Identity And Access Management

Which TWO best practices should be followed when designing OCI IAM policies? (Choose two.)

Your company uses Compute instances deployed across various departments to access OCI Object Storage buckets. Instead of storing API keys on the instances, you decide to use Instance Principals. Which of the following components is NOT required to configure Instance Principals for this workflow?

An administrator needs to write a policy that grants a group read-only access to all databases across the tenancy. Which resource type should be specified in the policy?

Which THREE actions occur or are required when migrating an OCI compartment containing resources to a new parent compartment? (Choose three.)

You are designing a cross-tenancy architecture where Tenancy A needs to allow a specific group from Tenancy B to manage Object Storage buckets in a specific compartment within Tenancy A. What mechanism must be established in Tenancy A to enable this?

Which TWO pieces of information are required when configuring an OCI IAM Identity Provider for SAML federation? (Choose two.)

Which TWO statements are true regarding the behavior of dynamic groups and instance principals? (Choose two.)

Which THREE attributes can be evaluated in an OCI dynamic group matching rule for compute instances? (Choose three.)

What is the function of the OCI IAM 'inspect' verb?

Your security team has implemented a policy that restricts access to Object Storage to requests originating from a specific dynamic group. However, a developer test script fails with a 403 Forbidden error even though the script runs on an instance in that dynamic group. Upon inspecting audit logs, you find that the API call was made using user credentials rather than instance principals. Why did the authorization fail?

Which verb grants the most comprehensive set of permissions (inspect, read, use, and manage) on a given resource type in an OCI IAM policy?

Which TWO options are valid ways to organize resources in OCI? (Choose two.)

Which THREE statements are true about OCI federation with SAML 2.0 Identity Providers? (Choose three.)

When configuring federation with an external Identity Provider (IdP) such as Microsoft Azure AD or Okta using SAML 2.0, which THREE tasks must be completed in Oracle Cloud Infrastructure? (Choose three.)

What is the primary function of OCI IAM federation?

Your organization has a requirement to allow users from a trusted partner company to authenticate to your OCI tenancy using Microsoft Entra ID (Azure AD) as the Identity Provider. Which component must be configured first in OCI before setting up the federation trust relationship?

An administrator wants to ensure that users belonging to the 'Contractors' group can only access OCI resources during normal business hours (Monday through Friday, 9 AM to 5 PM). Which policy feature should be used?

What is the primary purpose of an OCI API signing key?

Which THREE actions can be performed on compartments in OCI? (Choose three.)

Which THREE conditions can be evaluated using conditional clauses in OCI IAM policies? (Choose three.)

Which TWO actions can an OCI administrator perform on user accounts? (Choose two.)

What is required for a human user to authenticate programmatically against OCI using the CLI, SDKs, or API?

What is the primary purpose of OCI compartments?

An administrator needs to grant a group of database administrators the ability to manage Autonomous Databases in a specific compartment named DevComp. Which policy syntax is the most secure and adheres to the principle of least privilege?

Which TWO statements are true about OCI IAM compartments? (Choose two.)

Which OCI service is responsible for managing users, groups, compartments, and policies?

An auditor needs to verify all IAM policies across your entire tenancy to ensure compliance. Which policy statement allows a user in the 'Auditors' group to read all policies in the tenancy root?

An administrator needs to create a new root compartment under the tenancy to separate billing and administrative resources for a newly acquired subsidiary. Where must the administrator perform this action in the Oracle Cloud Infrastructure Console?

What is the primary function of an OCI dynamic group?

Which THREE tools or methods can be used to write and apply OCI IAM policies? (Choose three.)

Which TWO methods can be used to authenticate human users to the OCI Console? (Choose two.)

What happens to the resources inside a compartment when you delete the compartment itself?

An administrator wants to enforce strict access control based on resource metadata. They decide to use Tag-Based Access Control. Which of the following defines the correct prerequisite structure required before you can write a policy using tag values?

Which THREE statements are true regarding OCI IAM groups? (Choose three.)

Which THREE actions can an administrator perform to secure user accounts in OCI IAM? (Choose three.)

Which TWO types of groups exist in OCI IAM? (Choose two.)

What is the scope of an OCI IAM policy by default when it is created in the root compartment (tenancy)?

Your security policy states that users must enable Multi-Factor Authentication (MFA) to access production compartments. How can you enforce MFA for specific users in OCI IAM?

What is the function of the OCI IAM 'read' verb compared to 'inspect'?

You are configuring identity federation with an enterprise SAML 2.0 Identity Provider. After mapping the external IdP groups to OCI IAM groups, users successfully log in via SSO but receive an authorization error (404/Not Authorized) when trying to view any resources. What is the most likely cause?

Which of the following describes an OCI user group?

Which TWO statements are true regarding OCI IAM policy syntax scoping rules? (Choose two.)

An administrator needs to grant read-only access to all Object Storage buckets within a specific compartment named 'DataLake'. Which policy statement accomplishes this?

Your organization wants to grant an external team of auditors read-only access to a specific compartment named FinanceAudits without creating individual IAM users for each auditor. You decide to use identity federation with a SAML 2.0-compliant Identity Provider (IdP). Which of the following steps is NOT required to achieve this?

What is the primary function of OCI Identity Domains?

Your organization uses Oracle Identity Cloud Service (IDCS) federated with OCI. You need to assign an existing IDCS group named 'NetworkAdmins' to manage Virtual Cloud Networks in OCI. What is the proper workflow to achieve this?

An administrator wants to delegate compartment creation to a group of team leads named 'TeamLeads' without granting them full tenancy administrator privileges. Which policy statement achieves this?

What is the primary function of an OCI IAM policy statement?

Which TWO default resource types are available in every new OCI tenancy? (Choose two.)

Which TWO resource types can be managed using OCI IAM policies? (Choose two.)

An administrator wants to allow a group of developers to view and manage Event Service rules and notifications. Which resource types should be used in the IAM policy?

You are troubleshooting a federated user login issue where users authenticate successfully through your corporate SAML IdP, but upon redirection to OCI, they encounter an error stating that no matching user account or group mapping exists. What is the most likely misconfiguration?

Which TWO statements are true regarding OCI Identity Domains? (Choose two.)

When you create a new OCI tenancy, what is the name of the default top-level compartment created automatically by Oracle?

Which TWO of the following are valid verbs used in OCI IAM policy statements? (Choose two.)

Which TWO statements are true regarding OCI IAM policy evaluation behavior? (Choose two.)

Which TWO components are required when defining an OCI dynamic group matching rule for compute instances? (Choose two.)

Your team needs to allow a group of developers to read logs in the Logging service across all compartments, but you want to ensure they cannot modify or delete any logging resources. Which of the following IAM policy verbs should you use?

An administrator needs to allow a group of developers to create and manage File Storage Service (FSS) file systems and mount targets in a compartment named 'FSCompartment'. Which policy statement is correct?

You are troubleshooting a complex policy evaluation in your tenancy. There are multiple overlapping policies defined at both the tenancy root and various compartment levels. Which principle does OCI IAM follow when evaluating conflicting or overlapping policy statements?