1Z0-1072-25 Question 68
Select 2You have deployed an internal application on a private subnet in Oracle Cloud Infrastructure (OCI). The private subnet must have access to the internet for updating software packages and also needs to communicate with on-premises resources over a site-to-site VPN. Which two actions should you take to configure this setup correctly?
- A
Create an Internet Gateway and add a route rule in the private subnet� route table that directs 0.0.0.0/0 traffic to the Internet Gateway.
- B
Create a NAT Gateway in the VCN and add a route rule in the private subnet� route table that directs 0.0.0.0/0 traffic to the NAT Gateway.
- C
Attach a Dynamic Routing Gateway (DRG) to the VCN and add a route rule in the private subnet� route table that directs on-premises CIDR traffic to the DRG.
- D
Use a Service Gateway in the private subnet� route table to direct all traffic from on-premises to relevant OCI services.
- E
Configure a security list with a stateful ingress rule allowing inbound internet traffic directly to the private subnet.
Show answer and explanation
Correct answers: B, C
Explanation
In OCI, private subnets typically require a NAT Gateway to access the internet safely, ensuring only outbound connections are possible. To connect to on-premises resources, you use a Dynamic Routing Gateway (DRG). By attaching the DRG to your VCN and adding a routing rule in the private subnet� route table, traffic destined for your on-premises network is sent to the DRG. Refer to the Oracle Cloud Infrastructure documentation on 'VCN Routing' and 'Connectivity with DRGs' for detailed configurations and best practices.
- A. Incorrect.
Incorrect. Although creating and using an Internet Gateway will provide external access, it directly exposes the private subnet to the public internet. The recommended best practice for allowing outbound connections from a private subnet is to use a NAT Gateway, not an Internet Gateway.
- B. Correct.
Correct. A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet (e.g., for patching or updates) without exposing the private subnet to inbound internet traffic.
- C. Correct.
Correct. A DRG is required for on-premises connectivity when using a site-to-site VPN or an IPSec tunnel. You must add a route rule in the private subnet� route table so traffic to the on-premises CIDR is properly directed to the DRG.
- D. Incorrect.
Incorrect. A Service Gateway is used to provide private access to specific Oracle Cloud services like Object Storage. It is not used for routing on-premises traffic. On-premises traffic must go through a DRG.
- E. Incorrect.
Incorrect. Allowing inbound traffic from the public internet directly to a private subnet is contrary to a secure design. Private subnets are meant to be shielded from external traffic through either a NAT Gateway (outbound only) or a Load Balancer in a public subnet if external inbound requests are required.