1Z0-1104-25 Question 56
Select 2Your organization requires mandatory multi-factor authentication (MFA) for all OCI console sign-ins. Additionally, the security team wants to receive an alert if an identity administrator disables MFA for any user, so they can immediately investigate. Which two actions should you take to meet these requirements?
- A
- Create a new IAM sign-on policy requiring MFA for all console logins and attach it at the tenancy level.
- B
- Configure an ExemptMFA group and add all administrators to it so they can bypass MFA.
- C
- Define an alert rule for the UpdateUserMFA event in the Monitoring service and send notifications to the security team� channel.
- D
- Subscribe to the Identity domain audit events for MFA-related actions and route them to a Notification topic accessible by the security team.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce MFA for all console sign-ins in OCI, you typically create a sign-on policy at the root (tenancy) or identity domain level that applies to all users. For alerting, you can define rules that listen for specific MFA-related events, such as UpdateUserMFA, and route those events to an appropriate Notification topic for the security team. Refer to OCI documentation on IAM sign-on policies and event rules to ensure the policy is configured correctly and that alerts are set up to capture disabling or modification of MFA.
- A. Correct.
- Correct. Creating a sign-on policy at the tenancy level ensures that every user attempting to sign in via the console must complete MFA. Attaching the policy at the root level is the recommended approach for organization-wide coverage.
- B. Incorrect.
- Incorrect. Exempting administrators from MFA defeats the purpose of mandatory MFA. It also introduces a security gap because high-privileged accounts should always be protected by MFA.
- C. Correct.
- Correct. Defining an alert rule (for the UpdateUserMFA event) ensures you receive immediate notifications whenever an administrator disables or updates the MFA settings on a user account, allowing the security team to investigate promptly.
- D. Incorrect.
- Incorrect. While subscribing to domain audit events may capture broad identity changes, a more targeted approach for MFA changes is to use the specific UpdateUserMFA event. Simply forwarding all audit events could create noise without necessarily alerting on the critical MFA disable action.