1Z0-1072-25 Question 302
Select 2Your organization is planning to onboard external contractors to work on a new project in Oracle Cloud Infrastructure (OCI). You decide to create a new identity domain named 'ContractorDomain' for them, separate from your existing 'MainDomain.' You also create a new compartment called 'ContractorProjectCompartment' for all contractor resources. The contractors must only have access to resources in this new compartment and not to any other compartments. Which two actions must you perform to meet this requirement?
- A
- Create a group in 'ContractorDomain' specifically for the external contractor users.
- B
- Create an IAM policy inside 'ContractorDomain' that grants the contractor group access to 'ContractorProjectCompartment.'
- C
- In the root compartment of your tenancy, create a policy referencing the group in 'ContractorDomain' to allow them access to 'ContractorProjectCompartment.'
- D
- Move 'ContractorProjectCompartment' under 'ContractorDomain' so that all resources within it are isolated to only that domain.
Show answer and explanation
Correct answers: A, C
Explanation
To safely onboard external contractors and restrict them to a single compartment, create a dedicated group within the new identity domain (Option 1) and then set up a policy in the tenancy� root compartment granting privileges to that group for the �ContractorProjectCompartment� (Option 3). This follows OCI best practices for managing compartments and identity domains. Refer to Oracle's Identity and Access Management documentation for additional guidance on creating cross-domain policies and compartment-based access controls.
- A. Correct.
Option 1 is correct. You must create a dedicated group in the new identity domain ('ContractorDomain') for external contractor users. This separates their user accounts from your 'MainDomain' and improves access control management.
- B. Incorrect.
Option 2 is incorrect. While you can create policies in a domain for certain domain-scoped resources, granting access to a compartment in the tenancy typically requires a policy in the tenancy's root compartment. Defining the policy solely in 'ContractorDomain' would not properly authorize access to a compartment that exists at the tenancy level.
- C. Correct.
Option 3 is correct. In OCI, compartments exist at the tenancy level, so the standard practice is to create a policy in the root compartment referencing the group created in 'ContractorDomain.' This policy grants them access only to 'ContractorProjectCompartment,' isolating them from other resources.
- D. Incorrect.
Option 4 is incorrect. You cannot 'move' a tenancy-level compartment under a domain. Compartments are managed within the tenancy and not contained within an identity domain. Domains and compartments are distinct constructs in OCI.