6.3 Audit User Account Activity and Permissions to Identify Risks CCCS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst is investigating a user who has 'read' permission to a sensitive file share. Which action by the user would indicate privilege misuse?

   • AThe user lists the contents of the share
   • BThe user attempts to modify a file in the share
   • CThe user copies a file to their local machine
   • DThe user reads a file from the share
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A cloud security team is reviewing IAM roles and finds that a 'Data Scientist' role has been granted 'Storage Object Admin' on a bucket containing production data. The data scientists are only supposed to have 'Storage Object Viewer' access to this bucket for reading data for model training. The team also finds that the role has been granted 'Storage Object Creator' on a separate staging bucket. What is the most appropriate recommendation?

   • AKeep the 'Storage Object Admin' access on the production bucket, as it may be needed for future data updates
   • BGrant the Data Scientist role 'Storage Object Admin' on the staging bucket as well, to ensure consistency
   • CChange the Data Scientist role's access to the production bucket from 'Storage Object Admin' to 'Storage Object Viewer'
   • DRemove all access to the production bucket for the Data Scientist role, as they should not have any access
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An auditor is reviewing logs and notices that a user with 'Support Engineer' role has been executing 'Delete' commands on production database tables. The Support Engineer role is documented to only have 'Read' and 'Update' permissions on the production database. The user's activity log shows they authenticated with their own credentials and did not use a shared service account. What does this scenario most likely indicate?

   • AThe user is performing legitimate database maintenance outside of their documented role
   • BPrivilege escalation or a misconfiguration in the role's assigned permissions
   • CThe user is a victim of a phishing attack and their session was hijacked
   • DA false positive in the logging system, since the user's role clearly only allows read and update
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is reviewing authentication logs and finds that a user account has been successfully logged in from two different geographic locations within a 15-minute period. The user is a 'Sales Manager' who is currently on a business trip in Europe, according to the travel calendar. The two logins originated from the user's corporate laptop and a mobile device. What should the analyst do?

   • AContact the user to confirm if they logged in from both locations
   • BFlag the activity as a potential account compromise and investigate the logins further
   • CDisable the user's account immediately to prevent further access
   • DIgnore the activity because the user is on a business trip and may be using multiple devices
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A user with standard user permissions is observed performing an administrative action. What does this indicate?

   • AThe user is using a separate administrative account
   • BThe user's permissions have been misconfigured
   • CThe user has been granted temporary elevated permissions
   • DThe user is a member of a privileged group
   Reveal Solution Discussion Select an answer first