1Z0-1123-25 Question 24
Select 2Your organization is migrating a legacy reporting application to Oracle Cloud Infrastructure (OCI). The application runs on servers in a private subnet that must remain unreachable from the public Internet, but it needs to periodically download security patches from external repositories. You already created a Virtual Cloud Network (VCN) with separate public and private subnets. Which two fundamental tasks must you perform to enable outbound connections from the private subnet for these patch updates while maintaining inbound security? (Choose two.)
- A
Create an Internet Gateway and update the route table of the private subnet to direct 0.0.0.0/0 traffic to the Internet Gateway.
- B
Deploy a NAT Gateway and update the route table of the private subnet to direct 0.0.0.0/0 traffic to the NAT Gateway.
- C
Configure Security Lists or Network Security Groups to allow outbound traffic to external destinations from the private subnet.
- D
Deploy a Service Gateway and update the private subnet� route table to send all external traffic through the Service Gateway.
Show answer and explanation
Correct answers: B, C
Explanation
When configuring a private subnet that cannot be directly accessed from the Internet but still needs to reach external services, the recommended OCI approach is to deploy a NAT Gateway and set up appropriate routing in the private subnet� route table. Security Lists or Network Security Groups must also allow outbound traffic to the external patch repository addresses. This configuration ensures inbound protection while providing outbound connectivity. For additional details, refer to the Oracle Cloud Infrastructure documentation on NAT Gateways and network security configuration.
- A. Incorrect.
Option 1: Incorrect. Using an Internet Gateway for the private subnet would allow inbound traffic from the public Internet, compromising the application's security requirement.
- B. Correct.
Option 2: Correct. A NAT Gateway enables instances in a private subnet to access external Internet services without exposing those instances to inbound traffic.
- C. Correct.
Option 3: Correct. Even with a NAT Gateway in place, security rules must explicitly allow outbound connections to access patch repositories, ensuring that only approved outbound traffic is permitted.
- D. Incorrect.
Option 4: Incorrect. A Service Gateway provides private access to Oracle services (e.g., Object Storage) without traversing the public Internet, but is not used for general external Internet connectivity.