1Z0-1104-25 Question 25
Single answerYou are the security engineer for an enterprise that uses Oracle Cloud Infrastructure (OCI). The company has created a new compartment named 'TestCompartment' for its QA team. You have also created a new IAM group called 'TestAdmins' to manage all resources in that compartment. How should you configure OCI policies to ensure 'TestAdmins' can fully manage resources only in 'TestCompartment' and have no access to resources in other compartments?
- A
A) Attach a policy in the root compartment with a statement allowing the 'TestAdmins' group to manage all-resources specifically in the 'TestCompartment'.
- B
B) Assign each user in 'TestAdmins' an individual policy in the 'TestCompartment' so they can manage resources only for the assigned user.
- C
C) Use a dynamic group for 'TestAdmins' and create a policy that allows dynamic group members to manage all-resources in the entire tenancy.
- D
D) Move the 'TestAdmins' group to a separate region and specify a policy to manage resources only in that region.
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure, the recommended way to grant specific privileges to a group in a specific compartment is to write a policy in the tenancy (root) compartment referencing both the group and the target compartment. For example: 'Allow group
- A. Correct.
A) CORRECT: Best practice is to attach a standard policy at the tenancy (root) compartment level that explicitly references the target compartment ('TestCompartment') and the group ('TestAdmins'). The policy would be similar to: 'Allow group TestAdmins to manage all-resources in compartment TestCompartment'. This ensures that TestAdmins have full manage privileges but only within that compartment.
- B. Incorrect.
B) INCORRECT: Individual per-user policies are not recommended for scaling or maintaining least privilege effectively. OCI allows policies to be assigned at the group level, which is more efficient and less error-prone.
- C. Incorrect.
C) INCORRECT: Dynamic groups are primarily used to give access to resources based on matching rules (e.g., instance principles), not for human administrators. Additionally, granting tenancy-wide access would conflict with the requirement to limit privileges only to 'TestCompartment'.
- D. Incorrect.
D) INCORRECT: OCI compartments and regions are separate concepts. Granting or denying access based on region does not provide compartment-specific security boundaries. This approach would not restrict 'TestAdmins' from accessing other compartments in that same region.