1Z0-1072-26 Identity And Access Management Practice Test 5 — 15 Questions

Question 1

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

Accepted Answer

The resource (target) tenancy must define a policy allowing the external group using the tenancy name.. Cross-tenancy access requires an endorsement policy in the principal tenancy and a commitment policy in the resource tenancy.

Answer

The resource tenancy must define an endorsement policy allowing the external group to access its resources.

Answer

Cross-tenancy access requires every external user to have a local shadow user account.

Answer

Cross-tenancy policies are configured exclusively in the OCI DNS service.

Question 2

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Accepted Answer

A logical wrapper operator (ALL or ANY). Dynamic group rules must start with a logical operator (ALL or ANY) followed by matching criteria enclosed in curly braces.

Answer

A user password hash

Answer

An API signing key fingerprint

Answer

A VCN security list ID

Question 3

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Accepted Answer

A user can belong to multiple groups.. Groups contain users, can be mapped from federated IdPs, and are used in IAM policies.

Answer

Groups can be nested inside other groups to form a hierarchy.

Answer

Groups can own compartments directly without human members.

Question 4

Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)

Accepted Answer

Compute instances. The 'instance-family' resource type encompasses compute instances, boot volumes, and associated volume attachments.

Answer

Virtual Cloud Networks

Answer

Autonomous Databases

Question 5

Which TWO methods can be used to authenticate human users to the OCI Console? (Choose two.)

Accepted Answer

Username and password with optional Multi-Factor Authentication (MFA). Console login requires username/password and supports optional or mandatory MFA, as well as federation via external IdPs.

Answer

SSH private keys (.ppk)

Answer

Pre-authenticated request URLs

Answer

API signing key PEM files uploaded via web browser

Question 6

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Accepted Answer

Scope policies to specific compartments rather than the tenancy root whenever feasible.. IAM best practices include adhering to the principle of least privilege and scoping policies to compartments rather than tenancies when possible.

Answer

Hardcode API signing keys directly into public source code repositories.

Answer

Always assign the 'manage all-resources' role to every user to simplify troubleshooting.

Answer

Use tenancy-wide administrative policies for all standard developers.

Question 7

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

Accepted Answer

object-family. OCI IAM policies govern access to virtually all OCI resources, including compute and object storage.

Answer

employee-badge-readers

Answer

corporate-laptop-hardware

Answer

office-wifi-routers

Question 8

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

Accepted Answer

Compartment OCID (instance.compartment.id). Dynamic group rules support matching by compartment ID, instance ID, and defined/freeform tags.

Answer

The operating system user password hash

Answer

The public IP address of the user launching the instance

Question 9

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

Accepted Answer

Compartments. OCI resources are primarily organized using compartments and tags.

Answer

Windows Registry hives

Answer

Active Directory organizational units synced directly to resource folders

Answer

Physical server chassis slots

Question 10

Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)

Accepted Answer

Policies that reference the moved compartment by path may need to be updated.. Moving a compartment requires policies in both source and destination compartments/tenancy, and all child compartments/resources move along with it.

Answer

All compute instances in the compartment are automatically terminated and restarted.

Answer

Virtual Cloud Networks must be deleted before moving the compartment.

Question 11

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

Accepted Answer

Users authenticate against the external Identity Provider, not OCI IAM.. Federation supports external IdPs, maps external groups to OCI groups, and does not require local OCI passwords for users.

Answer

Federated users cannot access OCI via the CLI or SDKs.

Answer

Federation requires manual creation of local user profiles for every employee on day one.

Question 12

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

Accepted Answer

The defined tag namespace and key must be created prior to launching the tagged instance.. Tag-based dynamic group rules require the tag namespace and key to exist, and the compute instance must be tagged with that exact defined tag.

Answer

The compute instance must have an API signing key uploaded to its metadata.

Answer

The dynamic group must be assigned a static user password.

Answer

The compute instance must be rebooted every 24 hours to maintain dynamic group membership.

Question 13

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Accepted Answer

The tenancy root compartment. Every new tenancy starts with the root compartment and default IAM administration constructs.

Answer

A fully configured Autonomous Data Warehouse

Answer

A 10TB Object Storage archive bucket

Answer

A pre-configured Kubernetes production cluster

Question 14

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Accepted Answer

Policies specify the subject (group or dynamic-group).. OCI IAM policy syntax follows a structured grammar: Allow to

in where .

Answer

Policies must be written in XML format.

Answer

Policies can include explicit 'Deny' statements to override allowances.

Question 15

Which TWO types of groups exist in OCI IAM? (Choose two.)

Accepted Answer

Dynamic groups. OCI IAM features standard user groups and dynamic groups for resources.

Answer

Compartment security groups

Answer

Virtual network groups

Answer

Billing resource groups