1Z0-1072-26 Identity And Access Management Practice Test 5 — 15 Questions

Question 1

Which of the following describes an OCI user group?

Accepted Answer

A collection of users who can be assigned IAM policies to govern access to OCI resources.. An OCI user group is a logical collection of IAM users that allows administrators to grant permissions to multiple users at once via IAM policies. Policies are written against groups, not individual users, which simplifies access management. Groups are the primary mechanism for assigning access to OCI resources.

Answer

A network security group used to filter traffic between subnets.

Answer

A collection of compute instances grouped for auto-scaling.

Answer

A collection of compartments sharing a common budget.

Question 2

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

Accepted Answer

An API signing key pair (PEM format) and its corresponding fingerprint.. Programmatic access to OCI for a human user requires an API signing key pair in PEM format, with the public key uploaded to the user's IAM account and the corresponding fingerprint recorded. The CLI, SDKs, and direct API calls use the private key to sign requests, and OCI validates the signature against the uploaded public key.

Answer

A SSH key pair generated specifically for IAM authentication.

Answer

A password and an MFA token code.

Answer

A pre-authenticated request URL.

Question 3

What is the primary function of OCI Identity Domains?

Accepted Answer

To provide comprehensive identity and access management capabilities such as user lifecycle management, MFA, and OAuth/SAML integration.. OCI Identity Domains provide comprehensive IAM capabilities, including user lifecycle management, MFA, OAuth, SAML federation, and SCIM provisioning. They are the next-generation IAM model in OCI, replacing the legacy IAM service while maintaining compatibility. This matches option B.

Answer

To manage DNS zones and DNS resolution records.

Answer

To manage physical server racks in Oracle Cloud regions.

Answer

To isolate database traffic across virtual cloud networks.

Question 4

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Accepted Answer

Allow group DataReaders to read object-family in compartment DataLake. The policy statement 'Allow group DataReaders to read object-family in compartment DataLake' grants read-only access to Object Storage buckets and objects within the DataLake compartment. The 'read' verb includes the ability to list and get objects, while 'object-family' covers buckets and objects. This precisely matches the requirement for read-only access to all buckets in that compartment.

Answer

Allow group DataReaders to use buckets in compartment DataLake

Answer

Allow group DataReaders to inspect storage in tenancy

Answer

Allow group DataReaders to manage files in compartment DataLake

Question 5

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Accepted Answer

The group mapping rule in the OCI Identity Provider configuration does not match the incoming group claim in the SAML assertion.. In OCI federation, the external SAML IdP asserts group membership via a group claim, and OCI maps those asserted groups to OCI IAM groups through group mapping rules configured on the Identity Provider. If the incoming group claim value does not match any configured mapping rule, OCI cannot resolve the user to an OCI group and returns the 'no matching user account or group mapping' error. The fix is to align the IdP's group claim attribute and values with the OCI IdP group mapping configuration.

Answer

The user's password in OCI IAM has expired and must be reset.

Answer

The API signing key of the IdP metadata XML file needs to be rotated daily.

Answer

OCI requires manual creation of local user profiles for every federated login attempt.

Question 6

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

Accepted Answer

Read includes all inspect permissions plus the ability to get resource metadata and configuration details.. The 'read' verb includes all permissions of 'inspect' plus the ability to get full configuration metadata and details of resources.

Answer

Read allows users to modify resources, whereas inspect only allows viewing.

Answer

Read allows downloading data from Object Storage, whereas inspect allows uploading.

Answer

Read is more restrictive than inspect.

Question 7

What is the primary purpose of an OCI API signing key?

Accepted Answer

To cryptographically sign API requests made by OCI SDKs, CLI, or REST API clients.. An OCI API signing key is an RSA key pair used to cryptographically sign API requests made by OCI SDKs, CLI, and REST clients. The public key is uploaded to the user's OCI profile, and the private key signs each request so the OCI service can verify the caller's identity via the signature.

Answer

To encrypt data at rest inside Object Storage buckets.

Answer

To establish IPsec VPN tunnels between corporate datacenters and OCI VCNs.

Answer

To authenticate users logging into the OCI web-based Console.

Question 8

What is the primary function of an OCI IAM policy statement?

Accepted Answer

To specify who can access what resources in OCI and at what level of granularity.. OCI IAM policy statements are the core authorization mechanism in OCI. Each statement follows the syntax 'Allow to

in where ', which defines who (users or groups) can perform which actions (inspect, read, use, manage) on which resources (instances, buckets, VCNs) within a compartment or tenancy. This granular control is exactly what option A describes.

Answer

To establish routing tables for internet gateways.

Answer

To configure automated backup schedules for block storage volumes.

Answer

To define firewall rules for IP traffic filtering across VCN subnets.

