1Z0-1072-25 Question 70
Select 2You have a Virtual Cloud Network (VCN) in Oracle Cloud Infrastructure containing a private subnet that must download software updates from the public internet, but inbound access from the internet should remain blocked. You have already created a NAT Gateway for outbound traffic. Which two steps must you take so that compute instances in the private subnet can successfully reach external update servers?
- A
Add a route rule in the private subnet� route table to send 0.0.0.0/0 to the NAT Gateway as the target.
- B
Add a route rule in the private subnet� route table to send 0.0.0.0/0 to the Internet Gateway as the target.
- C
Update the security list or Network Security Group for the private subnet to allow outbound traffic on necessary ports.
- D
Attach the NAT Gateway to a public Load Balancer that forwards inbound patch requests to the private subnet.
Show answer and explanation
Correct answers: A, C
Explanation
In Oracle Cloud Infrastructure, a NAT Gateway allows instances in a private subnet to access public resources for software updates while preventing inbound connections from the internet. To enable outbound traffic, you must add a route rule directing 0.0.0.0/0 to the NAT Gateway. Additionally, the private subnet� security list or Network Security Group must allow outbound traffic on the necessary ports. For more details, refer to Oracle� documentation on configuring NAT Gateways and security lists.
- A. Correct.
Correct. A NAT Gateway must be specified in the private subnet� route table, sending the default traffic (0.0.0.0/0) to the NAT Gateway for outbound internet access without exposing instances to inbound traffic.
- B. Incorrect.
Incorrect. Routing the private subnet� traffic directly to an Internet Gateway would permit inbound public traffic, which contradicts the requirement to keep inbound access blocked.
- C. Correct.
Correct. Even with a NAT Gateway and correct route rules in place, the private subnet� security configuration (security list or Network Security Group) must allow outbound connections on required ports (e.g., HTTP/HTTPS) for software updates to succeed.
- D. Incorrect.
Incorrect. A NAT Gateway is not designed to handle inbound requests from the internet; attaching it to a public Load Balancer does not solve the requirement for outbound patch updates and would also risk exposing servers to public traffic.