1Z0-1072-26 Identity And Access Management — All Questions With Answers

Question 1hardmultiple choice

Read the full Identity And Access Management explanation →

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Question 2mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Question 3mediummultiple choice

Review the full subnetting walkthrough →

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

Question 4hardmultiple choice

Read the full Identity And Access Management explanation →

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

Question 5easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of compartments you can nest within a single parent compartment in OCI?

Question 6hardmultiple choice

Read the full Identity And Access Management explanation →

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Question 7mediummultiple choice

Review the full subnetting walkthrough →

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Question 8hardmultiple choice

Read the full Identity And Access Management explanation →

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

Question 9mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Question 10mediummultiple choice

Review the full subnetting walkthrough →

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Question 11easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of groups a single OCI user can be a member of?

Question 12mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to ensure that a newly created group can view billing and cost data across the tenancy, but cannot modify any resources. Which policy grants the appropriate access?

Question 13hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Question 14mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

Question 15easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

Question 16mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Question 17hardmultiple choice

Study the full AAA explanation →

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Question 18hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Question 19hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Question 20mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Question 21mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?

Question 22hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring a dynamic group matching rule that needs to include all compute instances whose OCID starts with a specific prefix or belong to a specific image. However, OCI dynamic group grammar does not support wildcard operators like asterisks (*) for prefix matching on instance IDs. Which approach should you use instead to group these instances?

Question 23hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

Question 24hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization requires that all IAM policies created in the tenancy must be reviewed and approved. To facilitate auditing, you need to write a policy allowing the 'ComplianceTeam' group to read IAM policies and read tenancy metadata. Which policy statement correctly implements this?

Question 25mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow a group of developers to create and manage Kubernetes clusters (OKE - Oracle Container Engine for Kubernetes) in a specific compartment named 'K8sCompartment'. Which policy statement is correct?

Question 26hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

Question 27hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

Question 28hardmulti select

Read the full Identity And Access Management explanation →

Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)

Question 29hardmulti select

Read the full Identity And Access Management explanation →

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Question 30mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Question 31hardmulti select

Read the full Identity And Access Management explanation →

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

Question 32mediummulti select

Read the full Identity And Access Management explanation →

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

Question 33hardmulti select

Read the full Identity And Access Management explanation →

Which THREE administrative tasks require membership in the tenancy Administrators group or equivalent high-level IAM privileges? (Choose three.)

Question 34mediummulti select

Read the full Identity And Access Management explanation →

Which THREE services integrate directly with OCI IAM for access control and governance? (Choose three.)

Question 35mediummulti select

Read the full Identity And Access Management explanation →

Which THREE resource types are associated with networking and can be managed via OCI IAM policies? (Choose three.)

Question 36hardmultiple choice

Study the full AAA explanation →

You are designing an IAM policy hierarchy for a multi-tenant OCI environment. You write the following statement in the root compartment: 'Define tenancy TenantA as ocid1.tenancy.oc1..aaaaaaa...; Define group NetworkAdmins as ocid1.group.oc1..aaaaaaa...; Allow group NetworkAdmins to manage virtual-network-family in tenancy TenantA'. What type of policy cross-tenancy grant does this represent?

Question 37hardmulti select

Read the full Identity And Access Management explanation →

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

Question 38mediummulti select

Read the full Identity And Access Management explanation →

Your organization is implementing dynamic groups to manage automated deployments from OCI Functions and Compute instances. Which THREE of the following matching rule criteria are valid for constructing OCI dynamic groups? (Choose three.)

Question 39mediummultiple choice

Study the full AAA explanation →

A security team wants to ensure that only members of the group 'ProdDBAdmins' can manage database systems in the compartment 'ProdDatabases' (OCID: ocid1.compartment.oc1..aaaa). They need to write a policy that grants the necessary permissions while following the principle of least privilege. Which policy statement should they use?

Question 40easymultiple choice

Read the full Identity And Access Management explanation →

A user is a member of the group 'Auditors' and has been granted the policy 'Allow group Auditors to inspect all-resources in tenancy'. The user attempts to list all users in the tenancy but receives an authorization error. What is the most likely reason?

