Identity And Access Management

What is the maximum number of groups a single OCI user can be a member of?

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)

An administrator needs to allow a group of developers to view IAM policies across the tenancy without allowing them to modify or delete any policies. Which policy statement accomplishes this?

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Which THREE resource types are associated with networking and can be managed via OCI IAM policies? (Choose three.)

You are writing a dynamic group matching rule for compute instances that need access to Object Storage. The instances must be members of the dynamic group if their OCID matches a specific value or if they are tagged with a specific freeform tag. Which syntax is valid for matching either condition using any/all operators?

Which THREE services integrate directly with OCI IAM for access control and governance? (Choose three.)

Which THREE resource types are included under the 'compute-instance-family' or 'instance-family' in OCI IAM policies? (Choose three.)

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances tagged with a defined tag namespace 'Department' and key 'CostCenter' equal to '400'. What is the correct syntax?

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

What is the function of the OCI IAM 'inspect' verb?

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

An administrator needs to restrict access so that developers can delete compute instances only if the request comes from a specific virtual cloud network subnet OCID. How can this be accomplished?

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

An administrator created a compartment hierarchy where compartment 'ProjectA' is a child of 'DepartmentX'. You need to allow the group 'Auditors' to inspect all resources in 'ProjectA' without giving them any visibility into other child compartments under 'DepartmentX'. Where should the policy be created?

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

You are configuring a dynamic group matching rule that needs to include all compute instances whose OCID starts with a specific prefix or belong to a specific image. However, OCI dynamic group grammar does not support wildcard operators like asterisks (*) for prefix matching on instance IDs. Which approach should you use instead to group these instances?

You need to write a policy allowing a dynamic group named 'AppInstances' to read objects in an Object Storage bucket, but ONLY if the bucket is tagged with a defined tag namespace 'Operations' and key 'Environment' set to 'Production'. What policy syntax achieves this?

What is the maximum number of compartments allowed in a single OCI tenancy (including root)?

You are designing a security architecture for multiple OCI compartments. Which TWO of the following statements regarding OCI compartments and IAM policies are correct? (Choose two.)

An administrator needs to ensure that a newly created group can view billing and cost data across the tenancy, but cannot modify any resources. Which policy grants the appropriate access?

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)

What is the primary function of OCI IAM federation?

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

What is the primary purpose of an OCI API signing key?

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

Which THREE permissions are granted when a group is given 'manage' access to a resource family? (Choose three.)

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

You are designing an IAM policy hierarchy for a multi-tenant OCI environment. You write the following statement in the root compartment: 'Define tenancy TenantA as ocid1.tenancy.oc1..aaaaaaa...; Define group NetworkAdmins as ocid1.group.oc1..aaaaaaa...; Allow group NetworkAdmins to manage virtual-network-family in tenancy TenantA'. What type of policy cross-tenancy grant does this represent?

What is the primary purpose of OCI compartments?

Which THREE administrative tasks require membership in the tenancy Administrators group or equivalent high-level IAM privileges? (Choose three.)

An administrator created a custom policy in the root compartment. However, a user complains that they cannot access resources in a child compartment. Upon inspection, you notice the policy syntax reads: Allow group DevGroup to manage instances in compartment ChildComp. What is the error in this policy?

What is the maximum number of compartments you can nest within a single parent compartment in OCI?

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases in a specific compartment named DevComp. Which policy syntax is the most secure and adheres to the principle of least privilege?

Which TWO statements are true about OCI IAM compartments? (Choose two.)

Which THREE statements are true regarding OCI IAM policy syntax structure? (Choose three.)

Which OCI service is responsible for managing users, groups, compartments, and policies?

Your company has merged with another organization. You need to configure cross-tenancy access so that Tenancy B can read Object Storage buckets in Tenancy A. You have created an endorsement policy in Tenancy A. What exact syntax must be used for the commitment policy in Tenancy B?

