1Z0-1104-25 Question 41
Select 2Your organization has created a new IAM domain named FinanceDomain in Oracle Cloud Infrastructure (OCI) to isolate financial operations. You have the root domain that contains a compartment called FinanceCompartment. You need to create a new user JohnDoe in FinanceDomain so that he can create and manage subcompartments under FinanceCompartment (which remains in the root domain). Which two steps must you perform to grant JohnDoe the required permissions while following OCI best practices?
- A
- Create the user JohnDoe in FinanceDomain, add him to a group in FinanceDomain, and then create a policy in the root domain referencing that group to allow compartment management.
- B
- Create the user JohnDoe in FinanceDomain, add him to a group in the root domain, and then create a policy in FinanceDomain referencing that root group for compartment management.
- C
- Create the user JohnDoe in FinanceDomain, then create a dynamic group in FinanceDomain for JohnDoe, and define a policy in the root domain granting compartment management to that dynamic group.
- D
- Create the user JohnDoe in FinanceDomain, but migrate FinanceCompartment to the FinanceDomain before granting JohnDoe any permission.
- E
- Create the user JohnDoe in FinanceDomain, add him to a group in FinanceDomain, and define a policy in FinanceDomain referencing the root domain for compartment management.
Show answer and explanation
Correct answers: A, C
Explanation
To grant a user from one IAM domain permission to manage resources held in another domain� compartment, you must create the user (and optionally a dynamic group) in the user� domain and then define a policy in the compartment-owning domain referencing that group or dynamic group. This ensures proper cross-domain authorization. Refer to the official Oracle Cloud Infrastructure documentation on 'Managing Domains and Cross-Domain Policies' for detailed guidance on implementing these best practices.
- A. Correct.
Option 1 is correct. If JohnDoe is in a group within FinanceDomain, the policy to manage compartments in the root domain must be defined in the domain that owns those compartments (the root domain). Cross-domain policy statements let you reference groups in FinanceDomain from the root domain� policy.
- B. Incorrect.
Option 2 is incorrect. A group in the root domain cannot be directly used by a user in FinanceDomain without additional cross-domain trust. Also, the policy for resources in the root domain should be created there, not in FinanceDomain. This approach is generally not the recommended pattern for cross-domain identity management.
- C. Correct.
Option 3 is correct. A dynamic group in FinanceDomain referencing JohnDoe can be included in a policy in the root domain to grant the necessary permissions. The policy resides in the domain that owns the targeted compartments (the root domain), referencing the group or dynamic group from FinanceDomain.
- D. Incorrect.
Option 4 is incorrect. You cannot simply migrate an existing compartment to a different domain. Moreover, there's no need to move FinanceCompartment to FinanceDomain. Cross-domain authorization is the recommended approach.
- E. Incorrect.
Option 5 is incorrect. While you do create the user and group in FinanceDomain, placing a policy in FinanceDomain referencing compartments in the root domain does not grant access to resources in the root domain. The policy must be in the domain that owns the resources.