1Z0-1072-25 Question 230
Select 2Your company needs to store sensitive financial documents in an Object Storage bucket on Oracle Cloud Infrastructure. The business requirement is to ensure that only members of the Finance IAM group can access buckets and objects, and that all data is encrypted at rest using your own encryption keys (rather than Oracle-managed ones). Which two configurations should you implement to fulfill these requirements?
- A
Rely on the default encryption at rest provided by Oracle-managed keys
- B
Create an IAM policy that allows only the Finance group to manage or use objects in the target bucket
- C
Allow public read access for the bucket to simplify access management
- D
Enable server-side encryption with customer-managed keys by integrating with OCI Vault
Show answer and explanation
Correct answers: B, D
Explanation
To secure data in OCI Object Storage, you can integrate with OCI Vault to use customer-managed keys for server-side encryption, going beyond the default Oracle-managed encryption. Restricting access at the IAM policy level ensures that only the specified group (Finance) can interact with the objects. Refer to the Oracle Cloud Infrastructure Documentation for 'Managing Buckets and Objects' and 'Using Customer-Managed Keys (CMK)' to validate configurations and follow best practices.
- A. Incorrect.
Option 1: Incorrect. While Oracle Object Storage is encrypted by default using Oracle-managed keys, this does not fulfill the requirement for using your own encryption keys. Customer-managed keys in OCI Vault are necessary to meet that specific requirement.
- B. Correct.
Option 2: Correct. An IAM policy that restricts access to the Finance group ensures only authorized members can read, write, and manage objects in the specified bucket, meeting the 'Finance group only' requirement.
- C. Incorrect.
Option 3: Incorrect. Allowing public read access contradicts the requirement for restricted access and would expose sensitive financial data to unauthorized users.
- D. Correct.
Option 4: Correct. By enabling server-side encryption (SSE) with customer-managed keys stored in OCI Vault, you comply with the mandate to use your own encryption keys instead of Oracle-managed ones.