1Z0-1104-25 Question 174
Select 2Your organization needs to monitor any modifications to OCI IAM policies and immediately alert the security team if any policy change grants broad administrative privileges. To achieve this, you plan to set up OCI Logging to capture policy changes and create an Event rule to trigger an alert. Which two steps are required to meet these requirements?
- A
- Enable and configure Audit Logging under the Identity service to capture policy creation or updates.
- B
- Use the OCI Events service to create an event rule that listens for IAM policy creation or updates, filtering by operations granting broad admin privileges.
- C
- Configure a custom log group to capture object storage access logs and filter for the update operation.
- D
- Integrate the event rule with the OCI Notifications service to send an alert to the security team's email or PagerDuty channel.
Show answer and explanation
Correct answers: A, B
Explanation
To securely monitor IAM policy changes in OCI, you must enable Audit Logging so that any creation or update operation is recorded. Next, you should create an OCI Event rule configured to filter for these IAM policy changes�particularly those granting broad privileges�and route them to a proper remediation or alert mechanism. While sending notifications is a key part of alerting, implementing the specific event filter for IAM policy changes happens at the Events service level, referencing the audit log data. For more details, consult the Oracle documentation on 'Using Audit Logs and Events for Identity and Access Management' and follow best practices for setting up event filters and notifications.
- A. Correct.
Option 1: Correct. OCI Audit Logging automatically tracks IAM policy changes. Ensuring it's enabled provides the source of audit data required for monitoring policy updates.
- B. Correct.
Option 2: Correct. Creating an event rule to precisely filter out creation or updates for policies that grant broad privileges is essential. This allows real-time notifications or subsequent actions when such changes occur.
- C. Incorrect.
Option 3: Incorrect. While custom log groups can track certain logs (e.g., Object Storage events), this option does not address IAM policy changes, which require the Audit service logs rather than object storage logs.
- D. Incorrect.
Option 4: Incorrect. Although integrating with OCI Notifications is common to send alerts, you do not directly create or integrate an event rule with Notifications alone. You must first filter the correct event source (IAM policy changes) which is handled in Option 2. Simply pointing an event rule at Notifications doesn't handle the specific IAM policy update scenario if not filtered properly.