1Z0-1104-25 Question 122
Single answerYou have an application storing confidential documents in an OCI Object Storage bucket using a customer-managed master key in OCI Key Management (KMS). Your organization mandates rotating keys every six months. What is the recommended approach to rotate the key without disrupting the existing applications that rely on the encrypted data?
- A
Create a new version of the existing master key, allowing automatic decryption of old data while new data uses the latest key version.
- B
Immediately delete the old key version after generating a new version to ensure stronger security guarantees.
- C
Disable the current master key and re-encrypt all data in the bucket with a new, completely separate master key.
- D
Change the Master Encryption Key assignment in the Object Storage settings without creating a new key version.
Show answer and explanation
Correct answer: A
Explanation
OCI KMS key rotation typically involves creating a new key version under the same master key, ensuring backward compatibility for decryption of existing data. Upon rotation, data encrypted with previous versions can still be decrypted, whereas newly encrypted data uses the latest version. This approach, detailed in the official OCI Key Management documentation, avoids disruptions and meets compliance requirements for regular key rotations.
- A. Correct.
Correct. By creating a new version of the existing master key, older data remains decryptable with previous versions of the key, and all newly encrypted data will use the latest key version. This approach minimizes disruption and complies with rotation policies.
- B. Incorrect.
Incorrect. Deleting the old key version immediately would prevent decryption of any data still encrypted with that version, disrupting the application. Old key versions should remain accessible for decryption until you are certain that no data relies on them.
- C. Incorrect.
Incorrect. Disabling the key or choosing a completely new master key without versioning would force re-encryption of all data, causing significant downtime and operational overhead. Versioning within the same key is a more efficient strategy.
- D. Incorrect.
Incorrect. Merely changing the master key assignment in Object Storage settings does not perform a proper key rotation. You need to create a new key version so that older data can still be decrypted while new data uses the latest version.