I85PREP
⌘ K
OCI Architect Professional study materials
OCI Architect Professional study resources

OCI Architect Professional practice questions

One question at a time. Build your OCI Architect Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity and Access Management

In an OCI tenancy, a compartment named Finance must be visible only to the finance team. Which IAM construct directly grants a group of users access to resources in that compartment?

  1. A network security group scoped to the finance VCN
  2. A dynamic group that matches the finance users' OCIDs
  3. A policy attached to the tenancy that references the compartment in its statement Correct answer.
  4. A tag default applied to the compartment

Explanation

Policies are the mechanism that authorizes groups (or dynamic groups) to act on compartments or tenancy resources; a policy statement names the compartment as the resource scope. Dynamic groups match principals by rule, not by permission, and NSGs and tag defaults do not grant IAM permissions.

Question 2Identity and Access Management

Which statement correctly describes the relationship between a compartment and a policy in OCI IAM?

  1. A policy is created in a compartment and its statements can reference that compartment or its children Correct answer.
  2. Policies are inherited only by sibling compartments, not by children
  3. A policy must be created in the root compartment of the tenancy
  4. A compartment can contain only one policy at a time

Explanation

Policies live in a compartment (commonly the tenancy root) and each statement names the compartment or tenancy resource it applies to. Compartments can hold many policies, and child compartments are addressable from a parent-level policy.

Question 3Identity and Access Management

A developer needs to read objects in a bucket named reports in the Object Storage namespace of the tenancy, but must not be able to delete them. Which policy statement grants exactly this?

  1. Allow group Devs to inspect objects in tenancy
  2. Allow group Devs to use buckets in tenancy where target.bucket.name='reports'
  3. Allow group Devs to manage objects in tenancy where target.bucket.name='reports'
  4. Allow group Devs to read objects in tenancy where target.bucket.name='reports' Correct answer.

Explanation

The verb read covers listing and getting objects without permitting deletion, and the condition restricts scope to the named bucket. manage is broader and includes delete, while inspect and use do not grant object read access.

Question 4Identity and Access Management

What is the purpose of a dynamic group in OCI IAM?

  1. To group human users who authenticate through federation
  2. To organize compartments into a hierarchy for billing
  3. To define a set of OCI resources, such as instances, that match a rule and can be granted permissions Correct answer.
  4. To store API signing keys for service accounts

Explanation

Dynamic groups match resource principals (for example compute instances) using rules based on attributes such as compartment OCID, so those resources can call OCI APIs with instance principals. Human users belong in regular groups, and compartment hierarchy is unrelated.

Question 5Identity and Access Management

Which OCI Identity Cloud Service concept is used to assign an application-specific role, such as 'Helpdesk', to a user?

  1. A tag namespace default
  2. A dynamic group rule
  3. An app role granted through an app role membership Correct answer.
  4. An IAM policy statement with the verb manage

Explanation

In OCI IAM (Identity Domains), applications expose app roles, and users or groups receive them through app role memberships. IAM policies govern OCI resources, not application-internal roles.

Question 6Identity and Access Management

An administrator wants users to sign in to the OCI Console using their corporate credentials from an external identity provider. Which capability enables this?

  1. Creating a dynamic group for the employees
  2. Enabling MFA on the tenancy's break-glass user
  3. Creating a local IAM user for each employee and sharing passwords
  4. Configuring identity federation with an identity provider such as Oracle IAM or another SAML/OIDC provider Correct answer.

Explanation

Federation lets an external identity provider authenticate users and assert their identity to OCI, so corporate credentials can be used. Local users and MFA do not integrate an external directory, and dynamic groups target resources.

Question 7Identity and Access Management

Which statement about the tenancy administrator (the default identity domain administrator) is accurate?

  1. The tenancy administrator can be deleted once any other user is created
  2. The tenancy administrator is limited to the root compartment only
  3. The tenancy administrator cannot use the Console and must use the CLI
  4. The tenancy administrator is a member of the Administrators group and has broad permissions across the tenancy Correct answer.

