Building LLM Applications with RAG and Vector Search →hardMultiple ChoiceObjective-mapped

1Z0-1127-25 Practice Question: Building LLM Applications with RAG and Vector Search

Exhibit

{
  "policy": "Allow dynamic-group RAGGroup to use generative-ai-embeddings in compartment Production"
}

Refer to the exhibit. A developer has set this policy to allow an OCI Data Science session to generate embeddings. However, the API call returns a 403 Forbidden. Which of the following is likely missing?

⚠ Common exam trap

Oracle often tests the distinction between policy syntax correctness and dynamic group membership, leading candidates to focus on permission levels or scope when the real issue is that the resource (Data Science session) is not a member of the dynamic group referenced in the policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The dynamic group does not include the Data Science session

The 403 Forbidden error indicates that the Data Science session does not have the necessary permissions to call the API. In OCI, policies grant permissions to dynamic groups, not directly to resources. The dynamic group must include the Data Science session (e.g., by matching the session's OCID or resource type) for the policy to apply. Without this, the session is not recognized as a principal, and the API call is denied.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy needs a 'where request.region != ...' condition
Why it's wrong here
Region conditions are not required for this permission.
✗
The policy should include 'in tenancy' instead of compartment
Why it's wrong here
Using 'in compartment' is acceptable and more restrictive.
✗
The service requires 'manage' permission instead of 'use'
Why it's wrong here
'Use' is sufficient for generating embeddings.
✓
The dynamic group does not include the Data Science session
Why this is correct
The session must be matched by a rule in the dynamic group for the policy to apply.

Go deeper

1Z0-1127-25 Practice Question: Building LLM Applications with RAG and Vector Search

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question