1Z0-1072-25 Question 301
Select 2Your organization recently created a new IAM domain named 'MarketingDomain' to isolate all marketing resources. You also created a group called 'MarketingAdmins' to manage these resources. You want to ensure that 'MarketingAdmins' can create and manage resources only within 'MarketingDomain', following your company� principle of least privilege. Which two steps must you perform to achieve this goal?
- A
Create a policy in the root domain granting the MarketingAdmins group access to manage all-resources in the tenancy.
- B
Create the MarketingAdmins group within MarketingDomain and define a policy in MarketingDomain granting 'allow group MarketingAdmins to manage all-resources in domain MarketingDomain.'
- C
Create a dedicated compartment inside MarketingDomain for marketing resources and define a policy in MarketingDomain granting MarketingAdmins access only to resources in that compartment.
- D
Replicate the policies from the root domain into MarketingDomain so that MarketingAdmins inherits existing root-level privileges.
- E
Create a custom IAM role in the root domain, assign it to MarketingAdmins, and grant them full access across every compartment in your tenancy.
Show answer and explanation
Correct answers: B, C
Explanation
To properly isolate marketing resources, you should create both the group and corresponding policies within the relevant IAM domain (MarketingDomain). Further, placing applications or resources in a dedicated compartment in MarketingDomain ensures that the MarketingAdmins group's privileges are scoped to the compartment in which they need to operate. This setup follows OCI best practices for implementing least privilege. Refer to Oracle Cloud Infrastructure IAM documentation on working with domains, compartments, and policies for detailed steps on creating and assigning permissions.
- A. Incorrect.
Option 1 is incorrect because it grants the MarketingAdmins group broad access to all resources in the entire tenancy, violating the principle of least privilege. The goal is to isolate privileges only within MarketingDomain.
- B. Correct.
Option 2 is correct. Creating the MarketingAdmins group inside MarketingDomain and defining a domain-level policy ensures that permissions apply only within MarketingDomain, aligning with the least privilege model.
- C. Correct.
Option 3 is correct. Placing marketing resources in a dedicated compartment within MarketingDomain and granting MarketingAdmins permissions specifically for that compartment enforces tighter control and isolates their privileges.
- D. Incorrect.
Option 4 is incorrect because replicating or copying all root-domain policies would allow MarketingAdmins to inherit unnecessary privileges beyond MarketingDomain, again violating the principle of least privilege.
- E. Incorrect.
Option 5 is incorrect because granting a custom IAM role with full access across all compartments extends privileges beyond MarketingDomain, contrary to the requirement to limit them to marketing resources only.