1Z0-1067-25 Question 104
Select 2You are responsible for maintaining a production database in Oracle Cloud Infrastructure (OCI), and the application credentials for connecting to the database are stored as a secret in OCI Vault. Your security policy mandates regular password rotation without causing downtime for the application. Which two strategies can help you achieve automated rotation of the database credentials while ensuring continuous availability?
- A
Create a new secret version in OCI Vault for every credential update and configure an Oracle Functions-based custom rotation task to switch versions automatically.
- B
Use the same secret version indefinitely, but manually refresh the credentials in the database to ensure the application keeps its connection.
- C
Enable the built-in Vault auto-rotation policy that updates the database password directly without requiring any external function or script.
- D
Develop a script or function to generate a new credential, store it as a newer secret version, and update the application to use the latest version without interruption.
Show answer and explanation
Correct answers: A, D
Explanation
OCI Vault allows you to manage secrets (like database credentials) by creating and versioning them. To achieve automated rotation, you typically integrate Vault with a rotation function or script (for example, using Oracle Functions), which updates both the database credential and the Vault secret. By always referencing the secret from your application rather than embedding credentials in code, you ensure minimal downtime and adhere to best practices. Refer to the OCI Vault documentation (docs.oracle.com) for details on configuring secret rotation and creating custom rotation functions.
- A. Correct.
Option 1 is CORRECT. OCI Vault supports creating multiple versions of a secret. By integrating with Oracle Functions or a custom script, you can automatically generate new credentials, store them as a new secret version, and trigger rotation tasks so the application swaps to the updated secret without downtime.
- B. Incorrect.
Option 2 is INCORRECT. Retaining the same secret version indefinitely contradicts the requirement for regular rotation. Manually refreshing credentials in the database also increases the risk of inconsistencies and downtime if not carefully synchronized.
- C. Incorrect.
Option 3 is INCORRECT. While OCI Vault provides secret management, there is no built-in 'auto-rotation policy' that directly updates the database password without any external triggers or scripts. You need to integrate with Oracle Functions or an external process to perform the update in the database and then update the secret.
- D. Correct.
Option 4 is CORRECT. You can create a rotation strategy where a script or function updates the database password, adds the newly generated password as a higher secret version in OCI Vault, and reconfigures the application to use the latest version, all of which can be done with minimal or no downtime.