1Z0-1104-25 Question 126
Single answerYour security team enforces a policy requiring rotation of the encryption key used for protecting sensitive data in Oracle Object Storage every 90 days. After 60 days, you create a new key version in Oracle Cloud Infrastructure (OCI) Key Management Service (KMS) and plan to update your applications to use the new version. However, you discover that several active workloads are still encrypting data with the old key version. Which action ensures you transition to the new key version without disrupting ongoing operations?
- A
Immediately disable the old key version so that all applications switch to the new key version.
- B
Enable the new key version, update application references, and only disable the old key version after verifying no workloads rely on it.
- C
Delete the old key version to free up space and force all workloads to use the new version.
- D
Keep both key versions enabled permanently and rely on OCI to automatically route all encryption requests to the new version after 90 days.
Show answer and explanation
Correct answer: B
Explanation
When rotating encryption keys in OCI KMS, you should create a new key version and then update all references to point to that new version without immediately disabling or deleting the old key version. Once you confirm that no active workloads rely on the old version, you can safely disable or retire it. This approach is recommended in Oracle documentation regarding key rotation best practices (refer to OCI Key Management documentation: https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm).
- A. Incorrect.
Incorrect: Immediately disabling the old key version will break any workloads still referencing it, causing service disruptions. While disabling may be necessary eventually, doing so without updates to active workloads can result in errors.
- B. Correct.
Correct: Proper rotation involves introducing the new key version, gradually updating workloads to use it, and only disabling or retiring the old key version once you're certain it� no longer in use. This prevents service interruptions while maintaining compliance.
- C. Incorrect.
Incorrect: Deleting a previously used key version is not a safe first step because active workloads may still need to decrypt or encrypt data using the old version. Deletion can cause critical service failures and data access issues.
- D. Incorrect.
Incorrect: Keeping both versions enabled permanently might violate compliance requirements and can lead to confusion about which key version is actually in use. OCI does not automatically switch workloads; administrators must explicitly update references and disable the old version.