1Z0-1072-25 Question 309
Single answerYour organization has a group called 'MarketingGroup' that needs read-only access to block volumes in the Production compartment, while retaining full administrative privileges on block volumes in the Development compartment. Which IAM policy statements correctly implement this requirement?
- A
A) allow group MarketingGroup to inspect volume-family in compartment Production allow group MarketingGroup to manage all-resources in compartment Development
- B
B) allow group MarketingGroup to read volume-family in compartment Production allow group MarketingGroup to manage volume-family in compartment Development
- C
C) allow group MarketingGroup to read volume in compartment Production allow group MarketingGroup to read volume in compartment Development
- D
D) allow group MarketingGroup to manage volume-family in compartment Production allow group MarketingGroup to read volume-family in compartment Development
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure (OCI), IAM policy statements use verbs (inspect, read, use, manage) combined with resource-type families to define allowed actions. 'manage volume-family' allows complete actions on block volumes, while 'read volume-family' restricts actions to viewing or retrieving details about volume resources. This scenario follows OCI documentation best practices by granting minimal necessary permissions in the Production compartment ('read volume-family') and broader administrative privileges in the Development compartment ('manage volume-family'). Refer to OCI IAM documentation for additional guidance on policy syntax and permission scopes.
- A. Incorrect.
Option A is incorrect because 'inspect' only provides a minimal view (listing resources without enabling read access), and 'manage all-resources' in the Development compartment goes beyond the requirement by allowing the group to manage every resource type, not just volumes.
- B. Correct.
Option B is correct. 'read volume-family' grants read-only permissions for block volumes (and related resources) in the Production compartment, while 'manage volume-family' provides full administrative control for block volumes in the Development compartment, matching the requirement.
- C. Incorrect.
Option C is incorrect because it grants only 'read volume' in both compartments, which does not allow the group to manage block volumes in the Development compartment as specified in the requirement.
- D. Incorrect.
Option D is incorrect because it reverses the desired permissions. It grants 'manage volume-family' in Production (which is too much for Production) and merely 'read volume-family' in Development (not enough for the needs in Development).