Explanation

The first user created with the tenancy belongs to the Administrators group, whose policy grants wide authority across the tenancy. It is not compartment-limited and can use any interface.

Question 8Identity and Access Management

A team needs a policy that allows only members of group Auditors to list all compartments in the tenancy without reading their contents. Which verb best fits?

  1. read
  2. use
  3. inspect Correct answer.
  4. manage

Explanation

inspect grants the ability to list resources and read metadata without access to contents, which matches listing compartments. read and manage include content access, and use applies to specific resource families.

Question 9Identity and Access Management

Which element of a policy statement identifies the principals to whom the permissions apply?

  1. The subject, such as 'group Finance' or 'dynamic-group Compute' Correct answer.
  2. The verb
  3. The resource, such as 'compartments in tenancy'
  4. The condition, such as 'request.region'

Explanation

A policy statement has a subject (group or dynamic group), a verb, a resource, and optional conditions. The subject names who receives the permission.

Question 10Identity and Access Management

An administrator wants instances in compartment App to read secrets from a vault in compartment Security. Which approach is correct?

  1. Create a local user per instance and embed the password in user data
  2. Add the instances to a dynamic group and write a policy allowing that dynamic group to read secrets in the Security compartment Correct answer.
  3. Rely on the instance's VCN to grant vault access
  4. Add each instance's OCID to a regular IAM group

Explanation

Instance principals rely on dynamic groups; a policy then grants the dynamic group the needed verb on the vault or secrets in the target compartment. Regular groups hold users, and network topology does not grant IAM permissions.

Question 11Identity and Access Management

A policy statement reads: Allow group Ops to manage instances in compartment Prod where request.region='us-ashburn-1'. What does this statement permit?

  1. Nothing, because conditions cannot reference request.region
  2. Instance management in every compartment when using Ashburn
  3. Read-only instance access in Prod in all regions
  4. Full instance lifecycle management in Prod, but only for requests made against the Ashburn region Correct answer.

Explanation

The verb manage grants the full instance lifecycle, the resource scope is compartment Prod, and the condition limits the statement to requests targeting the Ashburn region. Conditions may reference request attributes such as region.

Question 12Identity and Access Management

Which statement about identity domain administrators versus IAM policy administrators is correct?

  1. Identity domain administrators automatically receive manage rights on all compartments
  2. Both roles are identical in scope
  3. Identity domain administrators manage users, groups, and app roles inside the domain, while IAM policies govern access to OCI resources Correct answer.
  4. IAM policies can create users inside an identity domain

Explanation

Identity domain administration covers directory objects such as users, groups, and app role assignments, whereas IAM policies authorize actions on OCI resources like compute and storage. The two scopes are distinct and complementary.

Question 13Identity and Access Management

A company federates with an external IdP and wants members of the IdP group 'CloudOps' to receive OCI permissions. What must be done in OCI?

  1. Create a dynamic group whose rule matches the IdP group name
  2. Create a matching IAM group, map the IdP group to it during federation setup, and write policies granting that group permissions Correct answer.
  3. Write a policy whose subject is the IdP group's external OCID
  4. Rely on the IdP to push policies into OCI

Explanation

Federated identities are mapped to IAM groups, and policies are then written against those IAM groups. Policies reference OCI groups, not external IdP identifiers, and IdPs do not push OCI policies.

Question 14Identity and Access Management

Which statement about MFA in OCI IAM identity domains is correct?

  1. MFA replaces the need for IAM policies
  2. MFA can be enforced per sign-on policy so that specific user populations must present a second factor Correct answer.
  3. MFA automatically federates users to an external IdP
  4. MFA is only available for the tenancy administrator

Explanation

Sign-on policies in an identity domain can require MFA for chosen users, groups, or apps. MFA strengthens authentication but does not replace authorization policies or create federation.

