1Z0-1085-26 Governance And Administration — 30 Questions

Question 1

You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the condition 'where request.region = '. OCI IAM policy conditions support the variable request.region, which evaluates the region from which the request is made, so 'where request.region = ' restricts the policy to requests originating in the tenancy's home region. This is the documented way to scope a policy to the home region. The other options use non-existent variables or incorrect syntax.

Answer

IAM policies cannot be restricted by region; they always apply globally.

Answer

Use the condition 'where target.region.home = true'

Answer

Use the condition 'where principal.region = home'

Question 2

A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?

Accepted Answer

Allow group UserAdmins to manage identity-domains in tenancy. To manage identity resources like users and groups without granting infrastructure access, the domain resource type is 'tenancy' with the verb 'inspect' or 'manage' scoped to identity services.

Answer

Allow user UserAdmins to inspect compartments in tenancy

Answer

Allow group UserAdmins to manage all-resources in tenancy

Answer

Allow group UserAdmins to manage users in tenancy

Question 3

Your organization has a strict requirement that no IAM policy can be written without a specified description and that all policies must be reviewed. When creating an IAM policy in OCI, is providing a description mandatory?

Accepted Answer

Yes, providing a description is mandatory when creating an IAM policy.. In OCI IAM, a description is a mandatory field when creating a policy to help administrators document the business justification.

Answer

Descriptions are only mandatory when using the CLI, but optional in the Console.

Answer

Only if the policy is created at the tenancy root level.

Answer

No, the description is entirely optional and can be left blank.

Question 4

Which OCI feature allows you to group multiple independent policies together or organize permissions logically, although IAM policies themselves are written as statements within compartments or the tenancy?

Accepted Answer

Tags. While OCI IAM doesn't have a separate 'policy folder' construct, policies are organized by where they are attached (compartment/tenancy). Free-form and defined tags can also be applied to policies for organization.

Answer

Identity Domains

Answer

Service Gateways

Answer

Dynamic Groups

Question 5

You are setting up OCI Budgets for multiple departments. You want a budget to evaluate spending based on the actual costs incurred plus estimated charges for resources that have been running during the month. Which budget calculation rule should you select?

Accepted Answer

Forecasted spend. OCI Budgets support both 'ACTUAL' and 'FORECASTED' spend tracking types. To include both incurred spend and projected end-of-month spend, you use forecasted spend alerts.

Answer

Actual spend only

Answer

Static historical spend

Answer

Compartment quota calculation

Question 6

You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?

Accepted Answer

Near-real-time (typically within a few minutes). OCI dynamic group membership is evaluated continuously by the IAM service based on the matching rules, and changes such as moving an instance to a different compartment are reflected in near-real-time, typically within a few minutes. The instance's compartment ID changes, so the rule `instance.compartment.id = 'ocid1.compartment...'` no longer matches, and the instance is removed from the group. This propagation is automatic and does not require instance restart.

Answer

Only when the instance is stopped and restarted.

Answer

Dynamic group membership is static and never updates after initial creation.

Answer

Exactly every 24 hours during the daily IAM sync cycle.

Question 7

You are writing an IAM policy for a group that needs to manage block storage volumes, but you want to ensure they can only perform these actions from a specific corporate IP address range (`192.168.1.0/24`). How should you write the policy condition?

Accepted Answer

where request.ip = cidr('192.168.1.0/24'). OCI IAM policy conditions support request.ip using the cidr function to restrict access to specific source IP ranges.

Answer

where request.ip = 192.168.1.0/24

Answer

where request.ip = target.ip

Answer

where request.ip = '192.168.1.0/24'

Question 8

An administrator wants to use Tagged-Based Access Control (TBAC) in OCI IAM policies. Which condition syntax is used in an IAM policy to check if a resource has a specific defined tag value during a request?

Accepted Answer

where target.tag.Department.CostCenter = '1004'. TBAC in OCI uses target.tag...value in IAM policy conditions to verify resource tags.

