gateway connectivity tester
Why wrong: Service Gateways route to Oracle services and do not provide a path analyzer tool.