1Z0-1072-26 Identity And Access Management — 20 Questions

Question 1

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ANY {instance.id = 'ocid1.instance...', tag.Project.Value = 'Alpha'}. Oracle Cloud Infrastructure dynamic group matching rules use the ANY keyword to specify that a resource qualifies if it matches at least one of the listed conditions. The syntax ANY {instance.id = 'ocid1.instance...', tag.Project.Value = 'Alpha'} is valid: it uses the correct equality operator (=), the proper tag variable format (tag...Value), and comma-separated conditions inside braces. This allows an instance to be a member if its OCID matches OR if it has the freeform tag Project with value Alpha.

Answer

MATCH {instance.id == 'ocid1.instance...' OR tag.Project == 'Alpha'}

Answer

DYNAMIC {instance.id IN ('ocid1.instance...'))}

Answer

ALL {instance.id = 'ocid1.instance...', tag.Project.name = 'Alpha'}

Question 2

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Accepted Answer

The policy can be created in compartment 'ProjectA' using the syntax: Allow group Auditors to inspect all-resources in compartment ProjectA. OCI policies can be created in any compartment, and a policy created in 'ProjectA' applies to that compartment and its descendants. Writing 'Allow group Auditors to inspect all-resources in compartment ProjectA' grants the group inspect access only within ProjectA, without exposing sibling compartments under DepartmentX. This is the correct least-privilege placement and syntax.

Answer

Policies can only be created in the root tenancy, never in child compartments.

Answer

The policy must be created in the Identity service global container.

Answer

The policy must be created in the root compartment (tenancy).

Question 3

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

Accepted Answer

Allow group Developers to use instance-family in tenancy where request.ip in ('192.168.100.0/24'). OCI IAM policies support a request.ip condition that restricts access based on the source IP address or CIDR block of the request. The correct syntax uses 'use instance-family' (the verb needed to terminate instances) with 'where request.ip in ('192.168.100.0/24')' to limit the permission to that corporate CIDR. This precisely implements the requirement that developers can only terminate instances from the specified network range.

Answer

Allow group Developers to terminate instances in tenancy where client.subnet = '192.168.100.0/24'

Answer

Allow group Developers to inspect instances in tenancy where request.ip = '192.168.100.0/24'

Answer

Allow group Developers to manage instance-family in tenancy where request.ip = '192.168.100.0/24'

Question 4

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

Accepted Answer

Allow dynamic-group AppInstances to read objects in tenancy where target.tag.Operations.Environment = 'Production'. The correct syntax uses 'target.tag.Operations.Environment' with the value 'Production' and scopes the policy to the tenancy (or compartment) where the bucket resides. In OCI policy language, 'target.tag' refers to the resource being accessed (the bucket), and the tag namespace and key must match exactly. The value must be the tag value 'Production', not a boolean.

Answer

Allow dynamic-group AppInstances to read objects in compartment Production where target.tag.Operations.Environment = 'true'

Answer

Allow dynamic-group AppInstances to read objects in tenancy where request.tag.Operations.Environment = 'Production'

Answer

Allow dynamic-group AppInstances to read buckets in tenancy where bucket.tag.Operations.Environment = 'Production'

Question 5

What is the maximum number of compartments you can nest within a single parent compartment in OCI?

Accepted Answer

6 levels. OCI supports nesting compartments up to 6 levels deep beneath the root compartment (tenancy).

Answer

Unlimited

Answer

2 levels

Answer

10 levels

Question 6

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rules are evaluated asynchronously. When a new resource such as a compute instance is created, it can take a few minutes for the IAM service to evaluate the rules and populate the dynamic group membership. No restart or manual intervention is required.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 7

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Accepted Answer

Allow group Developers to use instances in tenancy where request.subnet.id = 'ocid1.subnet...'. OCI IAM policies use variables like request.subnet.id to evaluate the source subnet of an API call, allowing fine-grained conditions on where a request originates. The statement 'Allow group Developers to use instances in tenancy where request.subnet.id = ...' correctly scopes the permission to delete instances only when the request comes from the specified subnet OCID.

