1Z0-1072-25 Question 76
Select 2You launched a Compute instance in a private subnet in your Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN). The instance is attached to a Network Security Group (NSG). There is also an on-premises connection through a Dynamic Routing Gateway (DRG), with on-premises IP addresses in the 10.10.0.0/16 range. You created an ingress rule in the NSG to allow SSH (TCP port 22) from 10.10.0.0/16, but you still cannot establish an SSH connection from on-premises. The default security list is attached to the private subnet with no inbound rules. Which two steps must you perform to successfully allow inbound SSH from your on-premises environment? (Choose two.)
- A
Add a route rule in the private subnet's route table for 10.10.0.0/16 with the DRG as the target.
- B
Convert your NSG ingress rule from stateful to stateless so that return traffic is automatically allowed.
- C
Create an ingress security rule in the private subnet's Security List to allow SSH (TCP port 22) from 10.10.0.0/16.
- D
Create an egress security rule in the NSG for ephemeral ports (TCP 49152�65535) returning to 10.10.0.0/16.
- E
Assign a public IP address to the instance so it can be reached directly from the internet.
Show answer and explanation
Correct answers: A, C
Explanation
To enable inbound connections from on-premises, you must ensure traffic can route correctly between your private subnet and on-premises network. First, define a route in the subnet's route table pointing 10.10.0.0/16 to the DRG so that traffic flows to and from your on-premises environment. Second, remember that both NSG and security list rules apply. Even if the NSG allows SSH, the default security list attached to the subnet can still block inbound traffic. You must either allow the same port/traffic source in the security list or remove/replace the default security list. Refer to OCI documentation on 'Network Security Groups' and 'Security Lists' for details on how these mechanisms combine for layered security.
- A. Correct.
Correct. The subnet route table needs a route for on-premises IP addresses (10.10.0.0/16) with the DRG as the target. Without this route, traffic from on-premises will not reach the subnet, even if firewall rules are correctly configured.
- B. Incorrect.
Incorrect. OCI NSG rules are stateful by default, meaning return traffic is automatically allowed when you create a stateful ingress rule. Converting to stateless is not required and can complicate management of return traffic.
- C. Correct.
Correct. Since the default security list is still attached to the subnet with no inbound rules, traffic is effectively blocked there. You must either remove that security list or explicitly allow SSH on TCP port 22 from 10.10.0.0/16 in it. Subnet-level security lists and NSGs both apply, so blocking in either will deny traffic.
- D. Incorrect.
Incorrect. If your NSG rules are stateful, ephemeral ports for return traffic do not need a separate egress rule (stateful rules automatically allow response traffic). This step is unnecessary for enabling SSH from on-premises.
- E. Incorrect.
Incorrect. Assigning a public IP only exposes the instance to the public internet, which is not required for private on-premises connectivity through the DRG. A public IP would bypass the original goal of using the private subnet and private on-premises connection.