Oracle Cloud Infrastructure 2020 Architect Associate — Question 38

You created a virtual cloud network (VCN) with three private subnets. Two of the subnets contain application servers and the third subnet contains a DB System.
The application requires a shared file system so you have provisioned one using the file storage service (FSS).
You also created the corresponding mount target in one of the application subnets. The VCN security lists are properly configured so that both application servers and the DB system can access the file system. The security team determines that the DB System should have read-only access to the file system.
What change should you make to satisfy this requirement?

Answer options

• A. Create an NFS export option that allows READ_ONLY access where the source is the CIDR range of the DB System subnet.
• B. Modify the security list associated with the subnet where the mount target resides. Change the ingress rules corresponding to the DB System subnet to be stateless.
• C. Create an instance principal for the DB System. Write an Identity and Access Management (IAM) policy that allows the instance principal read-only access to the file storage service.
• D. Connect via SSH to one of the application servers where the file system has been mounted. Use the Unix command chmod to change permissions on the file system directory, allowing the database user read only access.

Correct answer: A

Explanation

The correct answer is A because creating an NFS export option that allows READ_ONLY access specifically for the DB System subnet ensures that it meets the requirement for read-only access. Option B is incorrect as modifying the security list to stateless does not directly address the access level for the file system. Option C is not suitable because an instance principal and IAM policy are not necessary for managing NFS permissions. Option D is also wrong since changing permissions using chmod does not enforce the desired access control at the network level for the DB System.