1Z0-1104-25 Question 48
Single answerA compliance team at your organization needs to review all audit logs across all compartments in Oracle Cloud Infrastructure for regulatory reporting. They must not be able to modify or delete any resources or logs. Which IAM policy statement best meets these requirements?
- A
Allow group ComplianceTeam to read audit-events in tenancy
- B
Allow group ComplianceTeam to manage audit-events in tenancy
- C
Allow group ComplianceTeam to read all-resources in tenancy
- D
Allow group ComplianceTeam to use audit-events in tenancy
Show answer and explanation
Correct answer: A
Explanation
The recommended approach is to create a precise IAM policy that gives the ComplianceTeam group the ability to read audit events without broader access to create, modify, or delete resources. According to Oracle's policy syntax (refer to Oracle Documentation on Policies: https://docs.oracle.com/en-us/iaas/Content/Identity/policiesdefault.htm), the 'read' verb grants read-only privileges. Hence, 'Allow group
- A. Correct.
Option 1 is correct because it grants the ComplianceTeam group only the read permission on audit events for the entire tenancy (all compartments). This matches the requirement to review logs without modifying them. The 'read' verb in OCI provides the ability to get listings and read resources without making changes.
- B. Incorrect.
Option 2 is incorrect because the 'manage' verb would allow the ComplianceTeam group to create, update, or delete audit-related resources, which exceeds the read-only requirement.
- C. Incorrect.
Option 3 is incorrect because granting read access to 'all-resources' in the tenancy includes much more than just audit events. This goes beyond the request for a limited read-only role on logs, potentially exposing them to other data they do not need to access.
- D. Incorrect.
Option 4 is incorrect because 'use' permissions allow additional operations beyond basic read, such as the ability to work with resources without full manage privileges. This would violate the team's strict read-only requirement.