Hard Difficulty Questions

Dynamic Routing Gateway

Why wrong: A DRG connects VCNs to on-premises networks or other VCNs, but does not manage administrative login sessions.

NAT Gateway

Why wrong: A NAT Gateway allows internal private instances to initiate outbound connections to the internet, not inbound administrative access.

Site-to-Site VPN

Why wrong: While a VPN provides private connectivity, it connects an entire corporate network rather than providing on-demand administrator access.

OCI Resource Manager Terraform syntax checker.

Why wrong: Resource Manager checks Terraform files, not standalone OCI IAM policy syntax outside of TF.

OCI Audit log analysis.

Why wrong: Audit logs record past events; they do not validate prospective policy syntax.

OCI Cloud Guard policy rules.

Why wrong: Cloud Guard scans security posture, not IAM policy syntax.

Deploy instances across three Fault Domains in a single Availability Domain with automated compute health checks.

Why wrong: A single AD deployment does not protect against a regional disaster event affecting the entire geographic area.

Backup daily block volumes to Object Storage and restore them in a secondary region upon disaster declaration.

Why wrong: This backup and restore approach results in a high RPO (hours) and high RTO (hours), failing to meet the requirement.

Deploy an active-passive architecture across two OCI regions using asynchronous database replication and manual DNS failover.

Why wrong: Asynchronous replication introduces a measurable RPO, and manual DNS failover increases the RTO beyond seconds.

IAM policies cannot be restricted by region; they always apply globally.

Why wrong: IAM policies can be conditioned using request variables like request.region and request.ip.

Use the condition 'where target.region.home = true'

Why wrong: Target region variables in OCI do not support a '.home' property suffix.

Use the condition 'where principal.region = home'

Why wrong: Principal region syntax is incorrect; context variables use the 'request.' prefix for request-time evaluations.

The user can still log into OCI using local OCI IAM password credentials.

Why wrong: Federated users do not have local OCI passwords unless explicitly configured with dual-identity, which is a security anti-pattern.

OCI will prompt the user to reset their OCI password.

Why wrong: Federated accounts do not manage passwords inside OCI.

The user retains access until their active OCI API signing key expires.

Why wrong: Federated console and session access is governed by the SAML token lifecycle, which cannot be established if the IdP rejects the user.

Descriptions are only mandatory when using the CLI, but optional in the Console.

Why wrong: The validation requirement applies across all OCI interaction interfaces (Console, CLI, SDK, API).

Only if the policy is created at the tenancy root level.

Why wrong: Descriptions are mandatory regardless of whether the policy is created at the root tenancy level or inside a compartment.

No, the description is entirely optional and can be left blank.

Why wrong: Leaving the description blank is not permitted by the OCI Console or API validation rules for policies.

Availability domains are isolated from each other and cannot communicate directly over the network.

Why wrong: They are connected via high-speed networks.

Communication between availability domains must route through the public internet.

Why wrong: Inter-AD traffic stays within the private OCI backbone network.

Availability domains share the same physical power infrastructure to ensure identical latency.

Why wrong: They have independent power, cooling, and physical security.

OCI evaluates policies alphabetically and applies the first matching statement.

Why wrong: OCI does not evaluate policies alphabetically; all applicable matching allow statements are evaluated additively.

Root tenancy policies are automatically disabled if any child compartment policy exists.

Why wrong: Root policies remain fully active regardless of child compartment policies.

Child compartment policies take precedence and override parent compartment policies.

Why wrong: Child policies add permissions; they do not override or restrict broader parent grants.

OCI FastConnect

Why wrong: FastConnect is a dedicated network connectivity service, not a cloud deployment model.

OCI VPN Connect

Why wrong: VPN Connect is a secure connection service, not a deployment model.

OCI Public Cloud Region

Why wrong: Public cloud regions are managed by Oracle in Oracle data centers.

Allow user UserAdmins to inspect compartments in tenancy

Why wrong: Groups, not individual users, are the target of OCI IAM policies, and 'inspect compartments' does not grant user management permissions.

Allow group UserAdmins to manage all-resources in tenancy

Why wrong: This would grant full access to all infrastructure resources, violating the principle of least privilege.

Allow group UserAdmins to manage users in tenancy

Why wrong: User and group management in OCI identity falls under the identity-domains or general tenancy-level identity verbs depending on IAM configuration, but 'manage identity-domains' is the standard OCI IAM construct.

