1Z0-1067-25 Question 100
Select 2While reviewing your Oracle Cloud Infrastructure (OCI) tenancy's security posture, you discover that multiple compute and database resources have been created in the root compartment by developer groups. Your security policy requires that only tenancy administrators are allowed to manage resources in the root compartment. Which two actions should you take to enforce this requirement?
- A
Remove any existing IAM policy granting developer groups �manage all-resources in tenancy� and instead provide them compartment-specific access.
- B
Enable the �root compartment lockdown� feature in the Tenancy Administration console to automatically deny any new resource creation in the root compartment.
- C
Create a policy statement to allow the Developers group to manage all-resources in the root compartment specifically for troubleshooting.
- D
Move existing resources out of the root compartment to designated sub-compartments, and ensure only the tenancy administrator group retains permissions for the root compartment.
Show answer and explanation
Correct answers: A, D
Explanation
Oracle Cloud Infrastructure recommends minimizing resource creation in the root compartment to maintain a clean and secure tenancy structure. By removing broad, high-level IAM policies and providing access only at the compartment level, you enforce the principle of least privilege. Refer to the Oracle documentation on Identity and Access Management (IAM) best practices (docs.oracle.com/en-us/iaas/Content/Identity/index.htm) to learn more about using policies and compartments to achieve a secure and organized tenancy.
- A. Correct.
Correct. Oracle IAM policies are based on 'allow' statements. By removing developer groups� broad permissions at the tenancy (root) level and restricting these groups to specific sub-compartments, you effectively eliminate their ability to create resources in the root compartment.
- B. Incorrect.
Incorrect. There is no built-in 'root compartment lockdown' feature in OCI Tenancy Administration. While you can implement policies to restrict or remove certain permissions in the root compartment, this specific feature name does not exist.
- C. Incorrect.
Incorrect. Allowing developer groups to manage resources in the root compartment contradicts the requirement that only tenancy administrators should have that capability. This would maintain or increase their current level of access rather than reduce it.
- D. Correct.
Correct. Moving resources out of the root compartment aligns with best practices to avoid clutter and improve security. Then, granting permissions in the root compartment only to the tenancy administrator group ensures that developers can no longer manage or create resources there.