1Z0-1072-25 Question 54
Single answerYour organization created a private subnet in an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN) to host internal application servers. These servers must download OS updates from the Oracle Linux yum servers but must remain inaccessible from the public internet. You want the most secure, cost-effective way to provide this access without exposing inbound connections. Which solution best meets these requirements?
- A
Create an Internet Gateway and add a route rule for 0.0.0.0/0 in the private subnet� route table pointing to that gateway for outbound traffic.
- B
Set up a NAT Gateway and create route rules in the private subnet� route table to send outbound traffic to the general internet via the NAT Gateway.
- C
Implement a Service Gateway for the VCN and configure a route rule directing traffic to the Oracle Services Network via this gateway.
- D
Deploy a Dynamic Routing Gateway (DRG) and establish an IPSec VPN tunnel to an on-premises firewall for routing to the Oracle Linux yum servers.
Show answer and explanation
Correct answer: C
Explanation
When instances in a private subnet only need access to Oracle services (such as Oracle Linux yum servers), the recommended practice is to use a Service Gateway. This allows the instances to communicate privately with the Oracle Services Network without assigning public IP addresses or routing via the public internet. Refer to Oracle Cloud Infrastructure documentation on 'Access to Oracle Services: Service Gateway' for configuration details and best practices.
- A. Incorrect.
Option 1 is incorrect because using an Internet Gateway would allow direct public internet access from the private subnet. Even if you block inbound traffic manually, this approach is less secure and not tailored to accessing only Oracle services.
- B. Incorrect.
Option 2 is incorrect because while a NAT Gateway allows outbound connections to the internet without allowing inbound traffic, it is not the most cost-effective or secure if you only need access to Oracle services like the Oracle Linux yum servers.
- C. Correct.
Option 3 is correct. A Service Gateway provides private access to Oracle services (including the Oracle Linux yum servers) directly from a private subnet without exposing resources to the public internet, satisfying both the security and cost-effectiveness requirements.
- D. Incorrect.
Option 4 is incorrect because establishing an IPSec VPN through a DRG is typically used to connect on-premises environments to OCI. It does not directly provide a private path to Oracle services, making it unnecessarily complex and not aligned with the requirement of accessing only Oracle Linux yum servers.