1Z0-1072-25 Question 294
Single answerYour organization has two compartments in Oracle Cloud Infrastructure (OCI): 'Dev' and 'Prod'. The DevOps group should have full permissions (manage) on compute instances in the 'Dev' compartment, but only read access in the 'Prod' compartment. Which policy statements best satisfy this requirement while following OCI best practices?
- A
Allow group DevOps to manage instance-family in compartment Dev Allow group DevOps to read instance-family in compartment Prod
- B
Allow group DevOps to manage instance-family in tenancy Allow group DevOps to read instance-family in compartment Prod
- C
Allow group DevOps to use instance-family in compartment Dev Allow group DevOps to manage instance-family in compartment Prod
- D
Allow group DevOps to read instance-family in tenancy Allow group DevOps to manage instance-family in compartment Dev Allow group DevOps to read instance-family in compartment Prod
Show answer and explanation
Correct answer: A
Explanation
In OCI, writing policies with precise compartment-level granularity is a best practice to ensure least privilege. The key actions�'manage' vs. 'read'�must be set appropriately for each compartment. Refer to the official OCI documentation on Identity and Access Management (IAM) and its policy statements for details on syntax and best practices (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policylanguage.htm).
- A. Correct.
Correct. This minimal set of policies grants DevOps the ability to fully manage compute instances in the Dev compartment while limiting them to read access in Prod.
- B. Incorrect.
Incorrect. Granting 'manage' permissions at the tenancy level is too broad and would allow DevOps to manage instances in all compartments, not just Dev.
- C. Incorrect.
Incorrect. This policy does the opposite: DevOps can only 'use' (perform a limited set of actions) in Dev but can manage in Prod, which contradicts the requirement.
- D. Incorrect.
Incorrect. While this grants correct permissions for Dev and Prod separately, it also grants read access for every compartment in the tenancy, which goes beyond the minimal scope needed.