An enterprise customer is designing a multi-tenancy Oracle Cloud Infrastructure (OCI) environment. They need to ensure that dynamic groups can properly authenticate workloads across different compartments without granting overly broad permissions. Which approach aligns with OCI IAM best practices?
Matching rules scoped to specific compartment OCIDs or instance tags restrict which workloads assume a dynamic group, and compartment-level policies then grant only the permissions needed there. This avoids the overly broad tenancy-wide grants that violate least privilege in multi-tenant designs.
Why this answer
OCI IAM best practice for multi-tenancy is to define dynamic groups whose matching rules are scoped to specific compartment OCIDs or instance tags, then attach policies at the compartment level rather than the tenancy root. This ensures workloads authenticate automatically via instance principals with least-privilege access limited to the resources they need. Using tags (e.g., defined tags like Operations.CostCenter) in matching rules further tightens scope and supports policy reuse across environments.
Exam trap
1Z0-997-26 often tests whether candidates understand that dynamic group matching rules must be scoped (by compartment OCID or tags) and that root-level policies for broad dynamic groups violate least privilege — the tempting 'simplest' answer is usually the wrong one.
How to eliminate wrong answers
Option A is wrong because a single dynamic group spanning all compute instances with a root-level policy grants overly broad permissions across the entire tenancy, violating least privilege and compartment isolation. Option B is wrong because disabling compartment security boundaries and assigning everyone to Administrators destroys the tenancy's security model and is a critical anti-pattern. Option D is wrong because hardcoding IAM user credentials in application config files exposes long-lived secrets, prevents rotation, and defeats the purpose of instance principals and dynamic groups.