1Z0-1072-25 Question 314
Select 2You run an application on Oracle Cloud Infrastructure (OCI) compute instances that need read access to an Object Storage bucket named MarketingBucket. You must ensure that only instances tagged with 'Environment=Prod' and coming from a predefined corporate Network Source (named 'CorporateSource') can access the bucket. Which two steps must you perform to meet this requirement?
- A
A. Define a dynamic group matching instances with tag key 'Environment' set to 'Prod', then create a policy granting read access to MarketingBucket for that dynamic group, including a condition to only allow requests if request.networkSource.name = 'CorporateSource'.
- B
B. Create a policy directly referencing the tag key 'Environment=Prod' in the allowed region, without any network source condition.
- C
C. Configure a Network Security Group (NSG) for the compute instances and set inbound rules to only permit traffic from CorporateSource.
- D
D. Attach a second dynamic group rule requiring resource.compartment.id = <compartment_OCID> and environment.tagName = 'CorporateSource'.
- E
E. Configure a network source with the IP addresses of your corporate data center named 'CorporateSource' and use it in the policy condition to restrict requests based on the network source.
Show answer and explanation
Correct answers: A, E
Explanation
To securely grant Object Storage access to specific compute instances, you must combine tag-based dynamic group membership with a network source restriction. First, define a dynamic group that uses a matching rule (tag.Environment.value = 'Prod') to target only those instances. Next, create a network source that enumerates the corporate data center IP addresses. Finally, write an IAM policy that allows the dynamic group to read objects in MarketingBucket, but only if request.networkSource.name matches the corporate network source. This follows OCI best practices for layered security, as documented in the OCI IAM guide at https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/identitypolicies.htm.
- A. Correct.
A. Correct. You must first define a dynamic group that uses a matching rule for instances tagged with 'Environment=Prod'. Then, in your policy statement (for example: 'Allow dynamic-group <dynamic_group_name> to read objects in compartment <compartment_name> where all {request.networkSource.name = CorporateSource}'), you include a condition referencing your network source. This ensures only requests from those tagged instances and from the specified network source are allowed.
- B. Incorrect.
B. Incorrect. While referencing a tag in a policy can work, this option omits the requirement to restrict access to the corporate network source. Without referencing the network source, any tagged instance could read from the bucket regardless of where it originates.
- C. Incorrect.
C. Incorrect. A Network Security Group (NSG) controls traffic at the VNIC level, not which principal can call the Object Storage service. NSGs do not replace the need for a dynamic group and policy condition referencing the network source. NSGs handle network-level traffic flow, not IAM-based access conditions.
- D. Incorrect.
D. Incorrect. Adding an additional dynamic group rule for the compartment and an environment tag referencing 'CorporateSource' is not valid. A dynamic group typically matches based on tags, instance OCIDs, or compartment IDs, but 'CorporateSource' is a network source name, not a tag value. This does not align with the actual requirement of restricting requests by IP range and tag.
- E. Correct.
E. Correct. Configuring a network source named 'CorporateSource' with the corporate data center IP range is essential. You then use this in the IAM policy condition (e.g., 'where request.networkSource.name = CorporateSource') to ensure only requests from those IPs match the policy that grants the dynamic group access.