* Requirement:Restrict inter-subnet communication unless permitted.
* Options Analysis:
* A:Removing default route breaks all routing, overly restrictive; incorrect.
* B:Separate VCNs are excessive, complex; less practical.
* C:NSGs provide granular, explicit control; optimal approach.
* D:External firewall adds complexity, not VCN-native; inefficient.
* NSG Advantage:Instance-level rules enforce policy within VCN.
* Conclusion:NSGs are the most appropriate solution.
NSGs enable precise security within a VCN. The Oracle Networking Professional study guide states,
"Network Security Groups (NSGs) allow you to define strict ingress and egress rules for instances, ensuring inter-subnet communication is explicitly permitted as per security policies" (OCI Networking Documentation, Section: Network Security Groups). This is more efficient than VCN separation or external firewalls.