1Z0-1072-25 Question 297
Select 2Your organization has two dedicated compartments in Oracle Cloud Infrastructure 2025: 'HR_Compartment' and 'Finance_Compartment.' The HR team needs to create and manage resources in 'HR_Compartment,' while the Finance team should only have read access to 'Finance_Compartment.' Which two steps correctly achieve this setup using IAM policies?
- A
Create a policy for the HR group with the statement 'ALLOW group HR to manage all-resources in compartment HR_Compartment.'
- B
Create a policy for the Finance group with the statement 'ALLOW group Finance to inspect all-resources in compartment Finance_Compartment.'
- C
Assign each user to the root compartment so they can override any compartment-level policies when needed.
- D
Use a single Oracle-defined policy that automatically grants both HR and Finance teams the required permissions on their compartments.
Show answer and explanation
Correct answers: A, B
Explanation
To properly implement compartment-level access control in Oracle Cloud Infrastructure 2025, you create dedicated policies that define the desired permissions for each group on their respective compartments. Refer to the Oracle Cloud Infrastructure documentation for details on managing compartments and writing IAM policies: https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/overview.htm and https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcompartments.htm.
- A. Correct.
Option 1 is correct. 'ALLOW group HR to manage all-resources in compartment HR_Compartment' gives the HR team full control over resources in their compartment, aligning with their requirement to create and manage those resources.
- B. Correct.
Option 2 is correct. 'ALLOW group Finance to inspect all-resources in compartment Finance_Compartment' provides read-only access (inspect privileges) to the Finance team, fulfilling their need to view resources without altering them.
- C. Incorrect.
Option 3 is incorrect. Assigning users to the root compartment with manage privileges would grant them permissions across all compartments, contradicting the principle of least privilege and failing to restrict them only to the specified compartments.
- D. Incorrect.
Option 4 is incorrect. Oracle does not provide a single predefined policy that automatically applies precise compartment-level controls for different teams. You must create separate policies for each group and compartment requirement.