Question 15Identity and Access Management

An engineer must allow a group to create and manage buckets but must not allow them to delete the bucket named archive. Which design is most appropriate?

  1. Grant manage buckets on the compartment and add a deny-style condition excluding the archive bucket Correct answer.
  2. Grant manage buckets only on a different compartment
  3. Grant manage buckets on the compartment and rely on Object Storage to block deletion of archive
  4. Grant read buckets on the compartment

Explanation

OCI policies are allow-only, so exclusion is achieved by scoping the grant with conditions that exclude the protected bucket, for example using target.bucket.name conditions. Object Storage does not independently block deletes for authorized principals.

Question 16Identity and Access Management

Which OCI CLI authentication method is appropriate for a CI/CD pipeline that must not store a human user's password?

  1. API key authentication using a dedicated service user's key pair stored in a secrets manager Correct answer.
  2. Using the Console's session cookie
  3. Embedding the tenancy administrator password in the pipeline script
  4. Interactive browser sign-in each run

Explanation

Non-interactive automation typically uses API key credentials for a dedicated principal, with the private key protected in a secrets store. Interactive sign-in and embedded administrator passwords are unsuitable for pipelines.

Question 17Identity and Access Management

A tenancy has compartments Dev, Test, and Prod. A policy in the root compartment allows group Eng to manage instances in tenancy. What is the effect?

  1. Eng must also be granted rights in each child compartment
  2. Eng can manage instances in Dev, Test, and Prod because the statement targets the tenancy Correct answer.
  3. Eng can manage instances only in compartments created after the policy
  4. Eng can manage instances only in the root compartment

Explanation

A statement scoped to the tenancy applies across all compartments within it, so Eng receives instance management everywhere. Separate grants per child compartment are unnecessary.

Question 18Identity and Access Management

Which statement about network sources in OCI IAM is correct?

  1. A network source encrypts API traffic
  2. A network source defines a set of allowed IP addresses or VCNs that can be referenced in policy conditions Correct answer.
  3. A network source assigns app roles to users
  4. A network source replaces groups as the policy subject

Explanation

Network sources group CIDR blocks or VCN OCIDs so policies can restrict access based on the request's source network. They are referenced in conditions and do not replace the policy subject.

Question 19Identity and Access Management

An administrator needs to grant a group permission to use a specific tag namespace when tagging resources. Which verb and resource combination is appropriate?

  1. read compartments in tenancy
  2. manage users in tenancy
  3. inspect instances in compartment Prod
  4. use tag-namespaces in tenancy Correct answer.

Explanation

Tagging permissions are expressed against tag-namespaces, and use grants the ability to apply tags from the namespace. The other statements address unrelated resources.

Question 20Identity and Access Management

A customer wants to restrict who can create new compartments in the tenancy. Which policy target should be used?

  1. compartments in tenancy Correct answer.
  2. instances in tenancy
  3. users in tenancy
  4. buckets in tenancy

Explanation

Compartment creation is controlled by permissions on the compartments resource at tenancy scope. Instance, user, and bucket targets govern different resource families.

Question 21Identity and Access Management

An organization uses identity domains and wants a break-glass local administrator that bypasses federation. Which design best preserves security?

  1. Share the local administrator credentials among the operations team
  2. Keep one local domain administrator with a strong password and MFA, monitored and used only for emergencies Correct answer.
  3. Disable all local users so only federated users exist
  4. Store the local administrator password in a public repository for quick access

Explanation

A single well-protected local administrator with MFA and monitoring provides emergency access if federation fails. Disabling all local users risks lockout, and sharing or exposing credentials undermines accountability.

Question 22Identity and Access Management

A policy grants 'Allow group Dev to manage all-resources in compartment App'. A resource in compartment App is also referenced by a second policy granting 'Allow group Ops to read all-resources in compartment App'. How are the two evaluated?

