Examkin

Question

Difficulty: MediumLogin Security, Login IP Ranges, and Login Hours

A Salesforce Administrator at FreightGlobe Logistics is establishing access restrictions for employees assigned to the Regional Dispatcher profile. The administrator configures Organization-Wide Network Access with a trusted IP range of 192.168.1.10192.168.1.10 to 192.168.1.100192.168.1.100. Additionally, on the Regional Dispatcher profile, the administrator sets Login IP Ranges to 10.0.5.110.0.5.1 to 10.0.5.5010.0.5.50. A dispatcher attempts to log into Salesforce from an IP address of 192.168.1.45192.168.1.45. What behavior occurs during this login attempt?

  1. The login attempt is restricted and access is denied because profile-level Login IP Ranges enforce a hard restriction regardless of Organization-Wide Network Access settings.Answer
  2. B
    The user logs in successfully without an identity verification prompt because the IP address is within the organization's trusted Network Access range.
  3. C
    The user is prompted to enter a multi-factor verification code sent via email or SMS because the IP address falls outside the profile's IP range.
  4. D
    The user is granted read-only access to records for the remainder of the active session.

Answer

The login attempt is restricted and access is denied because profile-level Login IP Ranges enforce a hard restriction regardless of Organization-Wide Network Access settings.
When Login IP Ranges are explicitly defined on a Profile, Salesforce enforces a strict boundary: any login request originated from an IP address outside that specified profile range is completely denied. Organization-Wide Network Access ranges only serve to bypass identity verification challenges; they cannot grant access to a user whose profile explicitly restricts their IP range.

Step-by-Step Solution

1
Analyze the scope of Organization-Wide Network Access trusted IP ranges.
Org-wide Network Access defines IP addresses from which users can log in without receiving an identity verification prompt (MFA/security token).
Org-level settings control identity verification requirement thresholds.
2
Analyze the scope of Profile-Level Login IP Ranges.
When Login IP Ranges are defined on a user's profile, users assigned to that profile are explicitly forbidden from logging in from any IP address outside that designated range.
Profile-level IP restrictions act as an absolute barrier (hard denial).
3
Evaluate the login attempt from IP 192.168.1.45192.168.1.45 against profile rules.
Since 192.168.1.45192.168.1.45 does not fall between 10.0.5.110.0.5.1 and 10.0.5.5010.0.5.50, the profile restriction blocks the user immediately.
Profile restrictions override organization-wide trusted IP exceptions.

Key Concept

Profile Login IP Ranges vs. Org-Wide Network Access
Rate this question

Topics

Login Security, Login IP Ranges, and Login Hours

More questions from this topic