1Z0-1104-25 Question 40
Select 2Your organization has acquired a new subsidiary and wants to provision a dedicated IAM domain for them in Oracle Cloud Infrastructure. You need to ensure the subsidiary� 'SubsidiaryAdmins' group can create and manage resources only within a newly created 'SubsidiaryCompartment' without affecting existing compartments in your primary domain. Which two actions must you take to fulfill this requirement?
- A
Create a new IAM domain, add the 'SubsidiaryAdmins' group to that domain, and grant them basic read-only access in the primary domain.
- B
Within the new domain, create a dedicated compartment named 'SubsidiaryCompartment' and then create a policy granting the 'SubsidiaryAdmins' group the manage verb in that compartment.
- C
In your primary domain, create a dynamic group that includes all 'SubsidiaryAdmins' and assign them the manage verb on the tenancy� root compartment.
- D
Create a new policy in your existing (primary) domain that explicitly denies access to any compartments for the 'SubsidiaryAdmins' group.
- E
Add the 'SubsidiaryAdmins' group to the new domain, then craft a policy within that domain to allow them to manage only the 'SubsidiaryCompartment'.
Show answer and explanation
Correct answers: B, E
Explanation
To isolate the subsidiary� administrators, you create a separate IAM domain for them and configure a new compartment within that domain. By granting the 'SubsidiaryAdmins' group the manage verb in the 'SubsidiaryCompartment' policy, members can fully control resources there without gaining broader privileges in your primary domain. Refer to Oracle� Identity and Access Management documentation for guidance on creating domains, compartments, and custom policies.
- A. Incorrect.
Option 1: Incorrect. Granting even basic read-only access in the primary domain is unnecessary if you want isolation. Placing the group in the new domain is correct, but continuing to manage them in the primary domain with any access contradicts the requirement of isolation.
- B. Correct.
Option 2: Correct. Creating a dedicated compartment within the new domain and granting the 'manage' verb in that compartment ensures that 'SubsidiaryAdmins' can administer resources solely in 'SubsidiaryCompartment'.
- C. Incorrect.
Option 3: Incorrect. Granting manage privileges on the root compartment in any domain (primary or otherwise) would give access to all resources, violating the requirement to restrict them only to the subsidiary compartment.
- D. Incorrect.
Option 4: Incorrect. A policy denying access in the primary domain is not strictly required because IAM domains are isolated by default; a newly created domain does not grant its users any privileges in another domain. You only need to ensure correct policies exist within the subsidiary domain.
- E. Correct.
Option 5: Correct. You must not only create the new domain, but also explicitly add the 'SubsidiaryAdmins' group to it and then craft the policy in that same domain. This combination provides the group with exactly the permissions they need, isolated from the primary domain's compartments.