  1. Permissions are additive; Dev receives manage and Ops receives read, and a user in both groups receives the union Correct answer.
  2. The policies conflict and both are ignored
  3. The later-created policy overrides the earlier one
  4. The more restrictive statement wins, so users in both groups get only read

Explanation

OCI IAM is allow-based and additive: statements grant permissions and there is no deny that subtracts from a grant. A principal in both groups therefore receives the union of the granted permissions.

Question 23Identity and Access Management

An architect must let a function in OCI Functions read objects from a bucket without storing credentials. Which configuration achieves this?

  1. Create a local user and embed the password in the function's environment variables
  2. Grant the function's compartment manage all-resources
  3. Place the function in a dynamic group matching its resource attributes and grant that dynamic group read objects on the bucket Correct answer.
  4. Use a pre-authenticated request embedded in the function code

Explanation

Functions can use resource principals when matched by a dynamic group rule, and a policy then grants the required object read permission. Embedding user credentials or broad compartment grants violates least privilege.

Question 24Identity and Access Management

A company requires that API calls to modify resources in compartment Prod be allowed only from the corporate network range. Which combination accomplishes this?

  1. Create a dynamic group for the corporate range
  2. Add the corporate CIDRs to the Prod compartment's security list
  3. Enable MFA on the group and omit any condition
  4. Define a network source for the corporate CIDRs and reference it in a condition on the Prod policy Correct answer.

Explanation

Network sources capture trusted CIDRs or VCNs and are referenced in policy conditions so that statements apply only to requests from those sources. Security lists affect traffic, not IAM authorization, and MFA is an authentication control.

Question 25Identity and Access Management

An administrator must ensure that members of group Contractors cannot manage instances in compartment Prod, while other engineers can. Which approach fits OCI's authorization model?

  1. Create a dynamic group for Contractors with an empty rule
  2. Write a deny statement for Contractors on instances in Prod
  3. Grant manage instances to everyone and rely on auditing
  4. Grant manage instances to the engineers' group scoped to Prod and grant Contractors no instance permissions there Correct answer.

Explanation

Because OCI policies only allow, exclusion is achieved by not granting the permission to the excluded group and granting it to the intended group. Deny statements are not part of the policy language.

Question 26Identity and Access Management

In OCI IAM, which resource is the container that holds users, groups, and identity providers, and that replaced the legacy tenancy-level IAM model?

  1. Dynamic group
  2. Policy store
  3. Identity domain Correct answer.
  4. Compartment

Explanation

Identity domains are the current construct that holds users, groups, identity providers, and domain-level policies. Compartments organize cloud resources rather than identities, and dynamic groups are matching rules for resources.

Question 27Identity and Access Management

A security architect needs a group whose membership is computed automatically from attributes of compute instances, so that no administrator adds users manually. Which OCI IAM construct should be used?

  1. Identity provider
  2. Static group
  3. Dynamic group Correct answer.
  4. Network source

Explanation

Dynamic groups define membership through matching rules evaluated against resource attributes such as compartment or freeform tags. Instances that satisfy the rule automatically become principals for policy statements.

Question 28Identity and Access Management

Which OCI CLI configuration element selects the identity domain or tenancy context against which a CLI request is authenticated?

  1. The --debug flag
  2. The --region flag
  3. The profile referenced with --profile Correct answer.
  4. The --output flag

Explanation

CLI profiles in the config file store credentials plus the tenancy, user, fingerprint, and key file used for signing requests. Selecting a profile changes which identity context and credentials the CLI uses.

Question 29Identity and Access Management

Which statement describes the scope of an IAM policy written in a compartment rather than at the tenancy root?

  1. It applies to every compartment in the tenancy regardless of placement
  2. It applies only to resources tagged with the compartment name
  3. It applies to the compartment in which it is written and to its child compartments Correct answer.
  4. It applies only to resources in the exact compartment where it is written

Explanation

Policies are inherited downward, so a policy attached to a compartment governs that compartment and all compartments nested beneath it. Tenancy-root policies therefore reach the whole tenancy.

