Network Security Groups (NSGs) provide a more granular and dynamic way to define ingress rules for a specific set of resources (like all production instances) compared to subnet-level Security Lists. A custom service connector can be configured to continuously stream VCN Flow Logs (which capture traffic metadata) to Object Storage for durable, long-term audit retention, fulfilling the logging requirement. Security Lists alone don’t provide the automated logging stream, and OCI Audit logs capture API calls, not network packet flows.

OCI Compute instance shapes have defined maximum network bandwidth. If the application’s traffic pattern exceeds the bandwidth limit of its current shape (e.g., a VM.Standard.E2.1.Micro), it can lead to packet loss and intermittent timeouts, even with all networking components correctly configured. This is a common real-world performance issue. The other options describe configuration errors that would result in a complete lack of connectivity, not intermittent problems.

When launching a VM DB System (or any compute instance) through the console, CLI, or API, you must select the encryption type for the boot and block volumes at creation time. Choosing “Encrypt using customer-managed keys” and providing the OCID of a key from your OCI Vault ensures all associated volumes are encrypted with your key. This setting cannot be changed after provisioning.

OCI File Storage provides a fully managed, scalable, and durable NFS file system. By placing the mount target in a private subnet and configuring security rules to allow access only from the web servers’ subnet, you keep traffic within the VCN (secure and cost-free). It offers shared access, unlike block volumes, and is better suited for structured file storage than Object Storage for this use-case of a backend service needing a filesystem interface.

The symptom describes a lack of session affinity. By default, a load balancer distributes requests across all healthy backend servers. If a user’s session data is stored locally on one instance, the next request might go to a different instance. Enabling a session persistence policy (like LB cookie or application cookie) ensures all requests from a user session are directed to the same backend server, preserving session state.

The largest source of internet data transfer costs is typically outbound traffic from resources with public IPs. Moving application instances to private subnets and removing their public IPs eliminates their direct internet egress path. Access can be controlled via the Bastion for management and the Load Balancer (which has its own, often more predictable, data transfer pricing) for user traffic. This is a foundational cost-optimization step.

For connections originating from outside OCI (like on-premises), the Autonomous Database must use a public endpoint. ACLs for Autonomous Database specifically whitelist source IP addresses/CIDR blocks. Therefore, the public IP address (or range) of the on-premises network must be explicitly added to the database’s ACL to allow the connection. Private endpoints and VCN peering only work for resources within OCI.

A Warm Standby strategy best meets the aggressive RTO (2 hours) and RPO (15 minutes). It keeps a running, functional environment in the DR region at a lower cost (e.g., smaller instance shapes). Combined with cross-region replication for data (e.g., using Object Storage cross-region copy or database replication), it allows for a relatively fast failover by scaling up resources and switching DNS, meeting the sub-2-hour RTO. Pilot Light and Backup/Restore typically have longer RTOs, while Active-Passive is more complex and costly.

OCI Tagging allows you to define tag namespaces and keys (e.g., ‘Compliance::ApprovalTicket’). You can then create a Tag Default that automatically assigns a null value to all resources in a compartment, and more importantly, create Tag-based IAM Policies that make the ‘ApprovalTicket’ tag a required tag for all operations in that compartment. This provides a technical enforcement mechanism that aligns with the compliance requirement.

Network Security Groups (NSGs) provide a more granular and dynamic way to define ingress rules for a specific set of resources (like all production instances) compared to subnet-level Security Lists. A custom service connector can be configured to continuously stream VCN Flow Logs (which capture traffic metadata) to Object Storage for durable, long-term audit retention, fulfilling the logging requirement. Security Lists alone don’t provide the automated logging stream, and OCI Audit logs capture API calls, not network packet flows.0