An integrated OCI service stores a citizen document using Vault envelope encryption. What is stored next to the ciphertext, and why must the app call Vault to read it?
Select an answer to reveal the explanation.
Short Explanation
Lock the document with a padlock (DEK), then lock that padlock’s key with the vault master key. Only the wrapped DEK sits with the file—so opening it means calling Vault under IAM.
Full Explanation
Envelope encryption generates a data encryption key, encrypts the payload with that DEK, then encrypts the DEK with a vault master key. Integrated services keep the wrapped DEK—not the plaintext DEK or master key—next to the data. Reading requires calling Vault to unwrap, which is why IAM on the master key matters.