1Z0-1151-25 Question 22
Select 2Your company is deploying a three-tier e-commerce application on Oracle Cloud Infrastructure (OCI). The application has a public-facing front-end, a middle-tier for processing orders, and a secure database back-end. Which two actions should you take to ensure a secure and functional deployment, following recommended best practices for core OCI services?
- A
Place the front-end and database in a single public subnet with an Internet Gateway so they can communicate directly over the internet.
- B
Place the front-end servers in a public subnet behind a Load Balancer and the database in a private subnet without direct internet access.
- C
Use a Service Gateway in the front-end subnet for outbound internet traffic to bypass the Internet Gateway requirement.
- D
Use a NAT Gateway for any private subnet that requires outbound internet connectivity without exposing databases publicly.
- E
Enable all inbound traffic temporarily for easier testing of your back-end database and restrict ports later after going live.
Show answer and explanation
Correct answers: B, D
Explanation
In this scenario, OCI best practices recommend segmenting the public (front-end) and private (database) tiers into separate subnets with appropriate gateways. The front-end typically resides in a public subnet behind a Load Balancer, whereas the database and other sensitive components remain in private subnets without direct exposure to the internet. When private resources need to initiate outbound connections, a NAT Gateway is used. For more information, refer to OCI Networking Best Practices in the Oracle documentation: https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm.
- A. Incorrect.
Option 1 is incorrect. Combining the front-end and database in a single public subnet violates security best practices, as the database should not be directly exposed to the internet.
- B. Correct.
Option 2 is correct. It is a common best practice to place the front-end in a public subnet (behind a Load Balancer) and the database in a private subnet that has no direct route to the internet, reducing security risks.
- C. Incorrect.
Option 3 is incorrect. A Service Gateway is typically used to securely access OCI services (like Object Storage) without routing traffic over the public internet, not to handle external internet-bound traffic for user-facing components.
- D. Correct.
Option 4 is correct. A NAT Gateway allows resources in private subnets to initiate outbound connections to the internet (for software updates, etc.) without exposing them via a public IP address.
- E. Incorrect.
Option 5 is incorrect. Leaving all inbound ports open is risky; ports should be opened selectively based on the principle of least privilege from the start, rather than open-all-then-close-later.