1Z0-1104-25 Question 68
Select 2You have set up a new OCI environment with a public subnet hosting an Internet-facing Load Balancer (LB) and a private subnet hosting application servers. You want to ensure that external traffic can only reach the application servers through the LB, and you also want to apply fine-grained security rules to protect against unwanted lateral movement within the VCN. Which two steps should you take to achieve this goal?
- A
Place the Load Balancer and the application servers in the same Network Security Group (NSG) and rely on default Security List settings for the subnets.
- B
Create a dedicated NSG for the application servers and add a restricted inbound rule that only allows traffic from the Load Balancer on required ports.
- C
Update the private subnet's Security List to allow inbound traffic only from the Load Balancer� public IP addresses on the necessary ports.
- D
Use an OCI Network Firewall in the public subnet set to allow all inbound traffic from the Internet to the private subnet.
Show answer and explanation
Correct answers: B, C
Explanation
To secure application servers within a private subnet, best practices involve both using Network Security Groups (NSGs) and properly configuring Security Lists. By creating a dedicated NSG for the private subnet and restricting inbound rules to only the Load Balancer� IP addresses or subnets, you ensure all external traffic is funneled through the LB. Additionally, updating the Security List to allow only the LB� IP addresses on the required ports adds another layer of defense. Refer to OCI documentation on Network Security Groups, Security Lists, and Network Firewall for recommended architectures and detailed configuration guidance.
- A. Incorrect.
Option 1 is incorrect. Placing the LB and application servers in the same NSG with default Security List rules may inadvertently allow direct traffic from the Internet to the application servers, undermining the requirement for isolation and fine-grained access control.
- B. Correct.
Option 2 is correct. A dedicated NSG for the application servers with specific ingress rules allows you to tightly control traffic flowing from the LB to the servers on the necessary ports, ensuring that direct Internet access is not permitted.
- C. Correct.
Option 3 is correct. Modifying the private subnet's Security List to allow inbound connections only from the LB� public IP addresses on specific ports ensures proper segmentation and conforms to the requirement that all external traffic must pass through the LB first.
- D. Incorrect.
Option 4 is incorrect. Configuring an OCI Network Firewall in the public subnet to allow all inbound traffic to the private subnet defeats the purpose of filtering and controlling the traffic flow to the servers. This approach would leave the servers more exposed than desired.