1Z0-1067-25 Question 105
Select 2You manage a microservices application on Oracle Kubernetes Engine (OKE) that needs secure payment service credentials. You have stored these credentials as a secret in OCI Vault. To reduce the risk of credential leakage, you want to automatically rotate the secret and ensure the application always retrieves the newest secret version without downtime. Which TWO configurations or practices are required to achieve this goal?
- A
Configure a new Master Encryption Key in OCI Vault every time you rotate the secret.
- B
Use the Secrets Retrieval API or OCI Auth Tokens within the application to fetch the updated secret at runtime.
- C
Disable secret versioning so that the application references a single secret value without having to manage multiple versions.
- D
Include secret data as static environment variables in your Kubernetes manifest to avoid redeploying services after rotation.
- E
Enable a rotation schedule for the secret in OCI Vault to automate credential rotation.
Show answer and explanation
Correct answers: B, E
Explanation
To properly manage secrets in OCI Vault, you set up automated rotation and ensure your application retrieves the most recent secret value without manual intervention. Using the Secrets Retrieval API or OCI Auth Tokens allows the application to securely fetch the updated credential during runtime. Scheduling rotation in OCI Vault ensures that credentials expire predictably, aligning with best practices outlined in Oracle� documentation for OCI Vault and Key Management.
- A. Incorrect.
Option 1 is incorrect: Rotating the Master Encryption Key whenever you rotate credentials is generally unnecessary and adds complexity. OCI Vault rotates the credentials themselves; you do not need to create a new key for every rotation.
- B. Correct.
Option 2 is correct: The application must dynamically fetch the latest secret from OCI Vault, either via the Secrets Retrieval API or OCI Auth Tokens, so it always uses the current credential version after rotation.
- C. Incorrect.
Option 3 is incorrect: Disabling secret versioning is counterproductive. OCI Vault uses versioning to manage credential updates during rotations. You should leave versioning enabled to retrieve the latest secret seamlessly.
- D. Incorrect.
Option 4 is incorrect: Storing secret data as static environment variables in Kubernetes means you would need to redeploy services to pick up rotated credentials. It also increases the risk of accidental exposure.
- E. Correct.
Option 5 is correct: Setting up a rotation schedule (or manually triggering rotation at regular intervals) in OCI Vault is essential for automating credential updates and reducing administrative overhead.