1Z0-1151-25 Question 42
Single answerYour organization has a private subnet in an OCI Virtual Cloud Network (VCN) that hosts backend application servers. The servers must connect only to on-premises resources through a Dynamic Routing Gateway (DRG) and should not have direct access to the public internet. Which configuration change should you implement in the route table associated with this private subnet to meet these requirements?
- A
Add a route rule for 0.0.0.0/0 specifying a NAT Gateway as the target.
- B
Add a route rule for the on-premises CIDR block specifying the DRG as the target, and remove any default route to the Internet Gateway.
- C
Add a route rule for the on-premises CIDR block specifying a Local Peering Gateway as the target.
- D
Add a Security List ingress rule to allow all incoming traffic on 0.0.0.0/0.
Show answer and explanation
Correct answer: B
Explanation
To ensure that instances in a private subnet have no direct internet access but can reach on-premises infrastructure, you must configure your route table to send traffic for the on-premises CIDR to the Dynamic Routing Gateway (DRG) and remove or avoid any default route to an Internet Gateway or NAT Gateway. For details, refer to the OCI Networking documentation on route tables, gateways, and best practices for designing hybrid cloud networks: https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/overview.htm.
- A. Incorrect.
Option 1: Incorrect. A NAT Gateway still provides a path to the public internet, which violates the requirement that traffic remain private and route only to on-premises resources through the DRG.
- B. Correct.
Option 2: Correct. Specifying the DRG as the target for the on-premises CIDR block ensures traffic is routed on-prem, and removing any default route (0.0.0.0/0) to the Internet Gateway blocks direct access to the public internet.
- C. Incorrect.
Option 3: Incorrect. A Local Peering Gateway (LPG) is used for VCN-to-VCN peering in the same region or across regions, not for connecting to on-premises environments. This would not satisfy the requirement to route traffic on-prem.
- D. Incorrect.
Option 4: Incorrect. Security List ingress rules define which inbound connections are allowed to the subnet. They do not control routing decisions or block internet egress.