1Z0-1104-25 Question 19
Select 2You are a security architect at a financial services firm planning to store daily transaction logs in an OCI Object Storage bucket. The logs must be encrypted with your own encryption keys and only accessible from a single private subnet in your VCN. Which two approaches should you recommend to ensure these requirements are met? (Choose two.)
- A
Enable server-side encryption with Oracle-managed keys and attach an Internet Gateway to the VCN for bucket access.
- B
Use an OCI Vault to create a customer-managed master encryption key, configure the Object Storage bucket to use that key, and set the bucket to 'private'.
- C
Create an IAM policy with a condition that grants access to the bucket only when requests originate from your private subnet's IP range, and set up an Object Storage service gateway for internal traffic.
- D
Use a pre-authenticated request so that only employees on the private subnet can access the Object Storage bucket.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirement of encrypting logs with your own key, you must use Oracle Cloud Infrastructure Vault to create a customer-managed encryption key and configure the bucket to use it. Making the bucket private ensures no public access. You also need to restrict access to the private subnet by creating an IAM policy with a specific condition and using a service gateway for secure connectivity. Refer to the 'Using Vault for Customer-Managed Keys' and 'Service Gateway for Private Access to Object Storage' sections of the OCI documentation for further details.
- A. Incorrect.
Option 1 is incorrect. Enabling server-side encryption with Oracle-managed keys does not fulfill the requirement of using your own keys. Additionally, attaching an Internet Gateway does not restrict bucket access to a single private subnet.
- B. Correct.
Option 2 is correct. Using an OCI Vault to create a customer-managed key satisfies the requirement for custom encryption. Setting the bucket to 'private' prevents direct public access, which is a necessary step toward limiting access to only the approved subnet.
- C. Correct.
Option 3 is correct. An IAM policy with a condition that restricts bucket access to requests originating from the private subnet is required to ensure that users outside this subnet cannot access the logs. Setting up a service gateway allows traffic to reach Object Storage privately, without using a public endpoint.
- D. Incorrect.
Option 4 is incorrect. A pre-authenticated request is accessible to anyone who obtains the URL, which does not guarantee that only users from the private subnet can access the bucket.