1Z0-1072-25 Question 61
Single answerYou have an OCI Compute instance running a web application in a private subnet. The instance needs to remain in the private subnet for secure internal communication, but must also host the application publicly on the Internet. Currently, the instance has only one VNIC with a private IP. How can you properly assign a public IP to meet the requirement for external access while keeping the instance in the private subnet?
- A
Reassign the instance� private IP address from the private subnet to a public subnet
- B
Assign an ephemeral public IP address to the instance� existing primary VNIC while it remains in the private subnet
- C
Attach a second VNIC in a public subnet and assign a public IP address to it
- D
Use a NAT Gateway for inbound traffic from the Internet to the private subnet
Show answer and explanation
Correct answer: C
Explanation
In OCI, a private subnet does not allow direct public IP assignments. To maintain the instance in a private subnet for internal security while granting external web access, you can create an additional VNIC on a public subnet. Assigning a public IP to that new VNIC allows inbound traffic from the Internet. This aligns with OCI best practices for segmenting networks and maintaining secure connectivity, as documented in the Oracle Cloud Infrastructure Network Concepts guide.
- A. Incorrect.
Incorrect: Moving the primary private IP to a public subnet would remove the instance� involvement in the private subnet. This negates the requirement to keep the instance within the private subnet for secure communication.
- B. Incorrect.
Incorrect: You cannot directly attach a public IP to a VNIC in a private subnet. Attaching an ephemeral or reserved public IP requires that the VNIC is in a subnet that supports public IP addresses.
- C. Correct.
Correct: Attaching a secondary VNIC in a public subnet lets you assign a public IP address while the instance remains connected to the private subnet via its primary VNIC. This is a common pattern when you need both secure private communication and public-facing access.
- D. Incorrect.
Incorrect: NAT Gateways only provide outbound Internet access for resources in private subnets. They do not route inbound traffic from the Internet to a private subnet.