I85PREP
⌘ K
OCI Security Professional study materials
OCI Security Professional study resources

OCI Security Professional practice questions

One question at a time. Build your OCI Security Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security fundamentals and OCI Identity and Access Management

A security administrator wants a policy that applies only to members of a group called Auditors, but the policy must still allow those users to read audit buckets. Which IAM policy subject type should the statement use?

  1. A service-level policy attached to the tenancy root
  2. An individual user OCID in the policy's subject section
  3. A group subject in the policy's subject section Correct answer.
  4. A dynamic group matching the auditors' compute instances

Explanation

IAM policies attach to compartments and their statements name subjects such as users, groups, dynamic groups, or service principals. Naming the group as the subject lets every current and future member inherit the permission without editing the policy. Users are usually granted access through group membership rather than individually.

Question 2Security fundamentals and OCI Identity and Access Management

Which statement best describes the OCI shared responsibility model for infrastructure as a service?

  1. Oracle secures the physical facilities and hypervisor while the customer secures guest OS patching and IAM configuration Correct answer.
  2. The customer is responsible for physical security of the region and Oracle secures all identity data
  3. Oracle patches guest operating systems while the customer secures data center access
  4. Both parties share equal responsibility for every layer from firmware to application code

Explanation

Under the shared responsibility model Oracle owns security of the cloud, including physical facilities, hardware, and virtualization layers. The customer owns security in the cloud, including guest operating system configuration, patching, data, and identity and access management. This division is a core security fundamentals concept.

Question 3Security fundamentals and OCI Identity and Access Management

An engineer needs to grant a compute instance permission to read objects in an Object Storage bucket without storing user credentials on the instance. What is the correct approach?

  1. Generate a customer secret key and hard-code it in the application configuration
  2. Add the instance to the Administrators group in the identity domain
  3. Create a dynamic group with a matching rule and a policy granting the dynamic group access Correct answer.
  4. Create a local UNIX user on the instance and embed that password in scripts

Explanation

Instance principals let compute instances authenticate with certificates issued by the instance metadata service. Access is granted by matching the instance to a dynamic group rule and then writing a policy that allows that dynamic group the required verb and resource. No long-lived user credentials need to be stored on the instance.

Question 4Security fundamentals and OCI Identity and Access Management

A policy statement reads: Allow group Developers to manage objects in compartment ProjectA where request.permission='OBJECT_CREATE'. What does this statement actually permit?

  1. Create operations on any resource type in ProjectA for members of Developers
  2. Only the create-object operation on Object Storage resources in ProjectA for members of Developers Correct answer.
  3. Object creation only in the tenancy root compartment for members of Developers
  4. All management operations on objects in ProjectA for members of Developers

Explanation

The verb manage covers a broad set of permissions, but a where clause on request.permission narrows the effective permission to the single operation named. Here only OBJECT_CREATE is allowed, so members can create objects but not delete or read them. The resource scope remains compartment ProjectA.

Question 5Security fundamentals and OCI Identity and Access Management

Which OCI IAM construct is used to organize a set of users who should receive the same level of access?

  1. Compartment
  2. Group Correct answer.
  3. Policy
  4. Identity domain

Explanation

Groups collect users so that policies can grant access to many principals at once. A user can belong to multiple groups and inherits the union of permissions granted to those groups. Compartments organize resources, policies define permissions, and identity domains isolate user populations.

Question 6Security fundamentals and OCI Identity and Access Management

A company wants to isolate the identities of two acquired business units so that each has its own user population, administrators, and sign-in policies within a single tenancy. Which OCI IAM feature should they use?

  1. Separate compartments for each business unit
  2. Separate policies for each business unit
  3. Separate identity domains for each business unit Correct answer.
  4. Separate dynamic groups for each business unit

Explanation

Identity domains provide isolated identity and access management environments within a tenancy, each with its own users, groups, and authentication policies. Compartments and policies govern resources and permissions but do not isolate user populations or sign-in behavior.

Question 7Security fundamentals and OCI Identity and Access Management

Which authentication factor combination provides multi-factor authentication in OCI IAM?

