1Z0-1151-25 Question 24
Single answerYour organization plans to deploy two separate departmental applications in Oracle Cloud Infrastructure (OCI). The finance application must remain private (accessible only within the company� network) but still be reachable by a marketing application that needs internet access to serve public web content. Both departments must manage their own resources and maintain strict governance. Based on OCI best practices for network security and resource organization, which approach best meets these requirements?
- A
Create a single compartment with a single public subnet, place both applications there, and use local firewall rules to isolate the finance application from the internet.
- B
Create two compartments (Finance and Marketing), with the finance servers in a private subnet and the marketing servers in a public subnet, and set up the appropriate gateways and route rules for inter-subnet communication.
- C
Use a single private subnet and dynamically attach and detach an Internet Gateway to allow the marketing application to accept public requests when needed.
- D
Place both finance and marketing servers in the same private subnet and use a NAT Gateway for all outbound traffic, forcing the finance application to rely on the marketing application for internet access.
Show answer and explanation
Correct answer: B
Explanation
Following OCI best practices, separate compartments help each department maintain autonomous resource management and governance. Meanwhile, using a private subnet and an appropriately configured gateway for finance ensures that the application remains non-public, while a public subnet and an Internet Gateway enable the marketing application to serve public traffic. For more information, refer to the OCI documentation on �Virtual Cloud Networks, Subnets, and Gateways� and �Compartments Best Practices.�
- A. Incorrect.
Incorrect. A single public subnet exposes the finance application to potential internet access. Firewall rules alone do not provide the strict isolation required for compliance. Also, separate compartments are recommended for governance and security management.
- B. Correct.
Correct. Creating dedicated compartments for each department ensures proper access control and governance, while using a private subnet for finance and a public subnet for marketing aligns with OCI� security best practices. Proper gateway configurations (Internet Gateway for marketing, potential Service Gateway or local network connectivity for finance) enable controlled traffic flows.
- C. Incorrect.
Incorrect. Dynamically attaching and detaching an Internet Gateway is cumbersome, error-prone, and not aligned with recommended architecture patterns. It doesn�t enforce consistent private isolation for finance nor ease of governance for each department.
- D. Incorrect.
Incorrect. Sharing a private subnet does not satisfy the requirement for public-facing marketing content. A NAT Gateway only provides outbound connections to the internet, and it cannot accept inbound connections for the marketing application.