1Z0-1151-25 Question 37
Select 2You are designing a new Oracle Cloud Infrastructure environment for a microservices-based application. The application has a public subnet for front-end servers and a private subnet for back-end services. Requirements state that resources in the private subnet must be able to send outbound traffic to the internet for updates and communicate securely with a separate VCN in the same region for shared database access. Which two actions should you take to meet these requirements while following best practices for VCN management?
- A
Configure an Internet Gateway (IG) on the private subnet� route table.
- B
Add a NAT Gateway to the VCN and update the private route table to direct 0.0.0.0/0 traffic to the NAT Gateway.
- C
Create a Local Peering Gateway (LPG) in both VCNs and configure the route tables to direct traffic between them.
- D
Use a Service Gateway to route all private subnet internet-bound traffic.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirements of allowing outbound internet traffic from a private subnet while also enabling secure communication with another VCN, you should use a NAT Gateway for internet-bound traffic and set up Local Peering Gateways for inter-VCN connectivity. Directly attaching an Internet Gateway to a private subnet is generally considered less secure because it can expose back-end services to inbound internet requests. A Service Gateway targets Oracle Services only and does not facilitate outbound internet connectivity. Consult the Oracle Cloud Infrastructure Virtual Cloud Network documentation for additional configuration details and best practices.
- A. Incorrect.
Option 1 is incorrect. Direct attachment of an Internet Gateway to a private subnet route table exposes the subnet to inbound internet traffic, violating typical best-practice security guidelines for private subnets.
- B. Correct.
Option 2 is correct. A NAT Gateway allows outbound internet connections from a private subnet while preventing inbound connections, aligning with best practices for secure private subnets.
- C. Correct.
Option 3 is correct. Local Peering Gateways enable routing between two VCNs in the same region without using an external route. This allows private subnet resources to communicate securely with resources in another VCN.
- D. Incorrect.
Option 4 is incorrect. A Service Gateway is primarily used to access Oracle services (like Object Storage) on the Oracle Services Network. It does not provide general outbound internet connectivity.