Question 41mediummultiple choice

Read the full Identity And Access Management explanation →

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Question 42easymultiple choice

Read the full Identity And Access Management explanation →

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Question 43easymultiple choice

Read the full Identity And Access Management explanation →

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Question 44easymultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases in a specific compartment named DevComp. Which policy syntax is the most secure and adheres to the principle of least privilege?

Question 45mediummultiple choice

Read the full Identity And Access Management explanation →

An auditor needs to verify all IAM policies across your entire tenancy to ensure compliance. Which policy statement allows a user in the 'Auditors' group to read all policies in the tenancy root?

Question 46easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of an OCI dynamic group?

Question 47hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Question 48hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Question 49mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

Question 50easymultiple choice

Read the full Identity And Access Management explanation →

Which OCI service is responsible for managing users, groups, compartments, and policies?

Question 51hardmultiple choice

Read the full Identity And Access Management explanation →

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

Question 52easymultiple choice

Read the full Identity And Access Management explanation →

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Question 53easymultiple choice

Read the full Identity And Access Management explanation →

What happens to the resources inside a compartment when you delete the compartment itself?

Question 54hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Question 55easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary purpose of OCI compartments?

Question 56mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Question 57easymultiple choice

Read the full Identity And Access Management explanation →

What is the function of the OCI IAM 'inspect' verb?

Question 58hardmultiple choice

Read the full Identity And Access Management explanation →

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Question 59mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Question 60hardmultiple choice

Read the full Identity And Access Management explanation →

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

Question 61easymultiple choice

Read the full Identity And Access Management explanation →

Which of the following describes an OCI user group?

Question 62easymultiple choice

Read the full Identity And Access Management explanation →

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

Question 63easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of OCI Identity Domains?

Question 64mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Question 65hardmultiple choice

Read the full Identity And Access Management explanation →

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Question 66easymultiple choice

Read the full Identity And Access Management explanation →

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

Question 67easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary purpose of an OCI API signing key?

Question 68easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of an OCI IAM policy statement?

Question 69mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

Question 70mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

Question 71easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of OCI IAM federation?

Question 72easymulti select

Read the full Identity And Access Management explanation →

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Question 73mediummulti select

Read the full Identity And Access Management explanation →

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Question 74mediummulti select

Read the full Identity And Access Management explanation →

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Question 75easymulti select

Read the full Identity And Access Management explanation →

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Question 76mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Question 77easymulti select

Read the full Identity And Access Management explanation →

Which TWO methods can be used to authenticate human users to the OCI Console? (Choose two.)

Question 78mediummulti select

Read the full Identity And Access Management explanation →

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Question 79easymulti select

Read the full Identity And Access Management explanation →

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

Question 80hardmulti select

Read the full Identity And Access Management explanation →

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

Question 81easymulti select

Read the full Identity And Access Management explanation →

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

Question 82hardmulti select

Read the full Identity And Access Management explanation →

Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)

Question 83mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

Question 84easymulti select

Read the full Identity And Access Management explanation →

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Question 85easymulti select

Read the full Identity And Access Management explanation →

Which TWO types of groups exist in OCI IAM? (Choose two.)

Question 86hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Question 87easymulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true about OCI IAM compartments? (Choose two.)

Question 88mediummulti select

Read the full Identity And Access Management explanation →

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Question 89easymulti select

Read the full Identity And Access Management explanation →

Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)

Question 90easymulti select

Read the full Identity And Access Management explanation →

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

Question 91hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Question 92hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Question 93mediummulti select

Read the full Identity And Access Management explanation →

Which THREE tools or methods can be used to write and apply OCI IAM policies? (Choose three.)

Question 94easymultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

Question 95hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

Question 96mediummultiple choice

Read the full Identity And Access Management explanation →

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

Question 97mediummultiple choice

Read the full Identity And Access Management explanation →

Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?

Question 98mediummultiple choice

Read the full Identity And Access Management explanation →

Your team needs to allow a group of developers to read logs in the Logging service across all compartments, but you want to ensure they cannot modify or delete any logging resources. Which of the following IAM policy verbs should you use?

Question 99easymultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Question 100hardmulti select

Read the full Identity And Access Management explanation →

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)

Question 1hardmultiple choice

Read the full Identity And Access Management explanation →

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Question 2mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Question 3mediummultiple choice

Review the full subnetting walkthrough →

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

Question 4hardmultiple choice

Read the full Identity And Access Management explanation →

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

Question 5easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of compartments you can nest within a single parent compartment in OCI?

