Examkin

Question

Difficulty: Very hardLogin Security, Login IP Ranges, and Login Hours

An administrator at Apex Global Financial configures security settings for users assigned to the Compliance Auditor profile. The organization-wide Network Access settings contain a trusted IP range of 198.51.100.0 to 198.51.100.255. On the Compliance Auditor profile, the administrator sets a Login IP Range of 198.51.100.50 to 198.51.100.100 and Login Hours from Monday through Friday, 08:00 AM to 05:00 PM. A user assigned to this profile attempts to log in under two separate conditions:
Condition 1: Saturday at 10:00 AM from IP address 198.51.100.75.
Condition 2: Tuesday at 02:00 PM from IP address 198.51.100.200.

Which outcome correctly describes the system behavior for these two login attempts?

  1. Both login attempts are denied because Profile Login Hours block Condition 1 and Profile Login IP Ranges block Condition 2.Answer
  2. B
    Condition 1 is denied due to Profile Login Hours, while Condition 2 succeeds after requiring identity verification because the IP address is within Network Access.
  3. C
    Condition 1 is denied due to Profile Login Hours, while Condition 2 succeeds without identity verification because the IP address falls inside the trusted Network Access range.
  4. D
    Condition 1 succeeds after requiring identity verification, while Condition 2 is denied due to Profile Login IP Ranges.

Answer

Both login attempts are denied because Profile Login Hours block Condition 1 and Profile Login IP Ranges block Condition 2.
Profile-level restrictions (Login Hours and Login IP Ranges) operate as absolute access controls. In Condition 1, logging in on Saturday violates the profile's allowed hours (Monday–Friday), resulting in denial. In Condition 2, logging in from IP 198.51.100.200 violates the profile's defined IP range (198.51.100.50 to 198.51.100.100). Even though this IP is listed in organization-wide Network Access, profile IP restrictions take precedence and completely block access rather than triggering identity verification.

Step-by-Step Solution

1
Evaluate Condition 1 against Profile Login Hours and Profile Login IP Ranges.
The login attempt occurs on Saturday at 10:00 AM. Although the IP (198.51.100.75) falls within the Profile Login IP Range, the time falls outside the allowed window of Monday-Friday 08:00 AM to 05:00 PM. Profile Login Hours act as a hard security boundary, resulting in an immediate denial of access.
Profile Login Hours strictly restrict user login access outside the defined time window.
2
Evaluate Condition 2 against Profile Login IP Ranges and Organization-Wide Network Access.
The login attempt occurs on Tuesday at 02:00 PM from IP 198.51.100.200. Although the time is valid and the IP is in the org-wide Network Access range (198.51.100.0 - 198.51.100.255), it falls outside the Profile Login IP Range (198.51.100.50 - 198.51.100.100).
When Login IP Ranges are defined on a profile, any attempt outside that specific range is explicitly denied, regardless of org-wide trusted IP settings.
3
Synthesize the results for both conditions.
Both Condition 1 and Condition 2 result in access denial.
Both Profile Login Hours and Profile Login IP Ranges impose hard restrictions that completely block access when violated.

Key Concept

Profile Login IP Ranges and Profile Login Hours enforce hard access denials. Org-wide Network Access trusted IP ranges merely relax identity verification (MFA/SMS prompts) for allowed logins and never override profile-level restrictions.
Rate this question

Topics

Login Security, Login IP Ranges, and Login Hours

More questions from this topic