Question 30Identity and Access Management

Which OCI IAM feature lets an administrator require a second authentication factor for console sign-in by members of a specific group?

  1. API key rotation schedules
  2. Password policy complexity settings
  3. Network perimeter rules
  4. Sign-on policy rules in the identity domain Correct answer.

Explanation

Sign-on policies in an identity domain evaluate conditions and can require an additional factor such as TOTP or push notification. Password policies govern credential strength, not a second factor.

Question 31Identity and Access Management

An administrator wants a policy that permits a group to inspect, but not modify, all resources in a compartment. Which verb pair matches this intent?

  1. manage and use
  2. use and manage
  3. inspect and read Correct answer.
  4. read and manage

Explanation

The inspect verb allows listing resources, and read adds access to the resources' contents and metadata without permitting changes. Verbs such as manage include create, update, and delete.

Question 32Identity and Access Management

Which OCI IAM principal type is intended for workloads such as OCI Functions or compute instances that call OCI APIs without embedded credentials?

  1. Customer secret key holder
  2. Federated user
  3. Dynamic group Correct answer.
  4. Local identity domain user

Explanation

Dynamic groups grant permissions to resources that match rules, and the resource then uses its own instance or resource principal to obtain short-lived credentials. Human users and long-lived secret keys are not required.

Question 33Identity and Access Management

Which statement describes the effect of the tenancy's home region on IAM resources such as identity domain users and groups?

  1. IAM identity data is mastered in the home region and consumed by all subscribed regions Correct answer.
  2. IAM identity data is stored in the customer's on-premises directory by default
  3. IAM identity data exists only in the region where the console session started
  4. IAM identity data is created independently in each region with no replication

Explanation

The tenancy home region hosts the authoritative IAM data, including users, groups, and policies, while other regions rely on that data for authorization. Architects therefore treat the home region as a resilience consideration.

Question 34Identity and Access Management

A policy statement must grant a group permission to create and delete subnets in compartment Network. Assume any required permissions on related resources are already granted. Which statement achieves this?

  1. Allow group NetAdmins to use subnets in compartment Network
  2. Allow group NetAdmins to read subnets in compartment Network
  3. Allow group NetAdmins to manage subnets in compartment Network Correct answer.
  4. Allow group NetAdmins to inspect subnets in compartment Network

Explanation

The manage verb covers the full lifecycle of the resource type, including create, update, and delete. The narrower verbs read, use, and inspect cannot create or delete subnets.

Question 35Identity and Access Management

An administrator writes a policy granting a group access to object storage buckets in compartment Data, but the group also needs the same access in compartment Archive. Which approach avoids duplicating the statement?

  1. Attach the policy to each bucket individually using tags
  2. List both compartments as targets in a single statement separated by a comma Correct answer.
  3. Grant the group manage all-resources at the tenancy root
  4. Create a second identity domain and migrate the group into it

Explanation

A policy statement can name multiple compartments in its target list, so one statement can cover Data and Archive. Broadening to the tenancy root would exceed the requirement, and tags do not attach policies.

Question 36Identity and Access Management

A group must be allowed to manage instances in compartment Prod only when the request is made by a member whose group membership is evaluated at request time. Which OCI IAM mechanism enforces the principal condition?

  1. A service limit increase
  2. A compartment quota policy
  3. A policy statement naming the group as subject Correct answer.
  4. A budget rule on compartment Prod

Explanation

The subject of a policy statement names the principal, such as a group, and authorization checks the caller's current group membership. Quotas and budgets govern capacity and spend, not authorization.

Question 37Identity and Access Management

An architect must prevent a compromised instance in compartment Web from reading secrets in compartment Vault. The instance currently belongs to a dynamic group that has read secrets in Vault. Which change removes that access?

  1. Add the instance to a second dynamic group with no policies
  2. Rotate the instance's SSH key pair
  3. Enable MFA on the tenancy administrator account
  4. Remove the matching rule that places the instance in the dynamic group Correct answer.

