1Z0-1104-25 Question 27
Single answerYour organization has an existing AdminGroup that is granted broad permissions via the policy: 'Allow group AdminGroup to manage all-resources in tenancy.' You create a new group called ProductionAdmins and add a policy to allow it to 'manage vcns in compartment ProductionCompartment.' However, members of ProductionAdmins can still manage compute resources in the ProductionCompartment. Which action is most likely to fix the issue so that ProductionAdmins can only manage VCNs in that compartment?
- A
Remove ProductionAdmins from the AdminGroup so members don�t inherit the root-level policy
- B
Raise the new policy to the root compartment level so it overrides the existing policy
- C
Modify the policy to explicitly include a deny rule for compute resources in ProductionCompartment
- D
Create a new dynamic group for ProductionCompartment and reassign ProductionAdmins there
Show answer and explanation
Correct answer: A
Explanation
When multiple policies apply, OCI evaluates them collectively. If a user or group has higher-level rights from one policy, no narrower policy will reduce those rights. Therefore, the most direct solution is to avoid overlapping memberships that grant full access. For details on IAM policy inheritance and best practices, see Oracle� documentation: https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policyreference.htm.
- A. Correct.
Correct. If ProductionAdmins is also part of AdminGroup (which has 'manage all-resources in tenancy'), they inherit full permissions. Removing members from AdminGroup prevents inheritance of the broader privileges, ensuring they only manage VCNs in ProductionCompartment.
- B. Incorrect.
Incorrect. Moving the policy up to the root compartment doesn't remove the broader 'manage all-resources' permission already granted at the tenancy level to AdminGroup. Higher-level policies do not override or negate existing policies that allow broader access.
- C. Incorrect.
Incorrect. While deny rules can be used in certain scenarios, Oracle Cloud Infrastructure leverages allow-based policy control by default. It� more straightforward and recommended to remove the conflicting broader access (in this case by changing group membership) rather than apply blanket deny statements.
- D. Incorrect.
Incorrect. Simply placing the group members into a dynamic group wouldn�t remove the original 'manage all-resources' permission they inherit from being in the AdminGroup. Dynamic groups are typically used to assign policies based on instance or resource attributes, not to override user group policies.