1Z0-1072-25 Question 71
Select 2You have provisioned a web server in a private subnet within your Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN). You created a NAT Gateway in the same VCN to allow the server outbound internet access for security updates. However, the server still cannot reach external update servers. Which TWO actions must you take to enable outbound connectivity through the NAT Gateway?
- A
Attach an Internet Gateway to the VCN and configure a route rule in the private subnet� route table to use the Internet Gateway as the default route.
- B
Create a route rule in the private subnet� route table with a destination of 0.0.0.0/0 and a target of the NAT Gateway.
- C
Open the necessary outbound ports in the subnet� security list or network security group to allow external traffic.
- D
Configure a Service Gateway in the VCN and direct the outbound traffic to the Service Gateway for internet access.
- E
Create a route rule in the NAT Gateway� route table pointing back to the private subnet.
Show answer and explanation
Correct answers: B, C
Explanation
To allow instances in a private subnet to reach external internet resources via a NAT Gateway in OCI, you must create a route rule for 0.0.0.0/0 pointing to the NAT Gateway in that subnet� route table and open the necessary outbound ports in the subnet� security list or network security group. Refer to OCI documentation on 'NAT Gateways' and 'Route Tables' for more details on properly configuring outbound connectivity in private subnets.
- A. Incorrect.
Option 1 is incorrect because attaching an Internet Gateway and routing private subnet traffic directly to it would bypass the NAT Gateway requirement. Private subnets typically shouldn�t use an Internet Gateway to ensure inbound traffic from the public internet is restricted.
- B. Correct.
Option 2 is correct. In OCI, the private subnet must have a route rule for 0.0.0.0/0 directing outbound traffic towards the NAT Gateway. This ensures all external requests go through the NAT Gateway rather than an Internet Gateway.
- C. Correct.
Option 3 is correct. Even with the NAT Gateway and route rules configured, security lists (or Network Security Groups) must explicitly allow outbound traffic on required ports (e.g., TCP port 80 or 443) for updates to succeed.
- D. Incorrect.
Option 4 is incorrect because a Service Gateway is used primarily to connect privately to Oracle Services such as Object Storage, not the public internet. It does not route general internet traffic.
- E. Incorrect.
Option 5 is incorrect because NAT Gateways do not require individual route tables. The route rule for outbound traffic resides in the specific subnet's route table, not the NAT Gateway itself.