1Z0-1072-25 Question 57
Select 2You are designing a multi-tier application on Oracle Cloud Infrastructure. The front-end servers must be accessible from the public internet, while the database servers must remain isolated but still be able to download updates from external repositories. Which two statements are correct about configuring public and private subnets to meet these requirements?
- A
Place front-end servers in a public subnet with a route to the Internet Gateway, and place database servers in a private subnet without a route to the Internet Gateway.
- B
Use a NAT Gateway for the private subnet so that database servers can fetch updates without exposing themselves to the internet.
- C
Assign public IP addresses to all database servers so they can reach the Internet Gateway directly when they need updates.
- D
Rely solely on a Service Gateway for outbound database updates, making a NAT Gateway unnecessary in this scenario.
Show answer and explanation
Correct answers: A, B
Explanation
In Oracle Cloud Infrastructure, a common best practice is to create a public subnet for front-end servers that must be reachable from the internet, and a private subnet for back-end servers such as databases that should remain inaccessible from the public internet. The public subnet typically has a route to the Internet Gateway, allowing inbound and outbound public traffic. The private subnet often uses a NAT Gateway for outbound internet access, enabling resources like databases to download updates and patches without exposing themselves publicly. Refer to the OCI documentation on 'Configuring a VCN with Public and Private Subnets' for more details on subnet and gateway configurations.
- A. Correct.
Correct. Public subnets can host resources with public IP addresses and have a route to the Internet Gateway, while private subnets typically do not have a route to the Internet Gateway, keeping those resources isolated.
- B. Correct.
Correct. NAT Gateways allow private subnet resources to initiate outbound connections to the internet (e.g., for updates) without exposing their private IP addresses.
- C. Incorrect.
Incorrect. Assigning public IP addresses to database hosts located in a private subnet defeats the purpose of the private subnet and introduces security risks.
- D. Incorrect.
Incorrect. While a Service Gateway can be used to connect to certain Oracle services without a public IP, it does not cover all external repositories. A NAT Gateway is required for general outbound connections, such as fetching custom updates.