1Z0-1072-25 Question 315
Single answerYour organization needs to limit Object Storage access within a specific compartment to only those Compute instances tagged with 'Department=Finance', coming from a trusted IP address range. You configure a Dynamic Group for all Finance-tagged instances, define a Network Source for the trusted on-premises IP range, and create a policy to strictly allow these instances to manage Object Storage in the 'Finance' compartment. Which option correctly meets these requirements?
- A
A) Create a Dynamic Group that includes all instances in the tenancy, then write a policy allowing the group to manage Object Storage in the �Finance� compartment without referencing the Network Source. Use a Tag Default to mark all resources with the label �Department=Finance.�
- B
B) Define a Network Source specifying your on-premises IP range, create a Dynamic Group that matches instances with the tag �Department=Finance,� and write a policy that grants the Dynamic Group permission to manage Object Storage in the �Finance� compartment, conditioning on the Network Source name.
- C
C) Write a compartment-level policy granting all instances permission to manage all resources in the compartment. Configure the compartment to update resource tags to �Department=Finance� after they are created, and specify the Network Source as a Measured Boot Source.
- D
D) Rather than configuring a Dynamic Group, use only a policy to �Allow any-user to use ObjectStorage in compartment <finance_compartment> where any {request.networkSource.name = <trusted_network>}�, relying solely on the resource tag �Department=Finance� for access control.
Show answer and explanation
Correct answer: B
Explanation
Option B correctly applies the three key controls: a Dynamic Group that uses tag-based matching (Department=Finance), a Network Source that defines an approved IP range, and a policy that references both. This follows best practices outlined in the Oracle Cloud Infrastructure documentation, particularly in the 'Managing Dynamic Groups', 'Network Sources', and 'Tag-Based Access Control' sections, which emphasize using conditions in your policies to limit access based on tags and approved network ranges.
- A. Incorrect.
A) Incorrect. Granting all instances in the tenancy access to Object Storage does not fulfill the requirement of restricting resources only to those with the tag �Department=Finance�. Additionally, not referencing the Network Source means the policy does not restrict requests to the trusted IP range.
- B. Correct.
B) Correct. Defining a Network Source for your on-premises IP range and creating a Dynamic Group for instances tagged �Department=Finance� allows you to write a policy that grants exactly those instances permission, but only if they originate from the defined Network Source. This approach meets all specified requirements: tag-based access, IP-based restriction, and compartment scoping.
- C. Incorrect.
C) Incorrect. Granting all instances permission at the compartment level is overly broad and does not leverage the Dynamic Group for tag-based matching. Also, Measured Boot Source is unrelated to restricting requests by IP address range; it� related to Trusted Platform Module attestation, not IP-based rules.
- D. Incorrect.
D) Incorrect. This relies solely on the resource tag and partial network restriction. Without a Dynamic Group, any user with credentials in the tenancy coming from the trusted IP source could access the Object Storage in the Finance compartment, even if the instance is not tagged 'Department=Finance'.