1Z0-1072-26 Identity And Access Management Practice Test 2 — 15 Questions

Question 1

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic group matching rules can take a few minutes to evaluate and populate newly created resources.. Dynamic group matching rule evaluation is not always instantaneous, but more importantly, compute instances must be explicitly configured with resource principal or instance principal features depending on the SDK version, and matching rules take a short time to evaluate newly created resources.

Answer

Compute instances must be manually added to dynamic groups via the IAM console.

Answer

The compute instances must be restarted for IAM policies to take effect.

Answer

Dynamic groups only support tagging rules, not compartment OCID rules.

Question 2

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Accepted Answer

Allow group Developers to use instances in tenancy where request.subnet.id = 'ocid1.subnet...'. OCI IAM policies support conditions based on the source subnet OCID using the 'request.subnet.id' variable.

Answer

Configure a security list rule allowing instance deletion from the specified subnet.

Answer

Allow group Developers to delete instances in subnet 'ocid1.subnet...'

Answer

Allow group Developers to manage instances in tenancy where client.subnet.id = 'ocid1.subnet...'

Question 3

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

Accepted Answer

Define group Partners in Tenancy B: endorse group Partners to read objects in tenancy TenancyA. A commitment policy in the source tenancy uses the 'endorse' verb along with the target tenancy OCID.

Answer

Define group Partners in Tenancy B: accept group Partners to read objects in tenancy TenancyA

Answer

Define group Partners in Tenancy B: permit group Partners to read objects in compartment Root

Answer

Define group Partners in Tenancy B: allow group Partners to access tenancy TenancyA

Question 4

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

Accepted Answer

Configure a security rule (or sign-on policy) within Identity Domains to require MFA for specific groups upon authentication.. OCI IAM supports native identity domains and security rules (formerly sign-on policies) where MFA can be enforced based on user groups and risk levels.

Answer

Enable MFA in the tenancy root compartment settings under Compartment Quotas.

Answer

Write an IAM policy with the condition where request.mfa = 'true'

Answer

Add a tag to the user account indicating that MFA is required.

Question 5

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Accepted Answer

Tenancy root (or the root compartment). The root compartment, which is created automatically with every tenancy, is named the tenancy root (or referred to by the tenancy name itself).

Answer

MasterCompartment

Answer

RootComp

Answer

Default-Tenant

Question 6

What happens to the resources inside a compartment when you delete the compartment itself?

Accepted Answer

The compartment cannot be deleted until all resources within it are deleted or moved to another compartment.. Before a compartment can be deleted in OCI, it must be completely empty of all resources and child compartments.

Answer

All resources inside the compartment are automatically deleted along with it.

Answer

Resources become orphaned and are managed by the tenancy administrator group.

Answer

Resources are automatically moved to the root compartment.

Question 7

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

Accepted Answer

Compartments nested deeper than one level from the tenancy root must be referenced using their hierarchical path (e.g., ParentComp:ChildComp).. Policy statements require the full path or correct scoping when referencing compartments. If a policy is written in the root compartment referencing a child compartment, the syntax 'compartment ChildComp' is correct only if ChildComp is a direct child; however, if syntax errors or missing family definitions exist, it fails. Wait, let's examine standard syntax: 'Allow group to

in compartment '. If ChildComp is nested deeper, the path must be specified, e.g., 'compartment ParentComp:ChildComp'.

Answer

Policies can never reference child compartments; they must always apply to the entire tenancy.

Answer

The verb 'manage' cannot be used with instances; it must be 'use'.

Answer

The group name must be prefixed with the tenancy name.

Question 8

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Accepted Answer

Allow group NetworkAdmins to manage subnets, route-tables, and vcns in tenancy. OCI defines fine-grained resource types within families, such as virtual-networks, subnets, and route-tables, allowing precise policy scoping.

Answer

Allow group NetworkAdmins to manage all-resources in tenancy where target.type != 'gateway'

Answer

Allow group NetworkAdmins to use networking in tenancy

Answer

Allow group NetworkAdmins to manage virtual-network-family in tenancy

Question 9

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Accepted Answer

No IAM policies have been created granting permissions to the mapped OCI IAM groups.. Successful authentication via federation only proves who the user is; authorization requires IAM policies to be written that grant the mapped OCI IAM groups permissions to resources.

Answer

The SAML assertion signature certificate has expired in the external IdP.

Answer

Federated users cannot access OCI without first creating local user accounts.

Answer

The user's browser blocked the OCI redirection cookies.

Question 10

What is the primary purpose of OCI compartments?

Accepted Answer

To organize and isolate cloud resources for security, access control, and billing management.. Compartments are logical isolations used to organize and control access to OCI resources across projects and departments.

Answer

To replace Virtual Cloud Networks for internal subnetting.

Answer

To isolate physical data center hardware for specific customers.

Answer

To automatically replicate data across multiple OCI regions for disaster recovery.

Question 11

What is the maximum number of groups a single OCI user can be a member of?

Accepted Answer

300 groups. OCI enforces limits on group membership per user. The standard limit is 300 groups per user.

Answer

10 groups

Answer

Unlimited

Answer

50 groups

Question 12

An administrator needs to ensure that a newly created group can view billing and cost data across the tenancy, but cannot modify any resources. Which policy grants the appropriate access?

Accepted Answer

Allow group CostAnalysts to read usage-reports in tenancy. Cost governance and billing data can be viewed by users with read or inspect permissions on 'tenancy' or specific cost-tracking resource types.

Answer

Allow group CostAnalysts to inspect compartments in tenancy

Answer

Allow group CostAnalysts to manage billing in tenancy

Answer

Allow group CostAnalysts to use tenancy-budget in tenancy

Question 13

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. Compartments are managed via the 'compartments' resource type in OCI IAM policies.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 14

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Accepted Answer

ALL {tag.Department.CostCenter.value = '400'}. Dynamic group rules support defined tags using the syntax tag...value = '' or similar notation depending on the exact schema, but standard OCI grammar uses tag.namespace.tagkey.value = 'val' or tag.namespace.tagkey = 'val'. Specifically, for defined tags: tag.Department.CostCenter.value = '400'.

Answer

ANY {defined.tag.Department.CostCenter == '400'}

Answer

ALL {instance.tag.Department.CostCenter = '400'}

Answer

MATCH {tag:Department:CostCenter = '400'}

Question 15

What is the function of the OCI IAM 'inspect' verb?

Accepted Answer

It allows users to list resources of a given type without viewing their contents or configuration details.. The 'inspect' verb allows users to list resources within a compartment or tenancy without viewing their sensitive configuration details or contents.

Answer

It allows users to inspect security vulnerabilities on compute instances.

Answer

It allows users to create, update, and delete resources.

Answer

It allows users to download object storage bucket files.