You are designing an OCI VCN for a new application with the following requirements: The application servers in a private subnet must be able to…

Requirements: Outbound internet access, no inbound exposure, and private OCIR access.

Option A: Internet Gateway allows inbound traffic, violating the no-exposure rule—incorrect.

Option B: NAT Gateway enables outbound-only internet access, but Internet Gateway adds inbound

exposure—incorrect.

Option C: NAT Gateway provides outbound internet access without inbound exposure; Service

Gateway enables private OCIR access—correct.

Option D: DRG is for external networks, not internet/OCIR access; Internet Gateway exposes

servers—incorrect.

Conclusion: Option C satisfies all requirements.

Oracle states:

"Use a NAT Gateway for outbound internet access from private subnets without inbound

connectivity. Use a Service Gateway for private access to OCI services like OCIR."

This supports Option C. Reference: NAT and Service Gateway Overview - Oracle Help Center

(docs.oracle.com/en-us/iaas/Content/Network/Tasks/NATgateway.htm & docs.oracle.com/en-

us/iaas/Content/Network/Tasks/servicegateway.htm).