1Z0-1072-25 Question 74
Select 2You are deploying a three-tier application in Oracle Cloud Infrastructure (OCI). The web servers are in a public subnet, and the application servers are in a private subnet. You need to allow inbound traffic over port 8080 from only the web servers to the application servers. You are concerned that the source IP addresses of the web servers may change over time, and you want to avoid manually updating firewall rules whenever that happens. Which two approaches can help ensure that only valid traffic from the web servers is allowed to reach the application servers on port 8080?
- A
- Create a Security List rule on the private subnet that allows inbound TCP traffic on port 8080 from the specific public IP addresses of the web servers.
- B
- Use a Network Security Group for the application servers that allows ingress from the web servers� Network Security Group on port 8080.
- C
- Create a Security List rule on the private subnet with a source of 0.0.0.0/0, restricting the destination port to 8080.
- D
- Assign both the web servers and the application servers to the same Network Security Group and allow port 8080 within that group.
Show answer and explanation
Correct answers: B, D
Explanation
To avoid constantly updating source IP addresses, it is best to rely on Network Security Groups (NSGs). An NSG approach uses the concept of grouping resources and allowing traffic based on group membership rather than specific IP addresses. In contrast, Security Lists operate at the subnet level and typically require explicit CIDR ranges, making them less flexible if IP addresses change. Refer to Oracle� documentation on 'Using Network Security Groups' for recommended practices in a dynamic environment.
- A. Incorrect.
Option 1 is incorrect because specifying the web servers' public IPs in the Security List means you must manually update these rules if the web servers' IP addresses change. This approach is not scalable when IP addresses change or when new web servers are introduced.
- B. Correct.
Option 2 is correct. Configuring a Network Security Group (NSG) for the application servers that permits ingress from the web servers� NSG (instead of specific IP addresses) ensures that changing IPs on the web side won't require manual rule updates. The NSG reference is dynamic: as long as the web servers are in the 'web server NSG,' traffic is allowed.
- C. Incorrect.
Option 3 is incorrect because allowing 0.0.0.0/0 opens the application servers to traffic from anywhere on port 8080. While it may functionally enable communication from the web servers, it violates the principle of least privilege and poses a security risk.
- D. Correct.
Option 4 is correct. Placing both web servers and application servers in the same NSG and then creating an in-group rule for port 8080 is a supported design. Traffic within the same NSG can be restricted to specific ports, ensuring that only valid traffic flows between these tiers.