1Z0-1104-25 Question 117
Select 2Your finance department stores sensitive data in an Oracle Cloud Infrastructure (OCI) Object Storage bucket, which is encrypted at rest using Oracle-managed keys by default. Due to new compliance regulations, your organization must manage and rotate your own encryption keys and maintain a secure key lifecycle. Which two steps should you take in OCI to meet these compliance requirements?
- A
Create a vault in OCI and configure a Customer-Managed Key (CMK), then enable the bucket to use your CMK for encryption.
- B
Use Data Safe to override Oracle-managed keys and generate user-managed encryption keys for your Object Storage bucket.
- C
Upload a custom SSL certificate to the Object Storage endpoint, thereby enforcing your own encryption at rest.
- D
Encrypt data on the client side before uploading to OCI and store the encryption keys securely in OCI Vault.
Show answer and explanation
Correct answers: A, D
Explanation
To satisfy compliance requirements that mandate managing and rotating your own encryption keys, you can leverage OCI Vault to create and manage CMKs for server-side encryption of Object Storage data. Additionally, client-side encryption of sensitive objects before uploading adds another layer of security, ensuring complete control over key lifecycle management. For more information, refer to the Oracle Cloud Infrastructure documentation on using Vault and customer-managed keys.
- A. Correct.
Option 1 is correct. By creating a vault and configuring a Customer-Managed Key (CMK) in OCI Vault, you ensure that encryption at rest uses keys under your control. You can then manage and rotate these keys according to your compliance requirements.
- B. Incorrect.
Option 2 is incorrect. Oracle Data Safe offers capabilities like data discovery, data masking, and auditing, but it does not replace or override the default encryption keys used by Oracle Object Storage.
- C. Incorrect.
Option 3 is incorrect. Uploading a custom SSL certificate secures data in transit but does not replace the need for a customer-managed encryption key at rest. SSL is unrelated to managing encryption keys for stored data.
- D. Correct.
Option 4 is correct. Client-side encryption involves encrypting data before uploading it to OCI. This approach gives you full control of the encryption process and keys, which you can securely manage and rotate in OCI Vault.