1Z0-1104-25 Question 118
Single answerYour organization runs an application that processes highly sensitive customer data in Oracle Cloud Infrastructure (OCI). You must ensure that you retain full control over the encryption keys used for data at rest on Block Volumes and have the flexibility to rotate those keys according to your company� compliance requirements. Which approach should you implement to meet these objectives?
- A
Use only Oracle-managed keys on Block Volumes, relying on the default key rotation schedule provided by OCI.
- B
Upload your own encryption libraries into OCI and handle all data encryption independently outside of OCI Vault.
- C
Create a custom master encryption key in Oracle Cloud Infrastructure Vault and apply it to encrypt Block Volumes, rotating the key on your own schedule.
- D
Disable at-rest encryption completely on Block Volumes and only rely on TLS for data in transit to secure the information.
Show answer and explanation
Correct answer: C
Explanation
OCI offers two main approaches for encryption keys: Oracle-managed keys (where rotation is handled by OCI) or customer-managed keys in OCI Vault, which you can rotate according to your own schedule. For organizations with strict compliance requirements, managing your own custom master encryption keys in OCI Vault ensures you control the key life cycle, rotation intervals, and who can access them. Refer to Oracle� documentation on Key Management for best practices on creating, storing, and rotating keys in OCI Vault.
- A. Incorrect.
Incorrect: While Oracle-managed keys do provide encryption at rest, you must rely on Oracle� rotation schedule. This doesn�t fully satisfy stringent requirements if you need custom key control and rotation frequency.
- B. Incorrect.
Incorrect: Managing your own encryption libraries entirely outside OCI Vault adds significant operational complexity and risk. It also lacks centralized audit and rotation capabilities provided by OCI Vault.
- C. Correct.
Correct: Using a custom master encryption key in OCI Vault offers full control over key rotation and lifecycle. You can align rotation schedules with your compliance needs and retain complete oversight of how data at rest is encrypted.
- D. Incorrect.
Incorrect: Relying solely on in-transit encryption is inadequate for protecting data at rest, and disabling encryption at rest on Block Volumes would violate most stringent security or compliance requirements.