I85PREP
⌘ K
OCI Operations Associate study materials
OCI Operations Associate study resources

OCI Operations Associate practice questions

One question at a time. Build your OCI Operations Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Oracle Cloud Infrastructure Operations

In OCI, which construct is used to group and isolate a set of related cloud resources for access control and cost tracking?

  1. Compartment Correct answer.
  2. Region
  3. Availability domain
  4. Fault domain

Explanation

Compartments are logical containers used to organize resources, scope IAM policies, and separate budgets and cost reports. Availability domains and fault domains are physical infrastructure groupings, and a region is a geographic area containing one or more availability domains.

Question 2Oracle Cloud Infrastructure Operations

An operations engineer needs a policy that allows a group to manage compute instances only in the compartment named Production. Which policy statement achieves this?

  1. Allow group Ops to read instances in compartment Production
  2. Allow group Ops to manage instances in compartment Production Correct answer.
  3. Allow group Ops to manage all-resources in compartment Production
  4. Allow group Ops to manage instances in tenancy

Explanation

An IAM policy statement has the form Allow <subject> to <verb> <resource-type> in <location>. Naming the instances resource-type with the manage verb scoped to the Production compartment grants full lifecycle control of compute instances there and nothing broader.

Question 3Oracle Cloud Infrastructure Operations

What is the primary operational purpose of an OCI fault domain?

  1. To provide a separate geographic replica of the tenancy
  2. To spread resources so a single hardware failure does not affect them all Correct answer.
  3. To store IAM policy documents
  4. To define the billing currency for a compartment

Explanation

Fault domains are groupings of hardware within an availability domain, and placing instances across them reduces the chance that one hardware fault takes down all instances. They are not geographic replicas, billing constructs, or policy storage.

Question 4Oracle Cloud Infrastructure Operations

A team wants block storage that can be attached to instances in any availability domain within the same region. Which OCI Block Volume option should they choose?

  1. Local NVMe disk
  2. Boot volume
  3. Regional block volume Correct answer.
  4. Paravirtualized attachment

Explanation

Regional block volumes are replicated across availability domains in a region and can be attached to instances in any of them. Boot volumes are tied to an instance lifecycle, paravirtualized is an attachment mode, and local NVMe is instance-local ephemeral storage.

Question 5Oracle Cloud Infrastructure Operations

Which OCI service is the recommended place to store and manage the encryption keys used to encrypt Object Storage buckets?

  1. OCI Bastion
  2. OCI Identity Domains
  3. OCI Logging
  4. OCI Vault Correct answer.

Explanation

OCI Vault is the managed key management service that holds master encryption keys and secrets used by other services, including Object Storage. Identity Domains handles identity, Logging collects logs, and Bastion provides managed SSH access.

Question 6Oracle Cloud Infrastructure Operations

An instance in a private subnet must download packages from the internet without exposing a public IP. What should the operator configure?

  1. An internet gateway attached directly to the private subnet
  2. A service gateway for all internet traffic
  3. A local peering gateway to the tenancy
  4. A NAT gateway in the public subnet with a route rule from the private subnet Correct answer.

Explanation

A NAT gateway resides in a public subnet and lets instances in a private subnet initiate outbound internet connections while blocking inbound connections. The private subnet's route table needs a rule directing internet-bound traffic to that NAT gateway.

Question 7Oracle Cloud Infrastructure Operations

Which OCI load balancer offering is designed to distribute traffic at Layer 4 with very high throughput and low latency?

  1. Network Load Balancer Correct answer.
  2. Application Load Balancer
  3. Web Application Firewall
  4. API Gateway

Explanation

The OCI Network Load Balancer operates at Layer 4 and is built for high-throughput, low-latency TCP and UDP traffic. The Application Load Balancer works at Layer 7, while API Gateway and WAF are not traffic-distribution load balancers.

Question 8Oracle Cloud Infrastructure Operations

A user reports that an instance is running but unreachable over SSH. Which OCI feature lets an operator open a session without a public IP or bastion host?

  1. Instance metadata service
  2. VCN flow logs
  3. OCI Cloud Shell with the instance console connection Correct answer.
  4. The serial console connection

Explanation

OCI Cloud Shell can be used together with the instance console connection to reach an instance for troubleshooting without exposing a public IP. The serial console is for boot-level recovery, metadata provides configuration data, and flow logs record traffic.

