1Z0-1123-25 Question 21
Select 2You are migrating a three-tier application to Oracle Cloud Infrastructure (OCI). The application servers are deployed on private subnets and require outbound access to the internet for patch downloads and package updates. However, your security policy mandates that these private servers must not accept any incoming connections directly from the internet. Which two steps must you perform to enable secure outbound internet connectivity for these private instances?
- A
Configure a NAT Gateway in your VCN and add a default route in the private subnet� route table pointing to the NAT Gateway.
- B
Create an Internet Gateway and use public IP addresses on the private instances to route all internet traffic through the Internet Gateway.
- C
Allow outbound HTTPS (TCP port 443) in the security lists or Network Security Groups for the private subnet.
- D
Set up a Service Gateway for direct connections to the general internet.
Show answer and explanation
Correct answers: A, C
Explanation
In OCI, private instances can securely download updates from the internet by using a NAT Gateway to facilitate outbound connections while preventing inbound connections. The route table must direct outbound traffic (0.0.0.0/0) to the NAT Gateway. Additionally, the security configuration (either via security lists or Network Security Groups) must allow outbound HTTPS. This configuration satisfies security requirements by limiting inbound connections and allowing only necessary outbound communication. For more details, refer to the 'Managing Gateways' section in the OCI Networking documentation (https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managinggateways.htm).
- A. Correct.
Correct. A NAT Gateway allows private instances to initiate outbound connections to the internet without enabling inbound connections from the internet. Updating the route table with a route rule (0.0.0.0/0) pointing to the NAT Gateway ensures traffic from the private subnet is routed correctly for external updates.
- B. Incorrect.
Incorrect. An Internet Gateway would enable both inbound and outbound traffic for the instances unless further mitigated; assigning public IP addresses on private servers directly exposes them to the internet, violating the security requirement.
- C. Correct.
Correct. You must explicitly allow outbound requests through a security list or Network Security Group on the private subnet. Opening TCP port 443 (HTTPS) ensures your private instances can reach internet patch repositories while not allowing unsolicited inbound traffic.
- D. Incorrect.
Incorrect. A Service Gateway is used for accessing Oracle services privately (for example, Object Storage), not for general outbound internet access. It will not provide connectivity to public external sites needed for software updates.