1Z0-1072-25 Question 55
Single answerYou are designing a new application environment in Oracle Cloud Infrastructure (OCI) 2025. The application includes public-facing web servers and database servers that should not be directly accessible from the internet. You decide to deploy these components into a single Virtual Cloud Network (VCN). Which approach best ensures that the web servers are reachable externally while the database servers remain fully private?
- A
Place both the web servers and database servers in a single private subnet and attach an Internet Gateway to enable incoming connections for the entire subnet.
- B
Deploy the web servers in a public subnet with an attached Internet Gateway, and deploy the database servers in a private subnet with no direct internet route but configured to use a NAT Gateway if needed for outbound connections.
- C
Provision the database servers in a public subnet and the web servers in a private subnet so that the databases can be accessed directly from the internet for administrative tasks.
- D
Place the web servers in a private subnet behind a NAT Gateway and the database servers in a separate public subnet to restrict their access using security lists.
Show answer and explanation
Correct answer: B
Explanation
In OCI, best practice is to assign public-facing resources (like web servers) to a public subnet with an Internet Gateway for inbound/outbound traffic, and private resources (like databases) to a private subnet that does not have a direct route to the internet. If backend resources need outbound access (e.g., for software updates), a NAT Gateway can be configured. Refer to Oracle documentation on 'Setting Up a VCN' and 'Managing Subnets' for details on recommended public and private subnet configurations.
- A. Incorrect.
Incorrect. Placing both web servers and database servers in the same private subnet that has an Internet Gateway exposes both sets of instances to potential inbound traffic, which defeats the purpose of isolating the database.
- B. Correct.
Correct. This configuration follows best practices: the public subnet hosts instances requiring external access (web servers) and is associated with an Internet Gateway. The private subnet hosts the database servers, which have no direct internet access. If the database servers need to initiate outbound connections (e.g., for patching), a NAT Gateway is used.
- C. Incorrect.
Incorrect. Placing the database servers in a public subnet violates the requirement to keep them non-accessible from the internet. The database servers should reside in a private subnet, preventing direct external connections.
- D. Incorrect.
Incorrect. This places the public-facing web servers in a private subnet, requiring additional complexity to provide inbound access. It also unnecessarily exposes the database servers to a public subnet.