CCNA Deploying and Managing Generative AI on OCI Questions

Why this answer

How to eliminate wrong answers

Option B is wrong because an incorrect compartment ID would produce a different error (e.g., 'compartment not found' or 'not authorized for compartment'), not a permission error on the artifact. Option C is wrong because a corrupted artifact would cause a validation or extraction failure during model loading, not an access-denied error at the storage retrieval stage. Option D is wrong because an invalid dedicated AI cluster ID would result in a cluster-not-found or capacity error, not a permission error on Object Storage.

Why this answer

How to eliminate wrong answers

Option A is wrong because it grants access to the 'admins' group instead of the finance department group, and 'use' on the resource type 'generative-ai-model' is correct but the group is wrong. Option B is wrong because 'manage' provides excessive permissions (e.g., create, update, delete models) beyond the required invoke action, violating the principle of least privilege. Option D is wrong because 'any-user' allows all authenticated users in the tenancy to invoke the model, which does not restrict access to only finance department users.

Why this answer

How to eliminate wrong answers

Option B is wrong because OCI Data Transfer Service is designed for offline bulk data migration (e.g., shipping physical drives) and does not address real-time inference data residency or network-level regional confinement. Option C is wrong because setting up a VPN connection to on-premises would route inference traffic outside the OCI region to an on-premises network, violating the data residency requirement that data never leave the specific region. Option D is wrong because enabling cross-region replication on the bucket would actively copy data to another region, directly contradicting the requirement that data never leave the original region.

Why this answer

How to eliminate wrong answers

Option A is wrong because OCI Logging is designed for collecting and storing log data (e.g., audit logs, custom logs) and does not offer built-in dashboards for real-time inference performance metrics like latency or throughput. Option B is wrong because OCI Notifications is a pub/sub messaging service for alerting and event distribution, not a monitoring dashboard for metrics. Option D is wrong because OCI Events triggers automated actions based on changes in OCI resources (e.g., state changes) but does not provide dashboards for continuous performance metrics.

Why this answer

How to eliminate wrong answers

Option B is wrong because using an Internet Gateway and public endpoint exposes the model endpoint to the public internet, increasing security risks and violating the requirement for a private subnet. Option C is wrong because VPN Connect is used to extend an on-premises network to OCI, not to access OCI service endpoints from within OCI; it would add unnecessary complexity and does not provide private access to the model endpoint. Option D is wrong because a NAT Gateway enables outbound internet access from a private subnet but does not provide private connectivity to OCI services; traffic would still leave the OCI network and return, which is less secure and not the intended use for accessing OCI service endpoints.

Why this answer

How to eliminate wrong answers

Option A is wrong because max_tokens controls the maximum number of tokens in the generated response, not the input prompt; truncation of the prompt is caused by the context window limit, not max_tokens. Option C is wrong because top_p=1 means nucleus sampling considers all tokens with cumulative probability up to 1, which is the default and does not cause deterministic output; it does not affect context retention. Option D is wrong because temperature controls randomness in token selection, not the ability to retain conversation history; a high temperature increases diversity but does not cause earlier messages to be ignored.

Why this answer

How to eliminate wrong answers

Option B is wrong because pre-built models in OCI Generative AI have names like 'cohere.command' or 'meta.llama-2-70b-chat', not custom names like 'my-fine-tuned-model'. Option C is wrong because the `model list` command only shows model metadata; deployment status requires a separate `oci generative-ai model get` or `oci generative-ai deployment list` command. Option D is wrong because the model list output does not indicate training status; training status is shown via `oci generative-ai model get` with a 'lifecycle-state' field (e.g., 'ACTIVE', 'CREATING'), and a listed model is typically already in an active state.

Why this answer

How to eliminate wrong answers

Option B is wrong because training separate models for each team does not address access control; it only creates more models without any mechanism to prevent cross-team visibility or invocation. Option C is wrong because encrypting model artifacts with different keys protects data at rest but does not control access at the API or invocation layer; teams could still see and invoke models if IAM permissions allow it. Option D is wrong because network security lists operate at the network layer and cannot distinguish between different models within the same Dedicated AI Cluster; they are designed for traffic filtering between subnets, not for model-level authorization.

