1Z0-1084-20 · Question #29
A new employee has just started working for your company. You create an Oracle Cloud infrastructure user account for this employee, following which they are able to log in, but still cannot create…
The correct answer is D. Add the employee to a group with policies to grant access to relevant resources. See the full explanation below for the reasoning.
Question
A new employee has just started working for your company. You create an Oracle Cloud infrastructure user account for this employee, following which they are able to log in, but still cannot create any resources. What should you do to resolve this?
Options
- ASend the employee API Signing Keys to log in.
- BDelete the account and create another one.
- CMake sure that the employee is logging in to the Oracle Cloud Infrastructure account from your
- DAdd the employee to a group with policies to grant access to relevant resources.
How the community answered
(51 responses)- A14% (7)
- B4% (2)
- C8% (4)
- D75% (38)
Community Discussion
3
Yusuf A.Oct 19, 2025The correct answer is D. When you create a new OCI user account, the user gets the ability to log in but has zero permissions by default, which is exactly what your scenario describes. OCI uses a policy-based access control model where permissions are attached to groups, not individual users, so you have to add the employee to a group that has policies granting access to the resources they need. A senior at my job actually walked me through this my first week, saying "a user with no group is like a badge that opens the front door but none of the rooms inside." Options A, B, and C do not address the permissions gap at all, and deleting and recreating the account in option B would just give you the same locked-out user all over again.
Viktor S.Oct 22, 2025D is right, but do you know WHY a group is needed instead of attaching a policy directly to the user?
Samuel O.Oct 24, 2025Ran into this exact scenario on my exam and almost second-guessed myself because option C looked like it was cut off, which threw me for a second. The answer is D, and I know this cold because in my previous job we had a new contractor who could log in just fine but kept getting permission denied errors until we added them to the right IAM group with the correct policies attached.