1Z0-1104-25 Question 59
Select 2Your organization requires that all users must provide Multi-factor Authentication (MFA) when signing in from outside the corporate IP range. Additionally, Security Operations wants an automated alert whenever a login is attempted from a new, unrecognized IP address. Which TWO configurations should you implement in Oracle Cloud Infrastructure (OCI) Identity Cloud Service (IDCS) to meet these requirements?
- A
Create a sign-on policy that triggers MFA for any login attempt originating outside the corporate IP range.
- B
Configure an IAM policy in OCI to deny all traffic from public IP addresses, allowing only the corporate IP range.
- C
Enable Suspicious Activity Monitoring in IDCS to detect logins from unrecognized IP addresses and configure notifications accordingly.
- D
Require user passwords to be reset every time a new IP address attempts a login provisioning workflow.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirement of MFA enforcement outside the corporate IP range, you must configure a sign-on policy in IDCS to prompt for MFA based on source IP address. Additionally, to detect and alert on new or unrecognized IP addresses, IDCS's Suspicious Activity Monitoring can be enabled to send notifications when it detects potentially risky login behavior. For more details on configuring sign-on policies and suspicious activity alerts, refer to the latest Oracle IDCS documentation.
- A. Correct.
Option 1 is correct. Sign-on policies in IDCS can be configured to enforce MFA based on IP address ranges, ensuring that attempts from outside the corporate network are prompted for an extra authentication factor.
- B. Incorrect.
Option 2 is incorrect. An OCI IAM policy restricting all public IP addresses is too broad and would block legitimate user access. IAM policies primarily control access to OCI resources and do not directly enforce MFA or user sign-on policies.
- C. Correct.
Option 3 is correct. IDCS supports Suspicious Activity Monitoring which can detect logins from previously unseen IP addresses. You can configure a notification channel (for example, email or pager) to alert your Security Operations team in these cases.
- D. Incorrect.
Option 4 is incorrect. Resetting passwords for every new IP attempt is not an IDCS best practice and does not specifically address MFA or sign-on alert requirements. The recommended approach is to use MFA prompts and suspicious-activity alerts rather than forcing constant password resets.