1Z0-1104-25 Question 26
Select 2Your organization has brought in a third-party consultant for two weeks to optimize the existing Database systems in your 'PerformanceOps' compartment on Oracle Cloud Infrastructure (OCI). The consultant must only be able to work with database systems in that compartment and must lose all access once the contract period ends. Which two actions should you take to ensure these requirements are met while adhering to the principle of least privilege?
- A
Create a dedicated group for the consultant and define a policy granting the group manage privileges for database-family resources in the PerformanceOps compartment
- B
Remove or disable the consultant� user account immediately after the two-week engagement ends to ensure no further access to OCI
- C
Use a dynamic group to grant access to the consultant's OCI user credentials, enforcing short-lived privileges through resource metadata
- D
Grant tenancy-wide manage privileges on all resources to the consultant, relying on resource quotas to limit creation of new OCI services
Show answer and explanation
Correct answers: A, B
Explanation
To meet the temporary consultant requirement and enforce the principle of least privilege, you should create a group with appropriate compartment-level policies, grant access only to the relevant database resources, and then revoke or disable that access once the contract ends. Refer to the Oracle Cloud Infrastructure IAM documentation on 'Managing User Credentials' and 'Writing Policies' for details on creating groups, policies, and revoking user access.
- A. Correct.
Correct. Creating a dedicated group for the consultant and writing a policy that grants manage privileges specifically for database-family resources in the PerformanceOps compartment ensures they can perform necessary optimization tasks without accessing other compartments. This aligns with least privilege by restricting access to only what is needed.
- B. Correct.
Correct. After the engagement ends, disabling or removing the consultant� user account (or removing them from the dedicated group) ensures they no longer have permissions to the compartments, resources, or operations in OCI. This prevents continued access beyond the intended contract period.
- C. Incorrect.
Incorrect. Dynamic groups in OCI are primarily designed for OCI resources (e.g., Compute instances) to obtain permissions based on resource metadata, not for human user accounts. Assigning a human user to a dynamic group is not a valid approach for limiting short-term access.
- D. Incorrect.
Incorrect. Granting tenancy-wide manage privileges is overly broad and violates the principle of least privilege. Although quotas can help control resource consumption, they do not limit access to view or perform operations in other compartments, which is not desired.