Share tenancy root administrative credentials among all team members.

Why wrong: Sharing root credentials is a severe security violation; individual accounts and least-privilege groups must be used.

Write all IAM policies at the root tenancy level to avoid managing multiple policies.

Why wrong: Writing all policies at the root violates least privilege and centralizes administrative complexity unnecessarily.

Store backups in multiple Fault Domains within the same Availability Domain.

Why wrong: Fault domains within the same AD are in the same building and do not satisfy the 500-mile geographic separation requirement.

Export backups via OCI CLI and transfer them manually using external hard drives shipped via courier.

Why wrong: Courier transfers are inefficient and prone to operational delays compared to automated cloud replication.

Upload backups to a public cloud storage bucket over an encrypted IPsec VPN tunnel spanning the public internet.

Why wrong: This traverses the public internet, which violates the requirement to avoid the public internet.

Dynamic group names are case-insensitive in rules but case-sensitive in IAM policies, causing a mismatch.

Why wrong: The primary reason permissions fail when a group is created is the complete absence of the associated policy statement.

The instances must be terminated and relaunched for dynamic group membership to evaluate.

Why wrong: Dynamic group membership evaluates automatically without requiring instance termination.

Dynamic groups cannot be used in IAM policies; only user groups can.

Why wrong: Dynamic groups are fully supported as principals in OCI IAM policies.

Defined tags replace IAM policies entirely for access control.

Why wrong: TBAC enhances IAM policies with conditions; it does not replace IAM policies or user groups.

Defined tags can only be created as free-form strings without any governance.

Why wrong: Defined tags are strictly governed with controlled keys and value types, unlike free-form tags.

OCI Hybrid Cloud via VPN Connect.

Why wrong: VPN Connect securely connects on-premises networks to public cloud regions over the internet.

OCI FastConnect with a dedicated private circuit.

Why wrong: FastConnect provides private network connectivity to the public cloud, but does not provide an isolated cloud data center on-premises.

OCI Public Cloud with a dedicated Virtual Cloud Network (VCN).

Why wrong: A VCN in the public cloud shares multi-tenant underlying infrastructure and internet-connected control planes.

OCI Resource Manager

Why wrong: Resource Manager is a service for infrastructure-as-code, not a deployment model.

OCI Data Catalog

Why wrong: Data Catalog is a metadata management service, not a distributed cloud model.

Oracle Autonomous Database on Dedicated Exadata Infrastructure in the Public Cloud

Why wrong: This is hosted in Oracle's public cloud data centers, not on-premises as requested.

OCI Exadata Cloud@Customer

Why wrong: Exadata Cloud@Customer provides Oracle Database and specific infrastructure services on-premises, but not the complete portfolio of all OCI public cloud services.

OCI Compute Cloud@Customer

Why wrong: Compute Cloud@Customer provides rack-scale cloud infrastructure for running virtualized workloads on-premises, but lacks the full scope of all OCI public cloud services found in a Dedicated Region.

By replicating all public cloud control plane services locally onto every customer node.

Why wrong: The full control plane is not duplicated locally; rather, local infrastructure is managed via secure cloud control plane channels.

By requiring manual exports of cloud templates and uploading them via Secure Shell (SSH) daily.

Why wrong: Management is automated via OCI consoles and APIs, not manual daily file transfers.

By converting the on-premises rack into a public OCI Region accessible via the public internet.

Why wrong: Compute Cloud@Customer is installed in a private data center, not exposed as a public multi-tenant region.

Elimination of all software licensing costs for third-party operating systems.

Why wrong: Third-party OS and software licensing costs still apply based on customer usage.

Requiring the customer's internal IT staff to manually patch the underlying hypervisors and control plane.

Why wrong: Oracle manages the underlying infrastructure and control plane maintenance as part of the service.

Only when the instance is stopped and restarted.

Why wrong: Dynamic membership evaluation is automatic and does not require an instance reboot.

Dynamic group membership is static and never updates after initial creation.

Why wrong: Dynamic groups are specifically designed to update automatically as resources match or stop matching the rule.

Exactly every 24 hours during the daily IAM sync cycle.

Why wrong: Dynamic group matching does not wait 24 hours; it updates much faster.