Elections break-glass accounts authenticate with password on the built-in Access identity provider and must work only from the jump network. How should that password path be scoped?
Select an answer to reveal the explanation.
Short Explanation
A break-glass password is a master key—you still keep it in a locked cabinet. Leave password on the built-in IdP, but only from the jump-network range on that Access policy, not from the open internet.
Full Explanation
The password method remains valid for built-in identity provider emergency accounts, but Access policies can constrain it with a network-range condition. Limiting that policy to the jump network keeps privileged civic logins off home and public paths. Allowing password from any network defeats the control. Carbon Black and NSX overlay objects do not replace Access network-range policy for that IdP method.