Explanation

Dynamic group membership is derived from matching rules, so removing the rule that matches the instance removes the principal from the group and therefore its policy-based access. Adding unrelated groups or rotating SSH keys does not revoke the existing policy grant.

Question 38Identity and Access Management

A company wants its OCI CLI automation to sign requests with a key that is not tied to a human user's console password. Which approach fits OCI IAM best?

  1. Create a dedicated service identity with API signing keys and grant it least-privilege policies Correct answer.
  2. Share the tenancy administrator's API key with the automation
  3. Disable federation so the automation can use local passwords
  4. Store a human administrator's password in the pipeline variables

Explanation

A dedicated non-human identity with its own API signing key isolates automation credentials and allows least-privilege policy grants. Reusing administrator credentials or storing human passwords expands blast radius and violates least privilege.

Question 39Identity and Access Management

Which OCI IAM construct should an architect use to allow API calls only from a defined set of public IP addresses, independent of the caller's group membership?

  1. A tag default applied to the compartment
  2. A password policy requiring longer passphrases
  3. A network source referenced in the policy condition Correct answer.
  4. A dynamic group matching the caller's compartment

Explanation

Network sources group CIDR ranges or VCN endpoints that can be referenced in policy conditions to restrict where requests originate. Group membership and password rules address identity, not network origin.

Question 40Identity and Access Management

An administrator must let a group read objects in a bucket but must ensure the group cannot delete the bucket itself. Which combination of policy design is most appropriate?

  1. Grant read on objects and buckets in the compartment, and withhold manage on buckets Correct answer.
  2. Grant manage all-resources in the compartment to the group
  3. Grant use buckets and manage objects in the compartment
  4. Grant manage buckets and read objects in the compartment

Explanation

Separating verbs by resource type lets the group read objects while withholding the lifecycle permissions that include bucket deletion. Granting manage on buckets would allow deletion.

Question 41Identity and Access Management

A federated user signs in through the company IdP and is mapped into an OCI group. Which statement explains how OCI authorizes that user's API calls?

  1. OCI evaluates policies against the mapped OCI group membership at request time Correct answer.
  2. OCI evaluates policies against the IdP's internal group identifiers directly
  3. OCI bypasses policies for federated users because the IdP already authorized them
  4. OCI requires the user to hold a local password before any policy applies

Explanation

Federation authenticates the user, but authorization still runs against OCI groups and policies. The IdP group must be mapped to an OCI group for policy statements to match.

Question 42Identity and Access Management

An architect wants to confirm that a policy granting access to a group actually applies to a specific user. Which check is most direct?

  1. Verify the user's current membership in the named group in the identity domain Correct answer.
  2. Verify the user's console language preference
  3. Verify the user's API key fingerprint length
  4. Verify the user's compartment quota

Explanation

Policy subjects are groups, so a user gains the grant only through membership in a named group. Confirming membership in the identity domain is the direct check.

Question 43Identity and Access Management

A policy statement reads: Allow group Ops to manage instances in tenancy where target.compartment.name = 'Prod'. What does this statement accomplish?

  1. It grants instance management across the tenancy but only for resources in the Prod compartment Correct answer.
  2. It grants instance management only in the compartment where the policy is stored
  3. It grants read-only access to instances in Prod
  4. It grants instance management in every compartment except Prod

Explanation

The tenancy target broadens the statement's reach, while the condition narrows it to resources whose compartment name is Prod. Conditions filter the effective scope without changing the verb.

Question 44Identity and Access Management

A tenancy uses identity domains and the architect must ensure that a departing employee's API signing keys stop working immediately while their federated console access is also revoked. Which action set is correct?