Answer

Configure a security list rule allowing instance deletion from the specified subnet.

Answer

Allow group Developers to delete instances in subnet 'ocid1.subnet...'

Answer

Allow group Developers to manage instances in tenancy where client.subnet.id = 'ocid1.subnet...'

Question 8

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

Accepted Answer

Define group Partners in Tenancy B: endorse group Partners to read objects in tenancy TenancyA. Cross-tenancy access in OCI requires two policies: an endorsement policy in the resource-owning tenancy (Tenancy A) and a commitment policy in the requesting tenancy (Tenancy B). The commitment policy must use the exact syntax 'Define group in Tenancy : endorse group to in tenancy '. Option B matches this syntax.

Answer

Define group Partners in Tenancy B: accept group Partners to read objects in tenancy TenancyA

Answer

Define group Partners in Tenancy B: permit group Partners to read objects in compartment Root

Answer

Define group Partners in Tenancy B: allow group Partners to access tenancy TenancyA

Question 9

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Accepted Answer

Compartments nested deeper than one level from the tenancy root must be referenced using their hierarchical path (e.g., ParentComp:ChildComp).. In OCI IAM, a policy statement's 'in compartment' clause must reference the compartment by its full hierarchical path when the target compartment is nested more than one level below the tenancy root. Because ChildComp is a child of another compartment (not directly under the tenancy), the correct syntax is 'in compartment ParentComp:ChildComp'. The policy as written uses only the leaf name, so OCI cannot resolve the target and the grant fails.

Answer

Policies can never reference child compartments; they must always apply to the entire tenancy.

Answer

The verb 'manage' cannot be used with instances; it must be 'use'.

Answer

The group name must be prefixed with the tenancy name.

Question 10

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Accepted Answer

Allow group NetworkAdmins to manage subnets, route-tables, and vcns in tenancy. The statement 'Allow group NetworkAdmins to manage subnets, route-tables, and vcns in tenancy' grants full management of exactly those three resource types while excluding gateways and peering connections, achieving the greatest precision. OCI policies are additive and resource-type-specific, so naming only the required resources is the most precise approach.

Answer

Allow group NetworkAdmins to manage all-resources in tenancy where target.type != 'gateway'

Answer

Allow group NetworkAdmins to use networking in tenancy

Answer

Allow group NetworkAdmins to manage virtual-network-family in tenancy

Question 11

What is the maximum number of groups a single OCI user can be a member of?

Accepted Answer

300 groups. OCI enforces a hard limit of 300 groups per user. This is a documented Identity and Access Management (IAM) service limit that applies to every user in a tenancy, regardless of whether the groups are local or federated. The limit exists to keep policy evaluation and group membership lookups performant.

Answer

10 groups

Answer

Unlimited

Answer

50 groups

Question 12

An administrator needs to ensure that a newly created group can view billing and cost data across the tenancy, but cannot modify any resources. Which policy grants the appropriate access?

Accepted Answer

Allow group CostAnalysts to read usage-reports in tenancy. To view billing and cost data in Oracle Cloud Infrastructure (OCI) without modifying resources, the correct IAM policy verb and resource combination is 'Allow group <group_name> to read cost-reports in tenancy' or 'inspect cost-reports'. 'usage-reports' is not the correct resource keyword.

Answer

Allow group CostAnalysts to inspect compartments in tenancy

Answer

Allow group CostAnalysts to manage billing in tenancy

Answer

Allow group CostAnalysts to use tenancy-budget in tenancy

Question 13

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Accepted Answer

ALL {tag.Department.CostCenter.value = '400'}. To include compute instances based on defined tags in an OCI dynamic group matching rule, the correct syntax format is tag...value = ''. For this scenario, it is tag.Department.CostCenter.value = '400' enclosed in matching rule brackets.

