1Z0-1151-25 Question 27
Select 2You are designing a multi-cloud solution to host a critical web application on Oracle Cloud Infrastructure (OCI). The web tier must remain in a private subnet without accepting any inbound connections from the public internet. However, your back-end servers need outbound connectivity to an external partner's on-premises network for data synchronization. Which two OCI network components should you configure to allow secure outbound traffic while blocking inbound connections from the public internet?
- A
Internet Gateway (IG)
- B
NAT Gateway
- C
Dynamic Routing Gateway (DRG)
- D
Service Gateway
Show answer and explanation
Correct answers: B, C
Explanation
To securely provide outbound connectivity for servers in a private subnet while preventing inbound public internet connections, you typically employ a NAT Gateway (for outbound internet access without inbound exposure) and a Dynamic Routing Gateway (to connect to on-premises networks via IPSec VPN or FastConnect). This approach aligns with OCI best practices for isolating workloads and ensures compliance with the requirement to restrict public inbound traffic.
- A. Incorrect.
- Internet Gateway (IG): Incorrect. An Internet Gateway allows both outbound and inbound traffic to the subnet if security rules permit it. Since the requirement is to block inbound connections from the public internet, relying on an IG would contradict that goal.
- B. Correct.
- NAT Gateway: Correct. A NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet or external networks without allowing inbound connections. This meets the requirement of securing outbound connectivity for the application.
- C. Correct.
- Dynamic Routing Gateway (DRG): Correct. A DRG is used to establish private connectivity between your VCN and external networks (e.g., on-premises data centers). In this scenario, it enables secure outbound communication to the partner� on-premises network.
- D. Incorrect.
- Service Gateway: Incorrect. A Service Gateway provides private access to Oracle services (e.g., Object Storage) within OCI without using the public internet. It does not address connectivity to an external partner� on-premises network.