1Z0-1067-25 Question 8
Single answerYou are manually deploying a new VCN and subnets in Oracle Cloud Infrastructure for an application running on a compute instance in a private subnet. The application must periodically download security updates from the public internet without exposing the instance directly. Which manual configuration step must you implement to enable the instance to fetch updates from the internet while keeping it private?
- A
Create an Internet Gateway and update the private subnet� route table to send all outbound traffic (0.0.0.0/0) to the Internet Gateway.
- B
Create a NAT Gateway and update the private subnet� route table to send all outbound traffic (0.0.0.0/0) to the NAT Gateway.
- C
Assign a public IP address to the instance in the private subnet to allow direct public internet access.
- D
Create a service gateway for Internet-bound traffic on the private subnet.
Show answer and explanation
Correct answer: B
Explanation
When deploying core OCI services manually, a NAT Gateway is recommended for granting private instances outbound internet connectivity without exposing them to inbound traffic. You must create the NAT Gateway and update your private subnet's route table to direct 0.0.0.0/0 traffic to the NAT Gateway. This ensures instances remain private while still being able to download security patches or connect to other internet resources. Refer to the Oracle Cloud Infrastructure Networking documentation for best practices on creating and configuring NAT Gateways.
- A. Incorrect.
Incorrect. While an Internet Gateway allows inbound and outbound internet connectivity, configuring a subnet route table to direct internet traffic through an Internet Gateway would expose resources publicly. This would defeat the privacy requirement.
- B. Correct.
Correct. A NAT Gateway enables instances in a private subnet to access the public internet for outbound connections (e.g., for software updates), without allowing inbound connections from the internet, thus preserving the private nature of the subnet.
- C. Incorrect.
Incorrect. Attaching a public IP addresses the need for internet access but violates the privacy requirement because the instance would be directly reachable from the internet.
- D. Incorrect.
Incorrect. A service gateway provides private access to specific Oracle services (like Object Storage) without traversing the public internet. It does not enable general outbound internet traffic.