1Z0-1104-25 Question 131
Single answerYou manage a web application that serves customer-facing transactions. To secure communications, you have an SSL certificate and an associated private key and passphrase. You want to store and manage these items in Oracle Cloud Infrastructure (OCI) Vault so that you can seamlessly rotate the certificate before it expires. Which approach should you use to configure these items in the Vault for efficient versioning and rotation?
- A
Store the SSL certificate, private key, and passphrase as a Key in OCI Vault to enable automatic rotation.
- B
Store the SSL certificate, private key, and passphrase as a Secret with versioning in OCI Vault, and schedule rotation as needed.
- C
Use the OCI Certificate Service to directly import and manage the SSL certificate within a Key for rotation.
- D
Maintain the SSL certificate, private key, and passphrase locally on the host, and rely on operating system file rotations.
Show answer and explanation
Correct answer: B
Explanation
OCI Vault Secrets are designed to store sensitive data, such as SSL certificates, private keys, passwords, and passphrases. Using a secret with versioning allows you to rotate the certificate (and its passphrase) securely and automatically, while retaining older versions if necessary. Refer to the OCI documentation (https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/managingsecrets.htm) for guidance on creating and managing secrets, scheduling rotations, and integrating them with your applications.
- A. Incorrect.
Incorrect: OCI Vault Keys are primarily intended for encryption and decryption operations (e.g., encrypting data at rest). They do not directly manage SSL certificates or related passphrases in a versioned manner.
- B. Correct.
Correct: Storing your SSL certificate, private key, and passphrase as a Secret with versioning in OCI Vault is the recommended approach. This allows you to schedule or manually rotate the secret, ensuring old versions are kept as needed and new versions seamlessly replace the old ones.
- C. Incorrect.
Incorrect: OCI Certificate Service may help manage certificates, but it does not replace the need for storing the private key and passphrase in a Secret for versioning and rotation. Additionally, ACL-based Key usage is different from storing the certificate and passphrase as a versioned secret.
- D. Incorrect.
Incorrect: Storing credentials locally makes rotation and auditing difficult. It also defeats the purpose of using a managed service like OCI Vault for secure storage and versioned updates.