1Z0-1104-25 Question 127
Single answerYou manage an application that stores a database password as a secret in OCI Vault. The application needs a new password, and you must ensure minimal downtime while switching to the updated credentials. Which sequence of steps should you take to update the secret properly?
- A
Create a new secret version for the updated password, configure the application to use the new version, then disable the old version once tests pass.
- B
Delete the old secret, create and enable a new secret with the updated password, and then modify your application code to reference the new secret� OCID.
- C
Replace the existing secret� contents in-place, keeping the same version number, so the application automatically picks up the updated password.
- D
Disable the Vault keys associated with the old secret, then create a new key and secret pair for the updated password.
Show answer and explanation
Correct answer: A
Explanation
Managing secrets in OCI Vault relies on versioning to ensure a smooth transition during updates. According to the OCI Vault best practices, you should always create a new secret version when you change sensitive information, update the consuming application to reference the new version, test it, and then disable or remove the old version. Refer to Oracle documentation on OCI Vault secrets management for additional guidance.
- A. Correct.
Correct: Creating a new secret version is the recommended approach. This allows you to test the updated password in the application before disabling the old version, minimizing downtime and risk.
- B. Incorrect.
Incorrect: Immediately deleting the old secret can cause application failures if references to it still exist. You should only disable or delete the old secret after confirming the new version is in use.
- C. Incorrect.
Incorrect: OCI Vault uses versioning for secrets. Simply overwriting without updating the version number is not supported. Creating a new version is the proper best practice.
- D. Incorrect.
Incorrect: Disabling Vault keys just for updating a secret is both unnecessary and disruptive. You can reuse the same master encryption key and simply create a new secret version.