1Z0-1072-25 Question 310
Select 2You have been asked to configure access for a 'FinanceGroup' so members can list and retrieve objects in the 'FinOpsCompartment' without being able to create or delete them. Which two IAM policy statements should you define to achieve this requirement?
- A
Allow group FinanceGroup to read objects in compartment FinOpsCompartment
- B
Allow group FinanceGroup to inspect buckets in compartment FinOpsCompartment
- C
Allow group FinanceGroup to manage object-family in compartment FinOpsCompartment
- D
Allow group FinanceGroup to use object-family in compartment FinOpsCompartment
Show answer and explanation
Correct answers: A, B
Explanation
To enable strictly read-only access to objects, you must grant policies that provide the ability to view buckets and read object content, without creation or modification rights. 'read' grants list and get privileges for objects, and 'inspect' allows viewing bucket metadata. The 'manage' and 'use' verbs provide more permissions than required for read-only, which could allow transferring, updating, or deleting objects. For more details, refer to the Oracle Cloud Infrastructure Identity and Access Management documentation regarding policy statements and verbs: https://docs.oracle.com/en-us/iaas/Content/Identity/policiesdefault/policiesdefault.htm
- A. Correct.
Correct. The 'read' verb allows listing and retrieving objects (get) but does not allow creation or deletion in the specified compartment.
- B. Correct.
Correct. The 'inspect' verb on buckets lets the group see bucket metadata without altering or creating them, enabling the group to identify which buckets to read from.
- C. Incorrect.
Incorrect. 'manage' provides full administrative access, including creation and deletion of objects, which exceeds the requirement of listing and retrieving only.
- D. Incorrect.
Incorrect. 'use' allows the group to perform read and some update operations (depending on the resource type), potentially giving more privileges than desired for strict read-only access.