1Z0-1072-25 Question 16
Single answerYour organization has deployed several Compute instances in a private subnet within a VCN that does not allow any inbound traffic from the public internet. You need to apply security patches and download external software updates from the internet while maintaining the instances in a private, non-publicly routable environment. Which configuration should you use when provisioning and managing these Compute instances?
- A
Assign a public IP address to each instance and open outbound rules to the internet on port 443
- B
Use an Internet Gateway and configure a security list for inbound traffic on port 22
- C
Create a NAT Gateway and update the private subnet� route table to direct outbound traffic through it
- D
Attach a Service Gateway for both inbound and outbound connectivity to the external repository
Show answer and explanation
Correct answer: C
Explanation
When configuring Compute instances in a private subnet that need to reach the public internet for patches or updates�while preventing inbound access�the recommended solution is to use a NAT Gateway. As per Oracle Cloud Infrastructure best practices, you update your route table to send outbound traffic from the private subnet to the NAT Gateway. This preserves the private status of your instances and ensures no direct inbound public IP connections are allowed. Refer to the official Oracle Cloud Infrastructure documentation on NAT Gateways for more details on configuration and usage.
- A. Incorrect.
Option 1 is incorrect because assigning a public IP directly exposes your instances to inbound connections, contradicting the requirement to keep them in a purely private subnet.
- B. Incorrect.
Option 2 is incorrect because using an Internet Gateway and opening inbound ports provides direct internet access to your subnet, exposing it to inbound traffic, which violates the requirement of no inbound connections.
- C. Correct.
Option 3 is correct. A NAT Gateway allows outbound internet traffic for the instances and prevents inbound connections from the public internet, fulfilling the requirement for applying security patches while keeping the subnet private.
- D. Incorrect.
Option 4 is incorrect for this scenario because a Service Gateway allows private access to specific Oracle services, such as Object Storage or OS Management services, but not general public internet software repositories.