1Z0-1151-25 Question 39
Single answerYour organization wants to connect an on-premises data center to a newly created Virtual Cloud Network (VCN) in Oracle Cloud Infrastructure (OCI) via a Dynamic Routing Gateway (DRG). The VCN has a private subnet containing application servers. You need to ensure that on-premises traffic can securely reach these servers in the private subnet. Which configuration change is required to route on-premises traffic to the private subnet in OCI?
- A
Configure a new NAT Gateway and update the subnet� route table to use the NAT Gateway for the on-premises CIDR.
- B
Add a route rule in the private subnet� route table with the on-premises CIDR as the destination and the DRG as the target.
- C
Modify the security list to allow inbound traffic from 0.0.0.0/0 to the private subnet.
- D
Set up a Service Gateway and direct all traffic from on-premises to the Service Gateway.
Show answer and explanation
Correct answer: B
Explanation
To allow on-premises traffic to reach a private subnet through a DRG in OCI, you must create a route rule in the relevant route table that points the on-premises CIDR block to the DRG. This ensures that traffic originating from on-premises will be correctly forwarded into the private subnet. For more information, see the official OCI documentation on DRG setup and route table configuration: https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/managingDRGs.htm.
- A. Incorrect.
Incorrect: A NAT Gateway is used primarily for outbound connections from private subnets to the public internet without exposing private IPs. It does not help in routing on-premises traffic to a private subnet through the DRG.
- B. Correct.
Correct: By adding a route rule in the private subnet� route table that specifies the on-premises CIDR block as the destination and the DRG as the target, you enable traffic to flow correctly from the on-premises network to the private subnet through the DRG.
- C. Incorrect.
Incorrect: While security lists (or NSGs) need to allow specific ports and sources, simply opening traffic from 0.0.0.0/0 is not a best practice and does not by itself ensure routing. You still need the appropriate route rule pointing to the DRG.
- D. Incorrect.
Incorrect: A Service Gateway provides private access to Oracle services such as Object Storage without needing a public IP. It is not intended for routing on-premises traffic directly to a private subnet.