A records office encrypts citizen PDFs with envelope encryption in OCI Vault. Which statement correctly matches key roles?
Select an answer to reveal the explanation.
Short Explanation
Think of three jobs: the vault’s master key, the everyday DEK that locks each PDF, and the wrapping key that packages material you bring in. Same vault family, different jobs.
Full Explanation
Envelope encryption in OCI Vault separates roles clearly for citizen PDF archives. The master encryption key is customer-managed in the vault and protects data encryption keys rather than encrypting every PDF byte directly in typical envelope flows. A data encryption key (DEK) encrypts the actual payload—the PDF bytes. When you import key material, a vault wrapping key (commonly described as 4096-bit RSA in OCI Vault import flows) wraps that material for safe transport into the vault. Same vault family, three different jobs: master, DEK, wrapping.
Calling the data encryption key the customer-managed master key that never encrypts application payloads fails by concept: the DEK is exactly the key that encrypts payloads; the master key wraps DEKs. Claiming the wrapping key encrypts every citizen PDF byte-for-byte in place of a DEK fails because wrapping keys protect key material during import, not bulk document ciphertext. Treating all three names as the same exportable AES key that Oracle forbids distinguishing fails: OCI Vault documents distinct roles and protection behaviors; collapsing them loses the envelope model the exam expects.
Exam caveat: master wraps DEKs; DEKs encrypt data; wrapping keys import material—do not swap the nouns. Operational check: encrypt a sample PDF with a DEK, wrap that DEK under the vault master key, store ciphertext plus wrapped DEK, then decrypt only after an IAM-authorized unwrap call—and confirm a principal without master-key access cannot read the PDF.