1Z0-1067-25 Question 9
Select 2You have deployed an Oracle Cloud Infrastructure environment with multiple subnets in a single VCN. One of the subnets is private, where application servers need to retrieve configuration files from Object Storage without exposing them to the public Internet. What two manual steps must you take to enable outbound connectivity for the private instances to access Object Storage?
- A
Create a Service Gateway in your VCN and add a route table entry for OCI services pointed to the Service Gateway.
- B
Add an Internet Gateway and attach a public IP to the private subnet instances.
- C
Establish a local peering gateway to link the private subnet with the Object Storage compartment.
- D
Update the private subnet� security list or network security group to allow outbound HTTPS (TCP/443) to OCI regional services.
Show answer and explanation
Correct answers: A, D
Explanation
Enabling private subnet instances to reach Object Storage securely requires two key actions: deploying a Service Gateway and configuring the subnet route table to direct OCI service traffic to that gateway, and allowing outbound HTTPS traffic in the subnet� security rules. This ensures access to Object Storage remains private. Refer to OCI Networking documentation on Service Gateways, route tables, and security lists for best practices.
- A. Correct.
Option 1 is correct. A Service Gateway allows private subnets to access OCI services like Object Storage without routing traffic over the public Internet. You also need a corresponding route table entry so the private subnet knows how to reach Object Storage through the Service Gateway.
- B. Incorrect.
Option 2 is incorrect. Using an Internet Gateway with publicly routable IP addresses would expose the private subnet to the public Internet, contradicting the requirement to keep instances private.
- C. Incorrect.
Option 3 is incorrect. A local peering gateway is used to connect two VCNs in the same region, not to connect a private subnet directly to Object Storage.
- D. Correct.
Option 4 is correct. Even with a Service Gateway, the private subnet must allow outbound HTTPS (443) traffic in a security list or network security group to ensure the instances can communicate with Object Storage.