1Z0-1072-25 Question 267
Select 2You have deployed an OCI File Storage system to store sensitive data for your organization� compliance project. To meet your security requirements, you must ensure that only designated subnets within your Virtual Cloud Network (VCN) can access the file system and that the data is encrypted when transferred between clients and the File Storage system. Which two actions should you take to fulfill these requirements?
- A
Configure Export Options on the File Storage mount target to limit access to specific VCN subnets.
- B
Enable 'Block Volume encryption in-transit' in the File Storage console to secure data during transfer.
- C
Mount the File Storage system using TLS to ensure data is encrypted in transit.
- D
Rely solely on the built-in encryption at rest, which also encrypts traffic between clients and File Storage.
Show answer and explanation
Correct answers: A, C
Explanation
Securing OCI File Storage involves limiting client access through Export Options and using encryption both at rest and in transit. Export Options tighten network security by limiting access to specific subnets or IP addresses. While OCI File Storage automatically encrypts data at rest, you also need to mount the file system using TLS to enable in-transit encryption. Refer to OCI File Storage documentation for instructions on configuring Export Options and TLS-based encryption in transit.
- A. Correct.
Option 1 is correct. Export Options let you restrict access by specifying which subnets or IP ranges can mount the file system, ensuring that only approved clients can connect.
- B. Incorrect.
Option 2 is incorrect. 'Block Volume encryption in-transit' is specifically for Block Volumes, not File Storage. There is no corresponding feature named this way for File Storage.
- C. Correct.
Option 3 is correct. In-transit encryption for File Storage can be enabled by mounting with TLS (where supported), ensuring data is secure between clients and the File Storage system.
- D. Incorrect.
Option 4 is incorrect. Encryption at rest only secures stored data. It does not encrypt data as it traverses the network, so relying on it alone does not fulfill in-transit encryption requirements.