You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?
A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?
Your organization has a strict requirement that no IAM policy can be written without a specified description and that all policies must be reviewed. When creating an IAM policy in OCI, is providing a description mandatory?
Which OCI feature allows you to group multiple independent policies together or organize permissions logically, although IAM policies themselves are written as statements within compartments or the tenancy?
You are setting up OCI Budgets for multiple departments. You want a budget to evaluate spending based on the actual costs incurred plus estimated charges for resources that have been running during the month. Which budget calculation rule should you select?
You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?
You are writing an IAM policy for a group that needs to manage block storage volumes, but you want to ensure they can only perform these actions from a specific corporate IP address range (`192.168.1.0/24`). How should you write the policy condition?
An administrator wants to use Tagged-Based Access Control (TBAC) in OCI IAM policies. Which condition syntax is used in an IAM policy to check if a resource has a specific defined tag value during a request?
An enterprise is auditing their OCI IAM setup and discovers that a policy statement was written with a syntax error. Which OCI mechanism validates IAM policy syntax before it is saved or applied?
A security administrator needs to grant a group of auditors read-only visibility into all resources across every compartment in the tenancy, but must not allow them to change anything. The tenancy uses a single root compartment with several nested child compartments. Which IAM policy statement accomplishes this with the least administrative overhead?
A security team must ensure that a specific IAM group can only launch compute instances in the 'Production' compartment and nowhere else in the tenancy. The group currently has no policies attached. Which policy statement should the administrator create to meet this requirement?
A cloud administrator must give a new contractor temporary access to a specific compartment for exactly 30 days, after which the access must expire automatically without manual intervention. Which OCI capability should the administrator use?
An administrator needs to give a group of auditors read-only visibility into all resources across every compartment in the tenancy, but must prevent them from changing anything. Which TWO actions satisfy this requirement? (Choose two.)
An administrator needs a policy that grants a group the ability to manage all resources in a specific compartment named ProjectA, but must explicitly prevent them from deleting any compute instances in that same compartment. The group should retain the ability to launch and stop instances. Which approach correctly enforces this requirement?
A company wants to create a compartment structure that isolates each of its three business units while still allowing a central platform team to manage shared networking resources. Which approach best satisfies both isolation and centralized management?
Your company has deployed resources across multiple compartments in Oracle Cloud Infrastructure (OCI). You need to track operational costs and allocate cloud spend back to specific business units using metadata key-value pairs attached to resources. Which OCI feature should you use?
An auditor needs to verify who deleted a critical production virtual cloud network (VCN) yesterday. Which OCI service should the auditor query to find this exact API event history?
Your organization wants to receive an email alert whenever monthly cloud spending reaches 80% of a specified $5,000 threshold. Which OCI tool should you configure?
Which OCI service provides security diagnostic and compliance evaluation tools by continuously monitoring resources against security best practices and industry benchmarks?
An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases only within a specific compartment named DevCompartment, without giving them access to any other resources in that compartment. Which IAM policy statement achieves this requirement?
You are designing an OCI compartment hierarchy. A junior administrator suggests creating a 7-level deep nested compartment structure to isolate every individual microservice environment. According to OCI best practices, what is the recommended maximum depth for a compartment hierarchy?
Your organization wants to ensure that a development team cannot provision compute instances with more than 4 OCPUs in the 'Staging' compartment, regardless of what their IAM policies allow. Which OCI governance feature should you implement?
You created a Defined Tag namespace called 'Department' and a key called 'CostCenter'. However, developers are forgetting to add these tags when creating compute instances. How can you ensure that every new compute instance created in a specific compartment automatically receives these tags without relying on manual user input?
Which OCI construct serves as the root container for all your cloud resources and acts as the logical boundary for managing users, groups, and compartments?
You want to delegate the ability to create and manage sub-compartments within an existing compartment called 'AppCompartment' to a lead architect, without granting them full tenancy administration rights. How should you write this IAM policy?
Which OCI tool can you use to visualize your monthly cloud spend trends, filter costs by compartments, and examine expenses broken down by specific services?
An administrator wants to move a Virtual Cloud Network (VCN) from 'CompartmentA' to 'CompartmentB'. What is the primary prerequisite that must be met for this move to succeed?
Your organization uses federated identity with an external SAML 2.0 identity provider (IdP). A user leaves the company, and their account is disabled in the corporate IdP. What happens when that user attempts to access OCI via the federated login?
An administrator wants to ensure that all Audit log events in the tenancy are archived to an Object Storage bucket for long-term retention and compliance. How should this be configured?
You need to grant an external auditing firm read-only access to view all resources across your entire OCI tenancy without allowing them to make any changes. What is the most efficient way to achieve this?
Which OCI administrative feature allows you to organize and categorize cloud resources using user-defined key-value pairs for granular tracking and automation?
Your organization wants to ensure that all resources tagged with `Environment: Production` cannot be deleted accidentally by any user, including administrators. Which OCI feature can help achieve protection against accidental deletion?
You have a parent compartment named 'ParentComp' and a child compartment named 'ChildComp'. If you write an IAM policy at the root tenancy level granting a group access to 'ParentComp', what is the inheritance rule regarding 'ChildComp'?
You need to export billing and usage data automatically every day into an Object Storage bucket for custom financial analysis and reporting. Which OCI feature facilitates this?
An administrator creates a new dynamic group with matching rules, but instances belonging to that group are not receiving the permissions granted by the policy referencing the dynamic group. What is the most likely cause?
You want to organize your OCI resources so that all networking components belong to one administrative boundary, security tools belong to another, and application workloads belong to a third. Which OCI entity is specifically designed to isolate resources for administrative and security delegation?
A security administrator needs to ensure that users configure Multi-Factor Authentication (MFA) for their OCI accounts to enhance login security. Where is MFA managed in OCI?
You want to ensure that any compute instance launched by the data science team is automatically tagged with a specific project code, without requiring manual tagging by the users. Which OCI governance mechanism is best suited for this?
An enterprise has multiple child compartments under a root tenancy. A security administrator wants to ensure that a specific IAM policy written in the root tenancy cannot be overridden or weakened by child compartment policies. How does OCI handle policy evaluation across hierarchical boundaries?
A security administrator in a large tenancy must determine which principal performed a specific DeleteBucket operation on an Object Storage bucket three weeks ago. The tenancy has Audit retention set to 90 days and no external SIEM integration. Where should the administrator look to find this information?
A junior cloud engineer has just joined a tenancy and needs to sign in to the OCI Console. The identity administrator wants to grant the engineer access without creating a separate local OCI password. Which identity type should the administrator federate with OCI Identity and Access Management to achieve this?
A finance team needs a consolidated, near-real-time view of all OCI costs broken down by the compartment that incurred them, and they want to save and share this view with other team members without exporting spreadsheets. Which OCI service should they use?
An administrator is preparing to use OCI Tag Defaults so that resources created by the application team are automatically tagged with the correct cost center and environment values. Which TWO statements about how Tag Defaults behave are correct? (Choose two.)
A new employee joins the finance team and needs access to OCI resources that the finance group already has permissions for. The administrator wants the employee to inherit exactly the same access as the rest of the team. What is the correct action?
A cloud administrator is preparing to onboard a new department into an existing OCI tenancy. To follow Oracle's governance guidance, which TWO practices should the administrator apply when creating the department's compartment structure? (Choose two.)
An administrator must ensure that members of a development group can create and delete compute instances in the 'Dev' compartment but must not be able to change the security rules of the VCN that those instances use. The group already has no policies. Which combination of policy statements achieves this?