  1. Delete or deactivate the user's API keys and remove the user from OCI groups or disable the federated account Correct answer.
  2. Rotate the tenancy signing key and restart all compute instances
  3. Change the password policy minimum length for the domain
  4. Remove the user from the IdP only and leave OCI API keys in place

Explanation

API keys are independent credentials that remain valid until deleted or deactivated, so revocation must explicitly address them. Removing group membership or disabling the account stops policy-based authorization for the identity.

Question 45Identity and Access Management

An architect must design authorization so that a group can manage only resources carrying the tag CostCenter=42, across several compartments. Which approach is valid in OCI IAM?

  1. Attach policies directly to each tagged resource
  2. Use a policy condition on request.principal.group or target resource tags combined with compartment targets Correct answer.
  3. Create one identity domain per compartment and duplicate the group
  4. Rely on compartment quotas to restrict the group to tagged resources

Explanation

Policy conditions can reference resource tags and other request attributes to narrow a grant, and multiple compartments can be listed as targets. Quotas and per-resource policy attachment do not provide tag-based authorization.

Question 46Identity and Access Management

A company federates with an external IdP and wants a small break-glass path that works if the IdP is unavailable. Which design best meets this requirement in an identity domain?

  1. Store the IdP signing certificate in a public bucket for recovery
  2. Grant the IdP administrator group tenancy administrator permanently
  3. Disable federation and rely solely on local accounts for all users
  4. Maintain a local identity domain administrator account with strong credentials and monitored use Correct answer.

Explanation

A local break-glass administrator remains usable when federation fails, provided credentials are strong and use is monitored and alerted. Permanent broad grants to federated groups or disabling federation entirely create different risks.

Question 47Identity and Access Management

An architect observes that a user can manage instances in compartment Dev even though the only policy naming the user's group grants manage instances in compartment Prod. Which explanation is most plausible?

  1. The user has MFA enabled on the identity domain
  2. The user's API key fingerprint is longer than usual
  3. The Dev compartment has a quota policy attached
  4. The user also belongs to another group that is granted manage instances in Dev by a separate policy Correct answer.

Explanation

Authorization is the union of all applicable policy grants, so membership in a second group with a Dev grant explains the access. Key fingerprint length, MFA, and quotas do not grant permissions.

Question 48Identity and Access Management

A workload running on a compute instance must call an OCI service in a different compartment. The instance is in a dynamic group, and the policy grants that group use of the service in the target compartment. Which statement about this design is accurate?

  1. The dynamic group must be converted to a static group before policies apply
  2. The instance must embed a human user's API key in its metadata
  3. The instance principal obtains short-lived credentials scoped to the dynamic group's policies Correct answer.
  4. The instance must be moved into the target compartment for the policy to apply

Explanation

Instance principals let the workload authenticate as itself, and the resulting token is authorized by the policies attached to its dynamic group. Cross-compartment access works because policies name the target compartment explicitly.

Question 49Identity and Access Management

An administrator must grant a group permission to create budgets but not to modify compartments. Which policy statement is appropriately scoped?

  1. Allow group FinOps to use compartments in compartment Finance
  2. Allow group FinOps to manage usage-budgets in tenancy Correct answer.
  3. Allow group FinOps to manage compartments in tenancy
  4. Allow group FinOps to manage all-resources in tenancy

Explanation

Using manage with the usage-budgets resource type grants budget lifecycle permissions, including creation. Budgets reside in the root compartment even when they target Finance spending, so the policy uses in tenancy. This policy does not grant permission to modify compartments.

Question 50Identity and Access Management

Which statement about the relationship between identity domain administrators and tenancy-level IAM policy administrators is accurate?

  1. Policy administrators can reset any user's password in every identity domain
  2. Domain administrators manage identities inside the domain, while policy administrators control resource access through policies Correct answer.
  3. Domain administrators automatically hold full tenancy policy authority
  4. The two roles are always held by the same principal by design

Explanation

Identity domain administration covers users, groups, and domain settings, whereas resource authorization is expressed through IAM policies managed by policy administrators. The roles are distinct and can be separated for least privilege.