Why this answer

How to eliminate wrong answers

Option A is wrong because switching to a serverless endpoint would not resolve the issue; serverless endpoints on OCI Generative AI still rely on underlying compute resources and may introduce cold-start latency, and the problem is a sustained increase in traffic that requires dedicated capacity, not variable traffic handling. Option B is wrong because reducing the batch size in inference requests would decrease throughput per request and increase the number of requests, potentially worsening CPU utilization and queue growth, not lowering it. Option C is wrong because implementing a caching layer for frequently requested descriptions would only help if identical requests are repeated, but the problem is a general increase in traffic volume and CPU saturation, not redundant requests; caching does not reduce the compute load for unique or varied product descriptions.

Why this answer

How to eliminate wrong answers

Option A is wrong because a site-to-site VPN only encrypts traffic between the client site and the VCN, but the public load balancer remains publicly accessible, violating the requirement that the endpoint not be accessible from the public internet. Option B is wrong because removing the load balancer and using a service gateway would bypass load balancing, breaking high availability and low latency, and service gateways are used for outbound traffic to OCI services, not for inbound client access. Option C is wrong because keeping the public load balancer with a WAF does not remove public internet accessibility; WAF only filters traffic but does not make the endpoint private, so the security team's concern remains unaddressed.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because implementing a custom proxy with logging introduces unnecessary complexity, latency, and potential security gaps, and is not a native OCI solution for logging inference requests. Option B is wrong because the OCI Audit service captures only management-plane events (e.g., create, update, delete operations on resources), not data-plane events like individual inference API calls. Option D is wrong because OCI Vault is designed for storing secrets (e.g., API keys, passwords), not for storing logs; logs should be stored in OCI Logging or Object Storage.

Why this answer

How to eliminate wrong answers

Option A is wrong because a memory leak would cause gradual memory consumption over time, not a consistent OOM error that correlates with dataset size; the error occurs immediately with a larger dataset, not after prolonged execution. Option B is wrong because OCI Data Science supports a wide range of GPU instances (e.g., VM.GPU.A10.1, VM.GPU.A100.1), and if the instance were unsupported, the job would fail with a different error (e.g., 'unsupported instance shape') rather than an OOM error. Option C is wrong because model compatibility with PyTorch version would typically cause import or runtime errors (e.g., 'module not found' or 'operator not implemented'), not an OOM error; PyTorch version mismatches do not directly affect memory allocation.

Why this answer

How to eliminate wrong answers

Option A is wrong because a batch size that is too small would actually reduce latency per request (though it might lower throughput), not cause high latency or timeouts; the issue here is overload, not underutilization. Option B is wrong because if the model were too large for the cluster memory, the deployment would fail to load or would crash immediately, not return high latency and timeouts during inference. Option D is wrong because client-side network slowness would manifest as high network round-trip time or packet loss, not as server-side timeouts from the inference endpoint; the problem is explicitly on the deployment side.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the model were not deployed, the error would typically indicate that the model endpoint is unavailable or not found, not an authorization failure. Option B is wrong because an incorrect model ID would result in a 'model not found' or 'invalid parameter' error, not an authorization error. Option C is wrong because an incorrect region configuration would cause connectivity or endpoint resolution errors, such as 'region not found' or 'endpoint unreachable', not an IAM permission error.

Why this answer

How to eliminate wrong answers

Option A is wrong because simply using a larger GPU shape does not change the fact that the inference script processes one request at a time; throughput gains require batching logic, not just more compute. Option B is wrong because OCI Model Deployment does not have a built-in request batching feature; this is a common misconception—the service routes each request individually to the container. Option C is wrong because OCI Streaming is designed for asynchronous, durable message buffering and would introduce significant latency and complexity; it is not suitable for real-time inference where low latency is critical.

Why this answer

How to eliminate wrong answers

Option B (OCI Events) is wrong because OCI Events is a notification service that triggers actions based on changes in OCI resources (e.g., state transitions), not a service for collecting time-series metrics like token usage or latency. Option C (OCI Notifications) is wrong because OCI Notifications is a pub/sub messaging service for distributing alerts and messages, not a metric collection or storage service. Option D (OCI Logging) is wrong because OCI Logging captures log data (e.g., text-based audit logs, error logs) from resources, not structured numeric metrics; metrics require OCI Monitoring's custom or predefined metric streams.