Question 9Oracle Cloud Infrastructure Operations

What does an OCI budget alert do when a defined spending threshold is reached?

  1. Converts the tenancy to a free-tier account
  2. Deletes the compartment that exceeded the budget
  3. Sends a notification through a configured topic to subscribed recipients Correct answer.
  4. Automatically terminates all compute instances in the tenancy

Explanation

Budgets track spending against a target amount and trigger alerts that publish to a Notifications topic, which then delivers messages to subscribers. Budgets are informational and do not terminate resources or change account type.

Question 10Oracle Cloud Infrastructure Operations

An operator wants to be notified when a specific user creates or deletes a VCN. Which OCI service combination supports this?

  1. Block volume backup policy
  2. Autonomous Database auto-scaling
  3. Object Storage lifecycle policy
  4. Audit events routed through a rule to Notifications Correct answer.

Explanation

The Audit service records API activity, and a rule can match specific event types and deliver them to a Notifications topic so subscribers are alerted. Lifecycle policies, auto-scaling, and backup policies address storage and database operations, not audit alerting.

Question 11Oracle Cloud Infrastructure Operations

Which statement about OCI Identity and Access Management policy verbs is accurate?

  1. use grants tenancy-wide administration
  2. inspect allows listing resources but not reading their contents Correct answer.
  3. read allows full management including deletion
  4. manage is limited to metadata operations

Explanation

The IAM verb hierarchy progresses from inspect to read to use to manage, with each level adding capabilities. inspect permits listing resources, read adds access to their contents, and manage grants full control including deletion.

Question 12Oracle Cloud Infrastructure Operations

A compute instance must be launched with a specific image and shape repeatedly by an automated pipeline. Which OCI capability best supports this repeatable deployment?

  1. Tag defaults
  2. Boot volume backups
  3. VCN security lists
  4. Instance configurations and instance pools Correct answer.

Explanation

Instance configurations capture the image, shape, and launch settings, and instance pools use them to create and maintain a group of identically configured instances. This makes repeatable, automated provisioning straightforward.

Question 13Oracle Cloud Infrastructure Operations

What is the effect of enabling a VCN flow log on a subnet?

  1. It encrypts traffic between instances
  2. It assigns public IP addresses to instances
  3. It blocks all inbound traffic to the subnet
  4. It captures information about traffic flowing through the subnet for analysis Correct answer.

Explanation

VCN flow logs record details about network traffic passing through a subnet, which supports security analysis and troubleshooting. They are observational and do not filter, encrypt, or address traffic.

Question 14Oracle Cloud Infrastructure Operations

Which OCI feature provides automated, policy-driven backup of block volumes on a schedule?

  1. Database Data Guard
  2. File system snapshots
  3. Object versioning
  4. Volume backup policies Correct answer.

Explanation

Volume backup policies define a schedule and retention for automatically backing up block volumes. Object versioning applies to Object Storage, file system snapshots apply to File Storage, and Data Guard protects databases.

Question 15Oracle Cloud Infrastructure Operations

An operator needs to grant a compute instance permission to read objects in a bucket without embedding credentials. Which mechanism should be used?

  1. A pre-authenticated request embedded in code
  2. A local user account on the instance
  3. A stored API key in the instance metadata
  4. Instance principals with a dynamic group and policy Correct answer.

Explanation

Instance principals let resources authenticate to OCI APIs using their instance identity, and a dynamic group plus policy grants the needed permissions. This avoids embedding long-lived credentials in code or metadata.

Question 16Oracle Cloud Infrastructure Operations

Which OCI service provides a private, managed endpoint for accessing Oracle services such as Object Storage without traversing the internet?

  1. Dynamic routing gateway
  2. Service gateway Correct answer.
  3. Internet gateway
  4. NAT gateway

Explanation

A service gateway lets resources in a VCN reach supported Oracle services privately over the Oracle network rather than the public internet. Internet and NAT gateways involve public connectivity, and a DRG connects to remote networks.

Question 17Oracle Cloud Infrastructure Operations

What does the OCI Compute shape determine for an instance?

  1. The retention period of its boot volume backups
  2. The IAM policies that apply to the instance
  3. The geographic region where the instance runs
  4. The number of OCPUs and amount of memory allocated Correct answer.

