1Z0-1072-25 Question 296
Single answerYour organization has two compartments: 'Development' and 'SharedServices.' The DevOps group must be able to fully manage only Compute resources in 'Development' while also being granted read-only access to all resources in 'SharedServices.' Which of the following sets of policy statements accomplishes this requirement?
- A
- Allow group DevOps to manage all-resources in compartment Development Allow group DevOps to read all-resources in tenancy
- B
- Allow group DevOps to manage instance-family in compartment SharedServices Allow group DevOps to inspect all-resources in compartment Development
- C
- Allow group DevOps to manage instance-family in compartment Development Allow group DevOps to read all-resources in compartment SharedServices
- D
- Allow group DevOps to manage all-resources in compartment Development Allow group DevOps to manage all-resources in compartment SharedServices
Show answer and explanation
Correct answer: C
Explanation
In Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM), policies define what specific groups can do in specific compartments. 'Manage instance-family' is narrower than managing all-resources and grants the necessary permissions for Compute instances without granting unnecessary privileges. Granting 'read all-resources' in the 'SharedServices' compartment restricts the group to viewing details without making changes. For reference, see the Oracle Cloud Infrastructure IAM Policies documentation: https://docs.oracle.com/en-us/iaas/Content/Identity/policies.htm
- A. Incorrect.
Option 1 is incorrect. Granting manage access to all-resources in the Development compartment is acceptable for the Compute requirement, but allowing read privileges to all-resources at the tenancy level is more expansive than needed, giving the group visibility across all compartments, not just 'SharedServices.'
- B. Incorrect.
Option 2 is incorrect. This policy swaps the compartments, granting manage rights in 'SharedServices' (which is not desired) and only inspect rights in 'Development.' It does not meet the scenario� requirements for managing Compute in 'Development' and read-only access in 'SharedServices.'
- C. Correct.
Option 3 is correct. 'Allow group DevOps to manage instance-family in compartment Development' precisely grants full control over Compute resources in the Development compartment, while 'Allow group DevOps to read all-resources in compartment SharedServices' grants read-only (i.e., view but not edit) access to every resource type in SharedServices, fulfilling the stated requirements.
- D. Incorrect.
Option 4 is incorrect. Allowing the group to manage all-resources in both compartments exceeds the requirement. The scenario explicitly limits full management rights to Compute resources in 'Development' and only read-only access in 'SharedServices.'