1Z0-1104-25 Question 49
Select 3Your organization wants to ensure that only compute instances tagged with Department=Finance can read objects in the 'Finance' compartment, and only when those requests originate from your corporate IP range 192.168.0.0/16. You plan to create a Dynamic Group that matches the Department=Finance tag, define a Network Source for the IP range, and then create an IAM policy that references both. Which three configuration steps accomplish this scenario? (Choose three.)
- A
- Create a Dynamic Group with the rule ANY {resource.matchTag('Department','Finance')}.
- B
- Create a Network Source listing 192.168.0.0/16 as the corporate IP range.
- C
- In the IAM policy, include a condition where request.networkSource.name equals the corporate Network Source you created.
- D
- Attach the policy at the root compartment and allow dynamic-group access to all resources with no mention of the Network Source.
- E
- Create a Dynamic Group with the rule ANY {resource.compartment.id =
}.
- Create a Dynamic Group with the rule ANY {resource.compartment.id =
Show answer and explanation
Correct answers: A, B, C
Explanation
In Oracle Cloud Infrastructure, Dynamic Groups can be configured to match resources based on tags, enabling fine-grained access control. Defining a Network Source allows you to restrict requests to specific IP addresses or ranges, and the IAM policy can reference both the Dynamic Group (by name) and the Network Source (by name) to enforce the desired security requirements. For more information, consult the official Oracle documentation on 'Managing Dynamic Groups,' 'Network Sources,' and 'Tag-Based Access Control.'
- A. Correct.
Option 1 is CORRECT. Using resource.matchTag('Department','Finance') ensures that the Dynamic Group only includes compute instances tagged with Department=Finance.
- B. Correct.
Option 2 is CORRECT. Defining a Network Source for 192.168.0.0/16 restricts access to requests originating from your corporate IP range.
- C. Correct.
Option 3 is CORRECT. Including request.networkSource in the policy statement enforces the rule that only requests from your named corporate Network Source are allowed.
- D. Incorrect.
Option 4 is INCORRECT. If you attach a policy at the root compartment without referencing the Network Source or limiting access by tag, it grants broader access than intended and fails to restrict usage to the corporate IP range.
- E. Incorrect.
Option 5 is INCORRECT. Matching resources based on compartment ID alone does not use the Department=Finance tag. The requirement is to restrict membership specifically to instances tagged with Department=Finance.