1Z0-1104-25 Question 128
Single answerYou are storing database credentials in an OCI Vault secret for a critical production database. The credentials must be rotated every 30 days to meet compliance requirements, and your application microservices must automatically use the latest version without manual updates. Which approach should you take to ensure the microservices always use the current secret version after rotation?
- A
Configure your microservices to reference a static version number in the connection string stored in OCI Vault.
- B
Use the secret� defined stage (e.g., 'CURRENT') in your microservices so they always retrieve the latest version of the secret.
- C
Export the secret value as an environment variable and manually regenerate the environment variable on each rotation cycle.
- D
Create a new secret for each rotation and update the microservices to point to the newly created secret.
Show answer and explanation
Correct answer: B
Explanation
When managing secrets in OCI Vault, you can assign stages to each secret version (such as 'CURRENT' for the latest production version). By configuring your microservices to always retrieve the secret by its stage rather than a specific version number, your applications will automatically begin using the newly rotated secret without manual intervention. This is considered a best practice in Oracle Cloud Infrastructure. For more details, refer to the official Oracle Cloud Infrastructure documentation on Managing Secrets.
- A. Incorrect.
Option 1 is incorrect. Referencing a static version number in your application code forces you to update the application or its configuration whenever the secret version changes, which is error-prone and does not ensure automatic use of the new secret.
- B. Correct.
Option 2 is correct. By referencing the secret through its designated stage (e.g. 'CURRENT'), the microservices will always retrieve the latest version as soon as it becomes active, making rotation seamless.
- C. Incorrect.
Option 3 is incorrect. Environmental variables would still need manual updating or application restarts upon each rotation, defeating the goal of automatic use of the latest version.
- D. Incorrect.
Option 4 is incorrect. Creating entirely new secrets for every rotation requires repeated reconfiguration of your microservices to point to the updated secret, which is not an efficient or automated process.