1Z0-1072-25 Question 121
Select 2Your organization hosts a public-facing application at example.com and wants to provide internal access to the same domain name on a private IP within a single OCI VCN. Which steps should you take to allow external clients to reach example.com via the public IP and internal hosts to resolve example.com to the private IP without complex workarounds?
- A
A. Create one public DNS zone for example.com, add a CNAME record pointing to the private IP, and rely on the built-in Functor service for internal resolution.
- B
B. Create a public DNS zone for example.com and a private DNS zone for the same domain name, placing the private zone in the same compartment and associating it with your VCN.
- C
C. Configure a public zone with a public IP address record for example.com, and use your on-premises DNS server to override queries to that domain internally.
- D
D. Create a public DNS zone for example.com with the public IP record, and then create a private DNS zone for example.com with the private IP record that is attached to the VCN where the internal hosts reside.
Show answer and explanation
Correct answers: B, D
Explanation
For split-horizon DNS in OCI, you typically create a public DNS zone that resolves your domain publicly, then create a private DNS zone with the same domain name, associating it with the VCN. This ensures external queries receive the public IP record from the public zone, while internal hosts in the VCN receive the private IP from the private zone. Refer to the Oracle Cloud Infrastructure DNS documentation for configuring both public and private zones, along with zone associations and record management best practices.
- A. Incorrect.
Option A: Incorrect. Oracle Cloud Infrastructure does not have a 'Functor' service for DNS override. Simply adding a CNAME to a private IP on a public zone does not differentiate internal from external traffic. Any public resolver would see the private IP, which is not desired.
- B. Correct.
Option B: Correct. This approach allows you to handle public traffic with one zone and internal traffic with another zone in the same domain name space. It is a common and supported method for splitting DNS resolution in OCI.
- C. Incorrect.
Option C: Incorrect. This relies on your on-premises DNS server to do a private override, which does not solve the problem solely within OCI. You also run the risk of inconsistent DNS behavior if on-premises networking changes.
- D. Correct.
Option D: Correct. Attaching the private zone to the VCN ensures that hosts within that VCN query the private DNS zone, resolving the internal IP address. Meanwhile, the public zone serves the public IP to external clients, fulfilling the split-horizon DNS use case within OCI.