A company has deployed a VCN in OCI with multiple subnets. Security requirements dictate that instances in different subnets within the same VCN…

Requirement: Restrict inter-subnet communication unless permitted.

Options Analysis:

A: Removing default route breaks all routing, overly restrictive; incorrect.

B: Separate VCNs are excessive, complex; less practical.

C: NSGs provide granular, explicit control; optimal approach.

D: External firewall adds complexity, not VCN-native; inefficient.

NSG Advantage: Instance-level rules enforce policy within VCN.

Conclusion: NSGs are the most appropriate solution.

NSGs enable precise security within a VCN. The Oracle Networking Professional study guide states,

"Network Security Groups (NSGs) allow you to define strict ingress and egress rules for instances,

ensuring inter-subnet communication is explicitly permitted as per security policies" (OCI

Networking Documentation, Section: Network Security Groups). This is more efficient than VCN

separation or external firewalls.

Reference: Oracle Cloud Infrastructure Documentation - Network Security Groups.