1Z0-997-25 Question 67
Select 2Your organization is deploying a set of microservices in Oracle Container Engine for Kubernetes (OKE). You need to securely store their database passwords and ensure these passwords are automatically rotated every 30 days. You also want each microservice to retrieve the latest password dynamically at runtime. Which two steps must you take to implement this using OCI Vault?
- A
A. Create a password secret in an OCI Vault, define a rotation policy for 30 days, and configure the microservices with permissions (dynamic groups or instance principals) to retrieve the secret at runtime.
- B
B. Embed the database passwords directly into each microservice� Kubernetes Deployment YAML file and manually update them every 30 days to maintain compliance.
- C
C. Configure a cloud-init script on each worker node to download the latest credentials from OCI Object Storage upon node startup, and restart all microservices every 30 days.
- D
D. Use an OCI Vault secret with a defined rotation period of 30 days and deploy an OCI Function triggered by an Events rule to rotate the secret and update the database password.
Show answer and explanation
Correct answers: A, D
Explanation
In OCI, secrets should be stored in Vault for encryption-at-rest and easy management. Rotation policies allow you to automate updating the secret� value on a defined schedule (for example, every 30 days). Microservices or other OCI services can securely retrieve these secrets at runtime using IAM-based authentication methods such as instance principals, resource principals, or dynamic groups, eliminating the need to hard-code or manually update credentials. Refer to Oracle� documentation on �Using Oracle Cloud Infrastructure Vault for Secrets Management� for more details on creating secrets, defining rotation policies, and integrating with other OCI services.
- A. Correct.
Option A is correct. Storing the database password as a secret in OCI Vault and defining a rotation policy for 30 days ensures automated rotation. Microservices can securely retrieve the secret at runtime by using IAM policies and resource principals (or dynamic groups and instance principals). This setup eliminates the need to expose or re-deploy credentials.
- B. Incorrect.
Option B is incorrect. Storing passwords directly in Kubernetes YAML files is insecure, and manual updates every 30 days are prone to error or oversight. It does not fully leverage automated rotation provided by OCI Vault.
- C. Incorrect.
Option C is incorrect. While using a cloud-init script to retrieve credentials is possible, storing secrets in OCI Object Storage and restarting microservices every 30 days is not a best practice for automated secrets management. OCI Object Storage does not provide built-in rotation capabilities, and manual restarts introduce unnecessary downtime and risk.
- D. Correct.
Option D is correct. OCI Vault can automate secret updates through a rotation process configured for 30 days. An OCI Function can be triggered by an Events rule to handle any additional operations needed�such as updating the database password or notifying relevant microservices�once the secret is rotated.