Which security measure is implemented out-of-the-box, and is included if you are not using BYOL...

For "Exadata Cloud@Customer" without Bring Your Own License (BYOL), "Oracle Native Network Encryption and TDE (Transparent Data Encryption)" (D) are implemented out-of-the-box. Native Network Encryption secures data in transit, while TDE encrypts data at rest, both enabled by default to ensure baseline security compliance. "Oracle Key Vault" (A), "Audit Vault and DatabaseFirewall" (B), and "Database Vault and Data Masking Pack" (C) are advanced security options requiring additional configuration or licensing, not automatically included without BYOL. Oracle’s Exadata Cloud@Customer documentation confirms these encryption features as standard.