1Z0-1104-25 Question 34
Select 2You are an OCI Security Administrator for a company with separate compartments for Marketing, Finance, and Operations teams. The Marketing team complains that they can see Finance and Operations resources in the console (though they cannot access them), and they prefer not to see unrelated resources at all. Which two steps can you take so that the Marketing team only sees Marketing resources while allowing Finance and Operations teams to see their own compartments?
- A
Create a policy allowing the Marketing group to manage Marketing resources, and ensure no 'inspect' permission is granted on other compartments.
- B
Remove any 'inspect' or higher-level permissions on Finance and Operations compartments from the Marketing group.
- C
Grant tenancy-wide 'inspect' permissions to the Marketing group and rely on compartment boundaries to hide unrelated resources.
- D
Use a dynamic group for the Marketing team and include 'deny' statements to prevent them from viewing other compartments.
- E
Introduce a single root-level policy that allows all groups to list compartments in the tenancy, and rely on resource-level permissions to block access.
Show answer and explanation
Correct answers: A, B
Explanation
To hide compartments and their resources, it is critical to avoid granting the 'inspect' permission to groups that should not see them. In OCI, any granted 'inspect' permission on a compartment allows users to list those resources in the console. Correctly configuring policies to grant access only to the appropriate compartment (and excluding any form of inspect or higher-level permissions on other compartments) is the recommended practice according to OCI IAM best practices. For more details, refer to Oracle's documentation on Identity and Access Management policies.
- A. Correct.
Option 1 is correct. To follow least privilege, Marketing should only receive explicit permissions for resources in the Marketing compartment. Excluding other compartments prevents them from listing resources outside their scope, ensuring they do not appear in the console.
- B. Correct.
Option 2 is correct. By removing or never granting 'inspect' permission on non-Marketing compartments, Marketing users will not even see other resources in their console. If they do not have 'inspect', the compartment and its resources will be hidden.
- C. Incorrect.
Option 3 is incorrect. Granting tenancy-wide 'inspect' means Marketing can list resources across all compartments. Compartment boundaries alone do not automatically hide them unless inspect privileges are revoked.
- D. Incorrect.
Option 4 is incorrect. OCI IAM policies do not support explicit 'deny' statements. The standard approach is to refrain from granting access rather than explicitly denying it. Dynamic groups are also typically used for matching instances based on attributes, not for scoping user permissions this way.
- E. Incorrect.
Option 5 is incorrect. Allowing all groups to list compartments at the root (tenancy) level will show every compartment in the console. Even if resource-level access is limited, the compartments would still be visible.