1Z0-997-25 Question 55
Select 2You are an architect for a healthcare provider that needs to store personally identifiable information (PII) in an Oracle Object Storage bucket. The data must be encrypted with a customer-managed key, accessible only by authorized groups, and every user action must be tracked for compliance. Which two actions must you take to implement the required security measures in Oracle Cloud Infrastructure?
- A
Create a Vault in OCI, generate a master encryption key, and associate it with your Object Storage bucket. Configure an IAM policy granting the relevant groups the required access while denying all others.
- B
Use the default Oracle-managed master key for your Object Storage bucket, and enable pre-authenticated requests for public access to ensure easy data sharing.
- C
Enable Object Storage logging or Object Events for all bucket operations and integrate these logs with the Audit service for complete tracking of user actions.
- D
Mark the bucket as 'Public' to simplify data access and rely on the default data-at-rest encryption for maintaining security.
Show answer and explanation
Correct answers: A, C
Explanation
To secure sensitive data in Object Storage, the best practice is to use customer-managed keys from OCI Vault for stronger control over encryption. You must also limit permissions using IAM policies to ensure that only authorized users or groups can access PII. Enabling Object Storage logging or Object Events (and integrating them with the Audit service) provides full visibility into who accessed the data and when�an essential step for regulatory compliance. Refer to the Oracle Cloud Infrastructure documentation on File Storage encryption, IAM policies, and OCI Audit (https://docs.oracle.com/en-us/iaas/Content/) for details on implementing these security measures.
- A. Correct.
Option 1 is correct. By creating a Vault and generating a master key, you can enforce customer-managed encryption. Configuring an IAM policy to grant required groups access while denying others ensures only authorized users can interact with the bucket.
- B. Incorrect.
Option 2 is incorrect. Using the default Oracle-managed key does not fulfill the requirement of providing a customer-managed key. Enabling pre-authenticated requests for public access contradicts the requirement that only authorized groups can access the bucket.
- C. Correct.
Option 3 is correct. Enabling Object Storage logging or Object Events and integrating them with the Audit service ensures all operations on the bucket are captured, thereby meeting the requirement for complete tracking of user actions.
- D. Incorrect.
Option 4 is incorrect. Marking the bucket as 'Public' directly conflicts with the requirement to limit access to authorized groups only, even though OCI automatically encrypts data at rest.