1Z0-1067-25 Question 87
Select 2You are a Cloud Ops professional at a compliance-driven financial institution. The institution mandates that all transaction records remain completely immutable for exactly 7 years. After the 7-year period expires, those records must be removed to free up storage. Which two Oracle Cloud Infrastructure approaches can meet these requirements?
- A
Configure a time-bound retention rule on the Object Storage bucket for 7 years to prevent deletions or updates, then use a lifecycle policy to delete the objects when the retention period ends.
- B
Create a custom IAM policy that denies object deletion for 7 years, ensuring no user can remove content during that period.
- C
Use the Legal Hold feature on each object to enforce immutability and remove the holds after 7 years when the data is no longer needed.
- D
Enable versioning on the Object Storage bucket and periodically purge old versions after 7 years.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure compliance with mandatory data retention, OCI's retention rules and legal holds both enforce a Write-Once-Read-Many (WORM) model, making objects immutable until the retention or hold period lapses. Additional lifecycle policies can clean up data after the retention period automatically. Relying solely on IAM policy or versioning does not guarantee immutability because those measures can be bypassed or altered. For more details, refer to Oracle Object Storage documentation on Retention Rules and Legal Holds: https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/objectretrievalpolicy.htm.
- A. Correct.
Option 1 is correct. A time-bound retention rule guarantees that objects cannot be altered or deleted during the retention period. Coupled with a lifecycle policy, it provides an automated way to delete the data after 7 years.
- B. Incorrect.
Option 2 is incorrect. While a custom IAM policy can restrict deletions, such a policy could be modified by administrators with the right privileges, thereby compromising immutability.
- C. Correct.
Option 3 is correct. Legal Hold enforces object-level immutability. Although removing the hold is manual, it still meets the requirement to keep data immutable until the 7-year period ends and then remove it.
- D. Incorrect.
Option 4 is incorrect. Enabling versioning alone does not guarantee immutability because all versions can still be deleted by an authorized user or administrative action.