Which two statements are true about using an Oracle Autonomous Database with private endpoints? (Choose two.)

When configuring an Oracle Autonomous Database (ADB) with a private endpoint, network security is a critical consideration. While security rules can be managed via Security Lists at the subnet level, Oracle's best practice and recommended approach is to use Network Security Groups (NSGs). NSGs provide a more granular, resource-specific firewall, separating the VCN's subnet architecture from the database's specific security requirements, making them a practical requirement for secure, enterprise-grade deployments. Furthermore, the cloning feature of Autonomous Database is highly flexible. It allows for the creation of a new database from a source, during which key configuration parameters, including the network access type, can be modified. Therefore, it is possible to clone an existing database that uses a public endpoint and configure the new cloned instance to use a private endpoint within a VCN.

B. An Autonomous Database with a private endpoint is, by definition, not accessible from the public internet. Access Control Lists (ACLs) are a security feature for public endpoints, not private ones.
D. The Always Free tier for Autonomous Database has specific limitations to maintain its free status. One of these documented limitations is the inability to configure a private endpoint.

1. Oracle Cloud Infrastructure Documentation

Use Private Endpoints with Autonomous Database

Section: "Network Security Groups". This section states

"Oracle recommends you use NSGs instead of security lists because NSGs let you separate the subnet's architecture from your database's security requirements." This supports the interpretation of NSGs as a practical requirement for proper security architecture (Answer A).

2. Oracle Cloud Infrastructure Documentation

Clone an Autonomous Database Instance

Section: "To clone an Autonomous Database instance". Step 8 in the procedure details the "Configure network access" option

where the user can select "Private endpoint access only" for the clone

irrespective of the source database's network configuration (Answer C).

3. Oracle Cloud Infrastructure Documentation

Always Free Autonomous Database. The feature comparison table explicitly lists "Private endpoint" as a feature that is "Not available with Always Free Autonomous Databases" (Answer D).

4. Oracle Cloud Infrastructure Documentation

Access to Oracle Services: Service Gateway. This document explains the concept of private access to OCI services

which fundamentally relies on keeping traffic off the public internet

invalidating the premise of using a public ACL with a private endpoint (Answer B).