1Z0-1104-25 Question 18
Single answerYour organization is migrating an internal HR application to Oracle Cloud Infrastructure (OCI). This application processes sensitive personal data, so you need a deployment design that follows the principle of least privilege. Which approach best demonstrates this principle when configuring access to resources in OCI?
- A
Create a single IAM group for all staff and assign broad management policies across all compartments to prevent accidental lockouts
- B
Implement per-compartment IAM policies, granting just the necessary permissions to user groups for each environment
- C
Deploy all compute instances on a public subnet and allow direct SSH access from the internet for efficient troubleshooting
- D
Use a single compartment for all environments to simplify policy management and reduce administrative overhead
Show answer and explanation
Correct answer: B
Explanation
Following the principle of least privilege means granting users only the minimum set of access rights needed for their tasks. By implementing compartment-based IAM policies, you minimize risks associated with unauthorized or accidental access to sensitive data. For more details on designing secure architectures in OCI, refer to Oracle� official documentation on security best practices (https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm).
- A. Incorrect.
Option 1 is incorrect. Granting broad permissions to a single group violates the principle of least privilege by providing more access than each user actually needs.
- B. Correct.
Option 2 is correct. Using per-compartment IAM policies and limiting each group� privileges to the minimum required directly aligns with the principle of least privilege.
- C. Incorrect.
Option 3 is incorrect. Placing all compute resources on a public subnet with open ingress introduces unnecessary risk and contravenes the principle of restricting access to only what� required.
- D. Incorrect.
Option 4 is incorrect. Combining all environments in a single compartment simplifies administration but increases blast radius and does not promote fine-grained access control.