  1. A password plus a time-based one-time passcode from an authenticator app Correct answer.
  2. A username plus a security question
  3. A password plus a second, stronger password
  4. An API signing key plus a customer secret key

Explanation

Multi-factor authentication requires factors from different categories, such as something you know (password) and something you have (a TOTP device or passkey). A password plus a one-time passcode from an authenticator app satisfies this. Two passwords or two knowledge-based answers are the same factor category.

Question 8Security fundamentals and OCI Identity and Access Management

A security team must ensure that a policy granting access to a sensitive compartment cannot be modified by compartment administrators. Where should the policy be created?

  1. In the sensitive compartment by a compartment administrator
  2. In the tenancy root compartment by a tenancy administrator Correct answer.
  3. In a child compartment beneath the sensitive compartment
  4. In a dynamic group rule attached to the compartment

Explanation

Policies in a parent compartment apply to that compartment and all of its children, and only principals with manage rights at the parent can change them. Placing a protective policy at the tenancy root prevents compartment-level administrators from altering it. This is a common way to enforce guardrails.

Question 9Security fundamentals and OCI Identity and Access Management

What is the purpose of the OCI Cloud Guard service in a security program?

  1. It encrypts all block volumes in a tenancy using customer-managed keys
  2. It acts as a web application firewall in front of public load balancers
  3. It stores audit logs for seven years for regulatory retention
  4. It continuously detects misconfigurations and risky activity against configurable detector recipes and reports problems Correct answer.

Explanation

Cloud Guard monitors a tenancy against detector recipes and identifies problems such as public buckets or overly permissive policies, reporting them for remediation. It is a posture management and threat detection service, not an encryption, firewall, or log-retention service.

Question 10Security fundamentals and OCI Identity and Access Management

Which OCI service provides a centralized, immutable record of API activity in a tenancy for security investigations?

  1. Events
  2. Audit Correct answer.
  3. Monitoring
  4. Logging

Explanation

The Audit service records API calls made against tenancy resources and retains them for a defined period, supporting forensics and compliance. Monitoring handles metrics and alarms, Logging collects and manages logs, and Events routes state-change notifications.

Question 11Security fundamentals and OCI Identity and Access Management

A policy must allow a group to use only a specific tag value on resources. Which policy element enables this restriction?

  1. A compartment named after the tag value
  2. A dynamic group rule matching the tag
  3. A where clause comparing request.resource.tag values Correct answer.
  4. A subject entry listing the tag namespace

Explanation

Tag-based access control uses conditions in the where clause to compare resource tags against expected values. This lets administrators grant permissions only when a resource carries an approved tag, supporting attribute-based access control. Tags themselves are not subjects, dynamic group rules, or compartments.

Question 12Security fundamentals and OCI Identity and Access Management

What is the effect of defining a policy in a compartment on resources in its child compartments?

  1. The policy applies only to sibling compartments at the same level
  2. The policy applies only to the compartment where it is defined
  3. The policy applies to the compartment and all compartments beneath it Correct answer.
  4. The policy applies to the tenancy root regardless of placement

Explanation

Policy inheritance flows downward: a policy written in a compartment governs that compartment and every child compartment under it. This allows administrators to set broad access at a high level and refine it lower in the hierarchy. Policies never apply upward or to siblings.

Question 13Security fundamentals and OCI Identity and Access Management

An organization requires that privileged administrators use a separate, time-limited session with elevated rights rather than permanent admin permissions. Which OCI IAM capability supports this?

  1. Sharing the tenancy administrator password among the team
  2. Just-in-time elevation through privileged access management integration with identity domains Correct answer.
  3. Disabling multi-factor authentication for administrators
  4. Permanent membership in the Administrators group for all staff

Explanation

Privileged access management features let organizations grant elevated access only when needed and for a limited duration, reducing standing privilege. Integrating this with identity domains keeps the elevation auditable. Permanent admin membership, shared passwords, and disabling MFA all increase risk.

Question 14Security fundamentals and OCI Identity and Access Management

Which statement about OCI IAM policy verbs is accurate?

