When migrating workloads from AWS to OCI, which connectivity option generally offers the LOWEST latency and HIGHEST bandwidth for data transfer, assuming a direct, dedicated connection is financially viable?

• A. Establishing an IPSec VPN tunnel over the public internet between the AWS Virtual Private Cloud (VPC) and the OCI Virtual Cloud Network (VCN).
• B. Utilizing a third-party cloud exchange provider to create a private network interconnect between AWS Direct Connect and OCI FastConnect.
• C. Employing AWS Transit Gateway to connect to a VPN Gateway on OCI via a public IP address.
• D. Leveraging AWS Storage Gateway to replicate data to OCI Object Storage over the internet.

For a multi-tier architecture with a strict compliance requirement to log all user access to private resources, which Bastion service configuration is most suitable?

• A. Dynamic port forwarding sessions with no logging enabled.
• B. Using a jump server with manually configured logging.
• C. SSH port forwarding sessions with minimal audit logs.
• D. Managed Bastion sessions with detailed session logging enabled.

You're automating the creation of multiple VCNs across different OCI regions using Cloud Shell scripting.
Which authentication method within Cloud Shell is best suited to programmatically authenticate with OCI, ensuring both security and scalability for this automation task?

• A. Using the default Cloud Shell user and configuring the OCI CLI with API keys in a shell script.
• B. Leverage Instance Principals in conjunction with a dynamic group that includes your Cloud Shell session.
• C. Creating a dedicated IAM user for automation, generating API keys, storing the keys securely in Cloud Shell's persistent storage, and using them in the scripts.
• D. Using Resource Manager stack with Terraform to provision network resources including cross-region configurations, leveraging OCI Vault to handle the sensitive credentials used in Terraform scripts.

Your company utilizes a hybrid cloud architecture, connecting its on-premises network to an OCIVCN using a FastConnect private peering connection. You need to ensure that instances within a specific subnet in the VCN can only communicate with resources in a designated IP address range within the on-premises network.
What is the MOST effective way to achieve this specific network isolation?

• A. Configure an Internet Gateway for the subnet with a route rule to the on-premises network.
• B. Configure a Local Peering Gateway (LPG) for the subnet to route traffic to the on-premises network.
• C. Modify the VCN's default security list to restrict traffic to the on-premises IP address range.
• D. Create a custom route table for the subnet with a route rule pointing to the Dynamic Routing Gateway (DRG) and configure network security groups (NSGs) to limit traffic to the specified on-premises IP address range.

You are deploying a three-tier web application using Infrastructure as Code (IaC) and Oracle Kubernetes Engine (OKE) within a single VCN. The application consists of a public-facing web tier (running in OKE), an application tier, and a database tier. You want to ensure that only the web tier can access the application tier, and only the application tier can access the database tier. You are leveraging Network Security Groups (NSGs) for granular access control. Your IaC code successfully creates all the components, but you are experiencing connectivity issues. Specifically, Pods in the web tier cannot reach the application tier.
Reviewing your IaC configuration, you realize the NSG assignments for the OKE cluster's node pool are misconfigured. Which of the following NSG configuration errors would most likely cause this connectivity issue?

• A. The NSG associated with the OKE node pool (web tier) only allows egress traffic to the internet and does not have a rule permitting egress traffic to the application tier's NSG on the required port (8080).
• B. The NSG associated with the OKE node pool (web tier) is missing an ingress rule allowing traffic from the VCN CIDR on port 443. This is causing a routing problem within the VCN.
• C. The NSG associated with the OKE node pool (web tier) allows ingress traffic from 0.0.0.0/0 on port 80, but egress traffic to the application tier's NSG is missing a rule allowing TCP traffic on port 8080 (the port the application tier is listening on).
• D. The NSG associated with the application tier allows ingress traffic from the VCN CIDR, but the NSG associated with the OKE node pool (web tier) has no ingress rules at all. Therefore, the OKE nodes are not reachable.