1Z0-1123-25 Question 20
Single answerA financial services company is migrating a three-tier application to OCI. The web tier runs on a public subnet, and the application and database tiers reside on private subnets. To apply regular security patches, the application servers on the private subnet need outbound internet connectivity but must remain inaccessible from outside. Which design choice best meets these requirements?
- A
Attach an Internet Gateway to the VCN and add a 0.0.0.0/0 route from the private subnet
- B
Use a NAT Gateway and add a 0.0.0.0/0 route from the private subnet to the NAT Gateway
- C
Peer the private subnet with the public subnet and route traffic through an internal load balancer
- D
Place the application servers in a public subnet and create a stateful security list blocking inbound connections
Show answer and explanation
Correct answer: B
Explanation
For outbound-only access to the public internet from private subnets, a NAT Gateway is the recommended solution. It enables instances in the private subnet to initiate connections out to the internet for tasks such as downloading patches, while preventing unsolicited inbound traffic. Refer to the OCI Networking documentation (https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm) for guidelines on configuring gateways, route tables, and security lists in a Virtual Cloud Network.
- A. Incorrect.
Incorrect. An Internet Gateway would allow outbound connectivity, but it also permits potential inbound connections if security lists are misconfigured. This approach isn't recommended for private subnets requiring outbound-only access.
- B. Correct.
Correct. A NAT Gateway provides outbound access to the internet for resources in a private subnet while preventing inbound connections, which aligns exactly with the requirement to patch application servers without exposing them to external sources.
- C. Incorrect.
Incorrect. Peering the private subnet with the public subnet and routing traffic through an internal load balancer doesn�t directly provide outbound internet access. Traffic still needs a path to the public internet, which this option does not address properly.
- D. Incorrect.
Incorrect. Placing application servers in a public subnet inherently exposes them to the internet. While a security list could block inbound connections, this contradicts the best practice of keeping sensitive components in private subnets.