1Z0-1072-25 Question 313
Select 2Your organization has an existing Object Storage bucket that contains confidential financial data. You need to ensure that only (a) instances tagged with Department=Finance, and (b) requests originating from your corporate data center� IP addresses, can read objects from this bucket. Which TWO statements describe the correct steps to achieve this requirement?
- A
- Create a dynamic group using a tag-based matching rule for Department=Finance, then write a policy granting the dynamic group permission to read objects in the bucket.
- B
- Create a network source defining the corporate data center IP range. In the same policy, include a statement granting read access to requests coming from that network source.
- C
- Use a pre-authenticated request and specify the Department=Finance tag within that URL to restrict access to only the tagged instances.
- D
- Assign your corporate data center IP addresses as instance-level metadata and build a dynamic group using those IPs. Then create a policy granting the dynamic group permission to read the bucket.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirement, you must combine a dynamic group for instances tagged with Department=Finance and a network source that represents the corporate data center IP range. Then, write policies allowing only the dynamic group and the network source to read objects from the bucket. Refer to Oracle Cloud Infrastructure Identity and Security documentation for best practices on dynamic group rules, network sources, and policy syntax.
- A. Correct.
Option 1 is correct. Dynamic groups can be defined by a tag-based matching rule (such as 'Department=Finance'), and a policy must explicitly allow that dynamic group to read objects in the target bucket.
- B. Correct.
Option 2 is correct. Creating a network source with the corporate data center IP range and referencing it within a policy lets you restrict read access to those specific IP addresses. This effectively ensures requests from outside that range are denied.
- C. Incorrect.
Option 3 is incorrect. Pre-authenticated requests cannot be restricted by tag; they are primarily used for publicly sharable URLs. Specifying a tag in the URL is not supported.
- D. Incorrect.
Option 4 is incorrect. Dynamic groups use OCI-defined properties such as instance OCID or tags to establish membership. They do not allow membership rules based on IP addresses. IP-based restrictions belong in Network Sources, not dynamic groups.