1Z0-1067-25 Question 108
Select 2Your team manages a critical application that stores its database credentials as a secret in Oracle Cloud Infrastructure (OCI) Vault. The application is currently pinned to a specific version of the secret. You need to rotate the secret in Vault due to a potential security concern. Which TWO steps must you perform to ensure the application seamlessly transitions to the new secret version with minimal downtime?
- A
Create a new secret version in OCI Vault for the database credentials and update the application to retrieve the latest version automatically
- B
Manually delete the old secret version in OCI Vault immediately after you create the new one
- C
Point the application to use an alias that always resolves to the active secret version rather than a specific secret version
- D
Rotate the Master Encryption Key in OCI Vault so the new secret version references the new key
Show answer and explanation
Correct answers: A, C
Explanation
When managing secrets in OCI Vault, rotating the secret typically involves creating a new version and ensuring the application references that new version. If the application pins a secret by version number, you must either update the reference or configure it to retrieve the 'latest version' or an alias instead. Deleting the old version too soon can cause downtime, and rotating the Vault� Master Encryption Key is a separate process from secret versioning. For more details, consult the OCI Vault documentation regarding secret creation and version management.
- A. Correct.
Option 1 is correct. You must create a new version for the secret in OCI Vault and ensure the application is reconfigured to retrieve the newest version so that it uses the updated credentials. If the application is pinned to an older version, simply adding a new version in Vault won�t help unless you update the reference in the application.
- B. Incorrect.
Option 2 is incorrect. Deleting the old secret version immediately is risky because the application may still rely on it until you confirm the new version works and is accessible by all instances. Best practice is to verify that the new secret version is functioning correctly before removing any older version.
- C. Correct.
Option 3 is correct. Referencing an alias or selecting 'latest version' in your application configuration ensures that the application automatically transitions to the new secret version without needing to modify the application code each time you rotate the secret.
- D. Incorrect.
Option 4 is incorrect. Rotating the Master Encryption Key is not automatically required every time you rotate a secret. Key rotation schedules are distinct from secret rotation schedules; rotating the vault� Master Key does not automatically update any secret� content or version references.