1Z0-1104-25 Question 30
Select 2Your company wants to grant the FinanceTeam group the ability to view all cost-related data across the tenancy and also allow them to create and edit budgets only in a specific compartment called BillingCompartment. Additionally, you need to ensure that every member of the FinanceTeam is required to use multi-factor authentication (MFA). Which two actions should you take to meet these requirements?
- A
A. Create a policy in the root compartment allowing the FinanceTeam group to read cost analysis across the tenancy, and enforce MFA at the group level using Identity and Access Management settings.
- B
B. Create a policy in BillingCompartment allowing the FinanceTeam group to manage budgets in that compartment, and enable MFA by adding the FinanceTeam group to a dynamic group with a conditional policy.
- C
C. Allow the FinanceTeam group to manage budgets in the root compartment, and enable MFA through an external identity provider without making changes in Oracle IAM.
- D
D. Create a policy in the root compartment allowing the FinanceTeam group to read all usage reports, create a separate policy in the BillingCompartment to manage budgets, and require MFA for each user in the FinanceTeam group.
Show answer and explanation
Correct answers: A, D
Explanation
In Oracle Cloud Infrastructure, you typically define an IAM policy in the root compartment to grant read access to cost analysis or usage reports across the tenancy. To give the group budget management privileges in a specific compartment (like BillingCompartment), you create a separate policy targeting that compartment with the 'manage budgets' permission. Multi-factor authentication is enforced per user and is configured in the IAM service by requiring each user in the FinanceTeam group to enable MFA. Refer to the Oracle Cloud Infrastructure documentation on IAM Policies and MFA for detailed steps and best practices (for example, 'Allow group FinanceTeam to read usage-reports in tenancy' and 'Allow group FinanceTeam to manage budgets in compartment BillingCompartment').
- A. Correct.
A. CORRECT. Granting the FinanceTeam group read access to cost data (for example, cost analysis) across the tenancy is done via a root compartment policy. Enforcing MFA at the group level is typically performed in Oracle Cloud Infrastructure Identity and Access Management (IAM) settings by configuring MFA for each user in that group.
- B. Incorrect.
B. INCORRECT. While creating a policy in the BillingCompartment for managing budgets is valid, enabling MFA by adding the group to a dynamic group is not. Dynamic groups are used to grant privileges to resources based on matching rules, not for enforcing MFA.
- C. Incorrect.
C. INCORRECT. Allowing the FinanceTeam group to manage budgets in the root compartment is too broad and does not limit scope to the BillingCompartment. Also, relying solely on an external identity provider for MFA without configuring IAM policies in OCI means you won't meet the requirement that every user in the FinanceTeam group must have MFA enabled in OCI.
- D. Correct.
D. CORRECT. Using one policy in the root compartment for reading cost data and another policy in the BillingCompartment for managing budgets aligns with best-practice compartment isolation. Requiring MFA for each user (rather than a dynamic group) is the correct method to enforce MFA in OCI.