1Z0-1072-26 Identity And Access Management — 30 Questions

Question 1

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Map the IDCS group 'NetworkAdmins' to an OCI IAM group, then write an OCI policy allowing that OCI IAM group to manage virtual-network-family in the desired compartment.. Federated groups from IDCS must be mapped to OCI IAM groups in the OCI Console, and then a policy must be written granting that OCI IAM group access.

Answer

Assign the NetworkAdmins group directly to the tenancy root compartment via the IDCS console.

Answer

Write a policy directly referencing the IDCS group name 'NetworkAdmins' with no OCI group mapping.

Answer

Create a local user in OCI IAM for every member of the IDCS 'NetworkAdmins' group and assign them roles.

Question 2

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Accepted Answer

ANY {instance.id = 'ocid1.instance...', tag.Project.Value = 'Alpha'}. Dynamic group matching rules support matching conditions using ALL or ANY operators with parameters such as instance.id and tag.namespace.tagkey.

Answer

MATCH {instance.id == 'ocid1.instance...' OR tag.Project == 'Alpha'}

Answer

DYNAMIC {instance.id IN ('ocid1.instance...'))}

Answer

ALL {instance.id = 'ocid1.instance...', tag.Project.name = 'Alpha'}

Question 3

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Accepted Answer

It applies across the entire tenancy and all compartments within it.. Policies created in the root compartment (tenancy) apply globally across the entire tenancy and all child compartments unless restricted.

Answer

It applies exclusively to the Identity and Access Management service.

Answer

It must be explicitly attached to each child compartment individually to take effect.

Answer

It applies only to the root compartment and cannot affect child compartments.

Question 4

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Accepted Answer

The policy can be created in compartment 'ProjectA' using the syntax: Allow group Auditors to inspect all-resources in compartment ProjectA. To limit access strictly to 'ProjectA', the policy can be attached either directly to 'ProjectA' or to the parent 'DepartmentX' with a specific compartment restriction.

Answer

Policies can only be created in the root tenancy, never in child compartments.

Answer

The policy must be created in the Identity service global container.

Answer

The policy must be created in the root compartment (tenancy).

Question 5

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

Accepted Answer

Allow group Developers to use instance-family in tenancy where request.ip in ('192.168.100.0/24'). OCI IAM policies support conditional access using the 'request.ip' variable in combination with logical operators like 'in'.

Answer

Allow group Developers to terminate instances in tenancy where client.subnet = '192.168.100.0/24'

Answer

Allow group Developers to inspect instances in tenancy where request.ip = '192.168.100.0/24'

Answer

Allow group Developers to manage instance-family in tenancy where request.ip = '192.168.100.0/24'

Question 6

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

Accepted Answer

Allow dynamic-group AppInstances to read objects in tenancy where target.tag.Operations.Environment = 'Production'. Policies can enforce tag-based access control using the target.tag variable to check if a resource possesses a specific defined tag.

Answer

Allow dynamic-group AppInstances to read objects in compartment Production where target.tag.Operations.Environment = 'true'

Answer

Allow dynamic-group AppInstances to read objects in tenancy where request.tag.Operations.Environment = 'Production'

Answer

Allow dynamic-group AppInstances to read buckets in tenancy where bucket.tag.Operations.Environment = 'Production'

Question 7

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Accepted Answer

manage. The 'manage' verb is the most powerful verb in OCI IAM policies, encompassing inspect, read, use, and full management capabilities.

Answer

use

Answer

read

Answer

inspect

Question 8

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases in a specific compartment named DevComp. Which policy syntax is the most secure and adheres to the principle of least privilege?

Accepted Answer

Allow group DBA-Group to manage autonomous-database in compartment DevComp. To grant access to specific resources within a specific compartment, the policy must scope the verbs to that compartment rather than the tenancy.

Answer

Allow group DBA-Group to manage all-resources in tenancy

Answer

Allow user DBA-Group to manage autonomous-database in tenancy

Answer

Allow group DBA-Group to use databases in compartment DevComp

Question 9

An auditor needs to verify all IAM policies across your entire tenancy to ensure compliance. Which policy statement allows a user in the 'Auditors' group to read all policies in the tenancy root?

Accepted Answer

Allow group Auditors to read policies in tenancy. To view policies, the resource type 'policy' must be specified with the 'read' or 'inspect' verb at the tenancy level.

Answer

Allow group Auditors to manage tenancy-resources in tenancy

Answer

Allow user Auditors to inspect security-rules in tenancy

Answer

Allow group Auditors to use iam-policies in compartment root

Question 10

What is the primary function of an OCI dynamic group?

