An internal HR API for city employees must not be reachable from the public internet, while a second citizen portal API must be. How do API Gateway front-end types differ?
Select an answer to reveal the explanation.
Short Explanation
Every gateway has a private address; a private front end stays inside the VCN neighborhood, while a public front end also gets a public IP and needs an internet gateway so citizens can reach it.
Full Explanation
Every API Gateway has a private IP. A private gateway front end is reachable only from its VCN (and legitimate peered or on-premises paths into that VCN). A public gateway also receives a public IP and requires an internet gateway (and correct routing/security lists or NSGs) so internet clients can reach the citizen portal. That distinction lets HR keep an internal employee API private while a second portal API is public—typically via separate gateways when front-end type must differ.
Private gateways are not “IP-less,” and public gateways are not limited to link-local addressing. Public gateways are not reachable only from the VCN, and private gateways do not require an internet gateway for their private access model. Front-end type is a gateway-level choice, not something you flip independently per route on one appliance.
Exam caveat: private connectivity still needs correct VCN routing, gateways (DRG/LPG as designed), and NSG/security list rules—privacy is not automatic from the label alone. Operational check: deploy a private gateway for HR and confirm only in-VCN clients succeed, deploy a public gateway with an internet gateway for the citizen portal, verify public DNS/HTTPS access, and ensure the HR API has no public IP exposure.