  1. Inspect is the least privileged verb, followed by read, use, and manage Correct answer.
  2. Read and use grant identical permission sets in every case
  3. Inspect grants the ability to modify resources but not to list them
  4. Manage is the least privileged verb and inspect is the most privileged

Explanation

The verb hierarchy runs from inspect (list resources) through read (view details), use (work with existing resources), to manage (full control including create and delete). Choosing the least verb that meets a need follows least privilege. The verbs are not interchangeable.

Question 15Security fundamentals and OCI Identity and Access Management

A dynamic group rule reads: All {instance.compartment.id = 'ocid1.compartment.oc1..example'}. Which instances match?

  1. Instances running in the tenancy root only
  2. Instances whose instance OCID equals the specified value
  3. Instances whose compartment OCID equals the specified value Correct answer.
  4. Instances tagged with the specified compartment name

Explanation

Dynamic group rules match on attributes of the instance principal, and instance.compartment.id compares the compartment that contains the instance. The rule therefore matches any instance in that compartment regardless of its own OCID or tags. Matching on instance.id would target a single instance.

Question 16Security fundamentals and OCI Identity and Access Management

Which OCI IAM feature lets an administrator require that users authenticate with a passkey or hardware security key?

  1. Assigning the user to the Administrators group
  2. Enabling a network perimeter in the VCN security list
  3. Configuring strong authentication factors in the identity domain's sign-on policy Correct answer.
  4. Setting a password complexity rule in the identity domain

Explanation

Identity domain sign-on and authentication policies determine which factors users must present, including passkeys and FIDO2 security keys. Password complexity governs only the knowledge factor. Network controls and group membership do not dictate authentication factor type.

Question 17Security fundamentals and OCI Identity and Access Management

What does the principle of least privilege require when writing an OCI IAM policy?

  1. Grant permissions to individual users rather than groups
  2. Grant only the permissions and scope needed for the task, using the narrowest verb and compartment Correct answer.
  3. Grant manage on the tenancy root so future needs are covered
  4. Grant access to all groups so any user can perform the task

Explanation

Least privilege means granting the minimum permissions at the narrowest scope required to perform a job. In OCI terms that means choosing the smallest sufficient verb and the most specific compartment. Broad root-level grants and individual user grants undermine this principle.

Question 18Security fundamentals and OCI Identity and Access Management

A security analyst needs to confirm which user deleted a bucket last week. Which two sources together best support the investigation?

  1. Audit logs for the API call and Object Storage logs for the resource operation Correct answer.
  2. Service limits and the compartment quota report
  3. Cloud Guard problems and the VCN flow logs
  4. Monitoring metrics and the budget alert history

Explanation

Audit records the identity and API call that performed the deletion, while service logs provide resource-level detail. Correlating them establishes who did what and when. Cloud Guard, flow logs, metrics, and quotas do not record the acting principal for a delete operation.

Question 19Security fundamentals and OCI Identity and Access Management

Which OCI IAM component determines the set of resources over which a policy statement's permissions apply?

  1. The compartment named in the statement Correct answer.
  2. The tenancy's default identity domain
  3. The user's home region
  4. The instance's shape

Explanation

A policy statement names a compartment that scopes which resources the permission covers, including its child compartments through inheritance. Home region, identity domain, and instance shape do not define the resource scope of a statement.

Question 20Security fundamentals and OCI Identity and Access Management

An administrator wants to allow a group to read objects in a bucket but prevent deletion. Which approach best satisfies this?

  1. Grant inspect on the bucket only
  2. Grant manage on the tenancy root and add a deny statement
  3. Grant read on objects in the compartment and omit manage or use permissions Correct answer.
  4. Grant manage on objects and rely on users not to delete

Explanation

Granting read provides view access without permitting modification or deletion, which aligns with least privilege. OCI IAM is allow-based, so avoiding the broader verbs is the reliable way to prevent deletion. Manage would include delete, and inspect would not permit reading object contents.

Question 21Security fundamentals and OCI Identity and Access Management

Which statement about federating an external identity provider with OCI IAM identity domains is correct?

  1. Federation eliminates the need for any OCI policies
  2. Federation requires that all users be placed in the Administrators group
  3. Users must maintain a separate OCI password in addition to the external provider account
  4. Users authenticate at the external provider and are mapped to OCI groups through SAML assertions or SCIM provisioning Correct answer.

