1Z0-1104-25 Question 42
Single answerYour organization has acquired a new business unit that requires strict resource isolation. You have decided to set up a separate IAM domain for them in Oracle Cloud Infrastructure. Within that new domain, you need to create compartments for their workloads, create new user accounts, and place those users into groups that are restricted to only the new domain� compartments. Which approach correctly accomplishes this requirement?
- A
Create the new domain, define separate compartments inside it, create local groups in that domain, assign new users to those groups, and write domain-specific policies granting access only to those compartments.
- B
Create the new domain but do not create any compartments; reuse the root compartment from the existing domain and rely on service-level access restrictions for resource isolation.
- C
Create the new domain and new user accounts there, but add them to groups in the primary (existing) domain so that you only need a single global policy for both domains.
- D
Create one compartment in the existing domain, place it under the new domain, and assign the new users to existing groups in the primary domain, leveraging a cross-domain policy.
Show answer and explanation
Correct answer: A
Explanation
When creating a new IAM domain in Oracle Cloud Infrastructure, the best practice for isolation is to define compartments within that new domain, create local groups, and use domain-specific IAM policies. Each domain is its own security boundary, so placing resources in separate compartments under the new domain ensures fine-grained access control. Refer to the Oracle Cloud Infrastructure Identity and Access Management documentation for guidance on setting up domains, compartments, users, groups, and policies to achieve isolation and governance.
- A. Correct.
This option is correct. By creating a separate domain with its own compartments and local groups, you can craft domain-specific policies that ensure users in that domain can only access resources within the new domain� compartments. This approach follows OCI best practices for isolation.
- B. Incorrect.
This option is incorrect because relying on the root compartment from the existing domain merges isolation boundaries, making it more difficult to ensure strict separation. Domain-specific compartments are key to isolating resources and applying targeted policies.
- C. Incorrect.
This option is incorrect because groups in the existing domain would have policies that potentially grant broader access than desired. To ensure isolation, each domain should manage its own groups and policies independently.
- D. Incorrect.
This option is incorrect because you can�t simply place a compartment that belongs to one domain under another domain. Compartments are managed within a domain, and cross-domain policy management would complicate the isolation and governance model.