IAM Auditing and Monitoring CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization's IAM audit logs show that a user who left the company two weeks ago is still able to authenticate and access resources. The organization has a policy to disable accounts within 24 hours of an employee's departure. What should the organization do?

   • AImmediately disable the user's account and review the audit logs to determine what the user accessed since departure.
   • BGenerate a compliance report showing that the account was disabled on the departure date.
   • CChange the user's password and keep the account active for monitoring.
   • DIgnore the issue because the user has not accessed anything sensitive.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company must provide auditors with a report showing all users who have been granted administrative privileges in the past quarter, including who granted the privilege and when. The company uses Azure Active Directory (Azure AD). What is the most efficient way to generate this report?

   • AExport the current list of directory roles and their members from the Azure AD portal.
   • BUse Azure AD's built-in access review feature to create a report of privilege assignments.
   • CQuery the Azure AD audit logs for 'Add member to role' activities and filter by the date range.
   • DUse Azure Policy to check for administrative role assignments.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization wants to monitor IAM activities for all user actions, including successful and failed access attempts, and to retain the records for one year to meet internal policy. What is the most effective approach?

   • AConfigure IAM password policy and enable multi-factor authentication.
   • BEnable CloudTrail only for the management console and keep logs for 90 days.
   • CEnable IAM audit logging for all services and configure the log retention period to 365 days.
   • DUse a third-party SIEM to collect logs, but do not enable native audit logging.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team wants to set up an alert for when a user is added to the 'Global Administrator' role in Azure AD. The team wants to be notified within 5 minutes of the change. The team has a limited budget and wants to minimize the cost of the alerting solution. What is the most cost-effective way to achieve this?

   • ACreate an Azure Monitor alert on the audit log for 'Add member to role' activity.
   • BUse Azure Sentinel to create an analytics rule for the role assignment.
   • CUse Azure Policy to detect the role assignment and trigger a remediation task.
   • DUse Azure Event Grid to trigger a Logic App that sends an email.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization's IAM audit logs show that a service account has been making API calls at unusual hours and downloading large amounts of data from a storage bucket. The service account is supposed to run a daily report at midnight. The organization has a security monitoring tool that can alert on anomalies. What should the organization do?

   • AImmediately revoke the service account's access and investigate the data downloads.
   • BCreate an alert for unusual activity on the service account and review the audit logs to determine if the downloads are expected.
   • CIgnore the activity because the service account is authorized to access the bucket.
   • DChange the service account's permissions to read-only.
   Reveal Solution Discussion Select an answer first