1Z0-1123-25 Question 22
Single answerYou have migrated a multi-tier web application to Oracle Cloud Infrastructure (OCI). The web servers are deployed in a public subnet to handle incoming traffic, while the application servers and databases are in private subnets. You need the application servers in the private subnet to periodically fetch updates from external sources on the internet without allowing unsolicited inbound connections from the internet. Which OCI networking service would fulfill this requirement?
- A
Internet Gateway
- B
NAT Gateway
- C
Service Gateway
- D
Local Peering Gateway
Show answer and explanation
Correct answer: B
Explanation
In this scenario, the key requirement is for hosts in a private subnet to access the internet for updates without allowing inbound internet traffic. The NAT Gateway is purpose-built for that purpose: it provides outbound access for private resources while blocking incoming internet connections. Refer to the OCI Networking documentation, specifically the section on NAT Gateways, for additional best practices and guidelines for implementing secure outbound access.
- A. Incorrect.
Incorrect. An Internet Gateway allows full inbound and outbound internet connectivity for public subnets, exposing endpoints in the subnet directly to the internet. This does not match the requirement to block inbound connections to hosts in the private subnet.
- B. Correct.
Correct. A NAT Gateway allows outbound access from private subnets to the internet while denying any inbound traffic that is not initiated from within the private subnet. This addresses the requirement to fetch external updates without opening the private subnet to unsolicited inbound traffic.
- C. Incorrect.
Incorrect. A Service Gateway is used to access Oracle Cloud services (e.g., Object Storage) privately without traversing the public internet. It does not provide general outbound internet access.
- D. Incorrect.
Incorrect. A Local Peering Gateway enables private traffic exchange between VCNs in the same region without using the public internet. It doesn't provide outbound connections to the internet.