1Z0-1104-25 Question 57
Select 2You are the security administrator for a large enterprise using Oracle Cloud Infrastructure (OCI). Your compliance regulations mandate that only the 'FinanceAdmins' group must be forced to use MFA when signing into the OCI console, whereas other groups can use MFA optionally. Additionally, you must generate an alert if any 'FinanceAdmins' member attempts to sign in without having MFA configured. Which two steps must you take to satisfy these requirements?
- A
Create a sign-on policy that enforces MFA for the FinanceAdmins group in the Identity domain's security settings, while leaving the default sign-on policy optional for other groups.
- B
Grant the FinanceAdmins group membership in a �MFA_Override� dynamic group so they can bypass MFA requirements when performing urgent operations.
- C
Configure an Event rule that triggers an alert via the Notification service whenever a FinanceAdmins member attempts to sign in without MFA configured.
- D
Update the VCN Security List to accept traffic exclusively from the FinanceAdmins group� IP addresses, thereby eliminating the need for MFA.
Show answer and explanation
Correct answers: A, C
Explanation
To satisfy the scenario� requirements, you must enforce MFA for the FinanceAdmins group by creating a targeted sign-on policy. Additionally, you can configure an OCI Event rule and associate it with the Notification service to generate alerts if members of the group attempt to sign in without MFA. These steps align with OCI best practices for managing MFA, sign-on policies, and security-related alerts. Refer to Oracle Cloud Infrastructure Identity documentation for detailed instructions on configuring sign-on policies and creating event rules.
- A. Correct.
Correct. You must create a sign-on policy in the Identity service that specifically requires MFA for the FinanceAdmins group and leaves other groups under the default (or optional) MFA policy. This ensures you meet the requirement that only FinanceAdmins are forced to use MFA.
- B. Incorrect.
Incorrect. Allowing the FinanceAdmins group to sidestep MFA via a dynamic group membership directly contradicts the requirement for mandatory MFA. This option would weaken security rather than enforce it.
- C. Correct.
Correct. Using OCI Events, you can detect a sign-in attempt from a FinanceAdmins member who has not configured MFA and trigger a Notification alert. This fulfills the requirement to generate an alert whenever FinanceAdmins attempt to sign in without MFA configured.
- D. Incorrect.
Incorrect. Restricting sign-in by IP addresses does not address the mandatory MFA requirement. It only limits network access, which does not satisfy the compliance rule that dictates MFA usage for FinanceAdmins.