An auditor needs to verify all IAM policies across your entire tenancy to ensure compliance. Which policy statement allows a user in the 'Auditors' group to read all policies in the tenancy root?

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

Your organization requires that all IAM policies created in the tenancy must be reviewed and approved. To facilitate auditing, you need to write a policy allowing the 'ComplianceTeam' group to read IAM policies and read tenancy metadata. Which policy statement correctly implements this?

What is the primary function of an OCI dynamic group?

Which THREE tools or methods can be used to write and apply OCI IAM policies? (Choose three.)

Which TWO methods can be used to authenticate human users to the OCI Console? (Choose two.)

Your organization is auditing resource configurations across compartments. You want to allow a security analyst group to inspect security posture and recommendations across the tenancy. Which OCI service resource type should be referenced in the policy?

What happens to the resources inside a compartment when you delete the compartment itself?

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

An administrator needs to allow a group of developers to create and manage load balancers within a specific compartment named 'AppCompartment'. Which policy syntax is correct?

Which TWO statements are true regarding cross-tenancy IAM policies? (Choose two.)

An administrator wants to allow the 'NetworkAdmins' group to manage VCNs, subnets, and route tables, but NOT gateways or peering connections. Which policy statement accomplishes this with the greatest precision?

Which TWO types of groups exist in OCI IAM? (Choose two.)

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

You are designing a security policy where a dynamic group named 'BatchProcessors' must be allowed to read and write objects in an Object Storage bucket, but ONLY if the request comes from an instance whose tags match a defined tag. However, your policy syntax validation fails when you submit it. Which rule structure is valid for combining resource permissions with tag conditions?

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Which of the following describes an OCI user group?

An administrator wants to allow a group of developers to create and manage Kubernetes clusters (OKE - Oracle Container Engine for Kubernetes) in a specific compartment named 'K8sCompartment'. Which policy statement is correct?

You have written a dynamic group rule matching instances based on their compartment OCID. However, newly launched compute instances in that compartment are not receiving the permissions assigned to the dynamic group. What is the most likely cause?

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

Which THREE factors should you consider when designing a compartment hierarchy for an enterprise OCI tenancy? (Choose three.)

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

What is the primary function of OCI Identity Domains?

Which TWO conditions must be met for a dynamic group matching rule to successfully include compute instances based on a defined tag? (Choose two.)

You are configuring cross-tenancy access where Tenancy A needs to allow a dynamic group from Tenancy B to access Object Storage buckets in Tenancy A. In addition to the endorsement and commitment policies, what other configuration is mandatory in Tenancy A for the dynamic group from Tenancy B to be recognized?

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

What is the primary function of an OCI IAM policy statement?

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

You are designing a security architecture where a dynamic group must access a Vault secret. In addition to creating the dynamic group and writing a policy allowing the dynamic group to read secrets, what specific permission or resource relationship must be established on the Vault itself?

Your organization uses Identity Domains. You need to configure a dynamic group matching rule that includes all compute instances launched in a specific compartment whose OCID is 'ocid1.compartment..oc1..aaaa...'. What is the exact syntax for this rule?

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Your organization is implementing dynamic groups to manage automated deployments from OCI Functions and Compute instances. Which THREE of the following matching rule criteria are valid for constructing OCI dynamic groups? (Choose three.)

An administrator wants to allow an application support group to view metrics and alarms across the tenancy without granting them access to modify infrastructure. Which policy achieves this?

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

An administrator wants to allow the 'SecurityOps' group to read audit logs across the tenancy. Which policy statement is correct?

Your team needs to allow a group of developers to read logs in the Logging service across all compartments, but you want to ensure they cannot modify or delete any logging resources. Which of the following IAM policy verbs should you use?

Your security team requires that developers can only terminate Compute instances if the request originates from a specific corporate CIDR block (192.168.100.0/24). How can you implement this requirement using OCI IAM policies?

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?