The ‘Home Region’ is a fundamental OCI concept where your tenancy is originally provisioned and where your IAM resources reside. Certain metadata and service operations are permanently tied to this region. While deploying resources in a specific region is important, declaring and understanding the Home Region is critical for compliance with data residency laws, as it controls where certain tenancy-level data is stored. A single AD does not guarantee region-level residency, and the other options are security features that don’t inherently enforce geographic boundaries.

Service limits are set at the tenancy level, but compartment quotas and IAM policies can further restrict what users can provision, effectively showing as a limit of 0. Before engaging support for a tenancy-level limit increase (which may not be needed), the administrator must verify if the user’s compartment has a quota set for that specific shape or if an IAM policy (e.g., `define tenancy usage-report as …`) or a quota statement in a policy is denying the use. Deleting other instances or trying different shapes doesn’t resolve this specific configuration issue.

The `manage virtual-network-family` permission grants full CRUD operations (create, read, update, delete) on all VCN resources. The policy syntax is correct and sufficient for deletion. The most common real-world reason a delete operation fails despite correct permissions is a resource dependency constraint enforced by the service itself (e.g., a subnet cannot be deleted while it contains an active instance or load balancer). The administrator should guide the user to check for and remove any attached resources first.

A VCN’s CIDR block is immutable and cannot overlap with any peered VCN. To use multiple distinct RFC 1918 ranges (like 10.0.0.0/16 and 10.1.0.0/16) while maintaining strong isolation boundaries, you must create separate VCNs, each with its own non-overlapping CIDR. Local Peering (within a region) then allows you to establish private routing between them, enabling controlled, cross-tier communication via route tables and security rules. A single VCN cannot have multiple primary CIDR blocks, and using a very large CIDR is inefficient and lacks the strong compartmentalization of separate VCNs.

For a public load balancer, the default behavior is to perform source Network Address Translation (NAT), making the source IP of packets arriving at the backend instances the private IP of the load balancer. To preserve the original client IP address, you must explicitly enable the ‘Preserve Client IP’ feature on the backend set (not the listener). When enabled, the load balancer uses the PROXY protocol v2 or inserts the `X-Forwarded-For` HTTP header (depending on the protocol) to convey the original IP. This is a backend set-level configuration.

While budgets alert on cost, and Events/Service Connectors are useful for automation, the first step for forensic analysis of *API call patterns* is the OCI Audit service. Audit logs automatically record all authenticated API calls, including the event type (e.g., `ListBuckets`), user/principal, and resource. By enabling and querying Audit logs for the specific compartment and event names, you can identify the source (which user or service) and volume of the listing calls, which is the direct cause of the API request costs. This provides the detailed evidence needed to remediate the issue.

Block Volume performance (IOPS and throughput) is determined by the Volume Performance Units (VPUs). You can dynamically increase the VPUs on an existing volume without needing to detach it from a running instance in most cases, but the question’s sequence is a valid operational step. This change takes effect immediately and predictably increases performance. Increasing size alone doesn’t guarantee higher performance without a VPU increase. Cloning or restoring from backup are valid methods to create a *new* volume with higher VPUs, but they are more complex and involve data copy steps, making the direct VPU adjustment on the live volume the most straightforward and efficient approach.

Network Security Groups (NSGs) provide stateful, instance-level (vNIC-level) firewall control. You can create an NSG with ingress rules that specify a source type of ‘Network Security Group’ and then attach that NSG only to vNICs of instances that have the `Security=Scanned` tag. Security Lists operate at the subnet level and cannot make rules conditional on instance tags. Route Tables control routing, not access. Local Peering Gateways are for VCN-to-VCN connectivity.

OCI Events service allows you to create rules that react to specific service events, most of which are sourced from the OCI Audit log. The ‘Instance Action – Stop’ (or `com.oraclecloud.computeapi.stopinstance`) is an audit event generated whenever an instance is stopped, regardless of the initiator. An Events rule can be configured to match this event and trigger actions like sending a notification via OCI Notifications, ONS, or a function. OCI Monitoring metrics are for resource utilization (CPU, memory, etc.), not discrete state-change events like ‘stopped’.

The ‘Home Region’ is a fundamental OCI concept where your tenancy is originally provisioned and where your IAM resources reside. Certain metadata and service operations are permanently tied to this region. While deploying resources in a specific region is important, declaring and understanding the Home Region is critical for compliance with data residency laws, as it controls where certain tenancy-level data is stored. A single AD does not guarantee region-level residency, and the other options are security features that don’t inherently enforce geographic boundaries.0