1Z0-1067-25 Question 103
Select 2Your operations team needs to ensure that MySQL database credentials stored as secrets in Oracle Cloud Infrastructure (OCI) Vault are automatically rotated every 90 days. At the same time, your microservices must remain operational and seamlessly retrieve updated credentials without manual intervention. Which two steps must you perform in OCI to implement automated credential rotation and ensure your microservices always use the latest secret version?
- A
A. Create a scheduled event rule that invokes a custom function in Oracle Functions to generate new credentials, update the MySQL database, and store the updated credentials as a new version of the secret in OCI Vault.
- B
B. Configure automatic key rotation for the encryption key used by OCI Vault to rotate the secret value every time the key rotates.
- C
C. Implement Resource Principals in the microservices so they always fetch the most recent secret version from Vault at runtime.
- D
D. Manually generate new credentials every 90 days and upload them to Vault from the console.
Show answer and explanation
Correct answers: A, C
Explanation
To automate secret rotation in OCI, you typically set up an OCI Event Rule to invoke a Function that rotates the credential and updates the secret in Vault on a schedule (e.g., every 90 days). You then configure the application or microservices to dynamically retrieve the updated secret from Vault. Resource Principals allow the microservices to securely access OCI services (including Vault) without embedding credentials. Refer to Oracle Documentation for 'Managing Secrets in OCI Vault' and 'Using Oracle Functions to Rotate Secrets' for detailed steps and best practices.
- A. Correct.
A is correct. OCI Vault does not automatically rotate secrets by default. You must integrate OCI Events with Oracle Functions to handle the rotation schedule. The function updates MySQL credentials and stores them in a new version of the existing secret, providing an automated rotation process.
- B. Incorrect.
B is incorrect. Configuring key rotation only rotates the encryption key and does not update the secret's underlying value. Rotating the key alone will not change the stored password in Vault.
- C. Correct.
C is correct. With Resource Principals, microservices can request the latest secret version at runtime without storing credentials locally, ensuring they always use the updated password after rotation.
- D. Incorrect.
D is incorrect. Manually uploading new credentials does not meet the requirement for an automated rotation schedule; it would require manual intervention every time.