Data protection, encryption, and key management
This domain tests how OCI protects data at rest and in transit, and how Vault keys and secrets are governed. Expect questions on envelope encryption, key versions, rotation, service integration, and the consequences of disabling or deleting key material.
Core rules
- OCI Vault stores master encryption keys and secrets. Vault supports symmetric and asymmetric keys; a virtual private vault provides a dedicated HSM partition.
- OCI uses envelope encryption: a master encryption key encrypts data encryption keys, and those DEKs encrypt data. Rotating the master key creates a new key version; old versions remain available to decrypt existing data.
- Key rotation is not re-encryption of all data. New writes use the new version; existing ciphertext stays tied to the version that encrypted it.
- Disabling a key blocks cryptographic operations that depend on it; scheduling deletion starts a waiting period and is destructive after completion. Neither is a substitute for rotation.
- Many services support customer-managed keys, including Block Volume, Object Storage, File Storage, and Base Database. The service principal needs policy authorization to use the key.
- Secrets are for credentials such as passwords and tokens; do not store them in instance metadata, user data, or code. Use secret bundles and rotation.
Worked example
A team encrypts a Block Volume with a customer-managed Vault key. Compliance requires annual rotation. Rotate the key to create a new version; do not delete the old version. New volume writes use the new version, while existing blocks remain decryptable with the old version. If the key is disabled, the volume cannot be attached or read until the key is re-enabled. Reasoning: rotation preserves availability and limits exposure; deletion or disablement breaks the service's ability to unwrap DEKs. Also verify the service principal has use keys authorization in the key compartment.
Traps
Equating rotation with re-encrypting every object; deleting a key version immediately after rotation; assuming TLS protects data at rest; storing secrets in plaintext; and forgetting the service-principal policy that lets a service use a customer-managed key.