1Z0-1072-25 Question 43
Single answerYou manage a VCN with one public subnet and one private subnet in Oracle Cloud Infrastructure. The application servers run in the private subnet and require outbound internet connectivity for updates, but you must block inbound connections from the internet into the private subnet. Which setup would best achieve this requirement?
- A
Deploy an Internet Gateway for the private subnet and add an ingress security rule in the private subnet� Security List to block inbound connections.
- B
Attach a NAT Gateway to the VCN and update the private subnet� Route Table with a route rule pointing to 0.0.0.0/0 via the NAT Gateway.
- C
Add a local peering gateway and configure a 0.0.0.0/0 route rule to allow inbound and outbound traffic between the subnets.
- D
Configure a service gateway on the private subnet to enable inbound HTTP access from the internet.
Show answer and explanation
Correct answer: B
Explanation
For a private subnet that needs secure outbound internet access, you typically configure a NAT Gateway. You then add a route rule in the private subnet� route table that sends all internet-destined traffic (0.0.0.0/0) to the NAT Gateway. This ensures that resources in the private subnet can fetch updates or communicate externally without exposing them to inbound public traffic. For more details, refer to Oracle Cloud Infrastructure Networking documentation on route tables and gateways.
- A. Incorrect.
Incorrect. An Internet Gateway provides both outbound and inbound access to the public internet. Simply adding an ingress deny rule is not the recommended way to limit inbound traffic to zero, because the gateway itself would allow inbound flows if incorrectly configured. This does not strictly block inbound traffic.
- B. Correct.
Correct. A NAT Gateway provides outbound internet access for resources in a private subnet without allowing inbound traffic. You update the private subnet� Route Table to direct all public traffic (0.0.0.0/0) to the NAT Gateway.
- C. Incorrect.
Incorrect. A local peering gateway is used for connecting two VCNs in the same region privately, not for public internet access. A 0.0.0.0/0 route to the local peering gateway does not facilitate outbound internet connectivity, and will not block inbound connections from the public internet.
- D. Incorrect.
Incorrect. A service gateway allows private connections to Oracle services like Object Storage or other regional services. It does not provide general outbound internet access and does not block inbound public traffic.