1Z0-1072-25 Question 60
Single answerYou are deploying a two-tier application on Oracle Cloud Infrastructure. The front-end web servers need to be accessible over the internet, while the back-end database must remain inaccessible from the public internet. You place the web servers in a public subnet and the database in a private subnet. How can you enable the database instances in the private subnet to download operating system updates from the internet while ensuring that they remain private?
- A
Associate an Internet Gateway directly with the private subnet for outbound connections
- B
Use a NAT Gateway and route all outbound private subnet traffic to it
- C
Assign public IP addresses to the database instances to allow outbound access
- D
Create a second public subnet to forward traffic to the private subnet
Show answer and explanation
Correct answer: B
Explanation
When using Oracle Cloud Infrastructure (OCI) to design a network with both public and private subnets, you typically use a NAT Gateway to allow instances in private subnets to reach the internet for software updates without exposing them to inbound public traffic. By routing outbound requests through the NAT Gateway, private instances maintain isolation from direct external access. For more information, refer to the Oracle Cloud Infrastructure Networking documentation on NAT Gateways and subnet design best practices.
- A. Incorrect.
Incorrect: Directly associating an Internet Gateway with the private subnet would allow inbound connections from the internet, compromising its privacy.
- B. Correct.
Correct: Using a NAT Gateway allows instances in the private subnet to initiate outbound connections to the internet while preventing inbound traffic from reaching them directly.
- C. Incorrect.
Incorrect: Assigning public IP addresses to the database instances opens them to inbound traffic from the internet, defeating the purpose of a private subnet.
- D. Incorrect.
Incorrect: Creating a second public subnet does not solve the requirement for secure, outbound-only connectivity from the private subnet; a NAT Gateway is specifically designed for that purpose.