Sample question 1 — OCI Networking
A regional bus operator patches close to four hundred Linux servers each month, and its SRE refuses to place a public address on any of them. Auditors also insist the machines stay unreachable from outside, yet the patch agent still has to pull packages from vendor mirrors on the open web. Which OCI object provides outbound-only access while the servers remain invisible from the internet?
- A. Attach an Internet Gateway straight to the server segment so hosts fetch packages.
- B. Expect outbound traffic from a Dynamic Routing Gateway with no peers attached.
- C. Place a NAT Gateway in the VCN and point the segment default route at it.
- D. Use a Service Gateway as the path for every public internet destination.
Answer: C. Option C is correct. Placing a NAT Gateway in the VCN and pointing the segment's default route at it gives the patch traffic an outbound path through a translated address, so the servers reach vendor mirrors while nothing on the internet can open a session to them. Option D would leave those downloads with no route out, since a service path reaches only Oracle-published endpoints. Option A would require exactly the addresses the auditors reject, and Option B forwards egress only toward attachments it already has.