Why this answer

How to eliminate wrong answers

Option B is wrong because an edge caching layer in Europe would only serve cached responses for common queries; it does not reduce inference time for unique or dynamic queries, and caching introduces stale data risks for a customer support chatbot that may require real-time accuracy. Option C is wrong because increasing the number of nodes in the cluster addresses throughput (handling more concurrent requests) but does not reduce the per-request inference time; with 80% utilization, the cluster is not saturated, so adding nodes would not lower latency for individual inference calls. Option D is wrong because deploying an additional endpoint in a European region would violate the compliance requirement to keep all data within the US; even with a global load balancer, inference would still require data processing in Europe, which is not permitted.

Why this answer

How to eliminate wrong answers

Option A is wrong because OCI Data Safe is a database security service focused on data masking, auditing, and user risk assessment for Oracle databases, not for filtering content generated by AI models. Option B is wrong because OCI Vault is a key management service for storing and managing encryption keys and secrets, not for content moderation or filtering of AI responses. Option C is wrong because OCI WAF (Web Application Firewall) protects web applications from common attacks like SQL injection and cross-site scripting at the HTTP/HTTPS layer, but it does not inspect or filter the semantic content of generative AI outputs.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing max-tokens only extends the length of the response, not the recency or accuracy of the information; it does not provide any mechanism to incorporate new data. Option B is wrong because prompt engineering cannot force the model to 'ignore' outdated training data; the model's parametric knowledge is fixed and cannot be selectively suppressed by instructions alone, leading to hallucinations or contradictions. Option D is wrong because fine-tuning requires retraining the model on new data, which contradicts the requirement to avoid retraining and is also resource-intensive and time-consuming.

Why this answer

How to eliminate wrong answers

Option A is wrong because OCI Block Volume is a block-level storage service attached to compute instances, designed for low-latency, persistent storage for databases or applications, but it is not a regional service for storing and managing large training datasets; it is tied to a specific compute instance and does not inherently enforce regional data residency for data at rest across multiple services. Option B is wrong because OCI File Storage is a network file system (NFS) service for shared file access across compute instances, but it is not optimized for large-scale object storage of training data and does not provide the same regional data residency guarantees as Object Storage; it is typically used for shared file systems, not as a primary store for fine-tuning datasets. Option D is wrong because Oracle Autonomous Database is a managed database service for transactional and analytical workloads, not designed for storing large unstructured datasets like LLM training data; it is optimized for structured data and SQL queries, and using it for fine-tuning data would be inefficient and misaligned with the data storage requirements for generative AI training.

Why this answer

How to eliminate wrong answers

Option B is wrong because a service gateway with a private endpoint only provides private connectivity within a VCN and does not prevent data from being processed or stored in other regions; it does not enforce regional data residency. Option C is wrong because OCI IAM policies control user permissions and resource access, not the physical location or movement of data between regions. Option D is wrong because OCI Data Transfer Service is designed for offline bulk data migration and does not provide ongoing control over where inference or training data resides during active AI workloads.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because deleting and recreating in a different region is an overreaction; the capacity issue is specific to the shape and AD, not the region, and moving regions introduces latency and complexity. Option C is wrong because the error is about capacity, not service limits; the user already verified sufficient service limits, so a limit increase would not resolve the immediate capacity shortage. Option D is wrong because waiting does not guarantee capacity will become available; the error indicates a persistent lack of capacity for that specific shape in that AD, and waiting could waste time without resolution.

Why this answer

How to eliminate wrong answers

Option B is wrong because pending inference requests would actually prevent scaling down, but the question states the cluster is not scaling down after a period of low traffic, implying no pending requests are present. Option C is wrong because compartment permissions affect resource access and management operations, not the autoscaling behavior of a cluster. Option D is wrong because a cooldown period that is too short would cause the cluster to scale down too aggressively or oscillate, not prevent scaling down entirely.

Why this answer

How to eliminate wrong answers

Option A is wrong because OCI Vision is designed for image and video analysis (e.g., object detection, OCR), not for generating text embeddings. Option B is wrong because OCI Speech handles audio-to-text transcription and speaker diarization, not text embedding generation. Option D is wrong because OCI Language provides NLP features like sentiment analysis, entity extraction, and text classification, but it does not offer a dedicated embedding API for semantic search; that capability is exclusive to OCI Generative AI.

