1Z0-1072-25 Question 293
Select 2Your organization runs multiple workloads in a single compartment named DevCompartment. The DevOps group only needs to create, update, and delete compute instances but must not manage subnets or other networking components. Which two policy statements meet these requirements according to OCI best practices?
- A
Allow group DevOps to manage instance-family in compartment DevCompartment
- B
Allow group DevOps to manage virtual-network-family in compartment DevCompartment
- C
Allow group DevOps to manage all-resources in compartment DevCompartment
- D
Allow group DevOps to use virtual-network-family in compartment DevCompartment
Show answer and explanation
Correct answers: A, D
Explanation
To enforce the principle of least privilege in Oracle Cloud Infrastructure Identity and Access Management, you should grant only the necessary permissions. 'manage instance-family' in the specific compartment allows complete control over compute instances, while 'use virtual-network-family' lets the group attach instances to networks without granting them the ability to create or change those networks. Refer to the OCI documentation on policy statements and resource families for best practices and exact syntax.
- A. Correct.
Correct. This policy allows the DevOps group to fully manage compute instances without granting them permission to networking resources they don't need to modify.
- B. Incorrect.
Incorrect. Granting manage permissions on the virtual-network-family would allow the DevOps group to create and modify networking resources, violating the requirement.
- C. Incorrect.
Incorrect. manage all-resources grants the DevOps group broader permissions than necessary, including networking resources, which must be restricted.
- D. Correct.
Correct. The use permission on virtual-network-family allows the DevOps group to attach their instances to existing subnets and VCNs without letting them create or alter those network components.