1Z0-1072-25 Question 45
Single answerYou have a private subnet in Oracle Cloud Infrastructure containing application servers that must download security patches from external repositories on the internet, but your security policy prohibits inbound traffic from the public internet. How can you enable these servers to retrieve updates while adhering to the security policy?
- A
Create an Internet Gateway and move the application servers into a public subnet to allow outbound and inbound traffic.
- B
Use a Service Gateway to connect the private subnet directly to Oracle-managed services on the internet.
- C
Deploy a NAT Gateway and update the private subnet's route table to use it for outbound traffic.
- D
Leverage a Local Peering Gateway to connect to a peered VCN that has internet access.
Show answer and explanation
Correct answer: C
Explanation
In OCI, the recommended method for allowing outbound internet access from instances in a private subnet without permitting inbound connections is through a NAT Gateway. The NAT Gateway is configured in the private subnet� route table to direct internet-bound traffic to the NAT Gateway address. This ensures that your servers can download software patches securely without exposing inbound connectivity. For more information, refer to the Oracle documentation on NAT Gateways: https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingNAT.htm
- A. Incorrect.
Incorrect. An Internet Gateway provides both inbound and outbound internet access for a VCN. Moving the servers to a public subnet would violate the security requirement to restrict inbound connections from the internet.
- B. Incorrect.
Incorrect. A Service Gateway routes traffic to Oracle-managed services (such as Object Storage), not to arbitrary external endpoints. It doesn�t allow access to generic internet repositories.
- C. Correct.
Correct. A NAT Gateway enables outbound connections to the internet while blocking inbound traffic, satisfying the requirement for securing the private subnet and still allowing patch downloads.
- D. Incorrect.
Incorrect. A Local Peering Gateway (LPG) is used for communication between two VCNs in the same region, not for internet access. Even if another VCN had an Internet Gateway, this would poorly enforce the desired security and not directly solve the outbound-only internet requirement.