Question 9

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

Accepted Answer

Allow group Developers to manage file-storage-family in compartment FSCompartment. File Storage Service resources (file systems, mount targets, snapshots, replication) are all members of the 'file-storage-family' aggregate resource type in OCI IAM. Granting 'manage file-storage-family' in the target compartment gives the Developers group full lifecycle control over FSS resources there, which is exactly what the administrator needs.

Answer

Allow group Developers to read storage-systems in tenancy

Answer

Allow group Developers to manage mount-targets in compartment FSCompartment

Answer

Allow group Developers to use nfs-shares in compartment FSCompartment

Question 10

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

Accepted Answer

Allow group DevOps to manage events, notifications in compartment AppComp. The OCI Events service and Notifications service use 'events' and 'notifications' as their resource types.

Answer

Allow group DevOps to use pub-sub in compartment AppComp

Answer

Allow group DevOps to manage messaging-family in tenancy

Answer

Allow group DevOps to inspect triggers in compartment AppComp

Question 11

What is the primary function of OCI IAM federation?

Accepted Answer

To allow users authenticated by an external Identity Provider to access OCI resources using single sign-on (SSO).. Federation enables external identity providers (like Microsoft Entra ID or Okta) to authenticate users seeking access to OCI without requiring local OCI user accounts.

Answer

To replicate compute instances across multiple cloud providers.

Answer

To share VCN routing tables between different tenancies.

Answer

To synchronize Object Storage buckets across different regions.

Question 12

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Accepted Answer

manage. In OCI IAM policy statements, the verb defines the level of access granted on a resource-type, and the valid verbs are inspect, read, use, manage. Option A (manage) is correct because it is the highest-level verb, granting full control including create, read, update, and delete on the specified resources. Option E (inspect) is correct because it is the lowest-level verb, allowing a user to list resources without accessing their contents or metadata beyond basic listing. Option B (write) is not a valid OCI IAM policy verb; write-style permissions are covered by manage or use depending on the resource. Option C (delete) is not a standalone verb in OCI policies; deletion is included within manage. Option D (execute) is not a valid OCI IAM policy verb; execution of functions or instances is granted via use or manage.

Answer

write

Answer

delete

Answer

execute

Question 13

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Accepted Answer

Create nested child compartments up to 6 levels deep. Option B is correct because OCI compartments support hierarchical nesting, allowing child compartments to be created up to six levels deep beneath the tenancy root, which helps model organizational structures and isolate resources. Option D is correct because an empty compartment can be deleted; OCI requires that all resources inside it be removed or moved first, since a compartment must be empty before deletion. Option E is correct because OCI allows moving a compartment to a new parent compartment within the same tenancy, which changes its position in the hierarchy while preserving its resources and policies. Option A is not correct because private IP addresses are assigned to VNICs or resources such as compute instances, not to compartments, which are logical containers for governance and resource grouping. Option C is not correct because a compartment is an identity and access management construct and cannot be converted into a virtual cloud network (VCN); VCNs are separate networking resources created within a compartment.

Answer

Assign a private IP address directly to a compartment

Answer

Convert a compartment into a virtual cloud network

Question 14

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Accepted Answer

Source IP address of the API request (request.ip). OCI IAM policy conditions support variables that describe the request and the target resource, so option A is correct because request.ip lets a policy evaluate the source IP address of the API call, for example to restrict access to a corporate CIDR range. Option C is correct because target.tag allows conditions on the defined tags of the resource being accessed, enabling tag-based authorization such as allowing access only when target.tag.Namespace.Key equals a specific value. Option D is correct because request.subnet.id evaluates the OCID of the source subnet from which the request originates, which is useful for limiting access to workloads in a trusted VCN subnet. Option B is not correct because OCI IAM has no condition variable for a user's corporate salary bracket, and option E is not correct because local weather conditions in a data center region are not exposed as IAM policy condition variables.

Answer

The user's corporate salary bracket

Answer

The local weather conditions in the data center region

Question 15

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Accepted Answer

A logical wrapper operator (ALL or ANY). Option B is correct because every OCI dynamic group matching rule must begin with a logical wrapper operator, either ALL (all criteria must be true) or ANY (at least one criterion must be true), which governs how the enclosed conditions are evaluated. Option C is correct because the matching criteria themselves must be enclosed in curly braces {}, for example 'ALL {instance.compartment.id = "ocid1.compartment..."}', which delimits the rule body that OCI IAM parses. Option A is not part of a dynamic group rule; password hashes are irrelevant to instance principal authentication and are never used in matching rules. Option D is also unrelated, since API signing key fingerprints apply to user API-key authentication, not to compute instance principals. Option E is incorrect because a VCN security list ID is a networking construct and is not a valid attribute in a dynamic group matching rule.

Answer

A user password hash

Answer

An API signing key fingerprint

Answer

A VCN security list ID