1Z0-1104-25 Question 37
Single answerYour organization has decided to create a new domain called 'SalesDomain' to separate sales users from other departments. You need to grant the 'SalesManagers' group within this new domain the ability to manage all resources in a compartment named 'SalesCompartment,' while ensuring they have no access to other compartments. How can you achieve this requirement?
- A
Create the domain 'SalesDomain,' create the group 'SalesManagers' in that domain, and attach a policy in the 'SalesCompartment' that allows the group to manage resources in the compartment.
- B
Create the domain 'SalesDomain,' but configure a global dynamic group for sales managers in the default domain to grant them tenancy-wide resource access.
- C
Place 'SalesCompartment' under the 'SalesDomain' hierarchy, so all users in 'SalesDomain' automatically have manage privileges in that compartment.
- D
Create a policy in 'SalesDomain' granting the domain itself the ability to manage 'SalesCompartment,' without assigning any groups.
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure (OCI), creating a separate domain allows for distinct user identities and groups that can be scoped to specific compartments via IAM policies. To enable a particular group to manage resources in a compartment, you must explicitly attach a policy statement granting those permissions. Refer to OCI documentation for IAM Domains and compartments management best practices, including 'Managing IAM Domains' and 'Using Compartments' in the Oracle Cloud Infrastructure documentation.
- A. Correct.
Correct. After creating the new domain and the group in that domain, attaching a policy at the compartment level (or above it) that explicitly grants the 'SalesManagers' group manage privileges on that compartment is the proper method. For example: 'Allow group SalesManagers to manage all-resources in compartment SalesCompartment.' This ensures the group has the right access without giving them broader privileges in other compartments.
- B. Incorrect.
Incorrect. A global dynamic group in the default domain would not restrict the group� privileges to a single compartment. Instead, it could grant them elevated access across the tenancy, which violates the requirement to limit access.
- C. Incorrect.
Incorrect. Simply placing the compartment under the new domain does not automatically grant privileges. Access is still governed by policies, so users in 'SalesDomain' do not automatically have manage privileges in 'SalesCompartment.'
- D. Incorrect.
Incorrect. Granting manage privileges to the entire 'SalesDomain' without specifying a group would jeopardize the principle of least privilege. You must assign privileges to a specific group in the domain, not the entire domain itself.