6.3 Audit User Account Activity and Permissions to Identify Risks CCCS Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   During a quarterly access review, an administrator discovers that a marketing coordinator has been granted 'Global Administrator' rights in the identity provider. The coordinator's job function only requires access to the marketing automation platform and a shared document library. The administrator also notes the coordinator has never used any administrative functions in the past 90 days. What is the most appropriate immediate action?

   • ARemove the Global Administrator role and assign the minimum permissions required for the marketing coordinator's job function
   • BLeave the role as-is since the coordinator has not used the admin functions, indicating no active threat
   • CDisable the coordinator's account until a full investigation into how the role was assigned is completed
   • DChange the Global Administrator role to a custom role with limited administrative permissions
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A system administrator is reviewing user activity and permissions in a cloud environment. The administrator finds that a former employee's account is still active and has 'Owner' permissions on several critical storage buckets. The account has not been used since the employee's departure three months ago. Which risk does this situation present?

   • AA compliance violation, but only if the account is used to access data containing personal information
   • BA dormant account with high-level permissions that could be used for unauthorized access if compromised
   • CNo immediate risk, since the account has not been used and the employee is no longer with the company
   • DA risk of data corruption, since the account may have been used to modify storage buckets before departure
   Reveal Solution Discussion Select an answer first