1Z0-997-25 Question 68
Single answerYou are designing a microservice on Oracle Cloud Infrastructure that needs to securely store and automatically rotate database credentials. The credentials are currently stored in OCI Vault as a secret. You want to ensure the application updates its configuration whenever the secret is rotated without requiring manual intervention. Which solution best addresses these requirements with minimal custom code?
- A
Configure the vault secret to rotate on a set schedule and create an OCI Events rule that triggers an OCI Function to update the microservice� configuration when a new secret version is created.
- B
Use Resource Principals to store the secret directly in the microservice� environment variables, and rely on native environment variable rotation by OCI.
- C
Set up a pre-built Oracle Cloud Agent on the Compute instance to automatically detect and retrieve new secret versions from OCI Vault without requiring an OCI Function or Events.
- D
Manually rotate the secret from the OCI Console on a monthly basis and restart the microservice so that it picks up the new credentials.
Show answer and explanation
Correct answer: A
Explanation
OCI Vault has a built-in rotation feature that can automatically schedule updates to secrets. To ensure downstream applications always use the latest credentials, you can integrate rotation events with OCI Functions via OCI Events. The function can then update the microservice� configuration or secret reference, eliminating the need for manual steps and reducing security risks. For more details, refer to Oracle Cloud Infrastructure documentation on 'Configuring Rotation for a Secret' and 'Using Oracle Events and Functions for Secret Rotation.'
- A. Correct.
Correct. Configuring a scheduled rotation in OCI Vault and using OCI Events to invoke an OCI Function is a recommended best practice. The function can programmatically fetch the new secret version and update the microservice or its configuration, ensuring the credentials remain in sync automatically.
- B. Incorrect.
Incorrect. Resource Principals allow the microservice to securely call OCI services but do not provide built-in environment variable rotation. You still need a rotation mechanism for secrets stored in the vault and a way to notify the microservice when credentials are updated.
- C. Incorrect.
Incorrect. Oracle Cloud Agent does not provide a pre-built feature to detect and update secrets in an application environment. This approach would require additional custom scripting or integration, and there's no built-in agent-based solution for rotating secrets automatically.
- D. Incorrect.
Incorrect. Manual rotation is error-prone and labor-intensive, as someone has to remember and execute the rotation. It also disrupts the application flow and does not minimize overhead or automate the process.