1Z0-1072-25 Question 305
Select 2Your company recently created a new domain named 'FinanceDomain' to isolate the finance department's resources from the rest of the organization. You need to set up fine-grained access so only Finance administrators can manage all existing and future compartments within 'FinanceDomain' while preventing them from managing resources in any other domain. Which two actions should you take to achieve this requirement?
- A
Create a group called 'FinanceAdmins' within 'FinanceDomain' and define a domain-specific IAM policy granting them 'manage' permissions on all compartments in 'FinanceDomain'.
- B
Create a domain-based policy in 'FinanceDomain' that includes the rule: 'Allow group FinanceAdmins to manage all-resources in tenancy'.
- C
Add the Finance administrators to the root tenancy's Administrators group so they can administer only the compartments belonging to 'FinanceDomain'.
- D
Define a policy in the home (root) tenancy with a statement such as: 'Allow group FinanceAdmins in domain FinanceDomain to manage all-resources in compartment <finance_compartment>'.
Show answer and explanation
Correct answers: A, D
Explanation
To isolate finance resources to a dedicated domain, you typically create a group in that domain and write IAM policies that grant access only to resources within the domain� compartments. According to Oracle� best practices (see the Oracle Cloud Infrastructure Identity and Access Management documentation), you can define these policies either in the domain itself or in the home tenancy, provided you reference the correct domain and group. Options that grant tenancy-level access or add administrators to the root Administrators group would violate the requirement for strict isolation.
- A. Correct.
Correct. Creating a dedicated group for the Finance administrators and restricting their privileges to the FinanceDomain by defining a domain-specific policy ensures they can manage resources only within that domain.
- B. Incorrect.
Incorrect. This policy grants the FinanceAdmins group permission to manage resources across the entire tenancy, not just the FinanceDomain, which violates your requirement of isolating the finance domain.
- C. Incorrect.
Incorrect. Adding these administrators to the tenancy-level Administrators group provides them with universal access to all domains, not just FinanceDomain, and contradicts the isolation requirement.
- D. Correct.
Correct. You can also define a policy in the home (root) tenancy referencing the group from the FinanceDomain, limiting their 'manage' privileges to specific compartments (and subcompartments) within that domain. This approach gives precise control over where the group can operate.