Security Testing Policy describes when and how you may conduct certain types of security testing of Oracle Cloud Services, including vulnerability and penetration tests, as well as tests involving data scraping tools. What does Oracle allow as part of this testing? (Choose the best)

According to the "Oracle Cloud Services - Security Testing & Assessment Policy," customers are explicitly permitted to conduct security tests, including vulnerability and penetration tests, against their own IaaS and PaaS resources. The policy states that customers may use their own security testing and monitoring tools for this purpose. This allows customers to validate the security posture of their applications and configurations running on OCI, provided they adhere to the other rules outlined in the policy, such as not targeting shared infrastructure or other tenants.

A. While validating isolation is a security goal, the policy focuses on the actions permitted. This option is a desired outcome, not a specifically allowed testing action itself.
C. The policy explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, even if restricted to the customer's own environment, to protect the underlying shared platform.
D. The policy strictly forbids any testing that targets Oracle's underlying hardware, managed services, or any infrastructure not exclusively allocated to the customer's tenancy.

1. Oracle Cloud Infrastructure, "Oracle Cloud Services - Security Testing & Assessment Policy", Document Version 2.0, Section: "Permitted Security Tests". The policy states: "You may use your own security testing and monitoring tools to test the Oracle IaaS and PaaS services that are dedicated to your use."

2. Oracle Cloud Infrastructure, "Oracle Cloud Services - Security Testing & Assessment Policy", Document Version 2.0, Section: "Prohibited Activities". This section explicitly lists "Denial of Service (DoS)" and testing "any Oracle managed host or service" as prohibited.