1Z0-997-25 Question 52
Select 2You are managing a microservices-based healthcare application on Oracle Container Engine for Kubernetes (OKE). The microservices read and write sensitive patient data to an Oracle Autonomous Database. The compliance team requires that database credentials and encryption keys must be stored securely with a rotation policy enforced, and that no plaintext credentials appear in application logs. Which combination of approaches most effectively meets these requirements? (Choose two.)
- A
A. Store the database credentials and encryption keys in OCI Vault, and configure automatic key rotation policies.
- B
B. Embed the credentials within your CI/CD environment variables for easier access during build and deployment.
- C
C. Bake credentials into Docker images to make the microservices self-contained and eliminate external dependencies.
- D
D. Create a dynamic group for OKE worker nodes, and a corresponding IAM policy that allows those nodes to retrieve secrets from OCI Vault.
Show answer and explanation
Correct answers: A, D
Explanation
To implement a secure solution in Oracle Cloud Infrastructure (OCI), you should use OCI Vault for storing secrets, including database credentials and encryption keys. Vault supports auto-rotation, which helps maintain compliance with security requirements. Additionally, OKE worker nodes can be placed in a dynamic group, and an IAM policy can grant them permission to retrieve credentials at runtime, thus preventing the exposure of secrets in plaintext. For more details, see the OCI documentation on Vault (docs.oracle.com/en/oci/) and IAM Dynamic Groups.
- A. Correct.
A. Correct. OCI Vault is designed to securely store confidential data (such as database credentials and encryption keys) and supports automatic key rotation. By configuring a key rotation policy, you mitigate the risk of long-lived keys, thereby aligning with compliance requirements.
- B. Incorrect.
B. Incorrect. Storing credentials in CI/CD environment variables might be convenient, but it risks accidental exposure (for example, in build logs). This does not fully satisfy the requirement for secure storage or key rotation.
- C. Incorrect.
C. Incorrect. Embedding credentials directly into Docker images is a significant security risk. Anyone with access to the image registry might retrieve the images and extract the credentials, violating compliance requirements.
- D. Correct.
D. Correct. Creating a dynamic group for your OKE worker nodes and granting permission to retrieve secrets from OCI Vault gives the pods secure, temporary access to needed credentials at runtime. This approach prevents credentials from being hardcoded or exposed in logs.