1Z0-1072-25 Question 234
Select 3Your company stores sensitive data in an Object Storage bucket on Oracle Cloud Infrastructure. Management mandates that only a specific group of approved users can upload or read data, the data must be encrypted at rest, and file transfers must use encryption in transit. Which three methods should you implement to meet these requirements?
- A
Create a public bucket and rely solely on user credentials to limit access
- B
Use an IAM policy that grants read and write access only to the required user group in the appropriate compartment
- C
Enable server-side encryption using Oracle-managed or customer-managed keys
- D
Access the Object Storage bucket only via HTTPS endpoints
Show answer and explanation
Correct answers: B, C, D
Explanation
To fulfill the organization's data protection and compliance requirements, you must control access with an appropriate IAM policy, encrypt all data at rest with server-side encryption (using Oracle-managed or customer-managed keys in OCI Vault), and ensure in-transit encryption by accessing the bucket only via HTTPS. Detailed guidance on these practices is available in the OCI documentation sections for 'Object Storage Security Overview' and 'Managing Access with IAM Policies.'
- A. Incorrect.
Option 1: Incorrect. Making the bucket public exposes it broadly on the Internet, which does not meet the requirement of restricting access to an approved user group. Even if user credentials help, a public bucket allows anyone with the bucket URL to access or attempt to access the data.
- B. Correct.
Option 2: Correct. Defining an IAM policy that grants required privileges to a group in a specific compartment ensures that only approved users have the ability to read and write objects. This aligns with the principle of least privilege and meets the security requirement.
- C. Correct.
Option 3: Correct. Enabling server-side encryption protects data at rest. Using either Oracle-managed keys or a customer-managed key from the OCI Vault satisfies the encryption requirement mandated by management.
- D. Correct.
Option 4: Correct. By using only HTTPS endpoints, data in transit is encrypted, preventing unauthorized access or interception of sensitive information during transfer.