1Z0-1123-25 Question 23
Select 2Your organization is migrating a three-tier application to Oracle Cloud Infrastructure (OCI). The design includes a public subnet with a load balancer that must receive traffic from the internet, and two private subnets: one for the application servers and one for the database. The application servers must download operating system updates via the public internet while remaining private for incoming traffic. Which two configuration steps should you implement to meet these requirements?
- A
Provision an Internet Gateway and configure a route in the public subnet� route table to direct 0.0.0.0/0 traffic to this gateway.
- B
Deploy a NAT Gateway and configure a route in the private subnet� route table to direct 0.0.0.0/0 traffic to this gateway for outbound updates.
- C
Use a Dynamic Routing Gateway (DRG) to allow inbound internet traffic from external sources directly into the private subnets.
- D
Configure a Service Gateway to allow both inbound and outbound internet traffic from the public and private subnets simultaneously.
- E
Place the public load balancer and the application servers in the same subnet for simplified routing to the internet.
Show answer and explanation
Correct answers: A, B
Explanation
To allow inbound connections from the internet, you need an Internet Gateway attached to your VCN and an appropriate route rule in the public subnet� route table. Private subnets that require outbound connections to the internet without allowing inbound traffic should use a NAT Gateway. This design separates the public load balancer from private application and database tiers, aligning with OCI best practices for securing multi-tier applications. For more information, refer to the Oracle Cloud Infrastructure Networking Concepts documentation: https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm
- A. Correct.
Correct. An Internet Gateway allows inbound web traffic from the internet to the load balancer. You must also update the public subnet� route table to send outbound traffic to the Internet Gateway (0.0.0.0/0).
- B. Correct.
Correct. A NAT Gateway provides outbound internet access for instances in private subnets without exposing them to inbound traffic from the internet. You must update the private subnet� route table so that traffic to 0.0.0.0/0 is directed to the NAT Gateway.
- C. Incorrect.
Incorrect. A Dynamic Routing Gateway (DRG) is primarily used for hybrid connectivity (e.g., connecting on-premises environments to OCI) or cross-VCN peering. It does not enable inbound internet access directly from external hosts.
- D. Incorrect.
Incorrect. A Service Gateway provides access to specific OCI services (such as Object Storage) without using the public internet. It is not suitable for generic internet traffic or inbound requests from external sources.
- E. Incorrect.
Incorrect. Placing the load balancer and application servers in the same subnet is not recommended for a multi-tier design. It compromises security granularity and does not isolate public-facing components from back-end application components.