1Z0-1072-25 Question 69
Single answerYou have a private subnet in your Virtual Cloud Network (VCN) that needs to reach the Internet for security patch downloads. You also need to route certain traffic between your on-premises data center and this subnet for database replication. Which solution should you implement to meet both objectives?
- A
Use an Internet Gateway for outbound traffic and a Local Peering Gateway for on-premises connectivity. Update the private subnet� route table to direct all traffic to the Internet Gateway.
- B
Use a NAT Gateway for outbound Internet access and a Dynamic Routing Gateway for on-premises connectivity. Update the route table to send public traffic to the NAT Gateway and on-premises traffic to the Dynamic Routing Gateway.
- C
Deploy a Service Gateway for outbound Internet access and a Local Peering Gateway for on-premises connectivity, with route rules pointing all traffic to the Service Gateway.
- D
Use a NAT Gateway for on-premises connectivity and an Internet Gateway for outbound Internet traffic. Configure your private subnet to use the Internet Gateway for all traffic.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, a NAT Gateway is used to provide outbound Internet connectivity for instances in a private subnet without exposing them to inbound Internet traffic. A Dynamic Routing Gateway (DRG) is essential for connecting on-premises environments to your OCI VCN. You must configure appropriate route rules directing Internet-bound traffic (0.0.0.0/0) to the NAT Gateway and on-premises traffic to the DRG. For more information, consult the Oracle Cloud Infrastructure documentation on VCN Routing and DRG configurations.
- A. Incorrect.
Option 1 is incorrect because a Local Peering Gateway is used for communication between two VCNs in the same region, not for on-premises connectivity. Also, if the subnet is private, directing all traffic to an Internet Gateway won�t work without proper NAT or public IP addresses.
- B. Correct.
Option 2 is correct. In a private subnet, you typically use a NAT Gateway to enable outbound Internet traffic. A Dynamic Routing Gateway (DRG) is required for on-premises connectivity via site-to-site VPN or FastConnect. Updating your route table so that 0.0.0.0/0 goes to the NAT Gateway for Internet traffic and the specific on-premises CIDR goes to the DRG fulfills both requirements.
- C. Incorrect.
Option 3 is incorrect because the Service Gateway is designed for private access to Oracle Cloud Infrastructure services (like Object Storage), not for general Internet access. Moreover, a Local Peering Gateway cannot connect to on-premises data centers�it only peers VCNs within the same region.
- D. Incorrect.
Option 4 is incorrect. A NAT Gateway cannot terminate on-premises VPN traffic. Additionally, the Internet Gateway would require public IP addresses or a public subnet for direct outbound access. Since the subnet is private, the NAT Gateway should handle outbound Internet traffic, not the Internet Gateway.