Okta Certified Administrator · Part I

Security

20% of the exam — the third-largest domain.

Security

Module 1: Okta Security Policy & Enforcement Framework

7 sub-topics · this deck covers sub-topic 7 of 7 — the last one in this module

The Exam Bullet

"Demonstrate understanding of network zones, dynamic zones, IP zones, and blocklist zones"

Policies keep referencing "network zone" as a condition. This sub-topic is the deep dive on what a zone actually is, and the fiddly rules for the "dynamic" flavor specifically.

The Mechanism

A network zone is "a configurable boundary you can use to grant or restrict access" to computers and devices in your org, defined via IP addresses, IP types, geographic locations, CIDR notation, or ASNs. Zones apply to global session policies, app sign-in policies, VPN notifications, and routing rules.

Three zone types exist: IP-based, dynamic, and blocklist.

Dynamic Zones — Location Rules

A single enhanced dynamic zone can't include two locations that contain each other, such as US and California.

To cover an entire continent like Europe or Asia/Pacific, you must select the individual countries — there's no single "continent" shortcut.

Dynamic Zones — IP Type & ASN

IP address type: Any, Any proxy, Tor anonymizer proxy, or Non-Tor anonymizer proxy — only one type per zone.

ASN (Autonomous System Number) uniquely identifies a network — a more efficient alternative to listing many IPs. If no ASN is specified, all ASNs match the zone.

The Gotcha — AND Logic Within a Zone

Conditions within a single dynamic zone use AND logic, not OR. To block requests that are "any proxy" OR from New Zealand, you must create two separate zones.

Okta determines the true client IP by analyzing proxy chains, then compares geolocation (via MaxMind), proxy type, and ASN against the zone's rules — all of which must match together.

The Exam Angle

Watch for scenario questions built around these traps:

→ "One zone should cover all of Europe." = not directly possible — select individual countries.

→ "Block traffic that's either from a proxy OR from a specific country." = needs 2 separate zones — a single zone can't OR two conditions.

One Line To Remember

Network zones (IP, dynamic, blocklist) gate policies via IP/CIDR/geo/ASN. Dynamic zones: can't nest containing locations (US + California), one IP-type per zone, missing ASN matches everything, conditions AND together (need 2 zones for OR-like logic), true client IP resolved via proxy-chain analysis against MaxMind geolocation.

Sources: help.okta.com — network-zones.htm · about-dynamic-zones.htm

✓ Module 1: Okta Security Policy & Enforcement Framework — complete (7 of 7 sub-topics)