1Z0-1072-25 Question 122
Single answerYour organization hosts an internal staging environment on Oracle Cloud Infrastructure and needs a subdomain accessible only within its VCN. At the same time, the main domain must be publicly accessible and managed within OCI. Which approach should you take to achieve these requirements?
- A
Create two separate Private DNS zones, one for the staging environment and one for the main domain, ensuring both are restricted to the VCN.
- B
Create a Public DNS zone for the main domain and a Private DNS zone for the internal staging subdomain.
- C
Rely on a single Public DNS zone and use Security Lists to block external access to the staging records within the same zone.
- D
Use a single Private DNS zone for both environments and configure a NAT Gateway for external domain name resolution.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, Public DNS zones are used for resources that need to be resolvable from the public internet, while Private DNS zones restrict name resolution to a defined scope, such as a VCN. In this scenario, creating separate zones is the best practice: configure a Public DNS zone for the main domain that external clients must reach, and a Private DNS zone for internally accessible subdomains. For more information, see the 'Managing DNS in Oracle Cloud Infrastructure' section of the official Oracle documentation.
- A. Incorrect.
Incorrect. You would not want to place the main domain in a private zone because it needs to be accessible over the public internet. Creating two private zones would limit both subdomains to internal resolution only.
- B. Correct.
Correct. A Public DNS zone for the main domain ensures global accessibility, while a Private DNS zone for the staging subdomain restricts resolution to only internal network contexts.
- C. Incorrect.
Incorrect. A Public DNS zone by itself does not support restricting certain records internally. Security Lists control network traffic, not DNS queries, so this approach would not limit DNS resolution for staging resources.
- D. Incorrect.
Incorrect. A private DNS zone does not allow external resolution by default, and a NAT Gateway only helps resources in a private subnet initiate connections to the internet. It does not publish a domain for public access.