1Z0-1072-25 Question 56
Single answerYour company is deploying a two-tier application on Oracle Cloud Infrastructure (OCI). The front-end tier requires direct inbound and outbound Internet access, while the back-end tier needs to stay private but still requires outbound Internet access for software updates. How should you configure your subnets and gateways to meet these requirements?
- A
Place both front-end and back-end instances in a single public subnet attached to an Internet Gateway (IG) for all traffic.
- B
Deploy front-end instances in a public subnet with an Internet Gateway route, and place back-end instances in a private subnet with a NAT Gateway route for outbound Internet access.
- C
Put front-end instances in a private subnet using a NAT Gateway for outbound connectivity, and assign an Internet Gateway for the back-end subnet.
- D
Place both front-end and back-end instances in private subnets and enable an Internet Gateway on each subnet for direct Internet access.
Show answer and explanation
Correct answer: B
Explanation
In OCI, public subnets typically have routes to an Internet Gateway and allow resources to receive public IP addresses for direct Internet access. Private subnets are designed for internal resources that do not require direct inbound Internet traffic. When private subnets need outbound Internet access (e.g., for updates), they connect through a NAT Gateway. For more details, refer to the official Oracle Cloud Infrastructure documentation on VCN subnets, gateways, and best practices for multi-tier architectures.
- A. Incorrect.
Option 1: Incorrect. While it provides Internet access, a single public subnet for both tiers exposes the back-end directly to the Internet, defeating the purpose of a private tier.
- B. Correct.
Option 2: Correct. The standard design is to put the front-end in a public subnet (with an IG for inbound/outbound Internet) and the back-end in a private subnet using a NAT Gateway for outbound traffic, protecting it from direct incoming Internet connections.
- C. Incorrect.
Option 3: Incorrect. Placing the front-end in a private subnet would prevent inbound Internet traffic from reaching it, while putting the back-end in a public subnet exposes it unnecessarily.
- D. Incorrect.
Option 4: Incorrect. Allowing each subnet its own Internet Gateway means both tiers end up accessible to the Internet, negating separation between a public front-end and a private back-end.