1Z0-1151-25 Question 40
Select 2Your organization has created a new private subnet (10.0.2.0/24) in an existing VCN with a CIDR block of 10.0.0.0/16 for application servers. These servers need to download updates from external sources on the Internet while remaining inaccessible from the Internet. You decide to use a NAT Gateway for outbound connections from the private subnet. Which two actions must you perform to ensure outbound Internet access from the private subnet using the NAT Gateway?
- A
- Create and apply a route rule in the private subnet� route table that sends 0.0.0.0/0 traffic to the NAT Gateway.
- B
- Update the private subnet� security lists (or NSGs) to allow outbound egress for the required Internet traffic.
- C
- Attach the NAT Gateway to the Internet Gateway's route table to forward requests for external traffic.
- D
- Assign public IP addresses to the compute instances in the private subnet so they can directly access the Internet.
Show answer and explanation
Correct answers: A, B
Explanation
To enable outbound Internet traffic from a private subnet using a NAT Gateway, you must create a route rule in the private subnet� route table pointing to the NAT Gateway for 0.0.0.0/0, and ensure the security rules (or Network Security Groups) allow the appropriate outbound traffic. The NAT Gateway then forwards traffic to the Internet Gateway without exposing private instances publicly. Refer to the official Oracle Cloud Infrastructure documentation on NAT Gateway configuration (docs.oracle.com/en-us/iaas/Content/Network/Tasks/nat-gateway.htm) for best practices and step-by-step instructions.
- A. Correct.
Option 1 is correct. You must add a route rule to direct all Internet-bound traffic (0.0.0.0/0) from the private subnet to the NAT Gateway so instances can reach external resources.
- B. Correct.
Option 2 is correct. Even with a NAT Gateway, you need to ensure that your security rules (or NSGs attached to the instances) allow outgoing traffic on the ports and protocols needed, such as HTTP/HTTPS.
- C. Incorrect.
Option 3 is incorrect. The NAT Gateway is placed in the private subnet� route table, not the Internet Gateway� route table. The Internet Gateway is for public subnets or publicly routable components. NAT Gateway traffic is routed internally to the gateway, and then the gateway handles outbound requests.
- D. Incorrect.
Option 4 is incorrect. Assigning public IP addresses to private subnet instances defeats the purpose of using a NAT Gateway for private access, and would expose those instances directly to the Internet.