Explanation

Federation lets users sign in through an external identity provider, with group or attribute claims mapped to OCI groups so existing policies apply. SCIM can automate user and group provisioning. Federation does not remove the need for policies and does not require admin rights.

Question 22Security fundamentals and OCI Identity and Access Management

A security engineer must ensure that a newly created Object Storage bucket is private by default and that any public bucket triggers an alert. Which combination of OCI services fits best?

  1. Cloud Guard detector recipes for public bucket detection plus a policy restricting public bucket creation Correct answer.
  2. Audit log retention plus a budget alert
  3. VCN flow logs plus a network security group
  4. Block Volume encryption plus a key rotation schedule

Explanation

Cloud Guard detectors can flag publicly accessible buckets, and preventive policy conditions can restrict who may create public buckets. Together they provide detection and prevention. Audit retention, budgets, flow logs, and encryption do not address bucket visibility.

Question 23Security fundamentals and OCI Identity and Access Management

Which OCI IAM policy subject represents an OCI service acting on a customer's behalf, such as a service that needs to read a bucket?

  1. A federated group from an external provider
  2. A service principal allowed through a service-level or resource principal policy Correct answer.
  3. A customer secret key stored in the bucket
  4. A human user account with a console password

Explanation

Some OCI services use resource principals or service principals to act on resources, and policies authorize them like other principals. Human accounts, federated groups, and stored secret keys are not service principals. This distinction matters when granting automation access.

Question 24Security fundamentals and OCI Identity and Access Management

Which practice best protects the tenancy administrator account in OCI IAM?

  1. Disable MFA so recovery is simpler
  2. Share the credentials with the operations team for coverage
  3. Store the password in a public repository for recovery
  4. Enforce MFA, avoid daily use, and monitor its activity through Audit Correct answer.

Explanation

The tenancy administrator has the broadest rights, so protecting it requires strong authentication, limited use, and monitoring. Sharing credentials, exposing passwords, and disabling MFA all increase the risk of compromise. Audit provides the visibility needed to detect misuse.

Question 25Security fundamentals and OCI Identity and Access Management

A team wants users to see only the compartments relevant to their projects in the console. Which mechanism primarily controls this visibility?

  1. The region selected at sign-in only
  2. Policies granting inspect or read on those compartments and denying effective access elsewhere Correct answer.
  3. The number of groups a user belongs to
  4. The user's time zone setting

Explanation

Console visibility follows authorization: users see compartments and resources for which they hold at least inspect permission. Because OCI IAM is allow-based, limiting grants to the relevant compartments keeps other compartments hidden. Time zone, region choice, and group count do not determine visibility.

Question 26Security fundamentals and OCI Identity and Access Management

In OCI IAM, what is the primary function of an identity domain?

  1. A container for users, groups, and identity-provider configuration that can be federated independently Correct answer.
  2. A billing construct that groups compartments for cost reporting
  3. A network construct that isolates subnets across availability domains
  4. A logging service that stores audit events for a tenancy

Explanation

Identity domains are the unit of identity management in OCI IAM: each domain holds its own users, groups, and federation settings, and a tenancy can have multiple domains. They are independent of networking and billing constructs.

Question 27Security fundamentals and OCI Identity and Access Management

Which OCI IAM construct is used to grant permissions to a collection of users at once?

  1. A group Correct answer.
  2. A dynamic group
  3. A compartment
  4. A tag namespace

Explanation

Policies grant permissions to groups, and users inherit access by being members of those groups. This lets administrators manage entitlements at scale rather than per user.

Question 28Security fundamentals and OCI Identity and Access Management

A policy statement reads: Allow group Auditors to read buckets in tenancy. What does the tenancy subject accomplish?

  1. It scopes the permission to every bucket in the tenancy, including those in all compartments Correct answer.
  2. It restricts the permission to buckets created after the policy date
  3. It limits the permission to buckets in the root compartment only
  4. It grants the group membership in every compartment automatically

Explanation

Using tenancy as the resource scope in a policy extends the statement across all compartments in the tenancy, which is useful for broad read-only audit roles. It does not create group membership or limit by creation date.

