Problem Context: BGP session is established, but no routes are exchanged, and basic config (ASNs, IPs) is correct.

Option A Analysis: Misconfigured keepalive timers would cause the session to drop intermittently. Since the session is confirmed as established, this is unlikely. Keepalives affect session stability, not route exchange.

Option B Analysis: A mismatch in BGP authentication keys (e.g., MD5 passwords) would prevent the session from establishing. Given the session is up, this is not the issue.

Option C Analysis: BGP prefix lists or route maps filter advertised routes. If either the on-premises router or OCI applies a filter (intentionally or misconfigured), it could block route advertisements despite an established session. This is a common issue in BGP setups and aligns with the symptoms.

Option D Analysis: MTU mismatches could cause packet loss or fragmentation, but BGP uses TCP (small packets), and session establishment indicates MTU isn't the primary issue. Route exchange failures are more likely due to filtering than MTU.

Conclusion: Option C is the most likely cause, as filtering directly prevents route exchange without affecting session status.

From Oracle's FastConnect documentation:

'Once a BGP session is established, routes are exchanged based on the prefixes advertised by each side. Route maps, prefix lists, or filters on either the CPE or OCI side can restrict which routes are advertised or accepted.'

'If no routes appear in the routing table despite an active session, verify that no filters are blocking advertisements.'

This supports Option C as the most likely cause. Reference: FastConnect Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/fastconnect.htm).

Requirement: IAM permission to accept cross-tenancy LPG peering.

Option A: ''Manage'' allows creating and accepting peering---correct.

Option B: ''Use'' permits using existing LPGs, not accepting requests---incorrect.

Option C: ''Inspect'' is read-only, insufficient---incorrect.

Option D: ''Read'' on virtual-network-family doesn't cover LPG management---incorrect.

Conclusion: Option A is required.

Oracle states:

'To accept a cross-tenancy peering request, the target tenancy needs 'manage local-peering-gateways' permission.'

This confirms Option A. Reference: Local VCN Peering - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/localVCNpeering.htm).

Goal: Ensure OCI-Azure traffic during BGP disruption.

Option A: Static routes bypass BGP dependency, maintaining connectivity---correct.

Option B: Disabling BGP stops routing---incorrect.

Option C: Notification doesn't ensure connectivity---incorrect.

Option D: Keepalive timers delay detection, not prevent disruption---incorrect.

Conclusion: Option A is most critical.

Oracle notes:

'For uninterrupted OCI-Azure Interconnect traffic during BGP maintenance, configure static routes between VCNs and VNets.'

This supports Option A. Reference: OCI-Azure Interconnect - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Network/Tasks/ociazureinterconnect.htm).

Requirement Breakdown: Maintain a specific public IP for external communication with high availability (HA).

Option A: Private IP with NAT Gateway is for outbound traffic from private subnets, not inbound public access. It doesn't support a fixed public IP for external clients.

Option B: Network Load Balancer (NLB) preserves client IPs (source IP) but doesn't allow reserving a specific public IP. IPs are assigned dynamically, failing the requirement.

Option C: Flexible Load Balancer (Application Load Balancer) supports reserving a public IP, ensuring the legacy IP is maintained. It also provides HA across Availability Domains (ADs).

Option D: Multiple load balancers with DNS round-robin don't maintain a single IP---clients see different IPs, violating the requirement.

Conclusion: Option C meets both the specific IP and HA needs efficiently.

Per Oracle documentation:

'The Application Load Balancer (Flexible Load Balancer) allows you to reserve a public IP address, which can be associated with the load balancer for consistent external access.'

'It provides high availability by distributing traffic across multiple backend instances.'

This supports Option C. Reference: Load Balancer Overview - Oracle Help Center (docs.oracle.com/en-us/iaas/Content/Balance/Concepts/balanceoverview.htm).

Requirement: Restrict inter-subnet communication unless permitted.

Options Analysis:

A: Removing default route breaks all routing, overly restrictive; incorrect.

B: Separate VCNs are excessive, complex; less practical.

C: NSGs provide granular, explicit control; optimal approach.

D: External firewall adds complexity, not VCN-native; inefficient.

NSG Advantage: Instance-level rules enforce policy within VCN.

Conclusion: NSGs are the most appropriate solution.

NSGs enable precise security within a VCN. The Oracle Networking Professional study guide states, 'Network Security Groups (NSGs) allow you to define strict ingress and egress rules for instances, ensuring inter-subnet communication is explicitly permitted as per security policies' (OCI Networking Documentation, Section: Network Security Groups). This is more efficient than VCN separation or external firewalls.