Your company utilizes a hybrid cloud architecture, connecting its on-premises network to an OCI VCN using a FastConnect private peering connection. You need to ensure that instances within a specific subnet in the VCN can only communicate with resources in a designated IP address range within the on-premises network. What is the MOST effective way to achieve this specific network isolation?

Goal: Restrict subnet traffic to a specific on-premises IP range via FastConnect.
Option A: Internet Gateway is for public access, not FastConnect—incorrect.
Option B: Default security list applies broadly, lacking granularity; NSGs are more effective—less optimal.
Option C: Custom route table with DRG ensures FastConnect routing; NSGs provide precise, instance- level traffic restriction—correct.
Option D: LPG is for same-region VCN peering, not on-premises—incorrect. Conclusion: Option C is the most effective method. Oracle notes: "Use a custom route table with a DRG route rule for FastConnect traffic. NSGs offer granular control to restrict traffic to specific IP ranges." This supports Option C. Reference: FastConnect and NSG Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/fastconnect.htm & docs.oracle.com/en- us/iaas/Content/Network/Concepts/NSGs.htm).