1Z0-1104-25 Question 6
Single answerYour organization recently migrated its on-premises finance, HR, and marketing systems to Oracle Cloud Infrastructure (OCI). Each department wants to maintain control over its own resources without interfering with one another. As a Security Professional, you need to design the best logical isolation strategy from the start. Which approach should you recommend first to achieve this requirement?
- A
Assign each department to an entirely separate Identity Domain and rely on cross-domain trust for collaboration.
- B
Create separate compartments for each department and apply relevant IAM policies to those compartments.
- C
Use a single compartment but rely on detailed Object Storage bucket policies to limit inter-departmental access.
- D
Grant each department member the Administrator role so they can manage only their own resources.
Show answer and explanation
Correct answer: B
Explanation
OCI recommends using compartments as the primary mechanism to separate and manage resources logically. By placing each department� resources in its own compartment and applying least-privilege IAM policies, you align with Oracle� best practices for secure deployment. Refer to the Oracle Cloud Infrastructure documentation on 'Managing Compartments' and 'Identity and Access Management' for more details on creating a scalable and secure multi-compartment design.
- A. Incorrect.
Option 1: Assigning each department to its own Identity Domain can work in certain scenarios, but it is typically more complex to manage and not necessary for simple departmental isolation. Compartments are the recommended first layer of resource isolation in OCI.
- B. Correct.
Option 2: Creating separate compartments for each department and applying IAM policies to those compartments is the fundamental best practice for logical isolation in OCI. This ensures each department controls access to its resources without cross-department conflicts. (Correct)
- C. Incorrect.
Option 3: Using a single compartment and relying on Object Storage bucket policies alone does not provide broad resource isolation. While bucket policies can limit storage access, they don�t address overall compartment-level security and governance needs.
- D. Incorrect.
Option 4: Granting everyone Administrator privileges for self-management contradicts the least-privilege principle and could easily lead to misconfigurations or security breaches. Roles should be scoped to specific resources and tasks instead.