1Z0-1104-25 Question 33
Select 2Your organization has created a new group called 'DataScientists' in Oracle Cloud Infrastructure (OCI). This group requires read-only access to an Object Storage bucket named 'analytics-dev' in the 'DevCompartment'. Additionally, the group must be prevented from making any changes to the data or accessing other compartments. Which two configurations should you implement to meet these requirements?
- A
Create an IAM policy in the DevCompartment granting read access on the 'analytics-dev' bucket to the DataScientists group.
- B
Attach a default Administrator policy to the DataScientists group to ensure broad resource visibility.
- C
Update the tenancy-level policy to allow the DataScientists group to manage all Object Storage resources in DevCompartment.
- D
Ensure the DataScientists group is not granted any policies that allow write or manage permissions in DevCompartment or other compartments.
- E
Configure a bucket policy in 'analytics-dev' that explicitly grants the DataScientists group read and write access to the objects.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirement for read-only access, you must create a policy that grants the DataScientists group permission to read data in the target compartment and bucket. At the same time, you must ensure there are no broader policies that inadvertently give them higher privileges. Refer to OCI documentation on IAM policies and compartment-level access control for best practices on granting the least privilege necessary (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policyreference.htm).
- A. Correct.
Explanation for Option 1: Correct. Creating a compartment-level IAM policy granting only 'read' permissions for the 'analytics-dev' bucket ensures DataScientists can view data but not modify or delete it. This is typically done with a policy statement like: 'Allow group DataScientists to read objects in compartment DevCompartment where target.bucket.name = "analytics-dev".'.
- B. Incorrect.
Explanation for Option 2: Incorrect. The Administrator policy grants full access to all OCI resources, which directly conflicts with the requirement for a read-only role and restricted compartment access.
- C. Incorrect.
Explanation for Option 3: Incorrect. The 'manage' permission encompasses create, delete, and update actions. Granting 'manage' on Object Storage would exceed the requirement and allow changes to data, which the scenario prohibits.
- D. Correct.
Explanation for Option 4: Correct. In OCI, you must also ensure no existing or newly attached policies give the DataScientists group permissions beyond read-only. If another policy grants them write or manage access, it would violate the scenario's restrictions.
- E. Incorrect.
Explanation for Option 5: Incorrect. This approach grants both read and write access, contradicting the requirement to prevent modifications. Bucket policies also do not replace the need for appropriate compartment-level IAM policies.