IAM Auditing and Monitoring CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security administrator at a multi-cloud company must ensure that every IAM change (user creation, permission modification, role assignment) is recorded with the identity of the actor, the timestamp, and the source IP address. The company uses AWS, Azure, and Google Cloud. What is the most effective way to meet this requirement?

   • AConfigure each cloud provider's native IAM policy simulator to log all permission checks.
   • BEnable multi-factor authentication (MFA) for all IAM users and rely on login logs.
   • CUse a third-party configuration management tool to periodically snapshot IAM policies and compare them.
   • DEnable CloudTrail in AWS, Azure Activity Log, and Google Cloud Audit Logs, and centralize them in a SIEM.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst notices that a user's IAM audit log shows a successful login from the user's home country at 9:00 AM and another successful login from a different country at 9:15 AM. The user is a developer who sometimes uses a VPN. The analyst must decide whether to escalate this as a potential compromise. What should the analyst do?

   • ACheck the IP addresses and whether they are associated with known VPN or cloud provider ranges, and review the user's recent activity.
   • BIgnore the event because the user is a developer and may have legitimate remote access needs.
   • CDisable the user's account and require a password reset before allowing further access.
   • DEscalate immediately because two logins from different countries in 15 minutes is impossible without a compromise.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a potential IAM-related security incident. The analyst has access to CloudTrail logs and notices that a user's access key was used to perform actions that the user has never performed before. The analyst also notices that the user's account was created recently. What is the most likely explanation?

   • AThe user's access key has been compromised and is being used by an attacker.
   • BThe analyst should correlate the actions with other logs, such as the user's login history and the source IP addresses, to determine if the activity is legitimate.
   • CThe user is new and is learning how to use the cloud environment.
   • DThe user is testing new features and performing actions they have not done before.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare organization must provide auditors with evidence that only authorized personnel accessed patient records in the cloud over the last quarter. The organization uses a cloud IAM system that logs all access. What should the organization do to meet this requirement?

   • ACreate a new IAM role that grants auditors read-only access to the system.
   • BGenerate an IAM compliance report that lists user access to the patient records system and export the corresponding audit logs.
   • CProvide the auditors with the IAM policy documents that define who has access to the system.
   • DRun a vulnerability scan on the patient records system and share the results.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a common element found in an IAM compliance report?

   • AThe credit card numbers of all users
   • BA list of all users and their assigned permissions
   • CThe physical location of the cloud data center
   • DThe source code of the IAM service
   Reveal Solution Discussion Select an answer first