Examkin

Question

Difficulty: MediumLogin Security, Login IP Ranges, and Login Hours

A System Administrator assigned a remote inventory specialist to the custom profile 'Logistics Operations'. The administrator configured Profile-level Login IP Ranges on this profile to strictly permit access from the corporate VPN range of 198.51.100.1 to 198.51.100.50. Later, the administrator added a home broadband IP range of 203.0.113.10 to 203.0.113.20 under the organization-level Network Access settings. What happens when the inventory specialist attempts to log in from home using the IP address 203.0.113.15?

  1. The user is denied access entirely and cannot log in.Answer
  2. B
    The user is allowed to log in after successfully completing identity verification.
  3. C
    The user logs in successfully without receiving an identity verification prompt.
  4. D
    The user logs in successfully, but access is limited to read-only mode.

Answer

The user is denied access entirely and cannot log in because profile-level login IP ranges impose a hard restriction on access.
When Login IP Ranges are defined on a user's Profile, Salesforce enforces a strict access policy. Any login attempt from an IP address outside the profile's specified range is denied access completely. Organization-level Network Access settings cannot grant access or bypass restrictions set at the Profile level.

Step-by-Step Solution

1
Evaluate Profile-level Login IP Ranges
Profile Login IP Ranges are set to 198.51.100.1 - 198.51.100.50. The user IP (203.0.113.15) falls outside this range.
Profile-level IP restrictions define the explicit boundary outside of which login is completely prohibited.
2
Evaluate Organization-level Network Access (Trusted IP Ranges)
The user IP is listed in Network Access, but Network Access only controls identity verification prompts (MFA/activation codes) when profile IP ranges are absent.
Profile-level security settings always take precedence over org-wide Network Access trusted IP settings.
3
Determine Final Login Outcome
Because the user's IP is outside the Profile Login IP Range, Salesforce rejects the authentication attempt.
Profile IP ranges act as an absolute access block rather than a trigger for identity verification.

Key Concept

Profile Login IP Ranges vs. Organization Network Access
Rate this question

Topics

Login Security, Login IP Ranges, and Login Hours

More questions from this topic