1Z0-1067-25 Question 107
Single answerYour company has an application running on an OCI Compute instance that needs to securely store and frequently update a database password. You decide to use Oracle Cloud Infrastructure Vault to manage this secret. Which approach best ensures the application can securely access and automatically rotate this password on a scheduled basis?
- A
Store the password in an OCI Vault secret and reference it from the application� environment variables without any rotation configuration.
- B
Use OCI Vault to store the password as a secret, configure a rotation policy in Vault, and allow the instance to retrieve the secret via an instance principal.
- C
Keep the password in a configuration file on the compute instance and rely on manual updates when the password changes each month.
- D
Encrypt the password with a custom key file stored on the instance and schedule a script to refresh that key file monthly.
Show answer and explanation
Correct answer: B
Explanation
In OCI, the recommended approach to securely manage and rotate secrets (including database passwords) is to store them in OCI Vault and configure rotation policies. By using instance principals, the application can securely retrieve secrets without embedding credentials. For more details, refer to the OCI documentation on Vault (Managing Secrets and Encryption Keys) and the OCI IAM documentation on instance principals.
- A. Incorrect.
Option 1 is incorrect because it stores the secret in a Vault but does not leverage a rotation policy to automatically update the password, nor does it describe a secure method of granting the application access to the secret (e.g., via an instance principal).
- B. Correct.
Option 2 is correct. Storing the secret in OCI Vault with a rotation policy and retrieving it from the application using an instance principal ensures both security and automated rotation. OCI Vault supports rotation policies, and instance principals can securely access secrets without embedding credentials in code.
- C. Incorrect.
Option 3 is incorrect because relying on a configuration file for storing sensitive credentials is less secure, and manual updates are prone to human error. This also does not leverage OCI Vault or an automated approach.
- D. Incorrect.
Option 4 is incorrect because storing a custom encryption key on the instance and manually refreshing it monthly does not use OCI-managed services like Vault and does not address secure rotation of the database password itself.