1Z0-1067-25 Question 97
Select 2You are responsible for implementing a consistent security posture in an OCI tenancy for a large enterprise. The enterprise requires that all compartments adhere to the principle of least privilege, that only authorized administrators can create or modify resources, and that any suspicious or non-compliant activities are detected automatically. You also need to ensure your approach remains flexible for future expansions. Which TWO configurations best satisfy these requirements?
- A
Create and attach well-scoped IAM policies to each compartment, ensuring minimal privileges for each team� responsibilities.
- B
Enable OCI Cloud Guard, configure a target for the entire tenancy, and set up detectors to flag or remediate unusual activities automatically.
- C
Grant the tenancy admin group the 'manage all-resources' permission in the root compartment to allow broad control across all compartments.
- D
Use a single default policy at the root compartment level that gives read-write access to all users across every compartment.
Show answer and explanation
Correct answers: A, B
Explanation
To secure an OCI tenancy, you must enforce least privilege through well-scoped IAM policies and continuous monitoring. IAM policies tailored for each compartment limit access, while OCI Cloud Guard provides ongoing detection and remediation of policy violations or misconfigurations. This combination balances security with flexibility, aligning with best practices described in the Oracle Cloud Infrastructure documentation.
- A. Correct.
This option is correct. Using compartment-specific IAM policies with just the necessary privileges enforces the principle of least privilege. It ensures each team has only the access required for their duties, reducing the risk of accidental or unauthorized changes.
- B. Correct.
This option is correct. Enabling Cloud Guard and configuring tenancy-wide targets allows automatic detection and remediation of suspicious or non-compliant activities. It provides continuous monitoring to maintain a strong security posture.
- C. Incorrect.
This option is incorrect. Granting 'manage all-resources' for an administrative group at the root level is overly permissive and contradicts the principle of least privilege. Although it simplifies management, it also increases risk.
- D. Incorrect.
This option is incorrect. A single open-ended policy at the root level undermines security and fails to limit access. It does not ensure that only authorized administrators can make changes and does not segment privileges effectively.