1Z0-1104-25 Question 60
Select 2You work at a company that has mandated multi-factor authentication (MFA) for all users. In addition, the security team wants to be automatically notified if a user attempts to sign in without having MFA configured or if multiple consecutive sign-in attempts fail due to missing MFA. Which two actions must you take in Oracle Cloud Infrastructure (OCI) to enforce this requirement effectively?
- A
Create a sign-on policy in your identity domain that requires MFA for all user sign-ins.
- B
Use OCI Events and Notifications to trigger an alert when sign-in attempts fail due to missing MFA and send an email to the security team.
- C
Enable MFA for each user manually without enforcing a sign-on policy, counting on voluntary compliance.
- D
Configure a monthly on-demand report to review compliance, instead of setting up automatic alerts.
Show answer and explanation
Correct answers: A, B
Explanation
To meet both the enforcement and alert requirements, you must combine a mandatory sign-on policy for MFA and a rule that triggers alerts when MFA-related sign-in failures occur. Sign-on policies in OCI identity domains allow administrators to enforce MFA usage at login. Meanwhile, using OCI Events in conjunction with OCI Notifications enables you to detect specific sign-in failures (for example, missing MFA) and immediately notify the security team, adhering to best practices for real-time incident monitoring. Refer to the Oracle Cloud Infrastructure Identity and Security documentation for details on creating sign-on policies and configuring event-based notifications.
- A. Correct.
Correct. Creating a sign-on policy within the identity domain that mandates MFA ensures that no user can sign in without having MFA set up.
- B. Correct.
Correct. Configuring OCI Events to detect failed sign-in attempts due to missing MFA and linking it to OCI Notifications fulfills the requirement of automatically alerting the security team.
- C. Incorrect.
Incorrect. Relying on manual MFA setup without enforcing a sign-on policy risks non-compliance, as users may ignore or delay enabling MFA.
- D. Incorrect.
Incorrect. A review of monthly reports alone fails to meet the requirement of real-time alerts when zero or multiple MFA failures occur. You need an automatic alert mechanism.