1Z0-1067-25 Question 102
Select 2Your organization has discovered that several developers can create resources in the root compartment, bypassing departmental policies and cost controls. As the Cloud Ops Professional overseeing tenancy security posture, you decide to restrict resource creation in the root compartment without impacting administrators. Which two actions should you take to achieve this goal?
- A
- Create an IAM policy that explicitly denies resource creation in the root compartment for all groups except the designated administrator group.
- B
- Move existing resources from the root compartment into dedicated compartments, and apply fine-grained IAM policies that grant creation privileges only within those compartments.
- C
- Enable Oracle Cloud Guard at the tenancy level to automatically block all non-administrator resource creation in the root compartment.
- D
- Use compartment quotas to keep the root compartment� resource creation limit at zero for all user groups, including administrators.
- E
- Manually manage all resource creation requests in the root compartment by using an approval workflow built into the OCI Console.
Show answer and explanation
Correct answers: A, B
Explanation
To strengthen your tenancy� security posture, follow the principle of least privilege by restricting resource creation in the root compartment and using dedicated compartments for different teams or applications. Oracle Identity and Access Management (IAM) policies are the primary mechanism for allowing or denying access to resources. Oracle Cloud Guard can help detect and respond to security risks but does not directly block resource creation. For more information, see the Oracle Cloud Infrastructure IAM documentation and best practices for compartment design.
- A. Correct.
Option 1 is correct. An IAM policy can be written to explicitly deny any resource creation in the root compartment except for the designated administrators. This ensures the 'least privilege' principle is upheld, preventing unauthorized resource creation at the highest level.
- B. Correct.
Option 2 is correct. Moving resources into their own compartments and then assigning appropriate privileges per compartment is a best practice. This approach allows for more granular control and segregates different functional areas, further strengthening tenancy security.
- C. Incorrect.
Option 3 is incorrect. While Oracle Cloud Guard helps detect misconfigurations and security risks, it does not automatically block resource creation. It offers recommendations and alerts but does not function as a direct enforcement tool for blocking resource provisioning.
- D. Incorrect.
Option 4 is incorrect. While compartment quotas can limit resource usage, setting it to zero across all user groups, including admins, would prevent even required administrative tasks. It is not a selective way to protect the root compartment while allowing authorized creation.
- E. Incorrect.
Option 5 is incorrect. There is no built-in approval workflow toggle in the OCI Console that lets you manually approve or deny each resource creation in the root compartment. Such functionality would require a custom solution outside of standard OCI features.