1Z0-1127-25 Deploying and Managing Generative AI on OCI Practice Question
A large enterprise is deploying a generative AI model for internal document summarization. The model is deployed on OCI Data Science using a custom container. The inference endpoint is behind a public load balancer. The security team requires that all traffic between the client and the endpoint be encrypted in transit and that the endpoint not be accessible from the public internet. The current setup uses a public load balancer with an SSL certificate. The VCN has a public subnet for the load balancer and a private subnet for the model deployment. The security team is concerned that the load balancer is publicly accessible. The enterprise wants to maintain high availability and low latency. What should the architect do to meet the security requirements?
⚠ Common exam trap
It's easy for candidates to think a WAF or VPN alone can satisfy both encryption and private access, but they overlook that the public load balancer itself remains a publicly routable endpoint, which directly violates the 'not accessible from the public internet' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace the public load balancer with a private load balancer in a private subnet, and attach an SSL certificate for encryption.
Replacing the public load balancer with a private load balancer in a private subnet ensures the endpoint is not accessible from the public internet, while attaching an SSL certificate maintains encryption in transit. This satisfies both security requirements without sacrificing high availability or low latency, as the private load balancer still provides load balancing and TLS termination within the VCN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a site-to-site VPN to connect clients to the VCN and access the endpoint via private IP.
Why it's wrong here
VPN provides encrypted connectivity but requires a public endpoint for VPN termination; also adds complexity and latency.
- ✗
Remove the load balancer and use a service gateway to access the model deployment directly from the VCN.
Why it's wrong here
A service gateway allows private access but does not provide load balancing or SSL termination.
- ✗
Keep the public load balancer but add a Web Application Firewall (WAF) to block unauthorized IPs.
Why it's wrong here
WAF filters traffic but does not make the endpoint private; it remains publicly accessible.
- ✓
Replace the public load balancer with a private load balancer in a private subnet, and attach an SSL certificate for encryption.
Why this is correct
A private load balancer is not internet-facing, ensures encryption via SSL, and provides high availability.
Visual reference
Go deeper
Related to this question
About these practice questions
This 1Z0-1127-25 question is part of Courseiva's 768-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 1Z0-1127-25 practice question is part of Courseiva's free Oracle certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 1Z0-1127-25 exam.