Explanation

A shape defines the compute resources of an instance, such as OCPU count and memory, and may also reflect specialized hardware like GPUs. Region placement, IAM policies, and backup retention are configured separately.

Question 18Oracle Cloud Infrastructure Operations

A security team wants to allow only TCP port 443 from a specific CIDR into a subnet. Which OCI construct is appropriate?

  1. A route rule in the route table
  2. A DHCP option set
  3. A security rule in a network security group or security list Correct answer.
  4. A local peering gateway

Explanation

Security lists and network security groups contain ingress and egress security rules that permit or deny traffic by protocol, port, and source or destination. Route rules direct traffic, DHCP options configure addressing, and peering links VCNs.

Question 19Oracle Cloud Infrastructure Operations

Which statement describes the difference between a security list and a network security group in OCI?

  1. A security list applies at the subnet level, while an NSG applies to selected VNICs Correct answer.
  2. Both apply only to the internet gateway
  3. A security list encrypts traffic, while an NSG routes it
  4. A security list applies to VNICs, while an NSG applies to subnets

Explanation

Security lists are attached to subnets and apply to all VNICs in them, whereas network security groups are attached to specific VNICs for finer-grained control. Neither construct encrypts or routes traffic.

Question 20Oracle Cloud Infrastructure Operations

What is the purpose of an OCI dynamic group?

  1. To define the physical placement of instances
  2. To schedule automated volume backups
  3. To match resources such as instances by rule so they can be granted access via policies Correct answer.
  4. To group users for federated single sign-on

Explanation

Dynamic groups use matching rules to include resources like compute instances, and policies can then grant those resources permissions without individual credentials. User groups, placement, and backup scheduling are handled by other features.

Question 21Oracle Cloud Infrastructure Operations

An operator is troubleshooting why an instance cannot reach a service gateway. Which configuration element most directly determines whether traffic is sent to the gateway?

  1. The boot volume size
  2. The instance shape
  3. The route table associated with the subnet Correct answer.
  4. The compartment name

Explanation

Route tables contain rules that direct traffic for specific destinations to a target such as a service gateway. If the subnet's route table lacks a matching rule, traffic will not be sent to the gateway regardless of other settings.

Question 22Oracle Cloud Infrastructure Operations

Which OCI service should be used to centrally collect and search logs from multiple resources?

  1. OCI Vault
  2. OCI Bastion
  3. OCI Logging Correct answer.
  4. OCI Registry

Explanation

OCI Logging collects service logs and custom logs, stores them in log groups, and supports searching and forwarding. Vault manages keys, Bastion provides managed SSH access, and Registry stores container images.

Question 23Oracle Cloud Infrastructure Operations

A team needs to run a containerized workload on OCI without managing worker nodes. Which service fits best?

  1. Compute instances with Docker installed
  2. Container Instances Correct answer.
  3. Functions
  4. Container Engine for Kubernetes with managed node pools

Explanation

OCI Container Instances runs containers without requiring the customer to provision or manage underlying nodes. Container Engine for Kubernetes involves cluster and node management, plain compute instances require full OS administration, and Functions is for event-driven code.

Question 24Oracle Cloud Infrastructure Operations

Which OCI Object Storage feature protects against accidental deletion by retaining prior versions of an object?

  1. Object versioning Correct answer.
  2. Pre-authenticated request
  3. Lifecycle policy
  4. Bucket replication

Explanation

Object versioning keeps multiple versions of an object so an overwrite or delete does not destroy prior data. Lifecycle policies transition or delete objects, pre-authenticated requests grant temporary access, and replication copies buckets to another region.

Question 25Oracle Cloud Infrastructure Operations

An operator must ensure that production and development resources are billed separately and that developers cannot see production resources. What is the most direct OCI approach?

  1. Use different fault domains for each environment
  2. Place each environment in its own compartment and scope policies and budgets accordingly Correct answer.
  3. Use separate availability domains for each environment
  4. Apply different shapes to each environment

Explanation

Compartments provide the boundary for both cost separation and IAM policy scoping, so placing environments in distinct compartments lets budgets and permissions be applied independently. Availability domains, shapes, and fault domains do not provide access isolation.

Question 26Oracle Cloud Infrastructure Operations

Which OCI service is used to define the compartment structure and apply policies that govern who can manage resources?

