1Z0-1072-25 Question 229
Select 2You have been asked to design an OCI Object Storage solution to store sensitive HR data. The HR team wants to ensure that only HR users can access the bucket and that the data is encrypted using keys they control, which they plan to rotate regularly. Which two actions should you take to meet these security requirements?
- A
Create an IAM policy allowing only HR group members to access the bucket, ensuring no public access is granted.
- B
Enable server-side encryption using Oracle-managed keys so the HR team can download and rotate them directly.
- C
Use customer-managed encryption keys stored in OCI Vault and enable server-side encryption to reference these keys.
- D
Allow public read access to the bucket while restricting sensitive object access by using object-level ACLs.
Show answer and explanation
Correct answers: A, C
Explanation
To secure sensitive data in OCI Object Storage, you must appropriately configure both access and encryption. An IAM policy can be written to precisely grant or deny access to the bucket, preventing unauthorized users from reading or writing data. For key management, using customer-managed keys in OCI Vault gives your organization full control over key rotation and lifecycle. Refer to Oracle� documentation on IAM policies and OCI Vault for best practices on restricting bucket access and managing encryption keys.
- A. Correct.
Correct: Limiting bucket access through an IAM policy ensures that only authorized HR users have permissions. This step prevents external users or other internal groups from accessing the sensitive data.
- B. Incorrect.
Incorrect: Using Oracle-managed keys does not grant the HR team direct control over key rotation. Oracle manages the lifecycle of these keys without the fine-grained control the HR team desires.
- C. Correct.
Correct: Customer-managed keys stored in OCI Vault allow the HR team to rotate their keys on their own schedule and maintain full control over the encryption lifecycle.
- D. Incorrect.
Incorrect: Enabling public read access would undermine the confidentiality requirement. ACLs are not sufficient to enforce the strict �HR-only� access requirement when the bucket is publicly accessible.