OCI security responsibilities are divided between Oracle and the customer. Oracle protects the infrastructure used to deliver cloud services, including physical facilities, hardware, and underlying networking components. Customers remain responsible for how they use and configure those services, including access policies, application security, data handling, and network security settings. For customer-managed compute environments, responsibilities also include maintaining the operating system and application software. The precise division varies with the service and its level of management, but using OCI does not transfer every security obligation to Oracle. Third-party tools may assist customers without replacing this division of responsibility. Option C best summarizes the model while recognizing that both parties contribute to the overall security of deployed workloads. Oracle documentation: Shared Security Model