Question 29Security fundamentals and OCI Identity and Access Management

What does the OCI IAM verb inspect allow a group to do?

  1. Modify only the tags attached to a resource
  2. Create and delete resources of the named type
  3. Read every field of a resource, including its contents
  4. List resources without reading their contents or metadata beyond the listing Correct answer.

Explanation

The inspect verb grants the ability to list resources of a type, which is useful for console navigation and inventory. It deliberately stops short of reading resource contents, which requires read.

Question 30Security fundamentals and OCI Identity and Access Management

Which OCI IAM policy verb is the most privileged and covers the full set of operations on a resource family?

  1. inspect
  2. read
  3. use
  4. manage Correct answer.

Explanation

The manage verb includes all permissions for a resource family, including create, update, and delete, so it is broader than use, read, or inspect. Least privilege usually favors the narrower verbs.

Question 31Security fundamentals and OCI Identity and Access Management

What is the purpose of the OCI IAM policy condition element?

  1. To define which compartment the policy itself is stored in
  2. To specify which identity provider authenticates the user
  3. To choose the order in which policy statements are evaluated
  4. To restrict when a statement applies based on attributes such as request time or resource tags Correct answer.

Explanation

Conditions add attribute-based constraints to a policy statement, for example limiting access to a time window or to resources carrying a particular tag. They refine an otherwise granted permission rather than changing where the policy lives.

Question 32Security fundamentals and OCI Identity and Access Management

A user must be prevented from creating API signing keys for their own account while keeping console access. Which OCI IAM control best addresses this?

  1. An identity domain password policy requiring longer passwords
  2. A budget alert on the tenancy's compute spend
  3. A network security group rule blocking the IAM endpoint
  4. A policy that omits manage or use on the user and api-key resource types for that group Correct answer.

Explanation

API key creation is governed by IAM policy on the user and api-key resource types, so withholding those permissions from the group prevents the action. Network rules and password policies do not govern IAM authorization for key creation.

Question 33Security fundamentals and OCI Identity and Access Management

Which statement describes the default authorization behavior of OCI IAM when no policy matches a request?

  1. The request is allowed for tenancy administrators only
  2. The request is allowed if the user is authenticated
  3. The request is denied only for write operations
  4. The request is denied because access must be explicitly granted Correct answer.

Explanation

OCI IAM is deny-by-default: a request succeeds only if an applicable policy statement allows it and no explicit deny applies. Authentication alone does not confer authorization.

Question 34Security fundamentals and OCI Identity and Access Management

Assume OCI IAM deny policies are enabled and required launch dependencies are already granted. Which policy pair lets Devs launch instances in compartment App but not delete them?

  1. Allow group Devs to inspect instances in tenancy
  2. Allow group Devs to read instances in compartment App
  3. Allow group Devs to manage instances in compartment App, plus a statement denying INSTANCE_DELETE for Devs in that compartment Correct answer.
  4. Allow group Devs to manage instances in compartment App

Explanation

The manage verb includes INSTANCE_CREATE, whereas use does not. With the required launch dependencies already granted, manage permits creation. An enabled IAM deny policy scoped to Devs and INSTANCE_DELETE in App prevents deletion despite the manage grant.

Question 35Security fundamentals and OCI Identity and Access Management

Which OCI IAM policy subject should be used to grant an OCI service access to resources in a customer compartment on the customer's behalf?

  1. An individual user account owned by the service team
  2. A customer secret key stored in Vault
  3. A service principal represented by the service name in the policy statement Correct answer.
  4. A dynamic group matching instances in the compartment

Explanation

Some OCI services act as service principals, and policies can name the service directly so it can operate on resources in the tenancy. This avoids sharing user credentials with the service.

Question 36Security fundamentals and OCI Identity and Access Management

What distinguishes a dynamic group from a regular OCI IAM group?

  1. Membership is inherited from the parent compartment's policy
  2. Membership is synchronized from an external identity provider on a schedule
  3. Membership is computed from matching rules on resource attributes rather than assigned to users Correct answer.
  4. Membership is limited to users holding the tenancy administrator role

Explanation

Dynamic groups contain OCI resources such as compute instances whose attributes satisfy a matching rule. Regular groups contain users, and policies can then be written for either.