Question 6hardmultiple choice

Read the full Identity And Access Management explanation →

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Question 7mediummultiple choice

Review the full subnetting walkthrough →

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Question 8hardmultiple choice

Read the full Identity And Access Management explanation →

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

Question 9mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Question 10mediummultiple choice

Review the full subnetting walkthrough →

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Question 11easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of groups a single OCI user can be a member of?

Question 12mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to ensure that a newly created group can view billing and cost data across the tenancy, but cannot modify any resources. Which policy grants the appropriate access?

Question 13hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Question 14mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

Question 15easymultiple choice

Read the full Identity And Access Management explanation →

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

Question 16mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Question 17hardmultiple choice

Study the full AAA explanation →

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Question 18hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Question 19hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Question 20mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Question 21mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?

Question 22hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring a dynamic group matching rule that needs to include all compute instances whose OCID starts with a specific prefix or belong to a specific image. However, OCI dynamic group grammar does not support wildcard operators like asterisks (*) for prefix matching on instance IDs. Which approach should you use instead to group these instances?

Question 23hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

Question 24hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization requires that all IAM policies created in the tenancy must be reviewed and approved. To facilitate auditing, you need to write a policy allowing the 'ComplianceTeam' group to read IAM policies and read tenancy metadata. Which policy statement correctly implements this?

Question 25mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow a group of developers to create and manage Kubernetes clusters (OKE - Oracle Container Engine for Kubernetes) in a specific compartment named 'K8sCompartment'. Which policy statement is correct?

Question 26hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

Question 27hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

Question 28hardmulti select

Read the full Identity And Access Management explanation →

Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)

Question 29hardmulti select

Read the full Identity And Access Management explanation →

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Question 30mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Question 31hardmulti select

Read the full Identity And Access Management explanation →

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

Question 32mediummulti select

Read the full Identity And Access Management explanation →

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

Question 33hardmulti select

Read the full Identity And Access Management explanation →

Which THREE administrative tasks require membership in the tenancy Administrators group or equivalent high-level IAM privileges? (Choose three.)

Question 34mediummulti select

Read the full Identity And Access Management explanation →

Which THREE services integrate directly with OCI IAM for access control and governance? (Choose three.)

Question 35mediummulti select

Read the full Identity And Access Management explanation →

Which THREE resource types are associated with networking and can be managed via OCI IAM policies? (Choose three.)

Question 36hardmultiple choice

Study the full AAA explanation →

You are designing an IAM policy hierarchy for a multi-tenant OCI environment. You write the following statement in the root compartment: 'Define tenancy TenantA as ocid1.tenancy.oc1..aaaaaaa...; Define group NetworkAdmins as ocid1.group.oc1..aaaaaaa...; Allow group NetworkAdmins to manage virtual-network-family in tenancy TenantA'. What type of policy cross-tenancy grant does this represent?

Question 37hardmulti select

Read the full Identity And Access Management explanation →

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

Question 38mediummulti select

Read the full Identity And Access Management explanation →

Your organization is implementing dynamic groups to manage automated deployments from OCI Functions and Compute instances. Which THREE of the following matching rule criteria are valid for constructing OCI dynamic groups? (Choose three.)

Question 39mediummultiple choice

Study the full AAA explanation →

A security team wants to ensure that only members of the group 'ProdDBAdmins' can manage database systems in the compartment 'ProdDatabases' (OCID: ocid1.compartment.oc1..aaaa). They need to write a policy that grants the necessary permissions while following the principle of least privilege. Which policy statement should they use?

Question 40easymultiple choice

Read the full Identity And Access Management explanation →

A user is a member of the group 'Auditors' and has been granted the policy 'Allow group Auditors to inspect all-resources in tenancy'. The user attempts to list all users in the tenancy but receives an authorization error. What is the most likely reason?

Question 41mediummultiple choice

Read the full Identity And Access Management explanation →

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

Question 42easymultiple choice

Read the full Identity And Access Management explanation →

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Question 43easymultiple choice

Read the full Identity And Access Management explanation →

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Question 44easymultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases in a specific compartment named DevComp. Which policy syntax is the most secure and adheres to the principle of least privilege?

