OCI Foundations Associate common mistakes
OCI Foundations Associate · Understand the traps and how to avoid them.
Answering questions about OCI's physical hierarchy by saying that a region contains multiple tenancies, or that a fault domain spans availability domains - i.e., reciting the region/availability domain/fault domain/compartment chain in the wrong order or with the wrong containment direction.
Candidates memorize the four terms as a list rather than as a containment tree, and the exam deliberately offers distractors that reuse the same vocabulary in swapped positions.
What to do instead
Draw the tree once from memory: tenancy (root) > region > availability domain (one or three per region, isolated datacenters) > fault domain (grouping of hardware within an AD) > resources; compartments are a separate logical/policy grouping that sits alongside, not inside, the physical chain. Then answer each item by walking down that tree until the two objects in the question appear.
Assuming that placing two resources in different compartments, or in the same compartment, automatically controls whether they can reach each other over the network.
Compartment and network isolation both feel like 'separation', so candidates conflate the two, and the exam exploits that by describing resources in separate compartments and asking about connectivity.
What to do instead
State the rule explicitly before answering: compartments are for access control, quota, and cost tracking only; network reachability is governed by the VCN, subnets, route tables, security lists, and network security groups. If a question asks 'can X reach Y', look only at VCN/subnet/rule information and ignore the compartment names.
Treating security lists and network security groups as interchangeable, for example answering that a security list applies to a single VNIC, or that an NSG applies to an entire subnet.
Both are lists of allow rules attached to network traffic, and in other clouds the equivalent constructs differ, so prior experience produces confident but inverted answers.
What to do instead
Lock in the two anchors: a security list is attached to a subnet and applies to every VNIC in that subnet; a network security group is attached to individual VNICs and can span subnets. Both are stateful and allow-only. When a scenario says 'only these two instances should talk to each other', the answer is an NSG; when it says 'everything in this subnet', it is a security list.
Describing Object Storage tiers as differing only in price, and answering that Archive-tier objects are immediately downloadable or that Infrequent Access objects can be read without any retrieval consideration.
The tier names sound like pricing plans rather than access-pattern commitments, and candidates skip the retrieval-latency column when skimming study material.
What to do instead
Memorize the tiers as an access-speed ladder: Standard (immediate), Infrequent Access (immediate reads but intended for rarely accessed data and subject to a minimum storage duration), Archive (not immediately retrievable; requires a restore that takes time before download). Also remember lifecycle policies can move objects between tiers automatically, and that auto-tiering exists as a separate option.
Answering that a block volume can be attached to many instances for simultaneous read-write use by default, or that a boot volume can be detached and attached to a different instance freely.
Candidates generalize from file storage, which is shared by design, and assume 'volume' means shareable; the boot-volume vs block-volume distinction is also easy to blur.
What to do instead
Separate the three storage shapes: File Storage is shared across many clients over NFS; Block Volume is attached to one instance at a time unless it is explicitly configured as shareable; Object Storage is accessed over HTTP(S) by many clients. For boot volumes, remember they are tied to the instance lifecycle and are not the artifact you move between instances - you create an image or a clone instead.
Answering database-service questions by assigning patching, backups, and host access to the wrong party - e.g., saying the customer patches the container database of an Autonomous Database, or that Autonomous Database requires the customer to choose an OS shape and SSH in.
All OCI database offerings are called 'database services', so candidates apply a single mental model to all of them instead of distinguishing the serverless offering from the VM-based one.
What to do instead
Build a two-column table. Autonomous Database: fully managed, no OS or database patching by the customer, no SSH, scaling handled for you. Base Database Service / DB systems on compute: customer manages the guest OS and database patches, has SSH access, chooses shape and storage. Answer every database item by first classifying which of the two columns it belongs to.
Assuming customer data at rest needs to be encrypted manually before it is protected, or that Oracle has no responsibility for the physical infrastructure - in other words, misplacing items on either side of the shared responsibility model.
The model is usually learned as a slogan rather than as a concrete split, so items like 'physical datacenter security', 'guest OS patching on a compute instance', and 'data classification' get placed on the wrong side.
What to do instead
Fix the split in one sentence: Oracle owns security of the cloud (facilities, hardware, hypervisor, managed-service internals), the customer owns security in the cloud (their data, their IAM policies, their instance OS and application configuration). Then note the default: data at rest in OCI storage services is encrypted by default, with Oracle-managed keys unless the customer supplies keys in Vault.
Writing or evaluating IAM policy statements without accounting for the verb hierarchy, so a policy granting 'read' is assumed to also permit launching, or 'manage' is assumed to be narrower than 'use'.
The verbs look like ordinary English, and candidates do not drill the cumulative ordering, which the exam tests directly with near-identical statements.
What to do instead
Memorize the ladder from narrowest to broadest: inspect < read < use < manage, where each higher verb includes the lower ones, and remember the separate FAMILY-verb form. Pair this with the two structural facts: policies are written at tenancy or compartment scope and are additive, and the default is deny for everyone except the tenancy's initial administrator context.
Confusing the time-limited free trial credit with Always Free resources - for example stating that Always Free resources stop working after 30 days, or that the trial credit never expires.
Both are marketed under 'Free Tier', so the two are stored as one fact, and the exam asks about expiry and about what happens when credits run out.
What to do instead
Hold two separate facts: the trial gives a fixed credit amount usable across paid services for a limited window, and when it ends paid resources stop or must be upgraded; Always Free is a set of specific resource allowances that persists indefinitely on the account. When a question mentions expiry or credits, it is about the trial; when it mentions a persistent allowance, it is Always Free.
Answering cost questions by assuming a stopped compute instance costs nothing, or by comparing OCPU and vCPU counts one-to-one when sizing and pricing.
Stopping an instance feels equivalent to deleting it, and the OCPU/vCPU ratios are a small detail that is easy to skip while focusing on hourly rates.
What to do instead
Answer with the billing rule: stopping an instance stops compute charges but attached block volume and boot volume storage continue to be billed, so costs do not go to zero unless the storage is also removed. For sizing, remember the x86 mapping of 1 OCPU to 2 vCPUs and check whether the question is quoting OCPUs or vCPUs before comparing prices.