1Z0-1067-25 Question 93
Single answerYour organization recently created a dedicated 'DevSecOps' compartment to store security-related logs generated by various cloud resources. The DevOps team needs read-only access to these logs so they can troubleshoot issues, but they are currently unable to view any log data in that compartment. Which approach best ensures the team can read logs from the 'DevSecOps' compartment while following Oracle Cloud Infrastructure best practices for managing identity and security?
- A
Create a policy in the 'DevSecOps' compartment granting read access to the DevOps group for log resources in that compartment.
- B
Attach a policy at the tenancy level with the statement: 'Allow group DevOps to read all-resources in tenancy'.
- C
Add all DevOps team members to the default Administrator group, ensuring they inherit full access across all compartments.
- D
Create a dynamic group to include all DevOps team members, then attach a policy that grants manage permissions on all log resources in tenancy.
Show answer and explanation
Correct answer: A
Explanation
To grant a specific group read-only permissions to logs in a compartment, create or attach a policy at the most appropriate level (either the compartment itself or the root compartment that contains it) with precise verb and resource-type definitions. According to OCI documentation, referencing the relevant resource type (e.g., 'log-groups', 'log-content') and compartment ensures adherence to the principle of least privilege and proper isolation. The recommended statement might look like 'Allow group DevOps to read log-groups in compartment DevSecOps'. This ensures the group can view logs while preventing unauthorized access to other compartments or resource types.
- A. Correct.
CORRECT. Policies must be attached to a compartment or the tenancy that contains the target resources. Granting the DevOps group read access specifically to log resources in the 'DevSecOps' compartment aligns with least privilege and fits OCI best practices.
- B. Incorrect.
INCORRECT. While attaching a policy at the tenancy level can grant access, it would be too broad (read all resources in the entire tenancy) and does not follow the principle of least privilege.
- C. Incorrect.
INCORRECT. Adding DevOps to the Administrator group is over-privileging. This would give them manage-level access to all compartments, which is not recommended as it violates the principle of least privilege.
- D. Incorrect.
INCORRECT. Using a dynamic group based on user membership is unnecessary here and granting 'manage' permissions in tenancy is more access than needed. A simpler group policy with the right verb (read) for the correct compartment is preferred.