A network-aware developer is placing an API Gateway for a permits API. Which placement rule is correct?
Select an answer to reveal the explanation.
Short Explanation
Plant the gateway in a regional subnet garden—not an AD-only plot. Public-facing gateways need a public subnet; private gateways can use private or public subnets. The service handles AD resilience for you.
Full Explanation
API Gateway appliances are created only in regional subnets. A public gateway must be placed in a public subnet so it can hold a public IP and serve internet clients for the permits API. A private gateway may use a private or public subnet while remaining privately addressed for VCN-local access. The service provides regional resilience; you do not manually pair AD-local gateways for failover.
Requiring gateways in AD-specific subnets with one gateway per availability domain contradicts the regional-subnet rule. Public gateways may not be “fixed” into private subnets merely because a NAT gateway exists—public front ends need public subnet placement per the product rules. Inventing a DIY pair of AD-local gateways for regional failover misunderstands the managed regional design.
Exam caveat: regional subnet plus correct public/private subnet choice is tested more often than deep peering trivia. Operational check: create the gateway in a regional public subnet for internet-facing permits traffic (or private subnet for private-only), confirm the front-end type matches intent, validate routing and NSGs, and avoid AD-scoped subnet placement that the service rejects or that breaks the documented model.