1Z0-1072-25 Question 299
Single answerYour organization has a dedicated 'DataScienceTeam' tasked with managing Data Science workspaces in the 'AnalyticsCompartment.' You need to ensure that only members of this team can create and administer Data Science resources in that compartment, while restricting all other groups. Which approach best meets this requirement?
- A
Create a policy: 'Allow group DataScienceTeam to manage data-science-family in compartment AnalyticsCompartment' and remove or adjust any conflicting policies.
- B
Attach a policy at the root tenancy level that grants DataScienceTeam the 'manage' verb on all resources across all compartments.
- C
Convert the DataScienceTeam group into a dynamic group and apply instance principal policies to control resource access.
- D
Use a single blanket policy: 'Allow all groups to use data-science-family in tenancy' and rely on resource tagging to track usage.
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure, you should define compartment-specific policies granting minimal necessary privileges to the correct group. A policy statement such as 'Allow group DataScienceTeam to manage data-science-family in compartment AnalyticsCompartment' ensures that only the intended group can access and manage Data Science resources. Refer to OCI documentation on IAM policies and compartments for best practices on scoping permissions appropriately.
- A. Correct.
Option 1 is correct. By creating a compartment-level policy granting 'manage data-science-family' to the DataScienceTeam, only that group can create and administer Data Science resources. Ensuring no conflicting policies exist for other groups helps maintain least-privilege access.
- B. Incorrect.
Option 2 is incorrect because granting privileges at the root tenancy level is overly broad, potentially giving DataScienceTeam permission to manage resources in all compartments. This violates the principle of least privilege.
- C. Incorrect.
Option 3 is incorrect. Dynamic groups are for instances and resources, not human user groups. Applying instance principal policies would not effectively limit access for non-DataScienceTeam members who are actual users.
- D. Incorrect.
Option 4 is incorrect because allowing all groups to manage Data Science resources and then relying on tags does not restrict creation or administration only to the DataScienceTeam. Tagging alone does not enforce proper IAM controls.