Answer

where tag.Department.CostCenter = '1004'

Answer

where resource.metadata.tag = '1004'

Answer

where request.tag.value = '1004'

Question 9

An enterprise is auditing their OCI IAM setup and discovers that a policy statement was written with a syntax error. Which OCI mechanism validates IAM policy syntax before it is saved or applied?

Accepted Answer

The built-in OCI IAM policy validator and syntax checker in the Console/API.. The OCI IAM policy editor in the console and API provides real-time syntax checking and validation as you type policy statements.

Answer

OCI Resource Manager Terraform syntax checker.

Answer

OCI Audit log analysis.

Answer

OCI Cloud Guard policy rules.

Question 10

Which TWO of the following statements are true regarding OCI Compartments? (Choose two.)

Accepted Answer

Resources can be moved from one compartment to another in most cases.. Option A is correct because in OCI most resources (such as compute instances, block volumes, VNICs, and subnets) can be moved between compartments after creation, either via the Console or CLI (e.g., oci compute instance action --action MOVE), allowing reorganization of resources without recreating them. Option E is correct because compartments are logical, global constructs in OCI's Identity and Access Management (IAM) model: a compartment exists across all regions of a tenancy, and resources created in different regions can all reside in the same compartment. Option B is incorrect because compartments are not tied to any Availability Domain; ADs are physical datacenter groupings within a region, while compartments are purely logical IAM containers. Option C is incorrect because a compartment's parent can be changed after creation by moving the compartment itself to a different parent compartment (or to the tenancy root), so the parent is not immutable. Option D is incorrect because OCI does allow deletion of a compartment that still contains resources; the resources are not required to be deleted or moved first, though the compartment must be empty of certain child compartments and the deletion cascades or the operation may be blocked only in specific cases—the blanket statement as written is false.

Answer

Compartments are strictly bound to a single Availability Domain.

Answer

Once a compartment is created, its parent cannot be changed.

Answer

You cannot delete a compartment until all resources inside it have been deleted or moved.

Question 11

Which THREE of the following are valid OCI IAM policy verbs, listed in order from least permissive to most permissive? (Choose three.)

Accepted Answer

use. The OCI IAM verb hierarchy from least to most permissive is: inspect -> read -> use -> manage.

Answer

modify

Answer

administer

Question 12

A security administrator needs to grant a group of auditors read-only visibility into all resources across every compartment in the tenancy, but must not allow them to change anything. The tenancy uses a single root compartment with several nested child compartments. Which IAM policy statement accomplishes this with the least administrative overhead?

Accepted Answer

Allow group Auditors to read all-resources in tenancy. Granting read access with the 'all-resources' keyword scoped to the entire tenancy gives the auditors visibility into every current and future compartment without writing per-compartment statements. The read verb supplies view-only access, satisfying the no-modification constraint, and the tenancy scope minimizes ongoing administrative effort as the environment grows.

Answer

Allow group Auditors to manage all-resources in compartment root

Answer

Allow group Auditors to read all-resources in compartment root

Answer

Allow group Auditors to inspect all-resources in tenancy

Question 13

A security team must ensure that a specific IAM group can only launch compute instances in the 'Production' compartment and nowhere else in the tenancy. The group currently has no policies attached. Which policy statement should the administrator create to meet this requirement?

Accepted Answer

Allow group ComputeAdmins to manage instances in compartment Production. To restrict a group's compute actions to a single compartment, the policy statement must name the instances resource type and use a verb like manage scoped to that compartment. Compartment-scoped statements limit both the resources and the actions available, so the group can create and control instances in Production without gaining any rights elsewhere in the tenancy.

Answer

Allow group ComputeAdmins to use virtual-network-family in compartment Production

Answer

Allow group ComputeAdmins to read instances in compartment Production

Answer

Allow group ComputeAdmins to manage instances in tenancy

Question 14

A cloud administrator must give a new contractor temporary access to a specific compartment for exactly 30 days, after which the access must expire automatically without manual intervention. Which OCI capability should the administrator use?