Why this answer

How to eliminate wrong answers

Option B is wrong because username and password are used for interactive console login (OCI IAM user password authentication) and are not supported for programmatic API calls from cloud functions; they would expose credentials in code and violate OCI security best practices. Option C is wrong because a session token is a temporary credential obtained via federation or token exchange (e.g., from an identity provider) and is typically used for CLI or SDK sessions, not for direct REST API signing from a cloud function without a token exchange flow. Option D is wrong because OCI certificate authentication (mTLS) is used for specific services like API Gateway or load balancer mutual TLS, not for standard OCI REST API endpoints like Generative AI, which rely on API signing keys.

Why this answer

How to eliminate wrong answers

Option B is wrong because a cluster with insufficient nodes would typically result in higher latency, timeouts, or '503 Service Unavailable' errors, not a '429 Too Many Requests' which is specifically a rate-limiting response. Option C is wrong because compartment mismatches cause '404 Not Found' or '403 Forbidden' errors, not a 429 status code. Option D is wrong because the cluster is explicitly stated as ACTIVE; an inactive cluster would return a '503 Service Unavailable' or '400 Bad Request' error, not a 429.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing max-tokens only extends the maximum length of the output, not the quality or repetition; it could even worsen the problem by allowing more repetitive text. Option C is wrong because increasing temperature to 1.5 makes the model more random and less focused, which typically reduces coherence and can increase nonsensical outputs. Option D is wrong because decreasing top-p to 0.8 narrows the sampling pool to the top 80% of probability mass, which may reduce diversity and potentially increase repetition rather than fix it.

Why this answer

How to eliminate wrong answers

Option B is wrong because request batching aggregates multiple inference requests into a single batch, which improves throughput (requests per second) but does not reduce the latency of any individual request; in fact, it can increase per-request latency due to queuing and waiting for batch completion. Option C is wrong because using a larger model increases the number of parameters and computational steps per token, which typically increases latency, not reduces it. Option D is wrong because increasing the number of replicas improves scalability and concurrency (handling more requests in parallel) but does not reduce the latency of a single inference request; each request still processes through the same model with the same token generation steps.

Why this answer

How to eliminate wrong answers

Option A is wrong because a NAT Gateway allows outbound internet access from a private subnet but does not provide private connectivity to OCI services; it would expose traffic to the internet. Option B is wrong because a Dynamic Routing Gateway (DRG) is used for connecting a VCN to on-premises networks or other VCNs via VPN or FastConnect, not for accessing OCI services privately within the same VCN. Option C is wrong because an Internet Gateway provides bidirectional internet access, which would make the endpoint publicly accessible, violating the requirement of private subnet-only access.

Why this answer

How to eliminate wrong answers

Option A is wrong because OCI Cloud Guard is a security posture management service that detects misconfigurations and threats, but it does not log individual inference requests to Generative AI. Option C is wrong because OCI Vault manages encryption keys and secrets, not request logging for AI services. Option D is wrong because OCI Audit logs capture only control-plane API calls (e.g., creating or deleting resources), not data-plane inference requests to the Generative AI service.

Why this answer

How to eliminate wrong answers

Option B is wrong because validation data leakage would cause artificially high performance on validation metrics, not degraded performance on edge cases; leakage means the model has seen the test data during training, which would inflate scores rather than cause failures. Option C is wrong because a learning rate that is too high typically causes training instability, divergence, or failure to converge, not selective degradation on edge cases after successful fine-tuning. Option D is wrong because insufficient training epochs would result in underfitting, where the model fails to learn even the main training patterns, leading to poor performance across all cases, not just edge cases.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the nodeCount to 8 would require even more public IPs, exacerbating the shortage rather than fixing it. Option C is wrong because attaching a different subnet with more public IPs is a workaround, but the root cause is that the cluster is not configured to assign public IPs; changing the subnet does not enable the assignment. Option D is wrong because changing the AI cluster shape to VM.GPU.A10.2 does not affect public IP allocation; it only changes the GPU type and compute capacity.