  1. OCI Block Volume
  2. OCI Networking
  3. OCI Identity and Access Management Correct answer.
  4. OCI Monitoring

Explanation

IAM governs authentication and authorization in OCI. Compartments and policies are defined there, controlling which principals can act on which resources. Networking, Block Volume, and Monitoring consume these permissions rather than define them.

Question 27Oracle Cloud Infrastructure Operations

An operator wants to stop a compute instance from being terminated by mistake while still allowing it to be stopped and restarted. Which OCI feature should be applied?

  1. A resource lock of type FULL
  2. A budget alert
  3. A tag default
  4. A resource lock of type DELETE Correct answer.

Explanation

A DELETE-type resource lock prevents deletion of the resource but permits other lifecycle actions such as stopping and starting. A FULL lock blocks both deletion and modification, which would be too restrictive here. Budget alerts and tag defaults have no lifecycle protection effect.

Question 28Oracle Cloud Infrastructure Operations

Which OCI construct is used to group a set of related compartments so that policies can be written once against the whole set?

  1. A dynamic group
  2. A region
  3. A compartment quota
  4. A tenancy Correct answer.

Explanation

The tenancy is the root compartment that contains all other compartments, and policies written at the tenancy level can apply to everything beneath it. Regions are physical locations, quotas limit resource counts, and dynamic groups match instances rather than compartments.

Question 29Oracle Cloud Infrastructure Operations

An operator needs to see the CPU utilization history of an instance over the past week. Which OCI service provides this?

  1. OCI Audit
  2. OCI Monitoring Correct answer.
  3. OCI Logging
  4. OCI Notifications

Explanation

OCI Monitoring stores and displays metric data such as CPU utilization, memory, and network throughput over time. Logging handles log records, Audit records API activity, and Notifications delivers messages to subscribers.

Question 30Oracle Cloud Infrastructure Operations

Which statement best describes an OCI availability domain?

  1. A virtual network dedicated to a single customer
  2. A billing unit used to separate production and development costs
  3. A physically separate data center group within a region that is isolated from failures in other availability domains Correct answer.
  4. A logical grouping of compartments within a tenancy

Explanation

An availability domain is one or more physically separate data centers within a region, isolated from failures in other availability domains. Deploying across availability domains improves resilience. Compartments, VCNs, and billing separation are different concepts.

Question 31Oracle Cloud Infrastructure Operations

An operator must ensure that an Object Storage bucket keeps every prior version of an object when it is overwritten. Which feature should be enabled?

  1. Object lifecycle policy
  2. Pre-authenticated request
  3. Replication policy
  4. Bucket versioning Correct answer.

Explanation

Versioning retains previous copies of an object whenever it is overwritten or deleted, allowing recovery. Lifecycle policies delete or archive objects, pre-authenticated requests grant temporary access, and replication copies objects to another region.

Question 32Oracle Cloud Infrastructure Operations

Which OCI service is designed to run a container image without the operator provisioning or patching any worker nodes?

  1. OCI Compute with a custom image
  2. OCI Container Engine for Kubernetes with managed node pools
  3. OCI Container Instances Correct answer.
  4. OCI Functions

Explanation

OCI Container Instances runs a container directly without requiring a cluster or node management. Container Engine for Kubernetes still involves node pools, Functions runs event-driven code rather than arbitrary long-running containers, and Compute requires the operator to manage the host.

Question 33Oracle Cloud Infrastructure Operations

What is the primary purpose of an OCI quota policy?

  1. To restrict which source CIDRs can reach a subnet
  2. To define how long an object version is retained
  3. To limit how many of a given resource a compartment can create Correct answer.
  4. To set the maximum number of IAM policies per tenancy

Explanation

Quota policies cap the quantity of a resource, such as compute cores or block volume storage, that can be consumed within a compartment or tenancy. They are separate from network security rules, retention settings, and IAM policy limits.

Question 34Oracle Cloud Infrastructure Operations

An operator wants to receive an email when a monitored metric crosses a threshold. Which two OCI services must be connected to achieve this?

  1. Service Connector Hub and Object Storage
  2. Audit and Logging
  3. Monitoring alarm and Notifications topic with an email subscription Correct answer.
  4. Budgets and Cost Analysis

Explanation

A Monitoring alarm evaluates a metric against a threshold and publishes to a Notifications topic when it fires. Subscribers on that topic, such as an email address, then receive the message. Audit, Logging, Service Connector Hub, and Budgets serve different purposes.

