Which two statements are true about network groups?

You want to control network traffic among your DBaaS instances.
Which two statements are true about network groups?

A.
By default, the DBaaS instances in a network group are accessible from hosts outside the network group.

B.
You can add a DBaaS instance to a network group, but this enables communication only within this network group.

C.
You can add a DBaaS instance to a network group, thus enabling communication with all other DBaaS instances both inside and outside the network group.

D.
You can create a network group to enable unrestricted communication among your DBaaS instances.

E.
DBaaS prevents network groups from having unrestricted communication among DBaaS instances.

Explanation:
Network groups provide a method for VMs to be grouped together for communications and firewall rules. You can define network groups to allow VMs within a
group to communicate with each other, while also preventing those VMs from communicating outside the group.
Note:
Access rule. Access rules define the permitted paths of communication for VMs that are within a network group. You can define an access rule to enable a specific
path of communication between two network groups, or between a network group and a specified list of IP addresses.

http://www.oracle.com/webfolder/technetwork/tutorials/obe/cloud/dbaas/OU/IntroDBaaS/ConfiguringNetworkSettings/
ConfiguringNetworkSettings.html#section2s2