1Z0-1104-25 Question 123
Single answerYour organization recently discovered that a sensitive OCI Block Volume is encrypted with an Oracle-managed key. Due to new compliance requirements, you must transition the volume to use a customer-managed key (CMK) while minimizing downtime. Which approach should you take?
- A
Import an external key into the vault and rotate the Oracle-managed key to seamlessly adopt the CMK for the existing volume.
- B
Create a backup of the existing volume, then restore it to a new volume encrypted with the CMK. Finally, detach and replace the old volume with the new one.
- C
Use the OCI Console to directly switch the current volume from Oracle-managed to customer-managed encryption in-place without downtime.
- D
Assign the vault a dynamic group that includes your instance, allowing the volume to be automatically re-encrypted at runtime.
Show answer and explanation
Correct answer: B
Explanation
Oracle Cloud Infrastructure recommends creating a new volume from a backup when migrating from Oracle-managed to customer-managed keys. This ensures all data is properly re-encrypted under the new key with minimal downtime. Refer to OCI Key Management Service documentation for best practices on securely managing and rotating encryption keys.
- A. Incorrect.
Option 1 is incorrect because rotating an Oracle-managed key does not convert it to a customer-managed key. Importing an external key alone won't automatically re-encrypt the existing volume.
- B. Correct.
Option 2 is correct. Backing up and then restoring the volume with the new customer-managed key is the recommended OCI best practice. This approach re-encrypts the data with minimal disruption by simply detaching the old volume and attaching the restored volume.
- C. Incorrect.
Option 3 is incorrect. You cannot just flip a switch on the volume to change its encryption from Oracle-managed to customer-managed. A backup-and-restore process is needed to re-encrypt the data.
- D. Incorrect.
Option 4 is incorrect. Dynamic groups control permissions to use resources in the vault, but they do not automatically migrate or re-encrypt existing volumes.