1Z0-1072-25 Question 52
Select 2You have deployed a Compute instance in a private subnet within an OCI Virtual Cloud Network (VCN). The instance is configured without a public IP address, but you need it to download software updates from the public internet. Which two steps must you perform to allow the instance to access external internet resources without exposing it publicly?
- A
Create and configure a NAT Gateway in your VCN
- B
Add a route rule in the private subnet� route table to send 0.0.0.0/0 traffic to the NAT Gateway
- C
Assign a public IP address to the instance so it can directly connect to the internet
- D
Create and configure an Internet Gateway for the private subnet route table
- E
Add an ingress rule in the private subnet� security list to allow inbound connections from any source
Show answer and explanation
Correct answers: A, B
Explanation
By using a NAT Gateway and appropriately configuring the private subnet� route table, you ensure that outbound internet traffic from the instance is allowed without exposing the instance to inbound internet connections. This is in line with OCI best practices for private subnets. For more information, consult the Oracle Cloud Infrastructure documentation on NAT Gateways and Route Tables.
- A. Correct.
Option 1 is CORRECT. A NAT Gateway enables instances in private subnets to initiate outbound connections to the internet without receiving inbound connections.
- B. Correct.
Option 2 is CORRECT. Updating the route table to direct all outbound internet traffic (0.0.0.0/0) to the NAT Gateway is essential for the instance to reach public endpoints.
- C. Incorrect.
Option 3 is INCORRECT. Assigning a public IP address would expose the instance directly to the internet, defeating the purpose of keeping it private.
- D. Incorrect.
Option 4 is INCORRECT. An Internet Gateway directly provides both inbound and outbound internet access, which would make the instance public. This contradicts the requirement of keeping it private.
- E. Incorrect.
Option 5 is INCORRECT. An inbound rule allowing traffic from any source would open the instance to the public internet, which again contradicts the privacy requirement.