A court-records analytics stream on OCI Streaming must use a customer-managed encryption key instead of relying only on Oracle-managed keys. Where is that customer-managed key sourced?
Select an answer to reveal the explanation.
Short Explanation
Streaming always locks the filing cabinet; you choose whether Oracle holds the master key or you name your own key in Vault. Data is encrypted in transit and at rest either way. Selecting a Vault master key is the Streaming setting for customer-managed control—creating and rotating keys in depth belongs to securing applications, not this item.
Full Explanation
OCI Streaming encrypts data in transit and at rest. When a court-records analytics stream must use a customer-managed encryption key instead of only Oracle-managed keys, you name a master key from OCI Vault on the Streaming configuration. Oracle-managed keys remain the simpler alternative when customer-managed control is not required. Selecting the Vault master key is the Streaming-side setting under test; deeper key creation and rotation procedures live with Vault in the securing domain.
An API Gateway usage-plan token is a metering credential, not stream AES key material. The consumer group’s offset store tracks read position and does not automatically rotate data encryption keys weekly. OKE Secrets volume mounts are for workloads on Kubernetes; Streaming does not read partition encryption material from those mounts.
Exam caveat: customer-managed keys add control and operational responsibility (access policies, rotation coordination). Do not invent alternate key stores such as usage-plan tokens or offsets.
Operational check: create or select a Vault master key, configure the stream (or pool encryption setting as documented) to use that customer-managed key, publish a test record, and confirm the stream shows customer-managed encryption rather than only the Oracle-managed default.