1Z0-1067-25 Question 114
Single answerYour organization recently completed a compliance audit that revealed several user groups in the 'Production' compartment have permissions to create, update, and delete resources, even though their roles only require read access. As the Cloud Ops Professional, you need to minimize the risk of unauthorized changes while still allowing these users to perform essential monitoring and troubleshooting tasks. Which approach best implements least-privilege access for these groups in Oracle Cloud Infrastructure?
- A
Remove all policies for these groups and reassign them later with broader privileges once details are clarified.
- B
Use a single 'manage all-resources' policy for each group but instruct the users to voluntarily avoid creating or deleting resources they do not need.
- C
Restrict the current broad 'manage' policy by splitting permissions into more granular policies (e.g., 'inspect', 'read') so that groups only have the minimum required access to resources.
- D
Grant 'manage' access only to a new security group, then place all current users in the same group for streamlined administration.
Show answer and explanation
Correct answer: C
Explanation
Least-privilege policies in Oracle Cloud Infrastructure typically involve using more specific verbs (e.g., 'inspect', 'read') instead of broad 'manage' permissions. This ensures users have only the access required for their roles, mitigating risk while maintaining essential functionality. Refer to the Oracle Cloud Infrastructure IAM Best Practices documentation for guidance on setting granular policies that match each group� actual needs.
- A. Incorrect.
Option 1 is incorrect because removing all policies without a clear plan can cause immediate access issues and downtime; it's too disruptive and does not follow a structured least-privilege approach.
- B. Incorrect.
Option 2 is incorrect because relying on users to self-regulate rather than enforcing restrictive policies goes against the principle of least-privilege and can lead to security gaps.
- C. Correct.
Option 3 is correct. Splitting broad 'manage' privileges into granular policies like 'inspect' or 'read' ensures that each group only has the permissions needed, thereby implementing least-privilege effectively.
- D. Incorrect.
Option 4 is incorrect because merging all users into a single group with broad 'manage' privileges is counterproductive to least-privilege, even if labeled as a 'security group.' It does not address the audit findings.