1Z0-1072-26 Identity And Access Management Practice Test 3 — 15 Questions

Question 1

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Instance principals and dynamic groups authenticate the instance itself as a principal, whereas API calls signed with user credentials evaluate permissions against the user, not the dynamic group.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.

Question 2

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Accepted Answer

database-family. Database resources in OCI are grouped under the 'database-family' resource type for IAM policies.

Answer

db-resources

Answer

sql-databases

Answer

databases

Question 3

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

Accepted Answer

OCI policies are additive; if any applicable policy grants access, the user is authorized.. OCI IAM evaluates policies based on an additive model (most permissive wins) across the hierarchy, but specific scoping and explicit denials do not exist (there is no explicit deny statement in OCI IAM).

Answer

Explicit deny statements always take precedence over allow statements.

Answer

Compartment-level policies take strict precedence, overriding and nullifying tenancy root policies.

Answer

The most recently created policy overrides all older conflicting policies.

Question 4

Which of the following describes an OCI user group?

Accepted Answer

A collection of users who can be assigned IAM policies to govern access to OCI resources.. An OCI group is a collection of users who share the same access requirements and policies.

Answer

A network security group used to filter traffic between subnets.

Answer

A collection of compute instances grouped for auto-scaling.

Answer

A collection of compartments sharing a common budget.

Question 5

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

Accepted Answer

Allow group Developers to manage load-balancers in compartment AppCompartment. Load balancers belong to the 'load-balancers' resource type in OCI IAM policies.

Answer

Allow user Developers to create load-balancers in compartment AppCompartment

Answer

Allow group Developers to manage lb-family in tenancy

Answer

Allow group Developers to use network-load-balancers in compartment AppCompartment

Question 6

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

Accepted Answer

5,000 compartments (default soft/hard limit). OCI imposes service limits on compartments per tenancy, which defaults to several thousand (typically 5,000 compartments per tenancy, adjustable via service limit request).

Answer

10 compartments

Answer

Unlimited with no restrictions

Answer

100 compartments

Question 7

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

Accepted Answer

An API signing key pair (PEM format) and its corresponding fingerprint.. Programmatic access requires API signing key pairs (public/private key) along with the user's tenancy OCID, user OCID, and region.

Answer

A SSH key pair generated specifically for IAM authentication.

Answer

A password and an MFA token code.

Answer

A pre-authenticated request URL.

Question 8

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Accepted Answer

Allow group AppSupport to read monitoring-family in tenancy. Monitoring service resources include metrics and alarms, governed by the 'monitoring-family' resource type.

Answer

Allow group AppSupport to use metrics in tenancy

Answer

Allow group AppSupport to inspect telemetry in tenancy

Answer

Allow group AppSupport to manage alarms in compartment root

Question 9

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

Accepted Answer

ALL {instance.compartment.id = 'ocid1.compartment..oc1..aaaa...'}. Dynamic groups match compute instances in a compartment using the parameter 'instance.compartment.id'.

Answer

DYNAMIC {compartment.id IN ('ocid1.compartment..oc1..aaaa...')}

Answer

ANY {resource.compartment = 'ocid1.compartment..oc1..aaaa...'}

Answer

MATCH {compartment.ocid == 'ocid1.compartment..oc1..aaaa...'}

Question 10

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Accepted Answer

Nothing further; endorsement and commitment IAM policies are sufficient for cross-tenancy dynamic group authorization.. For cross-tenancy dynamic group access, the target tenancy must also trust the source tenancy as an identity provider or use resource principal federation mechanisms supported by OCI cross-tenancy architecture.

Answer

You must create a local dynamic group in Tenancy A with the exact same matching rules as Tenancy B.

Answer

You must configure an API signing key for the dynamic group in Tenancy B.

Answer

You must establish a Remote VCN Peering connection between the two tenancies.

Question 11

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

Accepted Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy where target.tag.Project.Name = 'Analytics'. OCI IAM policy conditions are appended using the 'where' keyword followed by variable evaluations like target.tag or request.tag.

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy CONDITION tag.Project.Name = 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy IF target.tag.Project.Name == 'Analytics'

Answer

Allow dynamic-group BatchProcessors to manage objects in tenancy WITH tag Project.Name = 'Analytics'

Question 12

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Accepted Answer

Allow group SecurityOps to read audit-events in tenancy. Audit logs are accessed via the 'audit-events' resource type in OCI IAM policies.

Answer

Allow group SecurityOps to manage log-files in tenancy

Answer

Allow group SecurityOps to use audit in tenancy

Answer

Allow group SecurityOps to inspect audit-trails in compartment root

Question 13

What is the primary function of OCI Identity Domains?

Accepted Answer

To provide comprehensive identity and access management capabilities such as user lifecycle management, MFA, and OAuth/SAML integration.. Identity Domains provide advanced identity governance, user management, and authentication features in OCI, extending traditional IAM capabilities.

Answer

To manage DNS zones and DNS resolution records.

Answer

To manage physical server racks in Oracle Cloud regions.

Answer

To isolate database traffic across virtual cloud networks.

Question 14

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Accepted Answer

Allow group DataReaders to read object-family in compartment DataLake. Object Storage buckets and objects are managed using the 'object-family' resource type in OCI IAM policies.

Answer

Allow group DataReaders to use buckets in compartment DataLake

Answer

Allow group DataReaders to inspect storage in tenancy

Answer

Allow group DataReaders to manage files in compartment DataLake

Question 15

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Accepted Answer

The group mapping rule in the OCI Identity Provider configuration does not match the incoming group claim in the SAML assertion.. Federated group mappings link external IdP group names to OCI IAM group names. If the group name in the SAML assertion does not match the mapped rule in OCI, the user cannot be authorized.

Answer

The user's password in OCI IAM has expired and must be reset.

Answer

The API signing key of the IdP metadata XML file needs to be rotated daily.

Answer

OCI requires manual creation of local user profiles for every federated login attempt.