1Z0-1072-25 Question 75
Single answerYou have deployed an internal load balancer in one subnet and an application server in another subnet within the same VCN. The load balancer forwards traffic on port 8080 to the application server. Additionally, your office network must be able to SSH into the server on port 22. Currently, the application server is only associated with the default Security List for its subnet. Which configuration approach provides the simplest way to ensure only the load balancer can access port 8080 on the server and only your office network can access port 22?
- A
Add two new ingress rules to the existing default Security List: one allowing port 8080 from the load balancer subnet range, and another allowing port 22 from your office IP range. Remove any broader inbound rules from the list.
- B
Create a new Network Security Group (NSG) for the application server, define ingress rules for port 8080 from the load balancer subnet and port 22 from your office IP range, and remove broad inbound rules from the default Security List or disassociate it if not needed.
- C
Configure a Security List in the load balancer's subnet to allow traffic on port 8080 from the application server's private IP, and rely on the default Security List for SSH traffic to the server.
- D
Enable stateful inspection on the default Security List for all inbound ports and rely on ephemeral ports for any new inbound connections.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, Network Security Groups (NSGs) provide a targeted way to define and maintain security rules at the instance level, ensuring that only approved traffic from specific sources and ports is allowed. Utilizing NSGs helps avoid overly permissive or complicated Security List configurations at the subnet level. For more details, see Oracle� documentation on working with Network Security Groups to control network traffic effectively.
- A. Incorrect.
Incorrect. While adding ingress rules to the default Security List can work, it's not considered best practice when fine-grained control is needed for specific instances. Using only the default list risks overly broad rules if not carefully maintained.
- B. Correct.
Correct. Creating a Network Security Group allows you to isolate instance-specific rules (port 8080 from the load balancer subnet, port 22 from your office IP range) and remove or disassociate any wider subnet-level rules in the default Security List. This approach strikes the right balance between security and simplicity.
- C. Incorrect.
Incorrect. The application server, not the load balancer, needs the rule. The load balancer� Security List alone does not prevent other sources from potentially reaching the server if the server� default list remains broad.
- D. Incorrect.
Incorrect. Simply enabling stateful inspection for all inbound ports in the default list does not restrict traffic to specific source IP ranges or subnets. This leaves the server exposed to inbound requests on all ports.