Question 35Oracle Cloud Infrastructure Operations

An operator needs to copy all Object Storage objects written to a bucket into a Streaming stream for downstream processing. Which OCI service is intended for this?

  1. OCI Data Integration
  2. OCI Service Connector Hub Correct answer.
  3. OCI Vault
  4. OCI Bastion

Explanation

Service Connector Hub moves data between a source and a target service, such as from Object Storage or Logging into Streaming. Data Integration handles ETL-style data movement, Vault manages secrets and keys, and Bastion provides managed SSH access.

Question 36Oracle Cloud Infrastructure Operations

An instance in a private subnet must resolve Oracle service hostnames to private service endpoint addresses. Which OCI DNS feature provides this?

  1. A public zone with an A record
  2. A reverse DNS record for the instance
  3. A private zone attached to the VCN Correct answer.
  4. A CNAME record in the internet zone

Explanation

A private DNS zone attached to a VCN resolves names only for resources inside that VCN, which is how service private endpoints are reached by name. Public zones resolve globally, CNAMEs alias names but do not create private resolution, and reverse records map addresses to names.

Question 37Oracle Cloud Infrastructure Operations

Which OCI capability allows an operator to run a script on a running instance without opening an inbound SSH port?

  1. OCI Bastion
  2. The Run Command agent plugin Correct answer.
  3. A pre-authenticated request
  4. A VCN flow log

Explanation

The Run Command agent plugin executes commands on an instance through the Oracle Cloud Agent, so no inbound SSH access is required. Bastion still opens a session path, pre-authenticated requests apply to Object Storage, and flow logs only record traffic.

Question 38Oracle Cloud Infrastructure Operations

An operator wants to take a point-in-time copy of a block volume before a major upgrade. Which action accomplishes this?

  1. Create a volume backup Correct answer.
  2. Enable a lifecycle policy
  3. Attach the volume to a second instance
  4. Resize the volume

Explanation

A volume backup captures the state of a block volume at a point in time and can be used to restore or clone it. Lifecycle policies apply to Object Storage, attaching to another instance shares the live volume, and resizing changes capacity without preserving a copy.

Question 39Oracle Cloud Infrastructure Operations

Which statement about OCI IAM policy statements is accurate?

  1. A policy statement names only the compartment and the budget
  2. A policy statement names only the instance and the shape
  3. A policy statement names a subject, a verb, a resource-type, and a compartment Correct answer.
  4. A policy statement names only the user and the region

Explanation

An IAM policy statement follows the pattern of allow a subject to perform a verb on a resource-type in a compartment, optionally with conditions. Users, regions, budgets, and shapes are not the structural components of a statement.

Question 40Oracle Cloud Infrastructure Operations

A team wants to tag all resources created in a compartment automatically with the cost center, even when the creator forgets. Which OCI feature applies?

  1. A defined tag with a tag default Correct answer.
  2. A security zone recipe
  3. A budget rule
  4. A freeform tag applied manually

Explanation

A defined tag combined with a tag default automatically applies the tag value to new resources in the specified compartment. Freeform tags require manual entry, security zone recipes enforce security posture, and budget rules track spending.

Question 41Oracle Cloud Infrastructure Operations

An operator must confirm which user deleted a VCN last week. Which OCI service should be queried?

  1. OCI Audit Correct answer.
  2. OCI Logging
  3. OCI Vault
  4. OCI Monitoring

Explanation

OCI Audit records API calls against resources, including who made the call and when, which is exactly what is needed to identify the deletion actor. Monitoring holds metrics, Logging holds service and custom logs, and Vault manages keys and secrets.

Question 42Oracle Cloud Infrastructure Operations

Which OCI service stores encryption keys in a hardware security module and controls access to them through IAM policies?

  1. OCI Key Management in a compartment without policies
  2. OCI Object Storage
  3. OCI Certificates
  4. OCI Vault Correct answer.

Explanation

OCI Vault provides managed key and secret storage backed by HSMs, with access controlled through IAM policies. Certificates is a related but distinct service for certificate lifecycle, and Object Storage stores data rather than keys.

Question 43Oracle Cloud Infrastructure Operations

An operator is designing a subnet that must allow only outbound HTTPS to the internet and must block all other outbound traffic. Which OCI construct enforces this?

