1Z0-1072-25 Question 304
Single answerYour organization uses multiple IAM domains for different departments. You've just created a new domain called 'Research Department' and a companion 'Research' compartment for department-wide resources. The security team wants to ensure that only designated administrators in the 'Research Department' domain can manage resources in the 'Research' compartment, without granting them unnecessary privileges elsewhere. Which approach should you implement?
- A
A. Create a dynamic group in the 'Research Department' domain that includes all users and attach a tenancy-level policy granting manage access to all compartments.
- B
B. Create a group in the 'Research Department' domain, assign the designated administrators to that group, and attach a policy at the 'Research' compartment level granting them manage permissions.
- C
C. Add the designated administrators to the existing Administrators group in the primary domain so they inherit full access across all compartments.
- D
D. Create a policy at the root compartment that states only administrators from the 'Research Department' domain can manage IAM domains, ignoring the 'Research' compartment.
Show answer and explanation
Correct answer: B
Explanation
The best practice for delegating compartment-level management privileges is to create a dedicated group and a targeted policy that grants the necessary permissions within that compartment. In Oracle Cloud Infrastructure, you attach policies at the appropriate compartment level to enforce least privilege. Refer to the official OCI documentation on Identity and Access Management and compartment-level policies for more details on this recommended approach.
- A. Incorrect.
A. Wrong. Creating a dynamic group for all users in the 'Research Department' domain and granting them manage access at the tenancy level violates the principle of least privilege, allowing every user in that domain to manage resources in all compartments rather than just the 'Research' compartment.
- B. Correct.
B. Correct. By creating a group specifically for designated administrators within the 'Research Department' domain and attaching a policy at the 'Research' compartment level, you ensure that only those administrators have the necessary manage privileges for resources in that compartment. This adheres to least privilege and limits their authority appropriately.
- C. Incorrect.
C. Wrong. Adding the designated administrators to the overall Administrators group gives them far more privileges than needed, potentially allowing them to manage all compartments and resources across the tenancy.
- D. Incorrect.
D. Wrong. A policy that only references managing IAM domains does not properly restrict or define permissions for managing resources within specific compartments. It also doesn't address the requirement for controlling resource management in the 'Research' compartment.