1Z0-1104-25 Question 5
Single answerYou have created multiple compartments to isolate resources for different teams in your OCI tenancy. You want to grant a new developer permission to create and manage Compute resources only in the 'Development' compartment while restricting them to read-only access to logs in a separate 'Logging' compartment. Which solution best enforces the principle of least privilege in this scenario?
- A
Create a single group for all developers and grant it full administrative access to every compartment.
- B
Place the developer in a dedicated group and write an IAM policy that allows 'manage' on Compute in the Development compartment and 'read' on logs in the Logging compartment.
- C
Add the developer directly to the Administrators group, granting them global administrative privileges across all resources.
- D
Create a dynamic group based on the developer's user credentials and grant that group full permissions on the Development and Logging compartments.
Show answer and explanation
Correct answer: B
Explanation
In OCI, best practices recommend using the principle of least privilege by assigning narrowly scoped policies to groups. By creating a group specifically for the developer and writing an IAM policy with compartment-scoped permissions, you ensure they can only perform the required actions (manage Compute in Development, read logs in Logging). Reference: Oracle Cloud Infrastructure Documentation � Identity and Access Management Best Practices.
- A. Incorrect.
Incorrect. Granting full administrative access to every compartment violates least privilege and unnecessarily broadens access.
- B. Correct.
Correct. Creating a dedicated group and applying an IAM policy that grants only the necessary permissions to specific compartments aligns with the principle of least privilege.
- C. Incorrect.
Incorrect. Adding a user to the Administrators group gives universal permissions, which exceeds minimal required privileges and poses security risks.
- D. Incorrect.
Incorrect. While dynamic groups can be used to grant access based on conditions, giving full permissions to both compartments also violates the principle of least privilege.