  1. A network security group with only ingress rules
  2. A security list egress rule allowing TCP 443 and a default deny Correct answer.
  3. A route rule that removes the internet gateway
  4. A NAT gateway without security rules

Explanation

Security lists and network security groups evaluate egress traffic, and OCI denies traffic that no rule permits. An egress rule allowing TCP 443 with no broader allow rule achieves the requirement. Removing a route or using a NAT gateway alone does not filter by port.

Question 44Oracle Cloud Infrastructure Operations

An operator wants to know which compartments are consuming the most compute spend this month. Which OCI tool provides this breakdown?

  1. OCI Bastion
  2. OCI Audit
  3. OCI Monitoring
  4. Cost Analysis Correct answer.

Explanation

Cost Analysis reports actual and forecast spending, and it can group costs by compartment, tag, or service. Monitoring reports operational metrics, Audit reports API activity, and Bastion provides session access.

Question 45Oracle Cloud Infrastructure Operations

A compute instance must be able to read objects in a bucket without storing credentials on disk. Which OCI mechanism is designed for this?

  1. A user password stored in a configuration file
  2. A local API key stored in the instance metadata
  3. An instance principal authorized through a dynamic group and policy Correct answer.
  4. A pre-authenticated request embedded in the image

Explanation

Instance principals let a compute instance authenticate as itself, and a dynamic group matching the instance plus an IAM policy grants the required access. No credentials are stored on the instance. Pre-authenticated requests and stored keys or passwords all involve embedded secrets.

Question 46Oracle Cloud Infrastructure Operations

An operator observes that an instance in a private subnet can reach Object Storage by public IP but not through the service gateway. Which configuration element should be checked first?

  1. The instance's shape
  2. The bucket's storage tier
  3. The instance's boot volume size
  4. The service gateway route rule in the subnet's route table Correct answer.

Explanation

Traffic to a service gateway requires a route rule in the subnet's route table that targets the service gateway for the service's CIDR label. Without that rule, traffic falls back to other routes. Boot volume size, storage tier, and shape do not affect routing.

Question 47Oracle Cloud Infrastructure Operations

An operator needs to grant a group permission to manage instances in one compartment but only read instances in another. Which approach satisfies this with least privilege?

  1. A dynamic group matching all instances in the tenancy
  2. Two policy statements in the tenancy scoped to each compartment with the appropriate verbs Correct answer.
  3. One policy statement granting manage instances at the tenancy level
  4. One policy statement granting manage all-resources at the tenancy level

Explanation

Separate statements scoped to each compartment grant manage in one and read in the other, which is the least-privilege result. Tenancy-wide manage or manage all-resources grants far more than required, and a dynamic group defines principals rather than permissions.

Question 48Oracle Cloud Infrastructure Operations

An operator must ensure that block volume backups are retained for 90 days and then deleted automatically. Which configuration achieves this?

  1. A security zone recipe
  2. A budget rule on the compartment
  3. A backup policy with a retention period applied to the volume Correct answer.
  4. A lifecycle policy on the boot volume

Explanation

Backup policies define a schedule and retention period, so backups older than the retention window are removed automatically. Lifecycle policies apply to Object Storage, security zone recipes enforce security posture, and budget rules track spending.

Question 49Oracle Cloud Infrastructure Operations

An operator wants to restrict access to a bucket so that only requests from a specific VCN's private endpoint are allowed. Which combination is required?

  1. A service gateway in the VCN plus a bucket policy that denies requests not arriving through that endpoint Correct answer.
  2. A public bucket plus an internet gateway
  3. A pre-authenticated request with no expiry
  4. A NAT gateway plus a security list allowing all egress

Explanation

A service gateway provides private access to Object Storage, and a bucket policy can deny requests that do not arrive through the expected private endpoint. A public bucket, NAT gateway, or non-expiring pre-authenticated request all broaden access rather than restrict it.

Question 50Oracle Cloud Infrastructure Operations

An operator wants to see which IAM policies apply to a specific compartment before granting a new permission. Which approach is most reliable?

  1. Review only the policies defined directly in the compartment
  2. Review the compartment's quota policies
  3. Review only the tenancy-level policies
  4. Review policies in the compartment and in each parent compartment up to the tenancy Correct answer.

Explanation

Policies are inherited from parent compartments down to the target compartment, so the effective permission set requires reviewing the compartment and every ancestor including the tenancy. Reviewing only one level or quota policies misses inherited grants.