1Z0-1072-25 Question 77
Single answerYou are designing a three-tier application in Oracle Cloud Infrastructure. The application includes web servers in a public subnet, application servers in a private subnet, and a database in another private subnet. You need to ensure that: 1) External HTTPS (port 443) traffic can reach the web servers; 2) The application servers can access the database on port 1521; and 3) The database remains unreachable from the public internet. Which approach meets these requirements with the least exposure?
- A
Create a single Security List with default ingress rules for the entire VCN and open ports 443 and 1521 to all IP addresses.
- B
Use separate Security Lists for each subnet (allowing only port 443 access to the public subnet) and a Network Security Group for the database that only allows ingress from the application servers on port 1521.
- C
Attach a Network Security Group to the entire VCN and allow inbound TCP ports 443 and 1521 from 0.0.0.0/0 for simplicity.
- D
Allow ingress rules for port 443 and 1521 in the default Security List, and rely on the local firewall within each instance for further restrictions.
Show answer and explanation
Correct answer: B
Explanation
The best practice is to use Security Lists and Network Security Groups together to minimize exposure and maintain clear separation of duties. Security Lists can provide broad ingress and egress rules at the subnet level, while Network Security Groups let you finely control traffic for specific instances (like the database). As documented by Oracle, this approach allows you to restrict database access to only the necessary internal hosts, which is critical for both performance and security.
- A. Incorrect.
Incorrect. A single Security List that opens ports 443 and 1521 to all addresses does not limit database access only to the application servers. This setup would expose the database to the public internet.
- B. Correct.
Correct. By having distinct Security Lists for different subnets, you restrict the exposure of ports to only what each subnet requires. Using a Network Security Group specifically for the database tier further limits inbound traffic on port 1521 to only the application servers.
- C. Incorrect.
Incorrect. Applying a single Network Security Group to the entire VCN and opening ports from 0.0.0.0/0 fails to isolate the database from public internet access. This setup also leaves the application servers unnecessarily exposed.
- D. Incorrect.
Incorrect. Relying solely on instance-level firewalls is not a recommended best practice in OCI. It is more secure and manageable to use VCN-level Security Lists and Network Security Groups for traffic filtering.