1Z0-997-25 Question 65
Single answerYour organization stores application credentials in Oracle Cloud Infrastructure (OCI) Vault and needs to rotate those secrets every 30 days to comply with security policies. You want the rotation process to be fully automated and ensure the application continues to function without manual updates. Which method should you implement to achieve this goal?
- A
Schedule notifications in OCI Vault and manually update credentials once notified every 30 days.
- B
Configure a secret rotation policy in OCI Vault that triggers an Oracle Functions-based custom rotation script every 30 days.
- C
Export the secret from OCI Vault to a local file, run a cron job that updates the file daily, and re-import it to Vault monthly.
- D
Use an on-premises script to connect periodically to OCI Vault and rotate the secret by manually calling the OCI CLI each time.
Show answer and explanation
Correct answer: B
Explanation
To automate secret rotation in OCI Vault, you create a rotation policy that invokes an Oracle Function to generate and push the new secret at your desired interval (e.g., every 30 days). This design eliminates manual steps, ensuring continuous compliance and minimal application downtime. For reference, see the official OCI documentation on 'Using Rotation Policies' for OCI Vault and 'Oracle Functions' to build and attach rotation logic.
- A. Incorrect.
Option 1: This relies on manual updates after receiving a notification. The question specifically requires a fully automated process, so manual intervention contradicts the goal.
- B. Correct.
Option 2: Correct. OCI Vault supports automated secret rotation by configuring a rotation policy. Typically, you attach a custom Oracle Function that knows how to generate new credentials and update the secret automatically on a set schedule.
- C. Incorrect.
Option 3: Exporting secrets from OCI Vault to local files and re-importing them is error-prone and not a recommended best practice. It also breaks the fully automated process by introducing multiple manual or ad-hoc steps.
- D. Incorrect.
Option 4: Although you can script rotations with OCI CLI, it requires maintaining an on-premises script and scheduling, which is more complex and not the recommended automated approach using Vault� built-in rotation policies.