1Z0-1072-25 Question 312
Select 2Your organization is creating a new 'TestCompartment' to host compute instances and store data in Object Storage. You want to grant the 'DevGroup' permission to start and stop compute instances, but only allow them read-only access to Object Storage objects within this compartment. Which two IAM policy statements meet these requirements?
- A
Allow group DevGroup to use instance-family in compartment TestCompartment
- B
Allow group DevGroup to manage instance-family in compartment TestCompartment
- C
Allow group DevGroup to read all-resources in compartment TestCompartment
- D
Allow group DevGroup to read object-family in compartment TestCompartment
Show answer and explanation
Correct answers: A, D
Explanation
When configuring compartment-level IAM policies in Oracle Cloud Infrastructure, different verbs (inspect, read, use, and manage) grant varying levels of access. 'use' typically covers instance lifecycle actions (start, stop, etc.) without allowing instance creation or termination, while 'read' on object-family enables listing and downloading objects without modification rights. Refer to Oracle Cloud Infrastructure documentation on policy statements (https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policysyntax.htm) for detailed information on permissible verbs and resource types.
- A. Correct.
Correct. The 'use' verb on instance-family in this compartment allows DevGroup members to perform necessary operations such as starting and stopping instances without granting them the ability to create or terminate instances. This fulfills the compute requirement without providing excessive privileges.
- B. Incorrect.
Incorrect. The 'manage' verb is broader than 'use' and would permit DevGroup members to create, update, and delete compute instances�exceeding the simple start/stop requirement.
- C. Incorrect.
Incorrect. The 'read all-resources' statement gives read-only access to all resources in the compartment, which does not include permissions to start/stop instances. To manage instance state, the group must have at least 'use' permission on instance-family.
- D. Correct.
Correct. Granting 'read object-family' limits DevGroup members to listing and getting Object Storage objects and metadata. This prevents them from uploading, deleting, or modifying objects, which aligns with the read-only requirement.