A health department publishes sensitive lab-result events to OCI Streaming and must keep producers and consumers off the public internet while still using IAM to control who may produce or consume. Which stream-pool option supports that attachment model?

When sensitive lab-result events must stay off the public internet while IAM still controls who may produce or consume, restrict the OCI Streaming stream pool to a VCN with a private endpoint. Producer and consumer traffic then stays on private connectivity, and IAM policies continue to authorize produce and consume actions. That attachment model gives the health department a locked service door inside the private network rather than a street-facing bootstrap endpoint, without abandoning identity-based access control.

Disabling IAM and exposing only a public internet bootstrap endpoint is the opposite security posture. Moving the stream into API Gateway as a CORS policy so browsers become the only clients confuses HTTP edge CORS with Streaming pool networking. Converting the stream into an OCI Queue with a public pre-authenticated request changes products and weakens the private, IAM-governed event log requirement.

Exam caveat: private endpoint placement is an application-attachment and pool security choice—not a demand to redesign the entire tenancy network architecture in the exam item.

Operational check: enable the pool’s private endpoint in the target VCN, produce and consume from a subnet that can reach it, confirm public internet clients cannot reach the bootstrap endpoint, and verify IAM still denies principals lacking produce/consume permissions.