1Z0-1072-25 Question 66
Single answerYou have an Oracle Cloud Infrastructure (OCI) Compute instance that currently has an ephemeral public IP assigned to its primary VNIC in a public subnet. Your application team now wants to remove all direct inbound traffic from the internet for better security, but the instance still needs to make outbound connections to external APIs. Which approach ensures your instance can continue reaching public endpoints while preventing all inbound access from the internet?
- A
Remove the ephemeral public IP and rely on the existing Internet Gateway for outbound connectivity.
- B
Move the instance to a private subnet, remove the ephemeral public IP, and configure a NAT Gateway for outbound connections.
- C
Assign a Reserved Public IP to a secondary VNIC on the same subnet and block inbound traffic via security lists.
- D
Use a Service Gateway and remove the ephemeral public IP, ensuring the instance can reach all internet services.
Show answer and explanation
Correct answer: B
Explanation
The best practice for allowing outbound internet traffic from an OCI instance while blocking inbound public access is to place the instance in a private subnet with no public IP and use a NAT Gateway. This ensures that the instance can establish outgoing connections while inbound traffic from the internet is blocked at the gateway level. For more information, see the Oracle Cloud Infrastructure documentation on setting up NAT and private subnets (https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/buildingnetwork.htm#natgateway).
- A. Incorrect.
Incorrect. Simply removing the ephemeral public IP while keeping an Internet Gateway does not guarantee blocking inbound traffic. If the instance remains in a public subnet with a route table entry to the Internet Gateway, inbound traffic could still reach it unless additional security rules or configurations are enforced. This is not the recommended best practice for restricting inbound access.
- B. Correct.
Correct. Moving the instance to a private subnet and removing the ephemeral public IP ensures no direct inbound traffic. A NAT Gateway is designed for outbound access from private subnets without exposing the instance to incoming connections. This is the recommended approach for secure outbound-only connectivity.
- C. Incorrect.
Incorrect. While assigning a Reserved Public IP to a secondary VNIC could give you control over which IP to use, it still leaves the instance in a public subnet and directly reachable unless firewall or security list rules block all inbound traffic. This approach is more complex and does not inherently eliminate inbound exposure.
- D. Incorrect.
Incorrect. A Service Gateway allows access to Oracle services, such as Object Storage, without traversing the public internet. It does not provide general outbound internet access for all endpoints and therefore won�t help if you need to reach external APIs on the broader internet.