1Z0-1072-25 Question 137
Single answerYour organization is deploying a public-facing web application on Oracle Cloud Infrastructure. You want to configure an OCI Load Balancer that accepts HTTP/HTTPS requests from the internet and then routes traffic to application servers in a private subnet. Which configuration ensures that the Load Balancer is accessible from the internet while securely forwarding traffic to the private subnet?
- A
Deploy the Load Balancer in the same private subnet as the backend servers and configure an Internet Gateway for that private subnet.
- B
Deploy the Load Balancer in a public subnet with an ephemeral public IP address and create routing rules that direct traffic from the Load Balancer to the private subnet.
- C
Use a NAT Gateway in the same subnet as the Load Balancer to receive all inbound traffic and forward it to the backend servers in the private subnet.
- D
Place both the Load Balancer and backend servers in a public subnet, while disabling public IP addresses on the backend servers.
Show answer and explanation
Correct answer: B
Explanation
In OCI, a public Load Balancer must reside in a public subnet with a public IP address so that internet clients can connect to it. This Load Balancer then securely forwards traffic to private subnets that host backend servers. For more information, refer to the OCI documentation on Load Balancers and subnet best practices.
- A. Incorrect.
Incorrect. Placing the Load Balancer in a private subnet, even with an Internet Gateway, does not properly expose the Load Balancer to public traffic. Internet Gateways do not automatically route inbound connections into private subnets without a public endpoint.
- B. Correct.
Correct. A public Load Balancer should be hosted in a public subnet with an ephemeral public IP address. Then, you configure routing rules (and security lists or Network Security Groups) to forward traffic from that Load Balancer to the backend servers in private subnets. This ensures external accessibility and protects the backend servers by keeping them private.
- C. Incorrect.
Incorrect. A NAT Gateway handles outbound connections from private subnets to the internet, not inbound traffic from the internet to a private subnet. It does not replace the need for a public Load Balancer.
- D. Incorrect.
Incorrect. Placing backend servers in a public subnet can expose them directly to the internet, negating the security benefits of a private subnet. While you could disable public IP addresses on the servers themselves, the recommended approach in OCI is to keep backend servers in private subnets for improved security.