1Z0-1104-25 Question 115
Single answerYour organization is storing confidential HR records in an Oracle Object Storage bucket. Due to compliance requirements, you must manage and rotate the encryption keys while ensuring that Oracle administrators cannot access those keys directly. Which approach will best address these requirements?
- A
Use server-side encryption with Oracle-managed keys for data at rest.
- B
Use Oracle Cloud Infrastructure Vault (KMS) to create a customer-managed key and specify it for the Object Storage bucket.
- C
Manually encrypt the data offline with a local tool before uploading it to Object Storage.
- D
Enable block volume encryption on a Compute instance that processes the data later.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, using a customer-managed key through OCI Vault (KMS) is the recommended way to maintain exclusive control over key rotation, revoke access when needed, and align with compliance requirements. For further details, refer to Oracle's documentation on Key Management: https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keymanagementoverview.htm.
- A. Incorrect.
Option 1 is incorrect. While Oracle-managed keys do encrypt your data at rest, you do not control the rotation schedule or have exclusive control of the keys, which fails the compliance requirement of directly managing and restricting access to them.
- B. Correct.
Option 2 is correct. Using OCI Vault to create a customer-managed key allows you to directly manage key rotation and restrict access, ensuring compliance requirements are met. The key material is managed within the OCI Vault service, preventing Oracle administrators from accessing the keys directly.
- C. Incorrect.
Option 3 is incorrect. While manual encryption provides an extra layer of security, it complicates key management and does not guarantee compliance with the specific requirement of managing keys through a centralized service like OCI Vault. Furthermore, manual decryption is required whenever data is accessed.
- D. Incorrect.
Option 4 is incorrect. Block volume encryption applies to data stored on a Compute instance's block volumes rather than data residing in Object Storage. It does not fulfill the requirement to manage and rotate keys tied to the data stored in the Object Storage bucket.