1Z0-1072-25 Question 44
Single answerYou have a private subnet within a Virtual Cloud Network (VCN) hosting application servers that only have private IP addresses. Your team needs these servers to download the latest operating system updates from an external repository on the public internet, but you must ensure no inbound traffic from the internet is allowed to reach them. Which solution meets this requirement?
- A
Attach a NAT Gateway to the VCN and configure the private subnet� route table to send outbound internet traffic through the NAT Gateway.
- B
Convert the subnet into a public subnet by assigning Public IP addresses and open inbound rules in the Security List.
- C
Create an Internet Gateway and configure ingress rules on the private subnet to restrict unwanted inbound traffic.
- D
Use a Service Gateway to route outbound traffic for all internet destinations.
Show answer and explanation
Correct answer: A
Explanation
To allow private subnet instances outbound-only access to external internet resources, you should use a NAT Gateway. Update the private subnet� route table to direct all outbound internet-bound traffic to the NAT Gateway. This setup blocks unsolicited inbound traffic while allowing the servers to download updates freely. Refer to the Oracle Cloud Infrastructure documentation on NAT Gateways for configuration details: https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingNATgateway.htm.
- A. Correct.
When you attach a NAT Gateway and configure the subnet� route table, instances in the private subnet can initiate outbound connections to the internet without exposing themselves to inbound traffic. This satisfies the requirement to download updates from external sites while maintaining a private subnet.
- B. Incorrect.
Assigning public IP addresses would make the subnet public and compromise the requirement of blocking inbound traffic. Public IPs and open security rules would allow external sources to reach these instances.
- C. Incorrect.
An Internet Gateway provides bidirectional internet traffic. Although you can create security rules, relying on security lists or network security groups alone doesn�t ensure the same level of separation as a NAT Gateway for outbound-only access.
- D. Incorrect.
A Service Gateway is used to connect to specific Oracle services (e.g., Object Storage), not general external internet addresses. It does not enable outbound connections to arbitrary external repositories.