No.# D is the most correct answer if the mode is ASYNC between two regions.
C is also correct answer if only asking about the data guard protection modes to use in OCI.

No.# The answer should be "C. Create a NAT gateway in the VCN and configure the NAT gateway as the route target for the private subnet."
Since your Linux server are in the private subnet, they cannot have public IP Address (Public IP Address is a requirement to use Internet Gateway), and only can access internet via NAT Gateway.
From the user guide (documentation as following)
"You can add a NAT gateway to your VCN to give instances in a private subnet access to the internet.
Instances in a private subnet don't have public IP addresses. With the NAT gateway, they can initiate connections to the internet and receive responses, but not receive inbound connections initiated from the internet.
l NAT gateways are highly available and support TCP, UDP, and ICMP ping traffic."

No.# B is correct

No.# A correct No XSS under access control

No.# C as the application is not resilient to crash-consistent backup. Clone is not low cost. Clone is high cost. During cloning system is not available

No.# for SSL termination trafiic transferred from listner to backend unencrypted. So A is the answer

No.# C is correct. Load balancer is not free,