Accepted Answer

To allow OCI resources, such as compute instances, to be authenticated and authorized as principals in IAM policies.. Dynamic groups allow cloud resources (such as compute instances) to be treated as principal actors, enabling them to make API calls to other OCI services without hardcoding credentials.

Answer

To automatically scale compute instances based on CPU utilization metrics.

Answer

To automatically create compartments when new projects are initiated.

Answer

To group human users together based on their department or job function.

Question 11

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Accepted Answer

Define an IAM policy in Tenancy A endorsing the group from Tenancy B, and a policy in Tenancy B committing to the access.. Cross-tenancy access requires the target tenancy (Tenancy A) to define an endorsement, and the source tenancy (Tenancy B) to define a corresponding commitment.

Answer

Create local user accounts in Tenancy A for every user in Tenancy B's group.

Answer

Establish a Remote VCN Peering connection between Tenancy A and Tenancy B.

Answer

Share the Object Storage bucket directly using pre-authenticated requests.

Question 12

What is the maximum number of compartments you can nest within a single parent compartment in OCI?

Accepted Answer

6 levels. OCI supports nesting compartments up to 6 levels deep beneath the root compartment (tenancy).

Answer

Unlimited

Answer

2 levels

Answer

10 levels

Question 13

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Accepted Answer

Configure an Identity Provider (IdP) in OCI IAM by importing the SAML 2.0 metadata from the external IdP.. To set up external federation in OCI, you must first create an Identity Provider (IdP) record by uploading the IdP metadata XML file.

Answer

Provision local user accounts in OCI IAM for every partner employee.

Answer

Write a tenancy-wide policy allowing all external users to manage tenancy resources.

Answer

Create an API signing key pair for each partner user in OCI IAM.

Question 14

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

Accepted Answer

OCI IAM policies do not support time-of-day or day-of-week conditions; this must be managed via external IdP federation policies or session token lifetimes.. OCI IAM policies do not natively support time-of-day or day-of-week conditional constraints directly in policy syntax.

Answer

Write a policy with the condition: where request.time.hour between '09:00' and '17:00'

Answer

Configure an IAM security policy rule using the schedule builder in the OCI Console.

Answer

Use the 'time-window' parameter in the dynamic group matching rule.

Question 15

Which OCI service is responsible for managing users, groups, compartments, and policies?

Accepted Answer

Identity and Access Management (IAM). Identity and Access Management (IAM) is the foundational OCI service responsible for authentication and authorization.

Answer

OCI Audit

Answer

Resource Manager

Answer

Security Advisor

Question 16

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rule evaluation is not always instantaneous, but more importantly, compute instances must be explicitly configured with resource principal or instance principal features depending on the SDK version, and matching rules take a short time to evaluate newly created resources.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 17

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Accepted Answer

Allow group Developers to use instances in tenancy where request.subnet.id = 'ocid1.subnet...'. OCI IAM policies support conditions based on the source subnet OCID using the 'request.subnet.id' variable.

Answer

Configure a security list rule allowing instance deletion from the specified subnet.

Answer

Allow group Developers to delete instances in subnet 'ocid1.subnet...'

Answer

Allow group Developers to manage instances in tenancy where client.subnet.id = 'ocid1.subnet...'

Question 18

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

Accepted Answer

Define group Partners in Tenancy B: endorse group Partners to read objects in tenancy TenancyA. A commitment policy in the source tenancy uses the 'endorse' verb along with the target tenancy OCID.

Answer

Define group Partners in Tenancy B: accept group Partners to read objects in tenancy TenancyA

Answer

Define group Partners in Tenancy B: permit group Partners to read objects in compartment Root

Answer

Define group Partners in Tenancy B: allow group Partners to access tenancy TenancyA

Question 19

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

Accepted Answer

Configure a security rule (or sign-on policy) within Identity Domains to require MFA for specific groups upon authentication.. OCI IAM supports native identity domains and security rules (formerly sign-on policies) where MFA can be enforced based on user groups and risk levels.

Answer

Enable MFA in the tenancy root compartment settings under Compartment Quotas.

Answer

Write an IAM policy with the condition where request.mfa = 'true'

Answer

Add a tag to the user account indicating that MFA is required.

Question 20

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Accepted Answer

Tenancy root (or the root compartment). The root compartment, which is created automatically with every tenancy, is named the tenancy root (or referred to by the tenancy name itself).

Answer

MasterCompartment

Answer

RootComp

Answer

Default-Tenant