1Z0-1072-25 Question 59
Select 2Your team needs to deploy a three-tier application on Oracle Cloud Infrastructure (OCI). The web tier must be publicly accessible, while the application and database tiers must remain inaccessible from the internet. Which two statements are correct regarding how you should configure your public and private subnets for this deployment?
- A
The public subnet should have a route rule directing non-local traffic to an Internet Gateway, while the private subnet can use a NAT Gateway for outbound internet connectivity.
- B
All instances in the private subnet should be assigned public IP addresses for maintenance tasks, while the public subnet disallows public IP addresses entirely.
- C
You must attach an Internet Gateway to the VCN to allow the private subnet to receive direct inbound connections from the public internet.
- D
A public subnet can assign public IP addresses to instances by default, while the private subnet can reach external services via a NAT Gateway without direct inbound access from the internet.
Show answer and explanation
Correct answers: A, D
Explanation
In OCI, public subnets enable direct inbound and outbound internet connectivity through an Internet Gateway, typically assigning public IP addresses to instances. Private subnets should not assign public IP addresses if the goal is to prevent direct inbound internet traffic. Instead, private subnets can leverage NAT Gateways for outbound communication, such as downloading OS updates or patches, without exposing those instances to untrusted networks. For more details, refer to Oracle's VCN Subnets documentation: https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/subnets.htm.
- A. Correct.
Correct. Public subnets typically route traffic to the internet using an Internet Gateway. Meanwhile, private subnets can use a NAT Gateway to enable outbound internet access (for patches or updates) without exposing instances to inbound traffic from the public internet.
- B. Incorrect.
Incorrect. Assigning public IP addresses to private subnet instances defeats the purpose of having a private subnet. Private instances should not have public IP addresses if you want to protect them from direct inbound internet traffic.
- C. Incorrect.
Incorrect. While you do need an Internet Gateway at the VCN level for the public subnet to communicate with the internet, it is not used for private subnets to receive inbound connections. Private subnets should remain inaccessible from the internet unless specifically configured otherwise (for example, via jump hosts or bastion sessions).
- D. Correct.
Correct. Public subnets allow instances to have public IP addresses and communicate with the internet through an Internet Gateway. Private subnets do not require public IP addresses; they can use a NAT Gateway for outbound access without exposing their services directly to the internet.