Accepted Answer

Use OCI Identity Domains to create a user with an account expiration date. Identity Domains user accounts can carry an expiration date, which causes authentication to fail once the date is reached. This delivers the automatic, hands-off revocation the scenario demands while still allowing normal IAM policy-based authorization during the active window. Manually maintained group membership or policy conditions cannot enforce calendar-based expiry reliably.

Answer

Assign the contractor a pre-authenticated request (PAR) scoped to the compartment

Answer

Create an IAM policy with a condition that references the current date

Answer

Add the contractor to a group and set an expiry date on the group membership

Question 15

An administrator needs to give a group of auditors read-only visibility into all resources across every compartment in the tenancy, but must prevent them from changing anything. Which TWO actions satisfy this requirement? (Choose two.)

Accepted Answer

Create a policy with the statement Allow group Auditors to inspect all-resources in tenancy. Read and inspect are the two OCI verbs that provide visibility without modification. Scoping them to all-resources in tenancy covers every current and future compartment automatically, which is exactly what an auditor needs. Manage and use both allow state changes, and adding auditors to the Administrators group would grant far more than visibility.

Answer

Add the auditors to the Administrators group so they inherit its existing policies

Answer

Create a policy with the statement Allow group Auditors to use all-resources in tenancy

Answer

Create a policy with the statement Allow group Auditors to manage all-resources in tenancy

Question 16

An administrator needs a policy that grants a group the ability to manage all resources in a specific compartment named ProjectA, but must explicitly prevent them from deleting any compute instances in that same compartment. The group should retain the ability to launch and stop instances. Which approach correctly enforces this requirement?

Accepted Answer

Grant granular allow statements for the needed verbs, such as manage instances where the request excludes the DELETE action, by authorizing only the specific instance operations required. Because OCI IAM policies are additive and support only allow statements, the only reliable way to prevent deletion is to avoid granting the delete verb. Composing granular allow statements that cover launch, stop, and read operations on instances, without authorizing termination, delivers the required management capability while withholding deletion.

Answer

Write a broad 'manage all-resources in compartment ProjectA' policy and no deny statement, relying on instance termination protection at the instance level

Answer

Write 'Allow group ProjectAdmins to manage all-resources in compartment ProjectA' plus a statement denying use of the instance terminate verb in that compartment

Answer

Attach a tag-based access control policy that denies deletion to any instance tagged with ProjectA

Question 17

A company wants to create a compartment structure that isolates each of its three business units while still allowing a central platform team to manage shared networking resources. Which approach best satisfies both isolation and centralized management?

Accepted Answer

Create three sibling compartments under the root compartment and grant the platform team manage permissions on networking resources in each. Sibling compartments under the root preserve hard isolation between business units, and scoping the platform team's policy to networking resource types in each compartment gives it exactly the shared-management capability it needs. This design keeps policy statements narrow, supports per-unit quotas and cost tracking, and avoids tenancy-wide grants that would break isolation.

Answer

Create three compartments and grant each business unit manage all-resources in tenancy so they can self-manage

Answer

Create three compartments nested under a single business-unit compartment and give the platform team manage all-resources at the tenancy level

Answer

Create one compartment for all business units and rely on tagging to separate their resources

Question 18

Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?

Accepted Answer

Cost-tracking tags. Tags in OCI allow you to attach metadata to resources, which can then be used in Cost Analysis for tracking and allocating spend.

Answer

IAM policies

Answer

Budgets

Answer

Compartment quotas

Question 19

An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?

Accepted Answer

OCI Audit. OCI Audit automatically records all API calls made against OCI resources, including who made the call, when, from where, and what the request/response was. To find who deleted a VCN, the auditor queries Audit for the DeleteVcn API event, which retains this history for the configured retention period. This is the only OCI service that provides the exact API event history needed for forensic verification.

Answer

OCI Notifications

Answer

OCI Events

Answer

OCI Monitoring

Question 20

Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?

Accepted Answer

OCI Budgets. OCI Budgets allow you orange spending limits and trigger alerts at specified percentage thresholds via email or notifications.

Answer

OCI Tag Defaults

Answer

OCI Cloud Guard

Answer

OCI Cost Analysis