1Z0-1104-25 Question 84
Single answerYou are managing an e-commerce application behind an OCI Load Balancer that uses a TLS certificate stored in the Oracle Cloud Infrastructure (OCI) Certificates service. The certificate is scheduled for rotation soon, and you want to ensure the application continues to function without downtime when the certificate rotates. Which approach should you follow?
- A
Create a new certificate in the same compartment, manually attach it to the load balancer listener, and remove the old certificate only after traffic is confirmed to be operational with the new one.
- B
Use the old certificate� OCID in the load balancer listener; when rotation occurs, the listener automatically switches to the new certificate without further configuration.
- C
Enable certificate rotation in OCI Certificates and configure the load balancer to reference the certificate bundle by its resource OCID, so rotated certificates are automatically applied to the listener.
- D
Delete the expiring certificate before creating a new one, ensuring the load balancer automatically falls back to the default Oracle-managed certificate for continuity.
Show answer and explanation
Correct answer: C
Explanation
In OCI, each certificate rotation generally replaces the old certificate with a new version (and a new OCID) when automatic rotation is enabled. If your load balancer listener references the specific resource OCID of the automatically rotating certificate bundle, the load balancer seamlessly applies the renewed certificate without the need for manual updates or service disruption. Refer to the OCI documentation on Certificates and Load Balancer integration for detailed guidance on automating certificate lifecycle management.
- A. Incorrect.
Option 1 (Incorrect): While manually attaching a new certificate to the load balancer is a valid method, it does not provide automatic rotation. You would need to manually update the load balancer each time the certificate rotates, which is error-prone and can lead to downtime if not done quickly.
- B. Incorrect.
Option 2 (Incorrect): Simply using the old certificate� OCID does not ensure the load balancer will automatically update to a newly rotated certificate. Each certificate rotation typically results in a new OCID for the replaced certificate, so relying on the old certificate� OCID would not automatically pick up the new one.
- C. Correct.
Option 3 (Correct): By enabling rotation for the certificate and configuring the load balancer to reference the certificate bundle by its resource OCID, the load balancer automatically retrieves and applies the latest certificate version. This approach is recommended for automated certificate management with minimal downtime.
- D. Incorrect.
Option 4 (Incorrect): Deleting the expiring certificate first would cause the load balancer to lose its SSL configuration until you attach a new certificate. This can lead to a service disruption and is not the recommended best practice.