1Z0-1104-25 Question 125
Single answerYour team has deployed an application on OCI that uses a Customer-Managed Key (CMK) stored in OCI Key Management Service (KMS) to encrypt data in Object Storage. To comply with internal security policies, you need to rotate the CMK annually. The operations team is concerned that rotating the CMK might cause extended downtime or force re-encryption of all existing data. What is the recommended approach to meet the rotation requirement while minimizing service impact?
- A
A. Create a new vault each year and migrate all keys and data to the new vault before decommissioning the old one.
- B
B. Enable and schedule key version rotation for the existing CMK directly in OCI KMS, since this approach does not require re-encryption of existing data.
- C
C. Delete the current CMK and create a new key annually, forcing immediate re-encryption of all data in Object Storage.
- D
D. Duplicate the CMK in a different region and periodically switch your application to use the new region� vault for encryption.
Show answer and explanation
Correct answer: B
Explanation
OCI KMS supports key version rotation, allowing you to regularly rotate your Customer-Managed Key without re-encrypting previously stored data. This meets security requirements with minimal service disruption. The recommended best practice from Oracle documentation is to periodically rotate root keys�typically once per year�to limit key exposure and strengthen overall security. More details can be found in the OCI KMS documentation: https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm.
- A. Incorrect.
A. Creating a new vault each year and migrating all keys is unnecessary overhead. Migrating vaults is more complicated than simply rotating the key, and it can lead to potential service disruption.
- B. Correct.
B. This is correct. In OCI KMS, rotating the key version for the existing root key is straightforward and typically does not require re-encryption of existing data. The new key version is used for encrypting new data or re-encrypting the data encryption keys, thus minimizing downtime.
- C. Incorrect.
C. Deleting the existing CMK would invalidate its key versions, potentially breaking decryption for all previously encrypted data. This approach forces immediate re-encryption and causes significant service disruption.
- D. Incorrect.
D. Duplicating the key in a different region is useful for disaster recovery or cross-region requirements, but it is not the recommended practice for simple annual key rotation. It can add complexity and risk misconfigurations if the application frequently switches vaults.