1Z0-1072-25 Question 48
Select 2You have created a new private subnet in your Virtual Cloud Network (VCN) to host application servers that must download software updates from the public internet. You want to allow outbound traffic for these updates while blocking any inbound connections from the public internet. Which two steps should you take to achieve this configuration?
- A
Create a NAT Gateway and add a route rule in the private subnet� route table directing 0.0.0.0/0 to the NAT Gateway.
- B
Attach an Internet Gateway to the VCN and configure 0.0.0.0/0 in the route table for the private subnet pointing to the Internet Gateway.
- C
Configure stateful egress rules in the Security List or Network Security Group of the private subnet to allow outbound traffic to the required update ports (e.g., TCP 80 and 443).
- D
Enable an Application Load Balancer in front of the private subnet to allow inbound internet traffic for patch downloads.
Show answer and explanation
Correct answers: A, C
Explanation
To enable outbound connectivity from a private subnet while preventing inbound internet traffic, you use a NAT Gateway in combination with appropriate route table rules. You also configure egress rules in your Security Lists or Network Security Groups to allow the required outbound ports. This approach follows Oracle Cloud Infrastructure best practices for securely updating private resources. For more details, refer to the OCI documentation on 'Configuring a NAT Gateway' and 'Security Lists or Network Security Groups' for private subnets.
- A. Correct.
Option 1 is correct. A NAT Gateway enables outbound connections to the internet from private subnets, while denying inbound connections. You must also add a corresponding route rule in the private subnet� route table to send outgoing traffic to the NAT Gateway.
- B. Incorrect.
Option 2 is incorrect. An Internet Gateway would allow both outbound and potential inbound traffic, which conflicts with the goal of blocking inbound connections from the public internet.
- C. Correct.
Option 3 is correct. You need to open outbound (egress) rules for the specific ports required to download software updates (often TCP 80 and 443). This ensures the application servers can successfully connect to external sources over the internet.
- D. Incorrect.
Option 4 is incorrect. An Application Load Balancer is used to distribute inbound client requests to backend servers and does not provide the NAT functionality needed for secure outbound connectivity. Using an Application Load Balancer here would also defeat the purpose of blocking inbound traffic from the public internet.