1Z0-997-25 Question 69
Select 3You have been tasked with implementing an automated secrets management solution in OCI Vault to rotate a database password every 45 days. Your plan is to use an OCI Function that updates the database credential and syncs it back into the Vault. Which three tasks must you complete to ensure the secret is automatically rotated and the password remains up-to-date?
- A
Create a dynamic group that includes the function and write IAM policies allowing it to manage secrets in the Vault
- B
Configure a rotation policy on the secret that references your function for the automatic update process
- C
Configure an OCI Streaming service to replicate the secret� value to multiple regions for redundancy
- D
Use Resource Principals in your function code to authenticate and update the secret in OCI Vault
- E
Set the function� invocation endpoint as a fixed environment variable in the microservice for manual triggering
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate secret rotation, you must create a rotation policy in OCI Vault that regularly invokes your OCI Function. The function itself must have permission to read and update the secret�this is accomplished by creating a dynamic group (for the function) and defining IAM policies granting it access to the Vault. Finally, the function should use Resource Principals to securely authenticate without storing credentials elsewhere. For additional guidance, refer to Oracle� documentation on Vault secrets auto-rotation and OCI Functions with Resource Principals.
- A. Correct.
Correct: You need to allow the function to read and update secrets. Creating a dynamic group for the function� OCID and granting it permissions in IAM policies enables the function to interact with the Vault programmatically.
- B. Correct.
Correct: A rotation policy must be defined at the secret level so OCI Vault knows when and how often to invoke your function for password rotation.
- C. Incorrect.
Incorrect: While replicating secrets across regions might be part of a broader disaster recovery strategy, it is not required for automated rotation of the database credential. OCI Streaming is not used in this context.
- D. Correct.
Correct: Resource Principals allow the function to securely fetch and update secrets without manually configuring credentials. This eliminates the need to store credentials in code or environment variables.
- E. Incorrect.
Incorrect: Relying on a microservice to manually trigger the rotation defeats the purpose of automating the process. The rotation policy in Vault handles scheduling and invocation without requiring a fixed endpoint call from the microservice.