Answer

ANY {defined.tag.Department.CostCenter == '400'}

Answer

ALL {instance.tag.Department.CostCenter = '400'}

Answer

MATCH {tag:Department:CostCenter = '400'}

Question 14

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

Accepted Answer

Allow group Developers to manage load-balancers in compartment AppCompartment. The policy 'Allow group Developers to manage load-balancers in compartment AppCompartment' correctly grants the Developers group full management permissions on load balancers within the specified compartment. The verb 'manage' includes create, read, update, and delete operations, and 'load-balancers' is the correct resource type.

Answer

Allow user Developers to create load-balancers in compartment AppCompartment

Answer

Allow group Developers to manage lb-family in tenancy

Answer

Allow group Developers to use network-load-balancers in compartment AppCompartment

Question 15

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

Accepted Answer

5,000 compartments (default soft/hard limit). OCI imposes service limits on compartments per tenancy, which defaults to several thousand (typically 5,000 compartments per tenancy, adjustable via service limit request).

Answer

10 compartments

Answer

Unlimited with no restrictions

Answer

100 compartments

Question 16

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Accepted Answer

Allow group AppSupport to read monitoring-family in tenancy. OCI IAM policies use the verb 'read' to grant view-only access to resources, and 'monitoring-family' is the aggregate resource-type that covers both metrics and alarms in the Monitoring service. This combination gives the AppSupport group the ability to list and get metrics and alarms across the tenancy without any create, update, or delete permissions. It is the least-privilege policy that satisfies the requirement.

Answer

Allow group AppSupport to use metrics in tenancy

Answer

Allow group AppSupport to inspect telemetry in tenancy

Answer

Allow group AppSupport to manage alarms in compartment root

Question 17

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Accepted Answer

ALL {instance.compartment.id = 'ocid1.compartment..oc1..aaaa...'}. OCI dynamic group matching rules use the syntax 'ALL {. = }' or 'ANY {...}'. To match all compute instances in a compartment, the correct form is 'ALL {instance.compartment.id = ''}'. The 'ALL' keyword requires every condition to be true, and 'instance.compartment.id' is the correct attribute path for a compute instance's compartment.

Answer

DYNAMIC {compartment.id IN ('ocid1.compartment..oc1..aaaa...')}

Answer

ANY {resource.compartment = 'ocid1.compartment..oc1..aaaa...'}

Answer

MATCH {compartment.ocid == 'ocid1.compartment..oc1..aaaa...'}

Question 18

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Accepted Answer

Nothing further; endorsement and commitment IAM policies are sufficient for cross-tenancy dynamic group authorization.. To configure cross-tenancy access for a dynamic group in Oracle Cloud Infrastructure (OCI), you use IAM policies in both tenancies: the source tenancy must 'endorse' the dynamic group to perform actions on services in the target tenancy, and the target tenancy must 'admit' the dynamic group from the source tenancy. No local dynamic group, API signing key, or VCN peering is required in Tenancy A for IAM policy evaluation.

Answer

You must create a local dynamic group in Tenancy A with the exact same matching rules as Tenancy B.

Answer

You must configure an API signing key for the dynamic group in Tenancy B.

Answer

You must establish a Remote VCN Peering connection between the two tenancies.

Question 19

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Accepted Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy where target.tag.Project.Name = 'Analytics'. OCI IAM policy conditions are appended using the 'where' keyword followed by variable evaluations like target.tag or request.tag.

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy CONDITION tag.Project.Name = 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy IF target.tag.Project.Name == 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy WITH tag Project.Name = 'Analytics'

Question 20

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Accepted Answer

Allow group SecurityOps to read audit-events in tenancy. In OCI IAM, audit events are a distinct resource type, and the verb 'read' grants the ability to view audit-events. The policy 'Allow group SecurityOps to read audit-events in tenancy' correctly scopes the permission to the tenancy and uses the proper resource-type and verb combination for reading audit logs. This follows least privilege by granting read-only access rather than manage or use.

Answer

Allow group SecurityOps to manage log-files in tenancy

Answer

Allow group SecurityOps to use audit in tenancy

Answer

Allow group SecurityOps to inspect audit-trails in compartment root