Exam 1z0-997-22 topic 1 question 32 discussion

You work for a public health care company based in the United States. Their existing patient records system runs in an on-premise data center and the customer sends their tape backups offsite as part of their disaster recovery plan.
You develop an alternative archival solution using Oracle Cloud Infrastructure (OCI) that will save the company a significant amount of money on a yearly basis. The solution involves storing data in an OCI Object Storage bucket. After reviewing your solution with their customer Global Risk and Compliance (GRC) team, they highlight four security requirements:
All data less than 1 year old must be accessible within 2 hours
All data must be retained for at least 10 years and be accessible within 48 hours
All data must be encrypted at rest
No data may be transmitted across the public Internet
Which TWO options meet the requirements outlined by the customer GRC team? (Choose two.)