Question 37Security fundamentals and OCI Identity and Access Management

A security architect needs users to sign in to OCI with their existing corporate credentials while OCI IAM continues to enforce OCI policies. Which configuration achieves this?

  1. Issue each user an OCI API signing key tied to the corporate directory
  2. Federate the corporate identity provider with the identity domain using SAML or OIDC Correct answer.
  3. Place all users in a dynamic group matched by email domain
  4. Create matching local users and synchronize passwords with a script

Explanation

Federation lets the corporate identity provider authenticate users while OCI IAM authorizes them through policies. The identity domain holds the federation trust and group mappings.

Question 38Security fundamentals and OCI Identity and Access Management

A group mapping from a federated identity provider assigns users to an OCI IAM group. What is the effect on authorization?

  1. Users can only access resources in the default compartment
  2. Users automatically receive tenancy administrator rights
  3. Users bypass policy evaluation because the external provider vouched for them
  4. Users receive the permissions granted to that OCI group by policies, subject to any explicit denies Correct answer.

Explanation

Federation handles authentication, but authorization still flows through OCI IAM policies attached to groups. Mapped group membership therefore yields exactly the permissions those policies grant.

Question 39Security fundamentals and OCI Identity and Access Management

Which OCI IAM feature enforces a maximum session duration before a console user must authenticate again?

  1. The tenancy's budget rule
  2. The VCN's security list timeout
  3. The compartment's quota policy
  4. The identity domain's sign-on policy settings for session lifetime Correct answer.

Explanation

Sign-on policies in an identity domain control session behavior, including how long a session lasts before reauthentication. Quotas, security lists, and budgets do not govern authentication sessions.

Question 40Security fundamentals and OCI Identity and Access Management

An administrator must let a group view Object Storage buckets in one compartment but must ensure the group can never read object contents anywhere. Which design is sound?

  1. Grant inspect buckets in the compartment and add an explicit deny on object read in tenancy Correct answer.
  2. Grant read buckets in the compartment and rely on the console hiding object names
  3. Grant read objects in tenancy and restrict the group to a single bucket by name
  4. Grant manage objects in the compartment and audit usage weekly

Explanation

Inspect allows listing buckets without exposing contents, and an explicit deny on object read at tenancy scope prevents content access regardless of other grants. Explicit denies take precedence over allows.

Question 41Security fundamentals and OCI Identity and Access Management

What is the role of the OCI IAM identity provider resource within an identity domain?

  1. It defines the compartment hierarchy for resource isolation
  2. It stores the tenancy's API signing keys for programmatic access
  3. It stores the trust configuration and attribute mappings used to accept logins from an external IdP Correct answer.
  4. It records every API call made by federated users

Explanation

An identity provider resource in OCI IAM represents the federation trust with an external IdP, including metadata and attribute mappings. It does not store API keys, define compartments, or record audit events.

Question 42Security fundamentals and OCI Identity and Access Management

A team wants programmatic access for a CI/CD pipeline without storing a human user's credentials. Which OCI IAM approach fits best?

  1. A dynamic group matching the pipeline's compute instances, authorized by policy
  2. A dedicated service account user in a group limited by policy, with API keys stored in Vault Correct answer.
  3. The tenancy administrator's API key copied into the pipeline's environment variables
  4. A federated user account shared by all pipeline operators

Explanation

A dedicated non-human identity with narrowly scoped policy and keys held in a secrets manager supports accountability and rotation. Copying administrator keys or sharing accounts breaks least privilege and auditability.

Question 43Security fundamentals and OCI Identity and Access Management

Which OCI IAM capability allows an administrator to require that a group's members complete an additional verification step at sign-in?

  1. A sign-on policy in the identity domain that enforces an additional authentication factor Correct answer.
  2. A tag default that marks users as privileged
  3. A compartment quota that limits the number of sessions
  4. A dynamic group rule matching the user's department attribute

Explanation

Sign-on policies in OCI IAM identity domains define authentication requirements, including requiring an extra factor for specified users or groups. Quotas, tag defaults, and dynamic group rules do not enforce authentication steps.

