1Z0-1067-25 Question 106
Select 2Your organization stores sensitive data in an OCI Object Storage bucket protected by a master encryption key in Oracle Cloud Infrastructure Vault. Due to compliance requirements, the key must rotate automatically every 90 days with minimal manual intervention. Which two steps should you perform to successfully enable scheduled key rotation in OCI Vault?
- A
Enable the key� rotation schedule in the Vault console, specifying a 90-day interval.
- B
Create a new vault for each rotation to store the new key version.
- C
Manually re-upload existing data to Object Storage after each scheduled rotation.
- D
Ensure your applications reference the key using its OCID, allowing them to accept new key versions automatically.
Show answer and explanation
Correct answers: A, D
Explanation
By using OCI Vault� built-in rotation schedules and referencing keys by their OCID, you can automate the process of rotating and using new key versions without re-encrypting existing data or creating new vaults. Refer to Oracle Cloud Infrastructure documentation on Key Management for best practices and instructions on scheduling key rotations.
- A. Correct.
Correct. In OCI Vault, you can enable and configure a rotation schedule for a key. Specifying a 90-day interval ensures the key automatically rotates without repeated manual intervention.
- B. Incorrect.
Incorrect. You do not need to create a new vault for every key rotation. OCI Vault supports storing multiple versions of a key within the same vault, making rotation simpler and more efficient.
- C. Incorrect.
Incorrect. When a key rotates, OCI KMS creates a new key version automatically. Existing data encrypted with older versions remains valid. You do not need to manually re-upload or re-encrypt existing data if your application references the key symbolically (by OCID).
- D. Correct.
Correct. Referencing the key by its OCID allows OCI to seamlessly switch to the new key version upon rotation. As long as your applications use the key� OCID, they automatically pick up the latest version without additional manual configuration.