1Z0-1072-25 Question 290
Single answerYou have been asked to grant a specific user group called 'RDSuperUsers' the ability to create and manage virtual machine instances only in a newly created compartment named 'R&D_Compartment.' They should not have administrative privileges over other services or compartments in the tenancy. Which policy statement best satisfies this requirement?
- A
- Create a policy in the root compartment: 'Allow group RDSuperUsers to manage all-resources in tenancy.'
- B
- Create a policy in the R&D_Compartment: 'Allow group RDSuperUsers to manage instance-family in compartment R&D_Compartment.'
- C
- Create a policy in the root compartment: 'Allow group RDSuperUsers to manage instance-family in tenancy.'
- D
- Create a policy in the R&D_Compartment: 'Allow group RDSuperUsers to read all-resources in compartment R&D_Compartment.'
Show answer and explanation
Correct answer: B
Explanation
To ensure that a user group has privileges only for specific resources within a particular compartment, you must define a policy in that compartment with a scope and resource type that aligns precisely with the needed permissions. In this case, the policy statement 'Allow group RDSuperUsers to manage instance-family in compartment R&D_Compartment' grants the necessary privileges to manage VM instances while preventing broader access to other services or compartments. For more details, see OCI policies documentation: https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policyreference.htm.
- A. Incorrect.
Option 1 is incorrect. Granting 'manage all-resources in tenancy' at the root compartment level would give the RDSuperUsers group broad privileges everywhere, which exceeds the requirement of managing only virtual machine instances in a single compartment.
- B. Correct.
Option 2 is correct. Specifying 'manage instance-family in compartment R&D_Compartment' targets only VM instances (and related compute resources) in that specific compartment, which meets the requirement exactly and restricts access to other resources and compartments.
- C. Incorrect.
Option 3 is incorrect. This policy applies across the entire tenancy, allowing the group to manage compute resources in every compartment, which is too broad and violates the principle of least privilege.
- D. Incorrect.
Option 4 is incorrect. Allowing the group to 'read all-resources' only grants read access, not the ability to create or manage VM instances, which fails to meet the RDSuperUsers team's requirements.