1Z0-1072-26 Identity And Access Management Practice Test 2 — 15 Questions

Question 1

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Accepted Answer

Allow group AppSupport to read monitoring-family in tenancy. OCI IAM policies use the verb 'read' to grant view-only access to resources, and 'monitoring-family' is the aggregate resource-type that covers both metrics and alarms in the Monitoring service. This combination gives the AppSupport group the ability to list and get metrics and alarms across the tenancy without any create, update, or delete permissions. It is the least-privilege policy that satisfies the requirement.

Answer

Allow group AppSupport to use metrics in tenancy

Answer

Allow group AppSupport to inspect telemetry in tenancy

Answer

Allow group AppSupport to manage alarms in compartment root

Question 2

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Accepted Answer

ALL {instance.compartment.id = 'ocid1.compartment..oc1..aaaa...'}. OCI dynamic group matching rules use the syntax 'ALL {. = }' or 'ANY {...}'. To match all compute instances in a compartment, the correct form is 'ALL {instance.compartment.id = ''}'. The 'ALL' keyword requires every condition to be true, and 'instance.compartment.id' is the correct attribute path for a compute instance's compartment.

Answer

DYNAMIC {compartment.id IN ('ocid1.compartment..oc1..aaaa...')}

Answer

ANY {resource.compartment = 'ocid1.compartment..oc1..aaaa...'}

Answer

MATCH {compartment.ocid == 'ocid1.compartment..oc1..aaaa...'}

Question 3

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Accepted Answer

Nothing further; endorsement and commitment IAM policies are sufficient for cross-tenancy dynamic group authorization.. To configure cross-tenancy access for a dynamic group in Oracle Cloud Infrastructure (OCI), you use IAM policies in both tenancies: the source tenancy must 'endorse' the dynamic group to perform actions on services in the target tenancy, and the target tenancy must 'admit' the dynamic group from the source tenancy. No local dynamic group, API signing key, or VCN peering is required in Tenancy A for IAM policy evaluation.

Answer

You must create a local dynamic group in Tenancy A with the exact same matching rules as Tenancy B.

Answer

You must configure an API signing key for the dynamic group in Tenancy B.

Answer

You must establish a Remote VCN Peering connection between the two tenancies.

Question 4

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Accepted Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy where target.tag.Project.Name = 'Analytics'. OCI IAM policy conditions are appended using the 'where' keyword followed by variable evaluations like target.tag or request.tag.

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy CONDITION tag.Project.Name = 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy IF target.tag.Project.Name == 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy WITH tag Project.Name = 'Analytics'

Question 5

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Accepted Answer

Allow group SecurityOps to read audit-events in tenancy. In OCI IAM, audit events are a distinct resource type, and the verb 'read' grants the ability to view audit-events. The policy 'Allow group SecurityOps to read audit-events in tenancy' correctly scopes the permission to the tenancy and uses the proper resource-type and verb combination for reading audit logs. This follows least privilege by granting read-only access rather than manage or use.

Answer

Allow group SecurityOps to manage log-files in tenancy

Answer

Allow group SecurityOps to use audit in tenancy

Answer

Allow group SecurityOps to inspect audit-trails in compartment root

Question 6

An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?

Accepted Answer

Allow group DevViewers to read policies in tenancy. In OCI, the 'inspect' verb allows listing and viewing metadata, while 'read' allows viewing the content of the resource. To view the actual content of an IAM policy, the 'read' verb is required. The provided options use non-standard syntax (e.g., 'policies' instead of 'policies' resource-type).

Answer

Allow group DevViewers to manage policy-documents in compartment root

Answer

Allow group DevViewers to use iam in tenancy

Answer

Allow group DevViewers to inspect security-settings in tenancy

Question 7

You are configuring a dynamic group matching rule that needs to include all compute instances whose OCID starts with a specific prefix or belong to a specific image. However, OCI dynamic group grammar does not support wildcard operators like asterisks (*) for prefix matching on instance IDs. Which approach should you use instead to group these instances?

Accepted Answer

Apply defined tags to the compute instances at launch and write a dynamic group rule matching those tags.. Since dynamic groups support matching by compartment ID, tags, or exact instance IDs, tagging instances at launch is the standard method to group arbitrary sets of compute instances.

Answer

Create an IAM user for each compute instance and assign them to a static group.

Answer

Manually add each instance OCID to the dynamic group membership list daily via CLI.

Answer

Use wildcard asterisks (*) directly in the instance.id matching rule.

Question 8

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

Accepted Answer

Allow group SecurityAnalysts to read cloud-guard-family in tenancy. Cloud Guard in OCI is exposed through the cloud-guard-family resource type, and the read verb grants the security analyst group the ability to inspect security posture, problems, and recommendations across the tenancy. Referencing cloud-guard-family in tenancy with read is the correct policy for auditing security posture.

Answer

Allow group SecurityAnalysts to inspect compliance-rules in tenancy

Answer

Allow group SecurityAnalysts to manage security-posture in tenancy

Answer

Allow group SecurityAnalysts to use vulnerability-scanners in compartment root

Question 9

Your organization requires that all IAM policies created in the tenancy must be reviewed and approved. To facilitate auditing, you need to write a policy allowing the 'ComplianceTeam' group to read IAM policies and read tenancy metadata. Which policy statement correctly implements this?

