Oracle Cloud Infrastructure Architect Associate Advanced Practice Exam: Hard Questions 2025

You operate a stateless API tier on OCI using instance pools behind an OCI Load Balancer. During a regional service event, some instances in the pool are terminated and replacement instances launch successfully, but the API intermittently returns 502 errors for several minutes after scaling events. Health checks show instances as healthy, yet traffic still fails for a subset of requests. Which design change MOST directly reduces this failure window during instance replacements while preserving autoscaling?

A team launches a VM in a private subnet with no public IP. The VM must pull packages from the public internet during bootstrapping and later must be reachable only via OCI Bastion. They created a NAT Gateway and added a route rule to the subnet route table. Bootstrapping still fails with timeout errors. Security lists allow egress to 0.0.0.0/0. Which is the MOST likely missing configuration?

You must migrate an on-prem Oracle database to OCI with minimal downtime. The application performs frequent small transactions and cannot tolerate long cutover windows. The target should support read scaling for analytics without impacting OLTP performance. Which approach best meets these requirements on OCI?

A security requirement mandates that database backups never traverse the public internet and must remain accessible even if an Availability Domain becomes unavailable. You are using an Oracle DB System. What is the BEST architecture for backups that meets these requirements with the least operational overhead?

An organization runs a multi-tier application where a public web tier resides in a public subnet and the app and database tiers are in private subnets. Security requires least-privilege access and minimal blast radius. Which design MOST closely follows OCI best practices while allowing the web tier to call the app tier and the app tier to call the database tier?

A company has strict governance requirements: only a central networking team may create or modify VCNs, DRGs, and route tables, while application teams can deploy compute and managed services into approved subnets. They need guardrails that prevent accidental creation of internet-facing resources in production compartments. Which approach BEST meets this goal using native OCI capabilities?

You need private connectivity from an on-prem data center to multiple OCI VCNs in the same region. Each VCN belongs to a different compartment and must remain isolated from the others (no transitive routing), but all must reach on-prem networks. The design should minimize operational overhead as new VCNs are added. Which architecture is BEST?

A private subnet hosts application instances that must call multiple OCI public endpoints (Object Storage, Logging, and Secrets) without using the public internet. After adding a Service Gateway and a route rule for "All <region> Services in Oracle Services Network", Object Storage access works but calls to Secrets still fail. No network security changes were made. What is the MOST likely cause?

A workload writes millions of small log files per day and requires them to be available to hundreds of ephemeral compute instances across multiple subnets in the same region. The application needs POSIX semantics and shared read/write access with low administrative overhead. Which storage service is the BEST fit?

A database on a VM uses an OCI Block Volume for data files. The team enabled backups but wants additional protection against logical corruption introduced by an application bug, with the ability to quickly roll back to a known-good point without restoring a full backup. They also need to keep performance impact minimal. Which approach BEST satisfies these requirements?