1Z0-1072-25 exam dumps: questions 301 to 318 of 318

Correct answers: B, C

• A. Incorrect.

  Option 1 is incorrect because it grants the MarketingAdmins group broad access to all resources in the entire tenancy, violating the principle of least privilege. The goal is to isolate privileges only within MarketingDomain.

• B. Correct.

  Option 2 is correct. Creating the MarketingAdmins group inside MarketingDomain and defining a domain-level policy ensures that permissions apply only within MarketingDomain, aligning with the least privilege model.

• C. Correct.

  Option 3 is correct. Placing marketing resources in a dedicated compartment within MarketingDomain and granting MarketingAdmins permissions specifically for that compartment enforces tighter control and isolates their privileges.

• D. Incorrect.

  Option 4 is incorrect because replicating or copying all root-domain policies would allow MarketingAdmins to inherit unnecessary privileges beyond MarketingDomain, again violating the principle of least privilege.

• E. Incorrect.

  Option 5 is incorrect because granting a custom IAM role with full access across all compartments extends privileges beyond MarketingDomain, contrary to the requirement to limit them to marketing resources only.

Correct answers: A, C

• A. Correct.

  Option 1 is correct. You must create a dedicated group in the new identity domain ('ContractorDomain') for external contractor users. This separates their user accounts from your 'MainDomain' and improves access control management.

• B. Incorrect.

  Option 2 is incorrect. While you can create policies in a domain for certain domain-scoped resources, granting access to a compartment in the tenancy typically requires a policy in the tenancy's root compartment. Defining the policy solely in 'ContractorDomain' would not properly authorize access to a compartment that exists at the tenancy level.

• C. Correct.

  Option 3 is correct. In OCI, compartments exist at the tenancy level, so the standard practice is to create a policy in the root compartment referencing the group created in 'ContractorDomain.' This policy grants them access only to 'ContractorProjectCompartment,' isolating them from other resources.

• D. Incorrect.

  Option 4 is incorrect. You cannot 'move' a tenancy-level compartment under a domain. Compartments are managed within the tenancy and not contained within an identity domain. Domains and compartments are distinct constructs in OCI.

Correct answers: A, B, D

• A. Correct.

  Correct: Creating the 'R&D-Compartment' in the 'R&D-Domain' is essential to isolate the R&D project� resources and help with fine-grained access control. Compartments are logical containers for organizing and controlling access to resources.

• B. Correct.

  Correct: You must create a local group within the newly created 'R&D-Domain' and add all R&D users to it. Group membership is required for applying policies that regulate what these users can do in a specific compartment.

• C. Incorrect.

  Incorrect: While creating a policy in the root domain (the primary IAM domain) can be valid for broad access, it does not help isolate permissions strictly within the new 'R&D-Domain' for this R&D group. You typically create policies in the same domain or the root compartment if you want cross-domain access, but here you only need local access within 'R&D-Domain.'

• D. Correct.

  Correct: To let the group manage compute resources in the 'R&D-Compartment,' you need to create a policy within the scope of the 'R&D-Domain' granting them 'manage compute-family' (or the proper verbs such as 'use,' 'inspect,' etc. depending on needs). This policy restricts the group� access to only the 'R&D-Compartment' in the 'R&D-Domain.'

• E. Incorrect.

  Incorrect: Moving the 'R&D-Domain' under another domain that has broader administrator privileges could inadvertently grant the R&D users permissions beyond their specific R&D compartment, violating the principle of least privilege.

Correct answer: B

• A. Incorrect.

  A. Wrong. Creating a dynamic group for all users in the 'Research Department' domain and granting them manage access at the tenancy level violates the principle of least privilege, allowing every user in that domain to manage resources in all compartments rather than just the 'Research' compartment.

• B. Correct.

  B. Correct. By creating a group specifically for designated administrators within the 'Research Department' domain and attaching a policy at the 'Research' compartment level, you ensure that only those administrators have the necessary manage privileges for resources in that compartment. This adheres to least privilege and limits their authority appropriately.

• C. Incorrect.

  C. Wrong. Adding the designated administrators to the overall Administrators group gives them far more privileges than needed, potentially allowing them to manage all compartments and resources across the tenancy.

• D. Incorrect.

  D. Wrong. A policy that only references managing IAM domains does not properly restrict or define permissions for managing resources within specific compartments. It also doesn't address the requirement for controlling resource management in the 'Research' compartment.

Correct answers: A, D

• A. Correct.

  Correct. Creating a dedicated group for the Finance administrators and restricting their privileges to the FinanceDomain by defining a domain-specific policy ensures they can manage resources only within that domain.

• B. Incorrect.

  Incorrect. This policy grants the FinanceAdmins group permission to manage resources across the entire tenancy, not just the FinanceDomain, which violates your requirement of isolating the finance domain.

• C. Incorrect.

  Incorrect. Adding these administrators to the tenancy-level Administrators group provides them with universal access to all domains, not just FinanceDomain, and contradicts the isolation requirement.

• D. Correct.

  Correct. You can also define a policy in the home (root) tenancy referencing the group from the FinanceDomain, limiting their 'manage' privileges to specific compartments (and subcompartments) within that domain. This approach gives precise control over where the group can operate.