6.3 Audit User Account Activity and Permissions to Identify Risks CCCS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst is investigating a potential data breach. The analyst finds that a user with 'Customer Support' role has been accessing the 'Customer Database' and performing 'Export' operations. The user's role is documented to have 'Read' access to the database, but the export operation is not explicitly listed in the role's permissions. The analyst also notices that the user has been logging in from a new IP address that is not associated with the corporate network. What is the most likely conclusion?

   • AThe user is a victim of a phishing attack, and the attacker is using their account to export data
   • BThe user's account has been compromised, and the attacker is using it to export data
   • CThe user's role may have been misconfigured to include export permissions, or the user has found a way to perform the export despite not having explicit permission
   • DThe user is performing legitimate work, and the export is a normal part of their job
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A cloud administrator is reviewing IAM policies and finds that a 'Developer' role has been granted 'iam.serviceAccounts.actAs' permission on a service account that has access to production secrets. The developers are only supposed to deploy code to a staging environment and should not have access to production secrets. What is the most significant risk?

   • ADevelopers can delete the service account, causing a denial of service
   • BDevelopers can view the service account's keys and use them to authenticate
   • CDevelopers can impersonate the service account and gain access to production secrets
   • DDevelopers can modify the service account's permissions to grant themselves more access
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which combination of user permissions and activity would be considered a high-risk indicator?

   • AA user with no permissions attempting to access a system
   • BA user with standard permissions accessing a shared drive
   • CA user with administrative privileges downloading a large volume of data
   • DA user with read-only access to a public website
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a routine audit, an administrator finds that a large number of users in the 'Engineering' group have been granted 'Contributor' access to a production finance application. The engineering team's documented role only requires 'Reader' access to this application for viewing reports. What is the most likely risk associated with this finding?

   • AUsers will be unable to perform their job functions because they lack the necessary permissions
   • BThe audit will fail because the users have not been granted the correct 'Reader' role
   • CUsers have more access than needed, increasing the potential impact if their accounts are compromised
   • DThe application will experience performance issues due to too many users with write access
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security analyst is reviewing user permissions in a cloud environment. Which scenario best illustrates the principle of least privilege being violated?

   • AA helpdesk technician has administrative rights to all cloud resources
   • BA database administrator has write access to the database they manage
   • CA manager has read access to their team's project reports
   • DA developer has read-only access to a production database
   Reveal Solution Discussion Select an answer first