Basic Security Configurations
Basic security configurations
This domain tests the policies and controls that decide how users authenticate, how sessions are constrained, and how admin access is limited. Expect password policies, MFA enrollment, global session and app sign-on policies, network zones, and admin roles.
Core rules
- Password policies set length, complexity, history, age, and lockout. They are assigned by group and evaluated at password set or reset.
- MFA enrollment policies define which factors users must enroll in and can be targeted by group. Authentication policies (app sign-on policies) add conditions such as network zone, device, or group and actions such as allow, deny, or require MFA.
- The global session policy applies at org sign-in and controls session lifetime and whether MFA is required before reaching the dashboard.
- Network zones define IP ranges; they can be used in policy conditions and to restrict admin access. Trusted proxies should be configured when Okta sits behind a proxy, or zone evaluation sees the proxy IP.
- Admin roles follow least privilege: super admin, org admin, app admin, group admin, help desk admin, and read-only admin. The system log records admin and authentication events.
Worked example
An admin creates a sign-on policy rule for the Contractors group requiring MFA when the user is outside the corporate network zone. A contractor on the corporate network is allowed without MFA; off-network is challenged. Reasoning: conditions are evaluated together, and the first matching rule wins. The rule must be ordered above a broader allow rule for the policy to take effect.
Traps
Do not assume a password policy enforces MFA; they are separate. A sign-on policy that requires MFA does not enroll the user; the enrollment policy does. Network zones use client IPs, so an unconfigured trusted proxy can make every request appear to come from one IP. A deny rule can override an allow if it is ordered first.