1Z0-997-25 Question 56
Select 2Your organization must maintain compliance by using encryption keys controlled outside Oracle Cloud but still integrate with Oracle Cloud Infrastructure (OCI) for data at rest encryption. The security team wants to keep complete control of the keys externally, while ensuring that an application deployed on OCI can securely access these external keys at runtime. Which two steps are necessary to properly implement this external key management solution in OCI for data at rest encryption?
- A
Create or configure an OCI Vault and import your externally held keys, allowing OCI to handle data encryption at rest while you retain key ownership and lifecycle management.
- B
Store the encryption keys in an attached block volume on a Compute instance, secured by operating system permissions only.
- C
Establish an IAM policy granting a specific group 'manage keys' permission scoped to the Vault's compartment, ensuring only authorized personnel can manage these keys.
- D
Disable automatic rotation to avoid key synchronization issues and rely solely on manual rotation within your external system.
Show answer and explanation
Correct answers: A, C
Explanation
To implement external key management for OCI data at rest encryption, you typically combine OCI Vault (or Key Management) with externally generated keys. Importing external keys into OCI Vault ensures that OCI can encrypt resources while you maintain ownership and control over the key material. Additionally, scoping an IAM policy to 'manage keys' in the Vault's compartment follows best practices by granting only necessary privileges to the security team. Refer to Oracle's official documentation on Vault and Key Management (docs.oracle.com/en/solutions/manage-encryption-keys/) for detailed guidance and recommended configurations.
- A. Correct.
Option 1 is correct. OCI Vault can be configured to use externally generated keys or wrapped keys, allowing you to retain control of the keys while OCI manages the encryption of resources at rest. This meets compliance and security requirements for external key ownership.
- B. Incorrect.
Option 2 is incorrect. Storing sensitive keys directly on a block volume, even with OS-level security, is not a best practice for key management. It lacks the robust auditing, rotation, and compartment-based access control that come with dedicated key management services.
- C. Correct.
Option 3 is correct. An IAM policy specifically scoped to manage keys in the relevant Vault compartment ensures that only authorized administrators (e.g., a security operations group) can create, rotate, or disable the keys, reinforcing the principle of least privilege.
- D. Incorrect.
Option 4 is incorrect. Disabling automatic rotation defeats the purpose of secure key management best practices. OCI Vault supports key rotation policies that can integrate with external key management, ensuring ongoing compliance without leaving the keys static indefinitely.