A gallery must let internet visitors reach a new web application in a cloud VPC. Two private subnets must keep talking to each other. The campus VPN stays as it is. Which change meets the visitor requirement?
Select an answer to reveal the explanation.
Short Explanation
The new visitors start on the public internet, so you publish the application at the cloud edge. You do not lock the two private subnets apart, because they are supposed to keep talking, and those visitors are not logging into the campus VPN.
Full Explanation
Inbound internet connectivity publishes the application at the cloud edge so sessions that start on the public internet can reach it. That is the visitor requirement. The private subnets must keep talking, so an east-west deny would break a flow the gallery wants to keep and would not create a public front door. Backhaul sends the VPC's own outbound traffic through the campus. It does not let internet visitors in. Lengthening the IKE lifetime retimes the campus VPN. Visitors are not authenticating to that VPN, and the stem says the VPN stays as it is. Exam caveat: publishing still needs a tight security rule on the application port. Reachable does not mean every port is open. Operational check: a client outside the gallery should reach the application through the cloud public endpoint, and a test between the two private subnets should still succeed.