1Z0-1104-25 Question 121
Select 2You have created a new vault in Oracle Cloud Infrastructure (OCI) Key Management Service (KMS) to secure data stored in Block Volumes. Your security team requires that all newly created block volumes be encrypted with a key from your vault rather than using Oracle-managed keys. Which two actions must you complete to ensure that new block volumes automatically use your vault-managed key?
- A
Attach the custom master encryption key to the block volume configuration when creating it, specifying the vault and key in the 'Encryption' section.
- B
Enable the 'Auto-Assign Vault Key' option in the Vault's console so that all new volumes automatically use your custom master key.
- C
Create an IAM policy allowing the Block Volume service to use and manage the custom key you created in the vault.
- D
Manually rotate the vault key on a 30-day schedule to ensure the newest key version is used by all future volumes.
Show answer and explanation
Correct answers: A, C
Explanation
To use a vault-managed key for new block volumes, you must specify that key when creating the volume and allow the Block Volume service to use it via IAM policies. While rotating the key is an important security practice, it does not affect whether new volumes use the custom vault key. For reference, consult the OCI documentation on 'Using Customer-Managed Keys with Block Volumes' and 'IAM Policies for Key Management' to configure these settings correctly.
- A. Correct.
Correct. When creating a new block volume, you must explicitly reference your vault and key. This ensures the block volume is encrypted using the custom key instead of Oracle-managed keys.
- B. Incorrect.
Incorrect. There is no built-in feature in OCI Key Management that automatically assigns a vault-managed key to new block volumes without specifying it in the volume creation process.
- C. Correct.
Correct. Block Volume service needs permission to use your vault key. An IAM policy granting the necessary actions (e.g., 'use keys') ensures the service can encrypt data with that key.
- D. Incorrect.
Incorrect. Regular key rotation is a recommended best practice for security, but it is not required to enforce the use of your vault-managed key for newly created block volumes.