1Z0-1104-25 Question 44
Select 2Your organization uses Oracle Cloud Infrastructure (OCI) for multiple projects. The 'AppTeam' group needs read-only access to the 'Production' and 'Staging' compartments so they can view existing compute instances without creating, deleting, or modifying any resources. Which two policy statements would you implement to meet these requirements?
- A
- allow group AppTeam to manage instance-family in compartment Production
- B
- allow group AppTeam to read instance-family in compartment Production
- C
- allow group AppTeam to read instance-family in compartment Staging
- D
- allow group AppTeam to read all-resources in tenancy
Show answer and explanation
Correct answers: B, C
Explanation
When creating least-privileged IAM policies in OCI, you match the specific group to the required resource types and compartments using appropriate verbs. 'read' grants users read-only capabilities over the specified resource type, whereas 'manage' includes all higher-level privileges. Refer to the official Oracle Cloud Infrastructure documentation on Identity and Access Management policies for details on policy syntax, resource types, and recommended least-privilege practices.
- A. Incorrect.
Option 1: Incorrect. The 'manage' verb grants full administrative privileges (create, update, delete, etc.) to the group, which exceeds the read-only requirement.
- B. Correct.
Option 2: Correct. This policy grants members of the 'AppTeam' group read-only access to compute (instance-family) resources in the 'Production' compartment, allowing them to view details of compute instances without making changes.
- C. Correct.
Option 3: Correct. Similar to Option 2, this grants read-only access to compute resources in the 'Staging' compartment, fulfilling the requirement for viewing instances in that compartment.
- D. Incorrect.
Option 4: Incorrect. Although 'read' appears correct, applying it to 'all-resources in tenancy' goes beyond the scoped compartments. It would allow the group to read every resource across the entire tenancy, not just the 'Production' and 'Staging' compartments.