1Z0-1104-25 Question 119
Select 3You are designing a new application in Oracle Cloud Infrastructure (OCI) to process personally identifiable information (PII). Your compliance requirements state that data must be encrypted at rest using customer-managed keys, the keys must be rotated on a regular schedule, and the use of these keys must be auditable. Data will be stored in OCI Object Storage and occasionally accessed by multiple OCI services for data processing. Which actions should you take to meet these requirements?
- A
Store your encryption keys in OCI Vault and configure them as customer-managed keys for Object Storage.
- B
Generate and maintain your own encryption keys in an on-premises vault, uploading the keys to OCI Object Storage whenever they need to be rotated.
- C
Enable key versioning and rotation in OCI Vault to rotate your keys regularly without manual re-encryption of existing data.
- D
Disable server-side encryption in OCI Object Storage so the keys remain fully under your control on-premises.
- E
Enable OCI Audit to track all key-related activities in OCI Vault, including key creation, rotation, and usage.
Show answer and explanation
Correct answers: A, C, E
Explanation
OCI Vault provides a managed Key Management Service (KMS) that integrates with services like Object Storage to securely encrypt data at rest using your own keys. By enabling key versioning and rotation in OCI Vault, you meet compliance mandates for regular key rotation without needing to re-encrypt existing data. Auditing key usage with OCI Audit helps track critical events and provides an audit trail for regulatory compliance. For more details, refer to Oracle documentation on OCI Vault (https://docs.oracle.com/en-us/iaas/Content/Vault/home.htm) and best practices for key management and auditing.
- A. Correct.
Option 1 is correct. Storing keys in OCI Vault and configuring them as customer-managed keys allows you to maintain full control over how your data is encrypted in OCI Object Storage. This aligns with the requirement to use customer-managed keys.
- B. Incorrect.
Option 2 is incorrect. While you can manage your own keys on-premises, simply uploading them to OCI Object Storage does not automatically integrate with OCI� encryption mechanisms nor provide the auditing and rotation features required. It also increases complexity and operational overhead.
- C. Correct.
Option 3 is correct. Enabling key versioning and automatic rotation in OCI Vault satisfies the requirement for regular key rotation without manually re-encrypting data already protected by the existing keys.
- D. Incorrect.
Option 4 is incorrect. Disabling server-side encryption contradicts the requirement to use encryption at rest with customer-managed keys. Turning off server-side encryption is not a best practice for PII data and fails to meet compliance needs.
- E. Correct.
Option 5 is correct. Enabling OCI Audit to capture key creation, rotation, and usage is vital for demonstrating compliance and monitoring any unauthorized activity related to your encryption keys.