1Z0-1072-25 Question 266
Select 2You manage a high-performance computing (HPC) environment that processes highly sensitive data. You plan to store this data in Oracle Cloud Infrastructure File Storage, and you need to ensure that only HPC compute instances in a private subnet can mount the file system. Additionally, your compliance team requires that data be encrypted in transit. Which two steps must you take to meet these security requirements?
- A
- Create an export in File Storage with Source set only to the HPC subnet's CIDR, ensuring that only those IP addresses can access the file system.
- B
- Enable encryption at rest by installing a custom external Key Management solution in each HPC node's operating system.
- C
- Mount the file system from the HPC compute instances using an NFS mount option that supports encryption in transit (for example, using TLS).
- D
- Place your mount target in a public subnet so that SSL encryption is automatically enforced by Oracle Cloud Infrastructure.
Show answer and explanation
Correct answers: A, C
Explanation
Oracle Cloud Infrastructure File Storage encrypts data at rest by default. To restrict access to only specific subnets, configure the export to allow connections only from the HPC subnet� CIDR. For in-transit encryption, use the appropriate NFS mount options (for example, with TLS) from each HPC node. Refer to the Oracle documentation on File Storage (OCI File Storage Overview and Security Best Practices) for detailed steps on export configuration and in-transit encryption.
- A. Correct.
Option 1 is correct. Restricting the file system export to a specific source CIDR (the HPC subnet) is a standard security practice. This ensures that only instances within that subnet can mount the file system.
- B. Incorrect.
Option 2 is incorrect. While Oracle Cloud Infrastructure does support using Customer-Managed Keys (CMKs) for encryption at rest, simply installing an external key management solution on each node is not an official OCI requirement for File Storage security. By default, File Storage is already encrypted at rest using Oracle-managed keys, and setting up external key management is not mandatory for basic File Storage security.
- C. Correct.
Option 3 is correct. To meet the requirement for encryption in transit, you must mount the file system using an NFS mount option that enables data-in-transit encryption, such as TLS (if supported in your environment). This ensures that any data traveling between HPC nodes and the file system remains encrypted over the network.
- D. Incorrect.
Option 4 is incorrect. Placing the mount target in a public subnet does not automatically enforce SSL or TLS for File Storage traffic, nor is it the recommended approach for restricting access to sensitive data.