Question 44Security fundamentals and OCI Identity and Access Management

A policy in compartment Finance grants a group manage on instances. A second policy in the tenancy explicitly denies the group the INSTANCE_DELETE permission. What is the outcome when a member tries to terminate an instance in Finance?

  1. The termination succeeds because manage always outranks deny
  2. The termination succeeds because the Finance policy is more specific
  3. The termination is denied only if the instance carries a defined tag
  4. The termination is denied because the explicit deny overrides the allow Correct answer.

Explanation

OCI IAM evaluates explicit denies with higher priority than allows, regardless of where each policy is attached. The broad manage grant therefore cannot override the tenancy-level deny for deletion.

Question 45Security fundamentals and OCI Identity and Access Management

Which OCI IAM policy element identifies the users or resources receiving permissions?

  1. The verb of the statement, such as read or manage
  2. The resource-type portion, such as instances or buckets
  3. The subject of the statement, such as group or dynamic-group Correct answer.
  4. The compartment scope after the in keyword

Explanation

A policy statement names a subject (who), a verb (what action), a resource type (on what), and a location (in where). The subject is the group or dynamic group receiving the grant.

Question 46Security fundamentals and OCI Identity and Access Management

An auditor must confirm that no group other than a break-glass group can create or modify IAM policies in a tenancy. Which approach most directly provides this assurance?

  1. Rely on the console's default hiding of the IAM menu for non-admins
  2. Check that all users have MFA enabled
  3. Review Audit logs for the past 24 hours only
  4. Review all policies granting manage or use on policies and policy statements, then verify group membership Correct answer.

Explanation

Assurance requires enumerating every policy that grants the relevant verbs on policies and then confirming which groups hold them and who belongs to those groups. A short log review or UI hiding does not prove the absence of grants.

Question 47Security fundamentals and OCI Identity and Access Management

A company's security standard requires that permissions granted to a group be limited to resources bearing the tag Environment=Prod. Which policy design enforces this?

  1. A statement with a condition comparing the resource's defined tag to the value Prod Correct answer.
  2. A tag default applied to the compartment
  3. A statement scoped to the root compartment with no condition
  4. A dynamic group rule matching instance shape

Explanation

Policy conditions can compare request or resource attributes, including defined tags, so access is granted only when the tag matches. Tag defaults merely populate tag values and do not restrict authorization.

Question 48Security fundamentals and OCI Identity and Access Management

Two identity domains exist in one tenancy, each federated to a different external IdP. A user authenticated in domain A attempts to use a policy granted to a group in domain B. What is the expected result?

  1. The request is denied because group membership in domain B is not established by domain A authentication Correct answer.
  2. The request is allowed if the user's email domain matches
  3. The request is allowed because both domains share the tenancy's policy store
  4. The request is denied only for console access but allowed for API calls

Explanation

Policies bind to groups within an identity domain, and authenticating in one domain does not confer membership in another domain's groups. Cross-domain access therefore requires explicit membership or mapping.

Question 49Security fundamentals and OCI Identity and Access Management

A security engineer must prove that a specific human identity, not a shared account, performed a privileged change. Which OCI IAM practices best support this?

  1. Disable Audit log retention to reduce storage cost
  2. Rely on the console's last-modified timestamp on the resource
  3. Grant the change through a broadly shared administrator group
  4. Require individual federated identities, avoid shared accounts, and retain Audit records of the API call Correct answer.

Explanation

Attribution depends on unique identities plus an immutable audit trail linking the request to that identity. Shared accounts and disabled logging remove the ability to attribute actions.

Question 50Security fundamentals and OCI Identity and Access Management

An administrator grants a group use on instances in a compartment and later finds members can attach block volumes to those instances. Why?

  1. The use verb is equivalent to manage for all dependent resources
  2. Policies in a compartment automatically extend to all sibling compartments
  3. The use verb on instances includes operations needed to operate them, such as attaching volumes authorized by the instance permission Correct answer.
  4. Group members inherit the tenancy administrator's permissions at runtime

Explanation

The use verb covers a defined set of operations required to work with the resource, which can include actions on related resources such as attaching storage. Administrators must review what each verb includes rather than assuming it is read-only.