Which is NOT a compliance document?

Detailed Answer in Step-by-Step Solution:

Objective: Identify a non-compliance document in OCI context.

Understand Compliance Docs: Formal attestations of adherence (e.g., SOC, ISO).

Evaluate Options:

A: Certificate—Proof of compliance (e.g., ISO)—compliance doc.

B: Pen test report—Security test result, not formal compliance—correct.

C: Attestation—Statement of compliance—compliance doc.

D: Bridge letter—Links audit periods—compliance doc.

Reasoning: B is operational, not a compliance artifact.

Conclusion: B is correct.

OCI documentation lists “compliance documents like certificates (A), attestations (C), and bridge letters (D) for standards like SOC or ISO; penetration test reports (B) are security assessments, not formal compliance docs.” Only B stands apart per OCI’s compliance terminology.

Oracle Cloud Infrastructure Compliance Documentation, "Compliance Artifacts".