1Z0-1104-25 Question 53
Select 2Your company wants to restrict administrative actions on OCI Compute instances to those labeled with a 'Department=Finance' tag, and only allow the IP range 203.0.113.0/24 to access them. You decide to use Dynamic Groups, Network Sources, and tag-based access control policies. Which two steps help you achieve this goal?
- A
A. Create a Network Source with the 203.0.113.0/24 CIDR block, then define a policy that allows access only if request.networkSourceName = <Your_Network_Source>. Create a Dynamic Group to include all instances with the Department=Finance tag, and reference the Dynamic Group in the policy.
- B
B. Create a Dynamic Group with the rule 'ALL {resource.tag.Department = 'Finance'}' and reference it in a policy without specifying network sources, since Dynamic Groups automatically restrict traffic from unknown IP addresses.
- C
C. Add a policy statement applying to the 'any-user' group that denies all instance actions except when the request comes from the 203.0.113.0/24 CIDR block. Do not use Tag or Dynamic Group conditions; rely on the default security lists to permit authorized traffic.
- D
D. Create a Dynamic Group for instances using the Department=Finance tag, and a separate Network Source with 203.0.113.0/24 configured. Write a policy including both conditions: 'where request.networkSourceName = <Your_Network_Source> and request.principal.tag.Department = 'Finance''.
Show answer and explanation
Correct answers: A, D
Explanation
To secure resources based on IP range and tag, you must configure both a Network Source and tag-based Dynamic Group or policy conditions. Network Sources identify allowed IP ranges while tags and Dynamic Group conditions ensure only the correct resources are targeted. Oracle Cloud Infrastructure documentation recommends combining these controls to enforce fine-grained access control. Refer to official OCI Identity and Access Management documentation for policies, Dynamic Groups, and Network Sources for detailed configuration steps.
- A. Correct.
Option A is CORRECT. By creating a Network Source for the 203.0.113.0/24 CIDR, you can ensure that only requests originating from that IP range are allowed. Referencing the Dynamic Group of instances tagged 'Department=Finance' in the policy ensures that only those labeled resources are managed. This combination is a standard approach: Network Sources guard the incoming request's origin, and Dynamic Groups apply conditions on the resource identity.
- B. Incorrect.
Option B is INCORRECT. Dynamic Groups do not automatically restrict traffic by IP address. They only define which resources or instances can be subject to a given policy. You still need a Network Source or equivalent condition to limit the source IP addresses.
- C. Incorrect.
Option C is INCORRECT. Applying a blanket deny to any user except from a particular block, without referencing Dynamic Groups or tag-based conditions, won�t scope actions to specific tagged instances. This approach fails to meet the requirement of ensuring only 'Department=Finance' tagged resources can be accessed.
- D. Correct.
Option D is CORRECT. Using both a Dynamic Group (to scope the 'Department=Finance' tag) and a Network Source (for the IP restriction) in a single policy statement is a valid way to achieve the objective. The policy condition 'where request.networkSourceName = <Your_Network_Source> and request.principal.tag.Department = 'Finance'' also ensures only properly tagged resources can be accessed from the specified IP range.