1Z0-1104-25 Question 83
Single answerYour organization has a microservices-based application running behind an OCI Load Balancer, and you want to enforce HTTPS with minimal downtime. You also need automatic certificate rotation while ensuring your TLS private keys remain securely stored. Which approach fulfills these requirements on Oracle Cloud Infrastructure?
- A
Use Oracle-managed certificates with domain ownership validation, which automatically handles certificate renewal and stores private keys securely in OCI.
- B
Generate self-signed certificates for each microservice and update them manually on each backend server when they expire.
- C
Store certificates in an external file repository and configure a script to regularly pull them into the Load Balancer listeners.
- D
Obtain certificates from a third-party CA and manually re-import them into the Load Balancer on a set schedule.
Show answer and explanation
Correct answer: A
Explanation
Using Oracle-managed certificates attached to an OCI Load Balancer allows you to delegate certificate lifecycle management�including renewal and private key protection�to OCI. Once domain ownership is validated, OCI automatically handles renewal, eliminating the need for repeated manual steps. This approach aligns with best practices outlined in the Oracle Cloud Infrastructure documentation, where managed certificates help ensure secure, continuously valid connections for both external and internal traffic.
- A. Correct.
Option 1 is correct. Oracle-managed certificates can be attached to the Load Balancer, automatically renewing the TLS certificate after domain ownership validation. The private keys stay securely managed within OCI, reducing operational overhead and downtime.
- B. Incorrect.
Option 2 is incorrect. Self-signed certificates require manual rotation and do not provide built-in security validation or automated renewal. This approach is error-prone and not recommended for production environments.
- C. Incorrect.
Option 3 is incorrect. While storing certificates externally could help with version control, it does not provide automated renewal. You would still need to manually manage updates or implement a script, which can be less reliable than a fully managed OCI solution.
- D. Incorrect.
Option 4 is incorrect. Even though a third-party CA can issue valid certificates, manual re-import into the Load Balancer is still required on certificate expiration. This does not meet the requirement for automatic certificate rotation.