1Z0-1072-25 Question 73
Select 2Your company has a three-tier application in Oracle Cloud Infrastructure (OCI) 2025. The front-end nodes run in a public subnet, behind an Internet-facing load balancer. The application servers reside in a private subnet, and the database server is in another private subnet. You need to allow inbound traffic only from the load balancer to the application servers on TCP port 8080, and from the application servers to the database server on TCP port 1521. You also want to easily add or remove instances without having to update multiple firewall rules every time. Which two actions should you take to meet these requirements?
- A
Configure a single security list at the VCN level with stateful ingress rules for ports 8080 and 1521 from 0.0.0.0/0.
- B
Assign the application servers and the database server to Network Security Groups (NSGs) that allow inbound rules only from the load balancer� IP addresses and the application servers� IP addresses on ports 8080 and 1521, respectively.
- C
Place the load balancer, application servers, and the database server in the same NSG so that you only need a single set of rules for all components.
- D
Use separate NSGs for the application server tier and the database tier. Configure ingress rules in each NSG that reference the other NSG in the source field, and then attach the appropriate NSG to each instance� VNIC.
- E
Create a dedicated security list for each subnet, referencing the load balancer's ephemeral port range in the application subnet security list and referencing ephemeral ports from the application subnet in the database subnet security list.
Show answer and explanation
Correct answers: B, D
Explanation
Using Network Security Groups (NSGs) is the recommended approach for this scenario because NSGs allow you to dynamically group VNICs and specify granular, stateful security rules. You can reference other NSGs as sources or destinations instead of individual IP addresses or entire subnets. This makes scaling simpler, as you just attach or detach instances from NSGs without constantly editing security list rules. Refer to Oracle Cloud Infrastructure documentation for best practices on distributing rules across NSGs for each tier of a multi-tier application.
- A. Incorrect.
Option 1 is incorrect. Using a single security list at the VCN level and allowing traffic from 0.0.0.0/0 on ports 8080 and 1521 opens those ports to the entire internet, which is not secure. It also does not address the flexibility needed for dynamic scaling.
- B. Correct.
Option 2 is correct. Assigning the application servers and database server to NSGs that explicitly allow only the load balancer's source IP addresses for port 8080, and only the application servers' source IP addresses for port 1521, implements a least-privilege model while making it simpler to add or remove instances through NSG membership.
- C. Incorrect.
Option 3 is incorrect. Placing all components in the same NSG removes the ability to enforce different security postures for front-end, application, and database tiers. This could lead to overly permissive rules and does not follow best practices for tier segregation.
- D. Correct.
Option 4 is correct. Using separate NSGs for the application and database tiers allows you to create rules referencing each other� NSG in the source field, ensuring that only traffic from the appropriate tier reaches each subsequent tier. You can attach instances to the NSGs without constantly updating subnet-level security lists.
- E. Incorrect.
Option 5 is incorrect. While configuring separate security lists for each subnet is possible, referencing ephemeral port ranges from the load balancer and application subnets can become cumbersome. It also requires you to manage subnet-level rules each time new instances are added or removed, which increases management overhead compared to NSGs.