Question

Difficulty: HardLogin Security, Login IP Ranges, and Login Hours

A Salesforce Administrator at Vanguard Health configures login access restrictions for users assigned to the Telehealth Specialist profile. The organization-wide Network Access settings contain a trusted IP range of 203.0.113.0 to 203.0.113.255. On the Telehealth Specialist profile, the administrator defines a Login IP Range of 203.0.113.50 to 203.0.113.100 and configures Login Hours from 08:00 to 17:00 Monday through Friday. A telehealth clinician attempts to log in from IP address 203.0.113.10 at 10:00 AM on a Tuesday. Which system behavior will occur during this login attempt?

  1. The login attempt is denied immediately because the user's IP address falls outside the Profile Login IP Ranges.Answer
  2. B
    The user is prompted for identity verification via SMS or email code because the IP address is outside the profile range but within organization Network Access.
  3. C
    The login attempt is granted without verification because the user's IP address is listed within the organization-wide Network Access trusted IP range.
  4. D
    The login attempt succeeds, but the user is granted read-only session access because the request occurred during valid profile Login Hours.

Answer

The login attempt is denied immediately because the user's IP address falls outside the Profile Login IP Ranges.
When Profile Login IP Ranges are defined, Salesforce enforces a strict denial for any login request outside the specified IP range. Even though the IP address 203.0.113.10 is included in the organization-wide Network Access list, profile-level IP boundaries strictly forbid access, causing the login attempt to be blocked immediately.

Step-by-Step Solution

1
Evaluate Profile Login Hours boundary
The login occurs at 10:00 AM on Tuesday, which falls within the permitted 08:00 to 17:00 Monday–Friday window.
Login Hours restrictions do not block this request.
2
Compare user IP against Profile Login IP Ranges
The user's IP address 203.0.113.10 lies outside the profile range of 203.0.113.50 to 203.0.113.100.
Profile Login IP Ranges define a strict restriction window. Any IP address outside this range results in hard denial.
3
Evaluate interaction between Profile IP Ranges and Org Network Access
Profile-level IP restrictions override org-level Network Access settings.
Org Network Access only determines identity verification (MFA challenge) requirements, whereas Profile IP Ranges strictly prohibit login attempts originating outside the range.

Key Concept

Profile Login IP Ranges act as strict access boundaries (hard deny), overriding organization-wide Network Access settings which only govern activation challenges.
Estimated Time:2m 0s
Rate this question