1Z0-1072-25 Question 78
Select 2Your organization has an internet-facing load balancer in a public subnet that routes web traffic to backend compute instances in a private subnet. You also need to allow SSH access to the backend instances exclusively from specific corporate IP addresses. Which two configuration steps will ensure that only HTTP/HTTPS traffic is exposed to the public internet while limiting SSH to the corporate addresses?
- A
A. Grant inbound TCP access on ports 80 and 443 from 0.0.0.0/0 in the load balancer� Network Security Group, and apply a Network Security Group to the backend instances allowing SSH only from the corporate IP range.
- B
B. Create a Security List rule allowing all inbound TCP ports from 0.0.0.0/0 in the public subnet that hosts the load balancer, and rely on stateful inspection to block unwanted traffic to the backend subnet.
- C
C. Configure your public subnet� Security List to allow inbound TCP on ports 80 and 443 from 0.0.0.0/0, and in the private subnet� Network Security Group, allow inbound traffic on port 22 only from your corporate IP range.
- D
D. Assign a Security List to both subnets that allows inbound SSH from 0.0.0.0/0, but mark it as �stateless� so it will be blocked if it is not initiated by the backend compute instances.
- E
E. Place the load balancer and the backend compute instances in the same subnet, allowing the load balancer to manage SSH connections from the internet on your behalf.
Show answer and explanation
Correct answers: A, C
Explanation
In Oracle Cloud Infrastructure, it is recommended to use a public subnet and security configurations (Security Lists or Network Security Groups) that allow only necessary inbound ports (typically 80/443) from the internet. For backend compute instances requiring SSH, best practice is to place them in a private subnet and attach suitable Network Security Group rules (or Security List rules) allowing SSH only from specific trusted IP sources. This layered approach reduces the attack surface and ensures that sensitive ports like SSH are never exposed to the general internet. Refer to the OCI documentation on 'Using Network Security Groups' and 'Security Lists' for detailed configuration examples and best practices.
- A. Correct.
A. CORRECT. Applying an NSG to the load balancer for public HTTP/HTTPS ports (80, 443) and a separate NSG to the backend instances for exclusive SSH access from corporate IP addresses is a recommended split. This ensures each tier has its own set of rules, minimizing exposure to the internet.
- B. Incorrect.
B. INCORRECT. Allowing all inbound TCP ports from 0.0.0.0/0 in the public subnet's Security List is overly permissive. Stateful inspection alone does not restrict which ports can be accessed; you should explicitly restrict unwanted ports.
- C. Correct.
C. CORRECT. Using a Security List to allow only HTTP/HTTPS for the public subnet and an NSG in the private subnet for limiting SSH to the corporate IP range is a solid approach. This is a typical OCI best practice, ensuring minimal public exposure.
- D. Incorrect.
D. INCORRECT. Marking rules as �stateless� does not automatically block inbound SSH from the internet. Stateless rules do not track connection state, but they do not serve as a protection against unintended inbound traffic.
- E. Incorrect.
E. INCORRECT. Placing everything in the same subnet does not restrict public SSH. The load balancer does not intrinsically manage SSH rules; it handles HTTP/HTTPS traffic. A separate private subnet and appropriate filtering are preferred for security.