1Z0-1072-25 Question 268
Select 2Your organization stores sensitive financial records on Oracle Cloud Infrastructure (OCI) File Storage. You must encrypt the data using your own master key and ensure that only your internal private subnets can access the file system. Which two actions should you take to meet these requirements?
- A
Use Oracle-managed keys for default at-rest encryption of your file system in OCI.
- B
Configure the file system to use a customer-managed key stored in OCI Vault.
- C
Set export options to restrict read/write access to specific internal IP ranges or subnets.
- D
Attach an Internet Gateway to the VCN where the mount target resides, making the file system publicly accessible.
- E
Configure a dynamic group to require encryption in transit on the mount target.
Show answer and explanation
Correct answers: B, C
Explanation
To secure OCI File Storage and meet strict data protection requirements, you can integrate the service with OCI Vault's Key Management to use your own master key (BYOK), rather than the default Oracle-managed encryption. Additionally, applying export options at the file system level restricts read/write permissions to specific private IP addresses or subnets. These methods ensure that only authorized internal resources can access your data and that your organization's encryption key policies are upheld. Refer to Oracle documentation on 'Using Your Own Keys With File Storage' for further guidance.
- A. Incorrect.
Option 1: INCORRECT. While OCI File Storage is encrypted at rest by default using Oracle-managed keys, this does not fulfill the requirement of using your organization's master key.
- B. Correct.
Option 2: CORRECT. By integrating File Storage with a customer-managed key in OCI Vault, you can use your own encryption key instead of the default Oracle-managed key, aligning with your compliance demands.
- C. Correct.
Option 3: CORRECT. Configuring export options to limit access based on IP address or subnet ensures that only your internal network can read or write to the file system, satisfying your security requirement.
- D. Incorrect.
Option 4: INCORRECT. Attaching an Internet Gateway to the VCN makes the mount target publicly accessible. This conflicts with the requirement to restrict access to internal subnets only.
- E. Incorrect.
Option 5: INCORRECT. Dynamic groups govern IAM policies rather than network-level encryption. You cannot enforce encryption in transit directly on a mount target through a dynamic group.