1Z0-1072-25 Question 67
Select 2You have an application running in a private subnet within your Oracle Cloud Infrastructure Virtual Cloud Network (VCN). The application needs to fetch software updates from the public internet, but you need to minimize inbound exposure from external sources. Which two configuration steps should you take to enable secure outbound internet connectivity for the private subnet without allowing inbound connections?
- A
Create and attach an Internet Gateway to the VCN and route all traffic through it
- B
Create and attach a NAT Gateway and add a route rule for outbound traffic in the private subnet's route table
- C
Use a Service Gateway in the VCN and ensure your software repositories are covered by Oracle's services
- D
Create egress security rules allowing outbound traffic to the required destination ports and IP addresses
Show answer and explanation
Correct answers: B, D
Explanation
Using a NAT Gateway and appropriate egress rules is the recommended approach for private subnets that need secure outbound connectivity to public endpoints. The NAT Gateway ensures traffic originates from the gateway� public IP address, preventing external hosts from initiating inbound connections to your private subnet. Refer to the Oracle documentation on �VCN Gateways and Route Tables� for best practices and detailed configuration steps.
- A. Incorrect.
Option 1: INCORRECT. While attaching an Internet Gateway can enable outbound and inbound traffic, it does not minimize inbound exposure. You would need to carefully configure security rules to block unwanted inbound connections, but a NAT Gateway is typically recommended for private subnet outbound traffic without external hosts initiating inbound traffic.
- B. Correct.
Option 2: CORRECT. A NAT Gateway allows resources in a private subnet to access the internet for software updates (outbound) without exposing private IP addresses to inbound internet traffic. You must also update the private subnet� route table to send outbound traffic to the NAT Gateway.
- C. Incorrect.
Option 3: INCORRECT. A Service Gateway is used to access Oracle services such as Object Storage within OCI, not third-party public internet endpoints. Since your application needs to fetch updates from external repos, a Service Gateway alone does not fulfill your requirement.
- D. Correct.
Option 4: CORRECT. You must create or update your subnet's security lists or network security groups to allow outbound connections on the ports required by the software repositories. Proper egress rules are essential for enabling outbound connections while limiting inbound exposure.