1Z0-1104-25 Question 38
Select 2Your organization has recently acquired a new subsidiary. Leadership has decided to create a separate IAM domain in Oracle Cloud Infrastructure (OCI) for the subsidiary to ensure administrative independence while maintaining a shared tenancy. You have been tasked with setting up this new domain so each department within the subsidiary has isolated access to its resources. Which two actions will help you properly configure the new subsidiary� environment?
- A
Create a new IAM domain for the subsidiary and provision separate compartments within that domain to isolate each department� resources.
- B
Rename the existing root domain to reflect the subsidiary� name, as advanced domain modifications can be done with minimal impact on resources.
- C
Grant all users from the new domain access to the entire tenancy, ensuring maximum flexibility and resource usage for the subsidiary.
- D
Create dedicated user groups within the subsidiary� domain and assign department-level policies granting least-privilege access to their respective compartments.
- E
Migrate existing compartments from your primary domain to the new domain so department-level structures can be reused without creating new compartments.
Show answer and explanation
Correct answers: A, D
Explanation
When creating or managing multiple IAM domains in OCI, the most secure and organized approach involves isolating departments with separate compartments, then assigning resource access via user groups and least-privilege policies. Domains cannot be renamed or merged after creation, and compartments are not transferable across domains. For more details on best practices for creating and managing IAM domains, users, groups, and compartments, refer to the official Oracle Cloud Infrastructure IAM documentation.
- A. Correct.
Option 1: CORRECT. Creating a new IAM domain for the subsidiary and setting up separate compartments for each department is a standard best practice to achieve resource isolation. Each compartment acts as a logical boundary, which can be governed by appropriate IAM policies within that specific domain.
- B. Incorrect.
Option 2: INCORRECT. Oracle Cloud Infrastructure does not support renaming an existing root domain. Once created, root domains and their names remain fixed. Attempting this would be a misunderstanding of OCI� domain management capabilities.
- C. Incorrect.
Option 3: INCORRECT. Granting all users broad access violates the least-privilege principle. This approach could lead to security risks and unintentional data exposure, defeating the purpose of domain-level segregation and compartment isolation.
- D. Correct.
Option 4: CORRECT. Creating user groups within the subsidiary� domain and assigning targeted IAM policies ensures that each group only has the access they need for their departmental resources. This upholds OCI� recommended approach of least-privilege access control.
- E. Incorrect.
Option 5: INCORRECT. Compartments cannot simply be �migrated� between domains. You must create new compartments in the subsidiary� domain. Compartments and resources in one domain remain separate from another domain.