Accepted Answer

Allow group ComplianceTeam to read policies, tenancy in tenancy. The policy statement 'Allow group ComplianceTeam to read policies, tenancy in tenancy' grants read access to IAM policies and tenancy metadata at the tenancy scope, which is exactly what the ComplianceTeam needs for auditing. The 'read' verb in OCI IAM covers GET operations on the specified resource types, and 'tenancy' as the location ensures the policy applies across the entire tenancy rather than a single compartment. This is the minimal-privilege statement that satisfies the requirement.

Answer

Allow group ComplianceTeam to use security-audits in compartment root

Answer

Allow group ComplianceTeam to inspect all-resources in tenancy

Answer

Allow group ComplianceTeam to manage iam-configs in tenancy

Question 10

An administrator wants to allow a group of developers to create and manage Kubernetes clusters (OKE - Oracle Container Engine for Kubernetes) in a specific compartment named 'K8sCompartment'. Which policy statement is correct?

Accepted Answer

Allow group Developers to manage cluster-family in compartment K8sCompartment. Container Engine for Kubernetes resources are managed using the 'cluster-family' resource type in OCI IAM policies.

Answer

Allow group Developers to manage containers in tenancy

Answer

Allow group Developers to use kubernetes in compartment K8sCompartment

Answer

Allow group Developers to read k8s-clusters in compartment K8sCompartment

Question 11

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

Accepted Answer

The policy must allow the dynamic group to read secrets and keys in the vault compartment, and the vault key must be accessible.. For a dynamic group to read a Vault secret, the policy must grant read access to both the secret and the key used to encrypt it, in the vault's compartment. The key is a separate KMS resource, so a policy that only covers secrets will fail when the service tries to decrypt. Both the secret-read and key-use permissions must be in place.

Answer

The vault must be placed in the exact same subnet as the compute instance.

Answer

The compute instance must have its root password stored as plain text in the instance metadata.

Answer

You must attach an API signing key directly to the compute instance metadata service.

Question 12

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

Accepted Answer

The resource (target) tenancy must define a policy allowing the external group using the tenancy name.. Option D is correct because in OCI cross-tenancy access, the resource (target) tenancy must author a policy that grants the external group permission to access its resources, identifying that group by the principal tenancy's name (e.g., 'Allow group in tenancy to ...'). Option E is correct because the principal tenancy must define an endorsement policy using the 'endorse' verb to authorize its users/groups to be referenced in policies written by the resource tenancy (e.g., 'Endorse group to ... in tenancy '). Option A is wrong because the endorsement policy belongs to the principal tenancy, not the resource tenancy, so the resource tenancy does not define an endorsement policy. Option B is wrong because cross-tenancy access does not require local shadow user accounts; users remain in their home tenancy and are granted access via policies. Option C is wrong because cross-tenancy IAM policies are a general IAM feature and are not configured exclusively in the OCI DNS service.

Answer

The resource tenancy must define an endorsement policy allowing the external group to access its resources.

Answer

Cross-tenancy access requires every external user to have a local shadow user account.

Answer

Cross-tenancy policies are configured exclusively in the OCI DNS service.

Question 13

Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)

Accepted Answer

Compute instances. In OCI IAM policies, the 'instance-family' resource type includes compute instances, boot volumes, and console histories.

Answer

Virtual Cloud Networks

Answer

Autonomous Databases

Question 14

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Accepted Answer

The defined tag namespace and key must be created prior to launching the tagged instance.. Option B is correct because in OCI, a defined tag's namespace and key must already exist in the tenancy before you can apply that tag to an instance; if the namespace/key is not pre-created, the tag cannot be attached and the dynamic group rule cannot match it. Option E is correct because a dynamic group matching rule must use valid syntax that references the tag's namespace, key, and value (e.g., tag...value = '') for the rule to evaluate to true and include the instance. Option A is wrong because API signing keys are for API authentication, not for dynamic group tag matching. Option C is wrong because dynamic groups are not assigned static user passwords; they match principals via rules. Option D is wrong because dynamic group membership is evaluated continuously based on rule matching, not by requiring periodic reboots.

Answer

The compute instance must have an API signing key uploaded to its metadata.

Answer

The dynamic group must be assigned a static user password.

Answer

The compute instance must be rebooted every 24 hours to maintain dynamic group membership.

Question 15

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Accepted Answer

Policies specify the subject (group or dynamic-group).. Option A is correct because every OCI IAM policy statement must name a subject, which is a group (for user principals) or a dynamic-group (for instance principals), in the form 'Allow group to ...' or 'Allow dynamic-group to ...'. Option B is correct because OCI IAM policy statements begin with the keyword 'Allow' — OCI policies are allow-only, so 'Allow' is the required leading verb of each statement. Option D is correct because the policy verb must be one of the four cumulative access levels: inspect, read, use, or manage, which determine the type of access granted on the specified resource. Option C is not correct because OCI policies are written in a human-readable, JSON-like declarative syntax, not XML. Option E is not correct because OCI IAM policies do not support explicit 'Deny' statements; access is granted only through 'Allow' statements, and absence of an allow results in denial.

Answer

Policies must be written in XML format.

Answer

Policies can include explicit 'Deny' statements to override allowances.