6.3 Audit User Account Activity and Permissions to Identify Risks CCCS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is reviewing user permissions and notices that a 'Project Manager' role includes the ability to 'Delete' records in the customer relationship management (CRM) system. The project managers are only supposed to 'Create' and 'Edit' records. No project manager has ever used the delete function. What is the most appropriate recommendation?

   • AAdd an approval workflow for any delete action performed by a Project Manager
   • BKeep the 'Delete' permission because it has never been used, so there is no active risk
   • CChange the Project Manager role to a custom role that includes all permissions except delete
   • DRemove the 'Delete' permission from the Project Manager role to align with the principle of least privilege
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security auditor is reviewing user activity and permissions in a multi-cloud environment. The auditor finds that a 'DevOps Engineer' role has 'Editor' permissions on a project in Cloud Provider A and 'Contributor' permissions on a resource group in Cloud Provider B. The role is documented to have 'Viewer' access in both clouds. The auditor also notices that the DevOps Engineer has been accessing resources in both clouds from the same IP address, which is a known VPN endpoint. What is the most significant risk?

   • AThe lack of multi-factor authentication on the DevOps Engineer's account
   • BThe fact that the user is accessing resources in two different clouds, which may indicate a lack of segregation of duties
   • CThe excessive permissions in both clouds, which exceed the documented 'Viewer' access and could allow unauthorized modifications
   • DThe use of a VPN endpoint, which may indicate the user is trying to hide their location
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An auditor is reviewing authentication logs and finds that a single user account has had 15 failed login attempts in the past 10 minutes, followed by a successful login. The successful login originated from a different IP address than the failed attempts. What should the auditor do next?

   • AIgnore the failed attempts because they are common and do not indicate a security issue
   • BInvestigate the successful login to determine if it is legitimate or if the account has been compromised
   • CReset the user's password and require multi-factor authentication on the next login
   • DDisable the user account immediately to prevent any further access
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security analyst is reviewing user account activity logs in CrowdStrike Falcon. Which log source would provide the most direct evidence of a user attempting to sign in from a new geographic location?

   • AAuthentication logs
   • BEndpoint detection and response (EDR) alerts
   • CFile integrity monitoring logs
   • DNetwork traffic logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is reviewing logs and notices that a user with 'Database Administrator' role has been performing 'SELECT' queries on a table containing customer credit card numbers. The Database Administrator role is documented to have full control over the database, including the ability to read all tables. However, the analyst also notices that the queries are being run from a personal laptop rather than the corporate workstation. What is the primary concern?

   • AThe user is performing unauthorized queries because the role does not allow reading credit card data
   • BThe user is attempting to exfiltrate data, and the analyst should immediately block the account
   • CThe activity is within the user's permissions, but the use of a personal device introduces an unmanaged endpoint risk
   • DThe user is likely a victim of a phishing attack and their credentials are being used by an attacker
   Reveal Solution Discussion Select an answer first