1Z0-1104-25 Question 54
Select 2Your organization wants only compute instances tagged with Department=Finance to access a particular Object Storage bucket named 'FinDatabase.' Additionally, requests to the bucket must originate from your corporate IP range 198.51.100.0/24, which you have already included in a network source called 'CorporateNetSource.' Which TWO steps are required to finalize the policy that ensures these Finance-tagged instances can access 'FinDatabase' only from the corporate IP range?
- A
Create a dynamic group with a matching rule for all instances in the 'Finance' compartment, then add a policy condition referencing the 'CorporateNetSource' network source.
- B
Create a dynamic group with a matching rule for the tag Department=Finance, then include a where request.networkSource.name=CorporateNetSource condition in the policy.
- C
Reference the dynamic group in a policy statement that grants read access to the 'FinDatabase' bucket, ensuring the policy includes the network source restriction.
- D
Use resource principals at the Object Storage level to match Department=Finance and attach the network source condition to the bucket itself.
Show answer and explanation
Correct answers: B, C
Explanation
In Oracle Cloud Infrastructure, dynamic groups allow you to group resources (like compute instances) by matching specific attributes or tags. By defining a dynamic group that matches instances tagged with Department=Finance, you ensure only those compute instances are considered in the policy. You can then write a policy rule that includes a 'where request.networkSource.name=' condition referencing 'CorporateNetSource' to restrict access to the specified IP range. Together, these configurations enforce both tag-based and network source-based restrictions. For further details, refer to Oracle Cloud Infrastructure documentation on 'Managing Dynamic Groups' and 'Using Network Sources in Security Rules.'
- A. Incorrect.
Incorrect: This option configures the dynamic group based on compartment membership, not the instance tag. The requirement specifically states only instances with the tag Department=Finance should be included, not an entire compartment named Finance. While you could create a network source condition, it doesn't fully address the tag-based membership requirement.
- B. Correct.
Correct: This option properly sets up the dynamic group membership rule to match compute instances tagged with Department=Finance. It also introduces the correct use of the policy clause where request.networkSource.name=CorporateNetSource to limit access to instances coming from the specified corporate IP range.
- C. Correct.
Correct: Even with a properly configured dynamic group, you must reference that group in a policy that grants access to the bucket. Including the network source restriction ensures that requests originate from the allowed IP range. This step completes the overall requirement of tag-based and IP-based restrictions.
- D. Incorrect.
Incorrect: Resource principals at the Object Storage level do not replace the need for dynamic groups and policies. You cannot simply 'attach' a network source condition directly to the bucket; the policy and network source configuration must be set at the tenancy or compartment level to restrict access based on source IP and tags.