1Z0-1104-25 Question 130
Select 2Your analytics application uses a secret stored in an Oracle Cloud Infrastructure (OCI) Vault to connect to a production database. Security guidelines require that the database password be rotated every 60 days. You also need to ensure the application always uses the latest password after rotation. Which two steps must you take to meet these requirements using native OCI capabilities?
- A
- Configure a scheduled rotation for the secret in OCI Vault and create a custom rotation function that updates your database account password, granting the function sufficient permissions via IAM policies.
- B
- Enable auto-rotation for the secret in OCI Vault without any additional steps; the Vault will update the database automatically.
- C
- Use the Vault-Managed Rotation feature that modifies database user credentials directly without needing to integrate a rotation function or configure IAM policies.
- D
- Update your application to retrieve the latest secret version from the Vault when establishing the database connection.
Show answer and explanation
Correct answers: A, D
Explanation
To rotate a secret automatically and ensure an external resource like a database receives the new credentials, you must combine OCI Vault's secret rotation schedule with a rotation function that updates the database user password. You also need an IAM policy granting the function permission to retrieve and manage secrets as well as modify the database password. Your application should always fetch the secret's latest version so it has the most up-to-date credentials. Refer to Oracle� documentation on OCI Vault secret rotation and IAM policies for best practices.
- A. Correct.
Option 1 is correct. Simply scheduling the rotation in the Vault is not enough on its own; you must configure a custom rotation function that updates the database account password. Additionally, you need an IAM policy that grants the function permission to manage or update the secret and communicate with the database.
- B. Incorrect.
Option 2 is incorrect. Auto-rotation only updates the secret stored in the Vault, not the database itself. A custom rotation function or appropriate external integration is required to synchronize the new password with the actual database account.
- C. Incorrect.
Option 3 is incorrect. OCI currently does not provide a built-in feature called 'Vault-Managed Rotation' that automatically modifies database user credentials on your behalf without any function or policy configuration. A custom solution (via a function or other mechanism) is needed to update credentials in the external database.
- D. Correct.
Option 4 is correct. After rotation, the latest secret version is stored in the Vault. Configuring your application to pull the secret� most recent version ensures that it is using the newest password for the database connection.