1Z0-1067-25 Question 99
Select 2Your organization� security teams have recently updated their policies to strengthen your tenancy� security posture in Oracle Cloud Infrastructure (OCI). They mandate that (1) multiple factors of authentication must always be used for every user, (2) console logins from outside the office IP range should be blocked, and (3) a critical compartment containing sensitive resources must maintain strict access controls to minimize accidental exposures. Which two actions should you implement to comply with these requirements while adhering to OCI best practices?
- A
Create a network source that includes only the office IP range, then associate a policy to restrict console logins to that source.
- B
Enable federated login through an external identity provider without configuring any IP restrictions.
- C
Enforce multi-factor authentication (MFA) for all user accounts at the tenancy level or via Identity provider settings integrated with OCI.
- D
Grant the Administrator group unrestricted access to the critical compartment, as it simplifies compartment policy management.
- E
Deploy a custom policy requiring group members to confirm a reason for access before performing any compartment operations.
Show answer and explanation
Correct answers: A, C
Explanation
To meet stringent security requirements in OCI, you should combine IAM features such as multi-factor authentication (MFA) enforcement and network sources for IP-based access control. Refer to the official OCI documentation on 'Managing Network Sources' and 'Securing User Access with MFA' for best practices on restricting console logins and ensuring users are prompted for multiple factors of authentication. Additionally, use precise compartment policies to enforce only the required level of access, preventing broad privileges on critical resources.
- A. Correct.
Option 1 is correct. Using an OCI network source to define an IP range and applying a policy that restricts console logins to that source ensures only the specified IP addresses (e.g., office IP addresses) can access the console. This aligns with best practices for limiting access based on source IP.
- B. Incorrect.
Option 2 is incorrect. Simply enabling identity federation does not automatically enforce IP-based restrictions in your OCI tenancy. You would still need to explicitly set up and maintain any required IP filtering in either the Identity Provider or in OCI.
- C. Correct.
Option 3 is correct. Enforcing MFA for all user accounts strengthens authentication, meeting the requirement that multiple factors be used. In OCI, you can enable MFA at the tenancy level or integrate external IdP MFA solutions to add an extra layer of security.
- D. Incorrect.
Option 4 is incorrect. Granting the Administrator group unrestricted access to the critical compartment would violate the mandate for strict access controls. Proper compartment-based policies should only allow the necessary level of access to the group or roles, not blanket permissions.
- E. Incorrect.
Option 5 is incorrect. While requiring a reason for each access is a good concept for audit trails, this option does not address the specific requirements (MFA, IP restriction, and strict access) in a measurable way. OCI does not natively enforce a 'confirm-a-reason' workflow in compartment policies.