1Z0-1072-25 Question 49
Single answerYour organization has created a new Virtual Cloud Network (VCN) with both a private subnet and a public subnet. They have provisioned a NAT Gateway to allow the private subnet to install software updates from external repositories. However, instances in the private subnet still cannot access the internet. Which action should you take to ensure outbound internet access for the private subnet?
- A
Create a route rule in the private subnet� route table that directs all outbound traffic (0.0.0.0/0) to the NAT Gateway
- B
Add a security list rule allowing inbound traffic from the NAT Gateway CIDR to the private subnet
- C
Create an additional Internet Gateway and attach it to the private subnet� route table
- D
Enable a public IP address on each instance in the private subnet
Show answer and explanation
Correct answer: A
Explanation
When implementing and managing Oracle Cloud Infrastructure Virtual Cloud Networks, a NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while preventing inbound connections from the internet. For this to work, you must add a route rule within the private subnet� route table that directs traffic to the NAT Gateway for the relevant destination CIDR (commonly 0.0.0.0/0). Refer to Oracle documentation on 'Using a NAT Gateway' for details on configuring route tables and security lists.
- A. Correct.
Correct. To allow the private subnet to access external repositories, you must add a route rule in the private subnet� route table directing outbound traffic to the NAT Gateway for 0.0.0.0/0. This ensures instances in the private subnet can reach the internet without exposing them to inbound traffic.
- B. Incorrect.
Incorrect. While security list rules are important, simply allowing inbound traffic from the NAT Gateway does not establish outbound connectivity. You specifically need to configure a route in the route table to point to the NAT Gateway for internet-bound traffic.
- C. Incorrect.
Incorrect. You do not need an additional Internet Gateway for a private subnet that relies on a NAT Gateway. The Internet Gateway is typically used to provide full internet routability for a public subnet, not for private subnet outbound traffic.
- D. Incorrect.
Incorrect. Assigning public IP addresses to instances in a private subnet defeats the purpose of having a private subnet and is not the recommended way to provide outbound-only internet access. A NAT Gateway plus the correct route rules is the appropriate solution.