1Z0-1104-25 Question 4
Select 2An organization discovers that a developer inadvertently has broad access to resources across multiple OCI compartments. To adhere to the principle of least privilege and properly isolate sensitive workloads, which two actions should the security administrator take going forward?
- A
Create and maintain separate compartments for each environment or team to isolate resources
- B
Grant tenancy-wide policy permissions to all resources for faster development
- C
Restrict IAM policies to ensure only the required groups or roles can access each compartment
- D
Use Oracle Cloud Infrastructure Logging to track and block all access attempts
Show answer and explanation
Correct answers: A, C
Explanation
In OCI, maintaining separate compartments and using narrowly scoped IAM policies are fundamental steps in implementing least privilege. Compartments logically group resources, while policies specify precisely who can access them. Refer to Oracle documentation on 'OCI Compartments and IAM Policies Best Practices' for more guidance on defining appropriate access boundaries.
- A. Correct.
Correct. Compartmentalizing resources according to environment or team helps maintain strict boundaries and enforces the principle of least privilege by minimizing unnecessary access.
- B. Incorrect.
Incorrect. Tenancy-wide policy permissions are too broad and contradict least-privilege principles. It allows access beyond what is required for specific tasks.
- C. Correct.
Correct. Granular IAM policies that grant privileges only to the necessary compartments and resources ensure that users cannot access data or services beyond their role requirements.
- D. Incorrect.
Incorrect. Logging provides detailed records of system events and user actions, but it does not inherently block or limit access. It is primarily used for auditing and troubleshooting, not for controlling resource isolation.