Question 45mediummultiple choice

Read the full Identity And Access Management explanation →

An auditor needs to verify all IAM policies across your entire tenancy to ensure compliance. Which policy statement allows a user in the 'Auditors' group to read all policies in the tenancy root?

Question 46easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of an OCI dynamic group?

Question 47hardmultiple choice

Read the full Identity And Access Management explanation →

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Question 48hardmultiple choice

Read the full Identity And Access Management explanation →

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Question 49mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

Question 50easymultiple choice

Read the full Identity And Access Management explanation →

Which OCI service is responsible for managing users, groups, compartments, and policies?

Question 51hardmultiple choice

Read the full Identity And Access Management explanation →

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

Question 52easymultiple choice

Read the full Identity And Access Management explanation →

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Question 53easymultiple choice

Read the full Identity And Access Management explanation →

What happens to the resources inside a compartment when you delete the compartment itself?

Question 54hardmultiple choice

Read the full Identity And Access Management explanation →

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Question 55easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary purpose of OCI compartments?

Question 56mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Question 57easymultiple choice

Read the full Identity And Access Management explanation →

What is the function of the OCI IAM 'inspect' verb?

Question 58hardmultiple choice

Read the full Identity And Access Management explanation →

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Question 59mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Question 60hardmultiple choice

Read the full Identity And Access Management explanation →

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

Question 61easymultiple choice

Read the full Identity And Access Management explanation →

Which of the following describes an OCI user group?

Question 62easymultiple choice

Read the full Identity And Access Management explanation →

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

Question 63easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of OCI Identity Domains?

Question 64mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Question 65hardmultiple choice

Read the full Identity And Access Management explanation →

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Question 66easymultiple choice

Read the full Identity And Access Management explanation →

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

Question 67easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary purpose of an OCI API signing key?

Question 68easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of an OCI IAM policy statement?

Question 69mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

Question 70mediummultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

Question 71easymultiple choice

Read the full Identity And Access Management explanation →

What is the primary function of OCI IAM federation?

Question 72easymulti select

Read the full Identity And Access Management explanation →

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Question 73mediummulti select

Read the full Identity And Access Management explanation →

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Question 74mediummulti select

Read the full Identity And Access Management explanation →

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Question 75easymulti select

Read the full Identity And Access Management explanation →

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Question 76mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Question 77easymulti select

Read the full Identity And Access Management explanation →

Which TWO methods can be used to authenticate human users to the OCI Console? (Choose two.)

Question 78mediummulti select

Read the full Identity And Access Management explanation →

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Question 79easymulti select

Read the full Identity And Access Management explanation →

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

Question 80hardmulti select

Read the full Identity And Access Management explanation →

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

Question 81easymulti select

Read the full Identity And Access Management explanation →

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

Question 82hardmulti select

Read the full Identity And Access Management explanation →

Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)

Question 83mediummulti select

Read the full Identity And Access Management explanation →

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

Question 84easymulti select

Read the full Identity And Access Management explanation →

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Question 85easymulti select

Read the full Identity And Access Management explanation →

Which TWO types of groups exist in OCI IAM? (Choose two.)

Question 86hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Question 87easymulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true about OCI IAM compartments? (Choose two.)

Question 88mediummulti select

Read the full Identity And Access Management explanation →

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Question 89easymulti select

Read the full Identity And Access Management explanation →

Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)

Question 90easymulti select

Read the full Identity And Access Management explanation →

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

Question 91hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

Question 92hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Question 93mediummulti select

Read the full Identity And Access Management explanation →

Which THREE tools or methods can be used to write and apply OCI IAM policies? (Choose three.)

Question 94easymultiple choice

Read the full Identity And Access Management explanation →

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

Question 95hardmulti select

Read the full Identity And Access Management explanation →

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

Question 96mediummultiple choice

Read the full Identity And Access Management explanation →

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

Question 97mediummultiple choice

Read the full Identity And Access Management explanation →

Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?

Question 98mediummultiple choice

Read the full Identity And Access Management explanation →

Your team needs to allow a group of developers to read logs in the Logging service across all compartments, but you want to ensure they cannot modify or delete any logging resources. Which of the following IAM policy verbs should you use?

Question 99easymultiple choice

Read the full Identity And Access Management explanation →

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Question 100hardmulti select

Read the full Identity And Access Management explanation →

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)