1Z0-1072-25 Question 317
Select 2Your company runs a daily log ingestion process in Oracle Cloud Infrastructure (OCI). A compute instance must read logs from an Object Storage bucket, but only if the requests originate from your corporate intranet IP addresses. Additionally, your organization uses a 'CostCenter' tag to control usage. You must ensure that only instances with the correct 'CostCenter' tag can read this bucket over your corporate network. Which two steps must you complete to accomplish this?
- A
Define a network source containing your corporate intranet IP addresses and reference it in a policy that allows the dynamic group to access the Object Storage bucket.
- B
Add a 'CostCenter' tag to the compute instance and rely on a tag-based policy alone to control which IP addresses can connect to the bucket.
- C
Place both the Object Storage bucket and compute instance in the same compartment and apply a policy allowing all resources in that compartment to read the logs.
- D
Create a dynamic group with a matching rule for instances tagged with 'CostCenter' and write a policy referencing both the dynamic group and the network source.
- E
Use the built-in Administrators group and skip configuring a custom network source or dynamic group.
Show answer and explanation
Correct answers: A, D
Explanation
In OCI, network sources define trusted IP ranges, while dynamic groups enable instance principal-based access policies. For tag control, you can match instances that possess the required key-value tags and place them in a dynamic group. You then create a policy referencing the dynamic group and the network source, ensuring only correctly tagged instances from specific IP addresses can access the Object Storage bucket. Refer to Oracle Cloud Infrastructure Documentation for 'Policies for Dynamic Groups' and 'Network Sources' for detailed configuration steps.
- A. Correct.
Correct. Defining a network source restricts traffic based on your corporate IP addresses. A policy can then reference this network source to allow only requests originating from those specific IP ranges to read the bucket.
- B. Incorrect.
Incorrect. While adding the required tag is important, a tag-based policy alone does not restrict requests to come only from your corporate IP addresses. You also need a network source or dynamic group policy condition.
- C. Incorrect.
Incorrect. Simply placing resources in the same compartment and giving blanket access does not enforce tag or IP address restrictions. This approach fails both the corporate intranet and tag-based requirements.
- D. Correct.
Correct. Dynamic groups can identify compute instances based on tags such as 'CostCenter'. By combining the dynamic group with a policy that also enforces the network source, you limit access to tagged instances coming from the approved IP address range.
- E. Incorrect.
Incorrect. Relying on the Administrators group is too broad. It bypasses the cost center and IP restrictions, failing the requirement to limit access to only properly tagged instances from your corporate network.