Why this answer

How to eliminate wrong answers

Option B is wrong because OCI Database with Transparent Data Encryption is designed for transactional workloads, not for storing large-scale training data for LLM fine-tuning, and it does not inherently enforce geographic region constraints on the data. Option C is wrong because OCI File Storage with export options and encryption can be mounted to a Data Science session, but it does not provide native mechanisms to enforce regional data residency; the data could be replicated or accessed across regions. Option D is wrong because OCI Block Volume with encryption attached to a notebook session encrypts data at rest, but it does not offer policy controls to ensure the data remains within a specific geographic region, as block volumes are tied to the compute instance's availability domain, not the broader region.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'manage all-resources' grants excessive permissions beyond what is needed, including access to unrelated services like compute or storage, violating the principle of least privilege. Option B is wrong because 'use' only allows actions like invoking or accessing the resource, but does not permit creating, updating, or deleting model endpoints. Option C is wrong because 'read' only allows viewing or listing resources, with no ability to create or manage endpoints.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because custom containers are not required for managed endpoints in OCI Generative AI; the service provides built-in serving infrastructure for supported model formats. Option C is wrong because a dedicated AI cluster is used for training or batch inference, not for deploying a managed endpoint, which uses OCI's shared serving infrastructure. Option D is wrong because using OCI CLI to create an endpoint is a valid method, but it cannot succeed until the model is registered in the Model Catalog; the CLI command requires a model OCID from the catalog.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the number of nodes to 2 does not solve the memory issue; OCI Generative AI managed endpoints deploy the model on a single node, and additional nodes are not used to aggregate GPU memory for inference. Option B is wrong because model parallelism is not supported for managed endpoints in OCI Generative AI; the service expects the entire model to fit on one node's GPU memory. Option D is wrong because reducing precision from FP16 to INT8 may lower memory usage, but it is not a guaranteed fix and could introduce accuracy loss; moreover, the question states the model requires 64 GB of GPU memory, and the team should first ensure the hardware meets the requirement rather than altering the model.

Why this answer

How to eliminate wrong answers

Option A is wrong because directly updating the existing model deployment with the new artifact would cause in-place changes, potentially triggering the memory spike and HTTP 500 errors on the live replicas, leading to downtime. Option C is wrong because stopping the existing deployment before updating causes complete downtime, violating the requirement to update without downtime. Option D is wrong because increasing replicas to 4 and then updating still performs an in-place update on all replicas, which does not isolate the faulty model and can still cause errors and memory spikes across the entire fleet.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the compartment AIResources did not exist, the error would be a '404 Not Found' or 'CompartmentNotFound' error, not a permissions-related error. Option B is wrong because the fine-tuning API is available in all OCI regions where Generative AI is supported; region unavailability would produce a 'ServiceNotSupported' or 'RegionNotSupported' error. Option D is wrong because the user is explicitly stated to be in the DataScientists group, and group membership alone does not grant access to Object Storage; IAM policies must be attached to the group or compartment to allow read access to training data.

Why this answer

How to eliminate wrong answers

Option A is wrong because compartment access is typically granted via a separate policy statement (e.g., 'Allow group to read compartments') and is not the specific missing permission for invoking an endpoint; the error is about resource-type permissions, not compartment-level access. Option B is wrong because 'manage generative-ai-model' allows management of the model resource (e.g., creating, updating, deleting models) but does not grant the runtime permission needed to invoke the endpoint for inference. Option D is wrong because reading the model's training data is a data-plane permission unrelated to endpoint invocation; model training data access is governed by object storage or data catalog policies, not by generative-ai-endpoint permissions.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Git repository URL is not a supported artifact format for OCI Generative AI custom model deployment; the service expects a static artifact file, not a live repository reference. Option B is wrong because a single .pth file contains only PyTorch model weights without the required configuration files (e.g., config.json, tokenizer.json) and inference code, making it incomplete for deployment. Option C is wrong because OCI Generative AI custom model deployment does not accept Docker images; it uses a serverless, managed inference environment that expects a .zip archive of model artifacts, not a containerized application.

Why this answer

How to eliminate wrong answers

Option B is wrong because OCI Cloud Guard is a security posture management service that detects misconfigurations and security threats, not a real-time performance monitoring or alerting tool for inference metrics. Option C is wrong because OCI Events is a notification service that reacts to state changes in OCI resources (e.g., object creation, instance termination) but does not natively track or alert on time-series performance metrics like error rates. Option D is wrong because OCI Logging collects and stores log data for audit and troubleshooting, but it lacks built-in metric-based alerting capabilities for monitoring inference performance trends or setting threshold alarms.