1Z0-1072-25 Question 261
Select 2Your company deployed a new file system in Oracle Cloud Infrastructure (OCI) File Storage and created a mount target in a private subnet. You need to allow multiple compute instances in the same VCN (and subnet) to read and write data to this shared file system. The security team only wants to open the ports strictly required for NFS access. Which two actions should you take to ensure that the compute instances can successfully mount the file system over NFS?
- A
Allow inbound traffic from the compute subnet on TCP ports 111 and 2049 for the mount target� subnet.
- B
Open ephemeral inbound ports in the security list (or network security group) for the mount target to accommodate NFS communication.
- C
Place the mount target in a public subnet so it can receive NFS traffic from the internet.
- D
Configure the file system to use NFSv4 by updating the default mount target protocols in OCI.
Show answer and explanation
Correct answers: A, B
Explanation
To configure OCI File Storage for shared access, you need to create or use an existing mount target in a subnet and ensure that NFS traffic is allowed. At minimum, open port 111 for rpcbind and port 2049 for NFS, and allow ephemeral ports for callback traffic in security lists or network security groups. By default, OCI File Storage is encrypted at rest and supports NFSv3, so you do not need to place the mount target in a public subnet or enable NFSv4. Refer to Oracle documentation on 'Configuring VCN Security Rules for File Storage' for specific details on ports and protocols required.
- A. Correct.
Correct. NFS relies on port 111 (TCP/UDP) for the portmapper/rpcbind service and port 2049 for NFS. Without these ports opened for inbound traffic on the mount target� subnet, compute instances cannot establish the NFS connection.
- B. Correct.
Correct. NFS communication can also use a range of higher (ephemeral) ports for RPC callbacks. Allowing ephemeral ports ensures the mount target can communicate bidirectionally with the client instances without being blocked by the firewall rules.
- C. Incorrect.
Incorrect. A public subnet is not required for internal NFS traffic. In fact, placing a mount target in a public subnet would unnecessarily expose it to the public internet, and the scenario only requires private subnet access within the VCN.
- D. Incorrect.
Incorrect. OCI File Storage supports NFSv3 and does not currently allow you to enable NFSv4 at the mount target level. The default protocol used is NFSv3, which is already encrypted at rest and can be secured in transit with VPN or FastConnect in many designs.