1Z0-1067-25 Question 91
Select 2You are part of a team managing Oracle Cloud Infrastructure (OCI). You need to ensure that members of the 'DevOps' group can create, start, and stop compute instances only in the 'DevCompartment' while also granting them the ability to read audit logs stored in the 'LogsCompartment.' You must follow the principle of least privilege. Which two statements correctly configure the policies to achieve this objective?
- A
Create a single policy that grants 'manage all-resources' to the DevOps group at the tenancy level, relying on compartment security tags to limit compute and logs access.
- B
Define one policy with 'Allow group DevOps to manage instance-family in compartment DevCompartment' for compute and a separate policy with 'Allow group DevOps to read object-family in compartment LogsCompartment' for logs.
- C
Use narrower resource-specific permissions by defining policies like 'Allow group DevOps to use instance-family in compartment DevCompartment' and 'Allow group DevOps to inspect object-family in compartment LogsCompartment.'
- D
Add the DevOps group to the built-in Administrators group, then use tagging to reduce permissions for compute and logs in individual compartments.
Show answer and explanation
Correct answers: B, C
Explanation
In OCI, it is best practice to write separate policy statements that grant only the required permissions to the specified resource families, ensuring minimum necessary privileges. The 'manage' verb allows full control of a resource family within a compartment, while 'use' or 'inspect' grants progressively limited permissions. Placing a group in Administrators or granting tenancy-wide policies goes against the principle of least privilege. Refer to OCI IAM documentation for detailed policy syntax and best practices: https://docs.oracle.com/en-us/iaas/Content/Identity/accesscontrol.htm
- A. Incorrect.
Option 1 is incorrect because granting 'manage all-resources' at the tenancy level exceeds the principle of least privilege, giving DevOps control over all resources across all compartments.
- B. Correct.
Option 2 is correct. It adheres to best practices by creating distinct policy statements, limiting DevOps to manage instance-family in DevCompartment for compute and allowing read access to object-family in LogsCompartment for logs.
- C. Correct.
Option 3 is correct. It demonstrates a more precise application of the principle of least privilege by limiting DevOps to only the necessary actions (use or inspect) on specific resource families in clearly defined compartments.
- D. Incorrect.
Option 4 is incorrect because adding the DevOps group to Administrators grants far-reaching permissions across the tenancy, which conflicts with limiting them to just the DevCompartment for compute and the LogsCompartment for logs.