1Z0-1067-25 Question 12
Select 3You are manually deploying a new high-performance computing (HPC) environment in Oracle Cloud Infrastructure. The environment must allow external internet access for the HPC nodes while keeping back-end administrative services private. You have decided to create two subnets (one public and one private) in a single Virtual Cloud Network (VCN). Which of the following steps do you need to complete to ensure the HPC nodes can securely access the internet from the private subnet and be reachable publicly if required?
- A
Create a private subnet and attach an Internet Gateway directly to it.
- B
Create a public subnet, attach an Internet Gateway to the VCN, and associate a route rule pointing 0.0.0.0/0 to that Internet Gateway.
- C
Create a route rule in the private subnet� route table pointing 0.0.0.0/0 to a NAT Gateway for outbound communication.
- D
Designate two dedicated public IP addresses for the private subnet by default to enable external access.
- E
Deploy Security Lists or Network Security Groups (NSGs) to control inbound and outbound traffic for both subnets.
Show answer and explanation
Correct answers: B, C, E
Explanation
When deploying core services manually in OCI, you must set up a VCN, subnets, routing, and gateways in a way that allows secure functionality. A public subnet typically contains resources that need direct internet exposure, requiring an Internet Gateway and a route rule forwarding 0.0.0.0/0 to it. A private subnet remains isolated but can still require outbound internet access through a NAT Gateway. Implementing appropriate Security Lists or Network Security Groups ensures that inbound and outbound connections are properly controlled. Refer to OCI documentation on 'VCNs and Subnets,' 'Working with Internet Gateways and NAT Gateways,' and 'Security Rules' for detailed configuration guidance.
- A. Incorrect.
Explanation (Option 1): This is incorrect because private subnets typically do not have a direct route to an Internet Gateway. Attaching an Internet Gateway to a private subnet would violate the principle of isolating internal resources from public networks. Instead, private subnets often rely on a NAT Gateway or Service Gateway for outbound connections.
- B. Correct.
Explanation (Option 2): This is correct. A public subnet requires an Internet Gateway at the VCN level and a route rule directing all public traffic (0.0.0.0/0) to that Internet Gateway. This setup allows external access to resources placed in the public subnet.
- C. Correct.
Explanation (Option 3): This is correct. By creating a route rule to a NAT Gateway in the private subnet� route table, the compute instances in the private subnet can initiate outbound connections to the internet for software updates or other tasks without exposing themselves directly to the public internet.
- D. Incorrect.
Explanation (Option 4): This is incorrect. Assigning multiple public IPs or any public IP address by default to the private subnet defeats the purpose of having a private subnet. Also, by design, a private subnet does not automatically receive public IP addresses. Any public IP association in OCI is typically at the instance or load balancer level in a public subnet, not the private subnet.
- E. Correct.
Explanation (Option 5): This is correct. Security Lists or Network Security Groups (NSGs) provide network security at the subnet or instance level. You should configure them for both public and private subnets, ensuring inbound and outbound traffic is restricted according to best security practices.