Question

Difficulty: MediumLogin Security, Login IP Ranges, and Login Hours

Northern Trail Outfitters maintains an organization-wide Network Access configuration with trusted IP ranges defined for their corporate offices (198.51.100.0 to 198.51.100.255). A field sales representative whose profile has no Login IP Ranges configured attempts to log into Salesforce from a remote location with IP address 203.0.113.50. What will happen when the agent enters valid login credentials from this external IP address?

  1. The user receives an identity verification challenge but can log in successfully upon completing verification.Answer
  2. B
    The login attempt is completely blocked because the IP address falls outside the organization's Network Access trusted ranges.
  3. C
    The login attempt is denied unless the external IP address is added to the user's profile Login Hours setting.
  4. D
    The user logs in seamlessly without verification because profile-level restrictions override org-wide Network Access rules.

Answer

The user receives an identity verification challenge but can log in successfully upon completing verification.
Organization-wide Network Access IP ranges define locations from which users can log in without completing an activation or multi-factor identity challenge. When a user logs in from an IP address outside these trusted ranges—and their profile does not have explicit Login IP Ranges configured—Salesforce prompts them for identity verification. Once verified, the login succeeds.

Step-by-Step Solution

1
Evaluate Profile-Level IP Restrictions
No Login IP Ranges are configured on the user's profile, so login attempts from any IP address are eligible for access rather than being hard-blocked.
Profile-level Login IP Ranges act as strict access boundaries where any IP outside the range is immediately denied entry.
2
Evaluate Org-Level Network Access Settings
The login IP address (203.0.113.50) is outside the org-wide Network Access trusted IP range (198.51.100.0 to 198.51.100.255).
Org-wide Network Access defines IP ranges where users can log in without identity verification.
3
Determine Final Login Behavior
Because the IP is not in the org-level trusted range, Salesforce prompts the user for identity verification (MFA/activation code). Upon successful verification, login is granted.
Being outside org Network Access trusted ranges triggers verification rather than blocking entry.

Key Concept

Difference between Org Network Access Trusted IP Ranges (identity verification prompt bypass) and Profile Login IP Ranges (hard login restriction).
Estimated Time:1m 30s
Rate this question