1Z0-1067-25 Question 101
Single answerYou are responsible for implementing a secure tenancy posture in Oracle Cloud Infrastructure for your company. The tenancy is organized into multiple compartments labeled Dev, Test, and Production. Developers should only access the Dev compartment, but you discover they can view logs in the Production compartment. Investigating reveals a root-compartment policy granting read access to logs in all compartments. Which solution best resolves this issue while preserving the necessary Dev access for developers?
- A
Remove the root-level logging policy and create more granular policies that explicitly allow the Dev group to read logs only within the Dev compartment.
- B
Move the developer group from the Dev compartment to the Production compartment to adopt the default permission model.
- C
Create a custom deny rule in the Production compartment that blocks all log access for the developer group while retaining the root-level policy.
- D
Enable a Security Zone in the Production compartment to automatically restrict cross-compartment log access for the developer group.
Show answer and explanation
Correct answer: A
Explanation
When implementing a tenancy security posture, it is crucial to follow the principle of least privilege and avoid tenancy-wide policies that permit unnecessary access. By refining or removing an overly broad allow policy in the root compartment, administrators can enforce compartment-based access. Reference: Oracle Cloud Infrastructure IAM best practices (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/bestpracticesforiam.htm).
- A. Correct.
Correct. Removing or modifying over-permissive root-level policies and replacing them with compartment-specific policies is a standard best practice. This ensures developers only have access to the Dev compartment� logs and cannot view logs from other compartments.
- B. Incorrect.
Incorrect. Moving the developer group to the Production compartment would grant them direct access to Production resources, contradicting the requirement for strict separation of environments.
- C. Incorrect.
Incorrect. Although a custom deny rule can adjust permissions, it is more efficient and secure to remove or refine the original overly broad policy. Deny rules can become complex to maintain and may not align with least-privilege principles if the allow policy at a higher level remains too broad.
- D. Incorrect.
Incorrect. Security Zones can protect certain resources, but simply enabling a Security Zone in the Production compartment is not the best way to fix an overly broad root-level policy. The root policy that grants excessive access still needs to be properly scoped.