To complete the task of setting up the context for Fn CLI and deploying the python function to exam-app, you can follow these steps:

a. Set up the Fn CLI context in Cloud Shell - In the OCI Console, go toDeveloper Servicesand clickFunctions. - Select your assigned compartment from the list on the left. - ClickGetting Startedon the top right corner. - Copy and paste the commands from theSet Up Fn CLI Contextsection into the Cloud Shell window. This will create a new context for your region and compartment. - Set your registry [repo-name-prefix] by entering the following command in the Cloud Shell window:

`fn update context registry [region_key].ocir.io/[tenancy-name]/{username}`

where [region_key] is the region key for your region (for example, iad for US East Ashburn), [tenancy-name] is the name of your tenancy (for example, ocuocictrng16), and {username} is your username (for example, 99248134-lab.user01).

For example, if your region is US East Ashburn, your tenancy is ocuocictrng16, and your username is 99248134-lab.user01, your command would be:

`fn update context registry iad.ocir.io/ocuocictrng16/99248134-lab.user01`

b. Login to the registry using docker login, which will require you to generate and use an Auth Token - To generate an Auth Token, follow these steps: - In the OCI Console, open the Profile menu on the top right corner and clickUser Settings. - ClickAuth Tokenson the left panel and then clickGenerate Token. - Enter a description for the token and clickGenerate Token. - Copy and save the token value. You will not be able to see it again later. - To login to the registry using docker login, follow these steps: - In the Cloud Shell window, enter the following command:

`docker login [region_key].ocir.io`

where [region_key] is the region key for your region (for example, iad for US East Ashburn).

For example, if your region is US East Ashburn, your command would be:

`docker login iad.ocir.io`

- Enter your username in the format `[tenancy-name]/oracleidentitycloudservice/{username}` (for example, ocuocictrng16/oracleidentitycloudservice/99248134-lab.user01) and press Enter.

- Enter your Auth Token as the password and press Enter. You should see a message saying "Login Succeeded".

c. Use wget https://objectstorage.us-ashburn1.oraclecloud.com/n/ocuocictrng5/b/PBT_Storage/o/ExamFunction-main.zipto upload the zip archive containing the Python function files to Cloud Shell. - In the Cloud Shell window, enter the following command:

`wget https://objectstorage.us-ashburn1.oraclecloud.com/n/ocuocictrng5/b/PBT_Storage/o/ExamFunction-main.zip`

This will download the zip archive to your current directory.

d. Extract the files by using the unzip utility and navigate to the python sub-folder - In the Cloud Shell window, enter the following commands:

`unzip ExamFunction-main.zip`

`cd ExamFunction-main/python`

This will extract the files from the zip archive and change your current directory to the python sub-folder.

e. Deploy the python function to the exam-app using an fn command - In the Cloud Shell window, enter the following command:

`fn deploy --app exam-app --local`

This will deploy the python function to the exam-app application using your local Docker image.

f. Invoke the function at least 2 times using an fn command - In the Cloud Shell window, enter the following command:

`fn invoke exam-app hellopython`

This will invoke the function and print its output.

- You can invoke the function again by repeating the same command or pressing Up Arrow and Enter keys. You should see different outputs each time you invoke the function.

One possible IAM policy statement that allows API Gateway to access Oracle Functions in your compartment is:

ALLOW any-user to use functions-family in compartment where ALL {request.principal.type = ‘ApiGateway’, request.resource.compartment.id = ‘’}

This statement grants the any-user group the permission to use the functions-family resource type in the specified compartment, but only if the request is coming from an API Gateway and the function belongs to the same compartment as the API Gateway. For more information, seeCreate a Policy to Give API Gateways Access to Functions.

• Option A is incorrect because adding an entry in the Security List of the ADW allowing ingress traffic for CIDR block 10.2.2.0/24 will not enable connectivity from the server on the private network to ADW. This is because ADW does not use security lists to control access to its database service2.
• Option B is correct because adding an entry in the route table (associated with the private subnet) with destination of 0.0.0.0/0; target type of NAT Gateway, will allow outbound internet access from the server on the private network without exposing its private IP address3. Additionally, adding a stateful egress rule to the security list (associated with the private subnet) with destination of 0.0.0.0/0 and for all IP protocols will allow outbound traffic from any source port to any destination port.
• Option C is incorrect because adding an entry in the access control list of ADW for IP address 129.146.160.11 will not enable connectivity from the server on the private network to ADW. This is because this IP address belongs to the NAT gateway, not to the server on the private network.
• Option D is incorrect because adding an entry in the route table (associated with the private subnet) with destination of 0.0.0.0/0; target type of Internet Gateway, will expose the private IP address of the server on the private network to the public internet3. This is not recommended for security reasons and may also cause routing conflicts.
• Option E is correct because adding an entry in the access control list of ADW for CIDR block 10.2.2.0/24 will allow access from any IP address within that range, including the server on the private network2.