You are designing a two-tier web application in Oracle Cloud Infrastructure (OCI). Your clients want to access the web servers from anywhere, but want to prevent access to the database servers from…

Question

Options

• ACreate public subnets for web servers and private subnets for database servers in your virtual
• BCreate public subnets for web servers and associate a dynamic routing gateway with that subnet,
• CCreate public subnets for web servers and private subnets for database servers in your VCN, and
• DCreate a single public subnet for your web servers and database servers, and associate only your

• A
  8% (4)
• B
  4% (2)
• C
  71% (34)
• D
  17% (8)

Explanation

When you create a subnet, by default it's considered public, which means instances in that subnet are allowed to have public IP addresses. Whoever launches the instance chooses whether it will have a public IP address. You can override that behavior when creating the subnet and request that it be private, which means instances launched in the subnet are prohibited from having public IP addresses. Network administrators can therefore ensure that instances in the subnet have no internet access, even if the VCN has a working internet gateway, and security rules and firewall rules allow the traffic. There are two optional gateways (virtual routers) that you can add to your VCN depending on the type of internet access you need: Internet gateway: For resources with public IP addresses that need to be reached from the internet (example: a web server) or need to initiate connections to the internet. NAT gateway: For resources without public IP addresses that need to initiate connections to the internet (example: for software updates) but need to be protected from inbound connections from the internet. Just having an internet gateway alone does not expose the instances in the VCN's subnets directly to the internet. The following requirements must also be met: The internet gateway must be enabled (by default, the internet gateway is enabled upon The subnet must be public. The subnet must have a route rule that directs traffic to the internet gateway. The subnet must have security list rules that allow the traffic (and each instance's firewall must allow the traffic). The instance must have a public IP address.

No community discussion yet for this question.