1Z0-1072-26 Identity And Access Management Practice Test 4 — 15 Questions

Question 1

What is the primary function of an OCI dynamic group?

Accepted Answer

To allow OCI resources, such as compute instances, to be authenticated and authorized as principals in IAM policies.. Dynamic groups allow cloud resources (such as compute instances) to be treated as principal actors, enabling them to make API calls to other OCI services without hardcoding credentials.

Answer

To automatically scale compute instances based on CPU utilization metrics.

Answer

To automatically create compartments when new projects are initiated.

Answer

To group human users together based on their department or job function.

Question 2

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Accepted Answer

Define an IAM policy in Tenancy A endorsing the group from Tenancy B, and a policy in Tenancy B committing to the access.. Cross-tenancy access in OCI requires a two-sided policy arrangement: Tenancy A defines a policy that endorses (names) the group from Tenancy B, and Tenancy B defines a policy that commits its group to the access. Both policies must exist for the cross-tenancy authorization to take effect.

Answer

Create local user accounts in Tenancy A for every user in Tenancy B's group.

Answer

Establish a Remote VCN Peering connection between Tenancy A and Tenancy B.

Answer

Share the Object Storage bucket directly using pre-authenticated requests.

Question 3

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

Accepted Answer

Configure an Identity Provider (IdP) in OCI IAM by importing the SAML 2.0 metadata from the external IdP.. Before OCI can trust an external IdP such as Microsoft Entra ID, you must create an Identity Provider resource in OCI IAM and import the SAML 2.0 metadata XML from the external IdP. This establishes the federation trust by registering the IdP's entity ID, SSO URL, and signing certificate. Only after this IdP resource exists can you configure group mapping rules and grant federated users access via policies.

Answer

Provision local user accounts in OCI IAM for every partner employee.

Answer

Write a tenancy-wide policy allowing all external users to manage tenancy resources.

Answer

Create an API signing key pair for each partner user in OCI IAM.

Question 4

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

Accepted Answer

OCI IAM policies do not support time-of-day or day-of-week conditions; this must be managed via external IdP federation policies or session token lifetimes.. OCI IAM policies do not support time-of-day or day-of-week conditions in policy statements. There is no 'request.time.hour' condition or schedule builder in IAM policy grammar. Time-based access restrictions must be enforced outside IAM — for example, through external IdP federation policies, session token lifetimes, or application-level controls.

Answer

Write a policy with the condition: where request.time.hour between '09:00' and '17:00'

Answer

Configure an IAM security policy rule using the schedule builder in the OCI Console.

Answer

Use the 'time-window' parameter in the dynamic group matching rule.

Question 5

Which OCI service is responsible for managing users, groups, compartments, and policies?

Accepted Answer

Identity and Access Management (IAM). Identity and Access Management (IAM) is the foundational OCI service responsible for authentication and authorization.

Answer

OCI Audit

Answer

Resource Manager

Answer

Security Advisor

Question 6

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

Accepted Answer

Configure a security rule (or sign-on policy) within Identity Domains to require MFA for specific groups upon authentication.. In OCI Identity Domains, MFA enforcement is configured through sign-on policies (also called authentication policies) that specify which groups must complete a second factor at sign-in. You create a sign-on policy, add a rule that requires MFA, and assign it to the target groups, so only those users are challenged. This is the supported, centralized way to enforce MFA for specific users or groups.

Answer

Enable MFA in the tenancy root compartment settings under Compartment Quotas.

Answer

Write an IAM policy with the condition where request.mfa = 'true'

Answer

Add a tag to the user account indicating that MFA is required.

Question 7

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Accepted Answer

Tenancy root (or the root compartment). When an OCI tenancy is created, Oracle automatically creates a top-level compartment known as the tenancy root or root compartment. It shares the tenancy's name and serves as the default container for all resources until administrators create additional compartments.

Answer

MasterCompartment

Answer

RootComp

Answer

Default-Tenant

Question 8

What happens to the resources inside a compartment when you delete the compartment itself?

Accepted Answer

The compartment cannot be deleted until all resources within it are deleted or moved to another compartment.. OCI prevents deletion of a compartment that still contains resources. You must first delete or move every resource out of the compartment before the compartment itself can be deleted, which protects against accidental mass deletion.

Answer

All resources inside the compartment are automatically deleted along with it.

