1Z0-1067-25 Question 109
Select 2Your HPC_Operators group needs to create and manage HPC compute instances only in the dev-hpc compartment. The group must not have privileges to manage or view resources in other compartments. Which TWO actions would you take to enforce least-privilege access for this requirement?
- A
- Create a policy in the dev-hpc compartment: 'Allow group HPC_Operators to manage instance-family in compartment dev-hpc.'
- B
- Create a policy in the root compartment: 'Allow group HPC_Operators to manage all-resources in tenancy.'
- C
- Remove HPC_Operators from any existing policies granting broad privileges in other compartments.
- D
- Create a dynamic group called HPC_Operators to include all user accounts belonging to HPC_Operators.
- E
- Assign HPC_Operators to the Security_Administrator group for additional security policies.
Show answer and explanation
Correct answers: A, C
Explanation
To implement least-privilege access control in OCI, you grant users only the permissions they require and remove or avoid granting any broader privileges. In this scenario, limiting the HPC_Operators group to 'manage instance-family in compartment dev-hpc' and ensuring they are not part of any broader policies or groups meets the requirement. Refer to Oracle Cloud Infrastructure IAM documentation for best practices on creating compartment-specific policies and structuring user groups to maintain least-privilege access.
- A. Correct.
Option 1 is CORRECT because creating a policy that limits the group� management privileges to instance-family permissions in the dev-hpc compartment enforces least-privilege principles for HPC_Operators. They can only operate resources in this compartment and nothing else.
- B. Incorrect.
Option 2 is INCORRECT because granting 'manage all-resources in tenancy' is overly broad, contradicting least-privilege principles. This would allow HPC_Operators to manage resources in every compartment.
- C. Correct.
Option 3 is CORRECT because removing HPC_Operators from policies that grant them unnecessary privileges in other compartments ensures that they can only manage resources in the dev-hpc compartment. This is crucial for maintaining least-privilege access control.
- D. Incorrect.
Option 4 is INCORRECT because dynamic groups in Oracle Cloud Infrastructure are used to provide access to resources based on instance or resource attributes, not for user-based group membership. HPC_Operators is a user group, not an instance or resource.
- E. Incorrect.
Option 5 is INCORRECT because the Security_Administrator group (or any broad administrator-like role) typically possesses extensive privileges beyond what HPC_Operators need to manage HPC compute instances, violating the principle of least privilege.