1Z0-1104-25 Question 120
Select 2Your organization needs to protect sensitive data stored in OCI Object Storage by enforcing server-side encryption with customer-managed keys (CMK) and restricting read access to only specific internal groups. Which two actions should you take to meet these requirements?
- A
Create an OCI Vault and store your encryption keys there, then configure Object Storage to use CMK for server-side encryption.
- B
Enable the Vault-based backup feature for Object Storage to rotate objects every seven days automatically.
- C
Set up an IAM policy allowing Object Storage 'READ' access only for user groups in the specified compartments.
- D
Attach a Key Versioning policy to Object Storage so that keys are forcibly rotated monthly without using Vault.
- E
Use Data Safe to automatically encrypt objects at rest regardless of key configuration.
Show answer and explanation
Correct answers: A, C
Explanation
To protect sensitive data in OCI Object Storage using customer-managed keys and ensure only approved groups can read the data, you must use OCI Vault with CMK for server-side encryption and configure IAM policies appropriately. Refer to the official Oracle Cloud Infrastructure documentation on Vault (https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm) and IAM policies (https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm) for detailed guidance on encryption key management and fine-grained access control.
- A. Correct.
Option 1 is correct. Using OCI Vault to store and manage customer-managed keys, then configuring Object Storage to use CMK for server-side encryption, ensures you have full governance of the encryption lifecycle in alignment with best practices.
- B. Incorrect.
Option 2 is incorrect. Enabling Vault-based backup rotation of an entire key or vault is different from the specific configuration needed to encrypt objects in Object Storage with CMK. This option does not address read access restrictions.
- C. Correct.
Option 3 is correct. An IAM policy restricting Object Storage 'READ' access to specific groups within the correct compartments limits visibility of the data to authorized users only, fulfilling the need to protect sensitive data.
- D. Incorrect.
Option 4 is incorrect. Key Versioning policies cannot be attached directly to Object Storage in this manner. Key rotation is managed in OCI Vault, not through a direct Object Storage policy.
- E. Incorrect.
Option 5 is incorrect. While Data Safe can assist in discovering, masking, and monitoring sensitive data, it does not automatically handle server-side encryption for Object Storage. You still need to manage encryption keys at the vault or service level.