Answer

Resources become orphaned and are managed by the tenancy administrator group.

Answer

Resources are automatically moved to the root compartment.

Question 9

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Accepted Answer

No IAM policies have been created granting permissions to the mapped OCI IAM groups.. Successful SSO login with a subsequent authorization error means authentication worked but authorization did not. In OCI, federated users inherit permissions only through IAM policies attached to the OCI IAM groups they are mapped to; if no policies grant those groups access to the resources, users authenticate but see 'Not Authorized'. Creating the appropriate policies resolves the issue.

Answer

The SAML assertion signature certificate has expired in the external IdP.

Answer

Federated users cannot access OCI without first creating local user accounts.

Answer

The user's browser blocked the OCI redirection cookies.

Question 10

What is the primary purpose of OCI compartments?

Accepted Answer

To organize and isolate cloud resources for security, access control, and billing management.. Compartments are logical containers used to organize and isolate OCI resources. They enable fine-grained access control via IAM policies, simplify billing by allowing cost tracking per compartment, and provide a security boundary for resources. This matches option D exactly.

Answer

To replace Virtual Cloud Networks for internal subnetting.

Answer

To isolate physical data center hardware for specific customers.

Answer

To automatically replicate data across multiple OCI regions for disaster recovery.

Question 11

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

Accepted Answer

Allow group TeamLeads to manage compartments in tenancy. The policy verb 'manage' on the 'compartments' resource in the tenancy grants full lifecycle control over compartments (create, update, delete, move) without conferring broader tenancy-admin rights. This is the least-privilege way to delegate compartment creation to TeamLeads. It does not grant identity administration or tenancy-level control.

Answer

Allow group TeamLeads to create sub-tenancies in tenancy

Answer

Allow group TeamLeads to use tenancy-root in tenancy

Answer

Allow group TeamLeads to administer identity in tenancy

Question 12

What is the function of the OCI IAM 'inspect' verb?

Accepted Answer

It allows users to list resources of a given type without viewing their contents or configuration details.. The OCI IAM 'inspect' verb grants permission to list resources of a given type — for example, seeing that a compute instance exists — but it does not permit viewing the resource's contents, configuration, or metadata. It is the lowest-privilege verb in the OCI verb hierarchy, sitting below 'read'. This makes it ideal for scenarios where a user needs inventory visibility without access to sensitive configuration details.

Answer

It allows users to inspect security vulnerabilities on compute instances.

Answer

It allows users to create, update, and delete resources.

Answer

It allows users to download object storage bucket files.

Question 13

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Accepted Answer

Dynamic group policies apply to instance principal or resource principal authentication, not API calls made using individual user credentials.. Dynamic group policies in OCI are evaluated only when the request is authenticated using instance principals (or resource principals), which derive identity from the instance's metadata and certificates. When the developer script uses a user's API key or auth token, the request is authorized against that user's IAM policies, not the dynamic group's. Since the user has no matching policy granting object read/write, the request returns 403 Forbidden. The dynamic group membership is irrelevant to user-credential API calls.

Answer

The compute instance must have port 443 blocked in its security list for instance principals to function.

Answer

Object Storage buckets do not support dynamic group access control.

Answer

User credentials override dynamic group policies entirely.

Question 14

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Accepted Answer

database-family. In OCI IAM policy syntax, 'database-family' is the aggregate resource type that encompasses all database-related resources, including Autonomous Databases, DB systems, and related database services. Granting read access to 'database-family' in the tenancy scope provides read-only visibility across all databases in the tenancy. This is the correct resource type to use when a policy must cover the entire database service family rather than a single database resource.

Answer

db-resources

Answer

sql-databases

Answer

databases

Question 15

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?

Accepted Answer

OCI policies are additive; if any applicable policy grants access, the user is authorized.. OCI IAM policies are additive by design: there is no concept of an explicit 'deny' rule in the policy language. When multiple policies apply to a request, OCI evaluates all of them and grants access if at least one applicable statement allows the action on the resource. This means overlapping policies at the tenancy root and compartment levels simply accumulate permissions rather than conflict in a precedence hierarchy.

Answer

Explicit deny statements always take precedence over allow statements.

Answer

Compartment-level policies take strict precedence, overriding and nullifying tenancy root policies.

Answer

The most recently created policy overrides all older conflicting policies.