1Z0-1085-26 Governance And Administration — Timed 10 Questions

Question 1

You need to write an IAM policy that allows a group named 'NetworkAdmins' to manage all VCN components, but you want to ensure that this policy is only applicable when evaluated from the home region of the tenancy. How can you accomplish this using policy conditions?

10 minute time limit — choose an answer to begin.

Accepted Answer

Use the condition 'where request.region = '. OCI IAM policy conditions support the variable request.region, which evaluates the region from which the request is made, so 'where request.region = ' restricts the policy to requests originating in the tenancy's home region. This is the documented way to scope a policy to the home region. The other options use non-existent variables or incorrect syntax.

Answer

IAM policies cannot be restricted by region; they always apply globally.

Answer

Use the condition 'where target.region.home = true'

Answer

Use the condition 'where principal.region = home'

Question 2

A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?

Accepted Answer

Allow group UserAdmins to manage identity-domains in tenancy. To manage identity resources like users and groups without granting infrastructure access, the domain resource type is 'tenancy' with the verb 'inspect' or 'manage' scoped to identity services.

Answer

Allow user UserAdmins to inspect compartments in tenancy

Answer

Allow group UserAdmins to manage all-resources in tenancy

Answer

Allow group UserAdmins to manage users in tenancy

Question 3

Your organization has a strict requirement that no IAM policy can be written without a specified description and that all policies must be reviewed. When creating an IAM policy in OCI, is providing a description mandatory?

Accepted Answer

Yes, providing a description is mandatory when creating an IAM policy.. In OCI IAM, a description is a mandatory field when creating a policy to help administrators document the business justification.

Answer

Descriptions are only mandatory when using the CLI, but optional in the Console.

Answer

Only if the policy is created at the tenancy root level.

Answer

No, the description is entirely optional and can be left blank.

Question 4

Which OCI feature allows you to group multiple independent policies together or organize permissions logically, although IAM policies themselves are written as statements within compartments or the tenancy?

Accepted Answer

Tags. While OCI IAM doesn't have a separate 'policy folder' construct, policies are organized by where they are attached (compartment/tenancy). Free-form and defined tags can also be applied to policies for organization.

Answer

Identity Domains

Answer

Service Gateways

Answer

Dynamic Groups

Question 5

You are setting up OCI Budgets for multiple departments. You want a budget to evaluate spending based on the actual costs incurred plus estimated charges for resources that have been running during the month. Which budget calculation rule should you select?

Accepted Answer

Forecasted spend. OCI Budgets support both 'ACTUAL' and 'FORECASTED' spend tracking types. To include both incurred spend and projected end-of-month spend, you use forecasted spend alerts.

Answer

Actual spend only

Answer

Static historical spend

Answer

Compartment quota calculation

Question 6

You have a dynamic group named 'AppInstances' configured with the matching rule `instance.compartment.id = 'ocid1.compartment...'`. An instance is moved from this compartment into a different compartment. How quickly does OCI update the dynamic group membership for this instance?

Accepted Answer

Near-real-time (typically within a few minutes). OCI dynamic group membership is evaluated continuously by the IAM service based on the matching rules, and changes such as moving an instance to a different compartment are reflected in near-real-time, typically within a few minutes. The instance's compartment ID changes, so the rule `instance.compartment.id = 'ocid1.compartment...'` no longer matches, and the instance is removed from the group. This propagation is automatic and does not require instance restart.

Answer

Only when the instance is stopped and restarted.

Answer

Dynamic group membership is static and never updates after initial creation.

Answer

Exactly every 24 hours during the daily IAM sync cycle.

Question 7

You are writing an IAM policy for a group that needs to manage block storage volumes, but you want to ensure they can only perform these actions from a specific corporate IP address range (`192.168.1.0/24`). How should you write the policy condition?

Accepted Answer

where request.ip = cidr('192.168.1.0/24'). OCI IAM policy conditions support request.ip using the cidr function to restrict access to specific source IP ranges.

Answer

where request.ip = 192.168.1.0/24

Answer

where request.ip = target.ip

Answer

where request.ip = '192.168.1.0/24'

Question 8

An administrator wants to use Tagged-Based Access Control (TBAC) in OCI IAM policies. Which condition syntax is used in an IAM policy to check if a resource has a specific defined tag value during a request?

Accepted Answer

where target.tag.Department.CostCenter = '1004'. TBAC in OCI uses target.tag...value in IAM policy conditions to verify resource tags.

Answer

where tag.Department.CostCenter = '1004'

Answer

where resource.metadata.tag = '1004'

Answer

where request.tag.value = '1004'

Question 9

An enterprise is auditing their OCI IAM setup and discovers that a policy statement was written with a syntax error. Which OCI mechanism validates IAM policy syntax before it is saved or applied?

Accepted Answer

The built-in OCI IAM policy validator and syntax checker in the Console/API.. The OCI IAM policy editor in the console and API provides real-time syntax checking and validation as you type policy statements.

Answer

OCI Resource Manager Terraform syntax checker.

Answer

OCI Audit log analysis.

Answer

OCI Cloud Guard policy rules.

Question 10

Which TWO of the following statements are true regarding OCI Compartments? (Choose two.)

Accepted Answer

Resources can be moved from one compartment to another in most cases.. Option A is correct because in OCI most resources (such as compute instances, block volumes, VNICs, and subnets) can be moved between compartments after creation, either via the Console or CLI (e.g., oci compute instance action --action MOVE), allowing reorganization of resources without recreating them. Option E is correct because compartments are logical, global constructs in OCI's Identity and Access Management (IAM) model: a compartment exists across all regions of a tenancy, and resources created in different regions can all reside in the same compartment. Option B is incorrect because compartments are not tied to any Availability Domain; ADs are physical datacenter groupings within a region, while compartments are purely logical IAM containers. Option C is incorrect because a compartment's parent can be changed after creation by moving the compartment itself to a different parent compartment (or to the tenancy root), so the parent is not immutable. Option D is incorrect because OCI does allow deletion of a compartment that still contains resources; the resources are not required to be deleted or moved first, though the compartment must be empty of certain child compartments and the deletion cascades or the operation may be blocked only in specific cases—the blanket statement as written is false.

Answer

Compartments are strictly bound to a single Availability Domain.

Answer

Once a compartment is created, its parent cannot be changed.

Answer

You cannot delete a compartment until all resources inside it have been deleted or moved.